Privacy and Robustness in Federated Learning: Attacks and Defenses

Analysis

Why This Paper Matters

Federated learning (FL) has emerged as a promising paradigm for training machine learning models across decentralized data sources without centralizing sensitive data. However, FL systems are vulnerable to a range of adversarial threats that can compromise both data privacy and model robustness. As FL adoption grows in privacy-sensitive domains such as healthcare and finance, understanding these vulnerabilities and the corresponding defenses becomes critical. This survey by Lyu et al. provides a timely and comprehensive overview of privacy and robustness challenges in FL, consolidating research from the past five years.

The paper addresses a significant gap in the literature by offering a unified taxonomy that spans threat models, privacy attacks and defenses, and poisoning attacks and defenses. By highlighting the intuitions, key techniques, and fundamental assumptions behind various attacks and defenses, it serves as an accessible entry point for researchers and practitioners new to the area, while also providing a structured reference for experts. Given the increasing deployment of FL in real-world systems, this survey is essential for guiding the design of secure and trustworthy FL solutions.

Technical Contributions

• Comprehensive Taxonomy: The paper introduces a unique taxonomy that categorizes threats in FL into three main areas: threat models, privacy attacks and defenses, and poisoning attacks and defenses. This taxonomy helps organize the diverse landscape of adversarial techniques and countermeasures.
• Threat Models: It systematically analyzes threat models in FL, considering adversaries both within and outside the system, and their capabilities and goals. This includes honest-but-curious servers, malicious clients, and external eavesdroppers.
• Privacy Attacks and Defenses: The survey reviews privacy attacks such as membership inference, property inference, and reconstruction attacks, and discusses defenses including differential privacy, secure aggregation, and homomorphic encryption. It highlights the trade-offs between privacy guarantees and model utility.
• Poisoning Attacks and Defenses: It covers poisoning attacks like data poisoning and model poisoning, and defenses such as robust aggregation, anomaly detection, and Byzantine-resilient methods. The assumptions and limitations of each are examined.
• Future Directions: The paper outlines promising research directions, including interdisciplinary approaches that integrate legal, ethical, and economic considerations into FL design.

Results

As a survey paper, it does not present new experimental results. Instead, it synthesizes findings from a large body of literature, providing a qualitative comparison of attack and defense strategies. The paper discusses the effectiveness of various defenses under different threat models, often referencing the original studies' metrics. For example, it notes that differential privacy can provide strong privacy guarantees but may degrade model accuracy, while secure aggregation protects against honest-but-curious servers but may not defend against malicious clients. The survey also highlights that no single defense is universally effective, and combinations are often necessary.

Significance

This survey is significant for several reasons. First, it provides a foundational reference for researchers entering the field of FL security and privacy, helping them navigate the complex landscape of attacks and defenses. Second, it identifies open challenges and future research directions, which can guide the development of more robust and privacy-preserving FL systems. Third, by emphasizing the interplay between privacy and robustness, it encourages holistic approaches that consider both aspects simultaneously. Finally, the paper's discussion of multidisciplinary goals, such as legal and ethical considerations, underscores the need for FL solutions that are not only technically sound but also socially responsible. Overall, this survey is a valuable resource for advancing the state of the art in secure federated learning.