RoFL: Attestable Robustness for Secure Federated Learning
  Even though recent years have seen many attacks exposing severe
vulnerabilities in federated learning (FL), a holistic understanding of what
enables these attacks and how they can be mitigated effectively is still
lacking. In this work we demystify the inner workings of existing targeted
attacks. We provide new insights into why these attacks are possible and why a
definitive solution to FL robustness is challenging. We show that the need for
ML algorithms to memorize tail data has significant implications for FL
integrity. This phenomenon has largely been studied in the context of privacy;
our analysis sheds light on its implications for ML integrity. In addition, we
show how constraints on client updates can effectively improve robustness. To
incorporate these constraints into secure FL protocols, we design and develop
RoFL, a new secure FL system that enables constraints to be expressed and
enforced on high-dimensional encrypted model updates. In essence, RoFL augments
existing secure FL aggregation protocols with zero-knowledge proofs. Due to the
scale of FL, realizing these checks efficiently presents a paramount challenge.
We introduce several optimizations at the ML layer that allow us to reduce the
number of cryptographic checks needed while preserving the effectiveness of our
defenses. We show that RoFL scales to the sizes of models used in real-world FL
deployments.
