Poisoning Semi-supervised Federated Learning via Unlabeled Data: Attacks
  and Defenses
  Semi-supervised Federated Learning (SSFL) has recently drawn much attention
due to its practical consideration, i.e., the clients may only have unlabeled
data. In practice, these SSFL systems implement semi-supervised training by
assigning a "guessed" label to the unlabeled data near the labeled data to
convert the unsupervised problem into a fully supervised problem. However, the
inherent properties of such semi-supervised training techniques create a new
attack surface. In this paper, we discover and reveal a simple yet powerful
poisoning attack against SSFL. Our attack utilizes the natural characteristic
of semi-supervised learning to cause the model to be poisoned by poisoning
unlabeled data. Specifically, the adversary just needs to insert a small number
of maliciously crafted unlabeled samples (e.g., only 0.1\% of the dataset) to
infect model performance and misclassification. Extensive case studies have
shown that our attacks are effective on different datasets and common
semi-supervised learning methods. To mitigate the attacks, we propose a
defense, i.e., a minimax optimization-based client selection strategy, to
enable the server to select the clients who hold the correct label information
and high-quality updates. Our defense further employs a quality-based
aggregation rule to strengthen the contributions of the selected updates.
Evaluations under different attack conditions show that the proposed defense
can well alleviate such unlabeled poisoning attacks. Our study unveils the
vulnerability of SSFL to unlabeled poisoning attacks and provides the community
with potential defense methods.
