Reproduce “Neurotoxin: Durable Backdoors in Federated Learning” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael W. Mahoney, Joseph E. Gonzalez, Kannan Ramchandran, Prateek Mittal
Neurotoxin introduces a backdoor attack strategy for Federated Learning that creates durable backdoors by selectively poisoning model parameters least frequently updated by benign clients. This method enables backdoors to persist for hundreds of training rounds, such as up to 400 rounds in GPT-2 next-word prediction tasks, significantly extending their lifespan compared to baseline attacks.
Key insights
- Backdoors can be made durable by selectively targeting and modifying model parameters that are infrequently updated by benign clients.
- The attack operates in the parameter space, shifting focus from data poisoning to strategic parameter modification.
- An optimal mask ratio (e.g., 1-5%) effectively balances backdoor effectiveness and extended lifespan.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.