PhD "Machine Unlearning for attack mitigation in federated learning" M/F

about the role

As a PhD student, you will work on a PhD thesis on the subject of: "Securing Federated Learning by Unlearning".

• Motivations and Context

Cybersecurity has become a major issue in an increasingly digital world. Indeed, cyberattacks are multiplying against both organizations and individuals. These attacks are increasingly sophisticated and now threaten Machine Learning (ML) models [1]. Researchers has thus shown the vulnerability of ML and the need to secure them [2].

Among these attacks against ML, we can cite the data poisoning attack where the attacker introduces or modifies the training data to corrupt the model of the victim. The attacker can thus introduce a backdoor in the model so that in the presence of a pattern the behavior of the model changes in accordance with his objective [3]. For example, for a self-driving car, the attacker could trick the AI by putting a green sticker on a “stop” sign so that it is recognized as a 70mph speed limit. To do this, he would simply have to modify the training dataset by introducing images of a "stop" sign with the label "stop" (legitimate data) accompanied by these same images but after adding a small green square with the label “70” (malicious data).

While it is obviously difficult for an attacker to gain privileged access to a training dataset, it is on the other hand easier for him to inject his malicious data in a collaborative learning setting.

In the field of collaborative learning, federated learning (FL) is a new paradigm of ML allowing participants to collaborate in the training of a global model while preserving the data privacy [4]. Thus, instead of sharing their data, participants share their model parameters. This approach arouses a large interest, especially at Orange. However, it is more vulnerable to the risk of poisoning attacks due to the probability of having an attacker among the diversity of participants [5].

One of the particularities of backdoors is that they are introduced by a subtle modification of the training set. It is therefore difficult to detect them during the training phase and they are often discovered during the production phase. Training being an expensive process, deleting the model and restarting from scratch is not an option. It is therefore necessary to unlearn the contribution of the malicious participants [6,7,8].

• Scientific Objective

The objective of this thesis is therefore to study and propose new unlearning algorithms in the federated learning setting. For this, it will be necessary to deeply understand the attack mechanisms against FL and ML to develop a framework to reproduce these attacks. The focus will be on the backdoor attacks. The main challenges to overcome are:

1. the detection of an attack and the attackers [9],
2. the suppression of the attacker's contribution in a model (unlearning).

The results of this work can then be used to secure Orange's federated learning platform "OrangeFL".