Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning
A summer-school study shows federated fine-tuning of MobileNetV4 leaks labels and stays open to client backdoors.
A summer-school report fine-tunes an ImageNet-pretrained MobileNetV4-Conv-Small model on ten Quick, Draw! classes to 97.50% test accuracy, then adapts it with head-only FedAvg over ten non-IID clients, raising client training accuracy from 90.34% to 91.49%. From one client update, an honest-but-curious server recovers the full private label set, but reconstructions follow class prototypes (mean SSIM 0.130). Backdoors injected by 30%, 50%, and 100% of clients reach 21.9%, 31.3%, and 54.7% attack success with at most 0.8 points of clean-accuracy loss. FLTrust lowers backdoor success to 1.8% and 4.0% at 30% and 50% malicious clients, and label-flipping success from 12.6% to 0.8%, but not when every client is malicious.
- One client update reveals the complete private label set
- Reconstructions match class prototypes, with mean SSIM 0.130
- Backdoor ASR reaches 54.7% when every client is malicious
- FLTrust cuts 50%-malicious backdoor ASR to 4.0%
- FLTrust fails when all clients are malicious
- Products
- FedMaestroQuickDraw!
- Organizations
- Indigma
- AI models
- MobileNetV4-Conv-Small
From the original article
1 min read at arxiv.orgFederated learning (FL) is increasingly used to adapt a pretrained, centrally fine-tuned model to data that remain on user devices, beyond training a model from scratch. In this report, prepared for the 4th Federated Machine Learning International Summer School, we study the privacy and integrity of this approach with a reproducible pipeline.
By Vasileios Perifanis · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.