VagueGAN: A GAN-Based Data Poisoning Attack Against Federated Learning Systems
Wei Sun, Bo Gao, Ke Xiong, Yang Lu, Yuwei Wang
Abstract
Federated learning (FL) is a privacy-preserving distributed learning paradigm relying on but without directly accessing privately owned datasets. However, the ‘‘available but not visible’’ nature of training data in FL leads to security risks. In particular, ‘‘not visible’’ local data can easily become the best targets of poisoning attacks. Although existing data poisoning methods may successfully attack FL systems, they mostly lead to significant data statistical changes and thus can be not hard to detect. In this paper, we propose VagueGAN, a new data poisoning attack model that unconventionally leverages the power of generative adversarial network (GAN) to generate seemingly legitimate vague data with appropriate amounts of poisonous noise. The quality of such vague data can be controlled on demand to achieve a balanced trade-off between attack effectiveness and stealthiness. Extensive experiments show that data poisoning attacks enhanced by our VagueGAN not only better degrade FL outcomes with low efforts but also are generally much less detectable.