Data Poisoning Attack Based on Privacy Reasoning and Countermeasure in Federated Learning

Federated learning is designed to train models in a distributed scheme while keeping the clients' data stored locally. The aggregation server only receives local models from clients and does not require clients to upload their local data, in which way it protects the clients' privacy. However, federated learning is vulnerable. The federated learning models are sensitive to poisoning attacks. Existing data poisoning attack methods assume that the attacker and the client have the same data distribution and data volume, which is unpractical. In this paper, we first propose a privacy inference-based poisoning data generation method, FLPDG. FLPDG changes the relationship between data and labels, and uses the data of benign clients to launch poisoning attacks. This method relies on the global model of an iterative update to obtain the data and labels of benign clients. Second, a privacy inference-based data poisoning attack model Poi_PDG is proposed. This model uses the FLPDG method to launch a data poisoning attack under conditions of insufficient original data volume of the attacker. Meanwhile, a defense method PDG_DF is proposed for Poi_PDG. It splits the image data into variance regions and utilizes GANs to hide the visual features of each image region. It controls the degree of feature hiding by setting different thresholds to keep the classification features of the image while ensuring the accuracy of the training model. Finally, several experiments are conducted to evaluate the proposed attack and defense methods, and the experimental results indicate the effectiveness of the methods.