Shielding Collaborative Learning: Mitigating Poisoning Attacks through
  Client-Side Detection
  Collaborative learning allows multiple clients to train a joint model without
sharing their data with each other. Each client performs training locally and
then submits the model updates to a central server for aggregation. Since the
server has no visibility into the process of generating the updates,
collaborative learning is vulnerable to poisoning attacks where a malicious
client can generate a poisoned update to introduce backdoor functionality to
the joint model. The existing solutions for detecting poisoned updates,
however, fail to defend against the recently proposed attacks, especially in
the non-IID setting. In this paper, we present a novel defense scheme to detect
anomalous updates in both IID and non-IID settings. Our key idea is to realize
client-side cross-validation, where each update is evaluated over other
clients' local data. The server will adjust the weights of the updates based on
the evaluation results when performing aggregation. To adapt to the unbalanced
distribution of data in the non-IID setting, a dynamic client allocation
mechanism is designed to assign detection tasks to the most suitable clients.
During the detection process, we also protect the client-level privacy to
prevent malicious clients from stealing the training data of other clients, by
integrating differential privacy with our design without degrading the
detection performance. Our experimental evaluations on two real-world datasets
show that our scheme is significantly robust to two representative poisoning
attacks.
