HoneyFL: Using Honeypots to Catch Backdoors in Federated Learning

Abstract

Federated learning (FL) has been revealed as vulnerable to backdoor attacks since the server cannot directly access the locally collected data of clients, even if they are malicious. Many efforts either try to validate the global model with trusted clients, or try to make it difficult or costly to upload malicious updates. Unfortunately, the existing solutions are still challenged in defending against stealthy backdoor attacks or negative impacts brought to the aggregation. Especially in the non-independent and identically distributed setting. Moreover, these methods overlook the threat of adaptive attacks, that is, attackers fully know the defense implementation. To address these issues, we propose a novel run-time defense against diverse backdoor attacks, dubbed HoneyFL. It differs from previous works in three key aspects: (1) effectiveness - it is capable of defending against stealthy backdoors through leveraging honeypot clients; (2) aggregation - it promises effective aggregation since only a limited number of honeypot clients are used; (3) robustness - it can handle adaptive backdoor attacks based on differential prediction. Compared with five state-of-the-art defense baselines, extensive experiments show that HoneyFL produces a higher backdoor detection success rate above 97% and a lower false positive rate below 3%, where seven attacks generate backdoor examples. Its impact on the aggregation results of the main task is negligible. We also show that the defense success rate of HoneyFL against adaptive attacks is approximately $\sim$3.52 of the baselines on average.