2 of 96

Team members

Mr. Kanishka yapa

supervisor

Mr. Samadhi Rathnayake

dr. Kasun Karunarathne

Co-supervisor

External supervisor

Seasoned expert with 20+ years in Network, Security, and PMO
Specializes in Technology Strategy and Cybersecurity
PhD from the University of Colombo
MSc from the University of Moratuwa
ISO 27701:2019 PIMS Lead Implementer

Peiris B.L.H.D

J.P.A.S. Pathmendre

Athauda A.M.I.R.B

A.R.W.M.V. Hasaranga

R24-053

3 of 96

introduction

R24-053

4 of 96

What is federated learning?
What security measures are implemented in federated learning?
Is security sufficient in federated learning?

R24-053

5 of 96

background

R24-053

6 of 96

background

R24-053

7 of 96

Our

objectives

Implementing detective & preventive security measures within a system that operates on a federated learning

CodeNexa : A Novel Security Framework for Federated Learning to Mitigate Man-in-the-Middle Attacks
HydraGuard: Backdoor immunity in FL Environments
SECUNID: Enhancing Security on Global Model
S.H.I.E.L.D :CoAE-SMC Enhanced VFL Security

main objectives

sub objectives

R24-053

8 of 96

System overview

CodeNexa

A Novel Security Framework for Federated Learning to Mitigate Man-in-the-Middle Attacks

hydraguard

Backdoor immunity

SECUNID

Enhancing Global Model Security

S.H.I.E.L.D.

Security in VFL

R24-053

9 of 96

System diagram

10 of 96

COMPONENT 1�

CODE NEXA: A NOVEL SECURITY FRAMEWORK FOR FEDERATED LEARNING TO MITIGATE MAN-IN-THE-MIDDLE ATTACKS

R24-053

Peiris B.L.H.D – IT21110184

11 of 96

WHAT IS THE FEDERATED LEARNING AND ITS �SECURITY CHALLENGES?�

2. WHAT ARE THE EXSISTING TECHNIQUES FOR THOSE

CHALLENGES?

BACKGROUND

R24-053

Peiris B.L.H.D – IT21110184

12 of 96

Research problem

Dynamic Nature of Federated Learning (FL)

Continuous Model Integrity Verification

Protection Against MITM Attacks

Efficient Handling of Frequent Model Updates

Scalable and Lightweight Defense Mechanism

R24-053

Peiris B.L.H.D – IT21110184

13 of 96

OBJECTIVE

DEVELOPING A NOVEL SECURITY FRAMEWORK FOR FEDERATED LEARNING TO MITIGATE MAN-IN-THE-MIDDLE ATTACKS

R24-053

Peiris B.L.H.D – IT21110184

14 of 96

SUB-OBJECTIVE

Identify gaps in current security techniques for FL systems.
Create a method to check and store key model metrics for validation.
Improve protection against MITM attacks by verifying only valid model updates.

R24-053

Peiris B.L.H.D – IT21110184

15 of 96

Component diagram

16 of 96

08. PROJECT COMPLETION

R24-053

Peiris B.L.H.D – IT21110184

17 of 96

R24-053

Peiris B.L.H.D – IT21110184

18 of 96

Work done model

The graph plots showcase the performance of multiple local models (from 0 to 8) in federated learning setup

19 of 96

Work done model

Match the metrics are same or not , if metrics are same model is accepted if not model is rejected.

R24-053

Peiris B.L.H.D – IT21110184

20 of 96

FRONTEND

R24-053

Peiris B.L.H.D – IT21110184

21 of 96

requirments

�Functional Requirements	Non-Functional Requirements
Model Integrity Validation	Scalability
Encryption of Metrics	Security
Multi-Seed Validation	Performance
Rejection of Compromised Models	Usability

R24-053

Peiris B.L.H.D – IT21110184

22 of 96

Research paper submission

ICAC Submission

SNAMS2024 Submission

R24-053

Peiris B.L.H.D – IT21110184

23 of 96

10. REFERENCES

R24-053

Peiris B.L.H.D – IT21110184

24 of 96

REFERENCES

[1] I. Goodfellow, J. Shlens, and C. Szegedy, ”Explaining and Harnessing Adversarial Examples,” in Proc. Int. Conf. Learn. Represent., 2015, pp. 1-11.

[2] N. Papernot, P. McDaniel, A. Sinha, and M. Wellman, ”SoK: Towards the Science of Security and Privacy in Machine Learning,” in Proc. IEEE European Symposium on Security and Privacy (EuroSP), 2018, pp. 399-414.

[3] Q. Yang, Y. Liu, T. Chen, and Y. Tong, ”Federated Machine Learning: Concept and Applications,” ACM Trans. Intell. Syst. Technol., vol. 10, no. 2, pp. 1-19, Jan. 2019.

[4] Y. Liu, Y. Kang, X. Song, and S. Yu, ”A Comprehensive Survey on Federated Learning: Concept, Applications, and Challenges,” ACM Computing Surveys, vol. 54, no. 5, pp. 1-36, Sep. 2021.

[5] X. Zhang, W. Hu, and P. Li, ”Towards Federated Learning Systems: A Survey on Security and Privacy,” IEEE Access, vol. 7, pp. 118096- 118108, Aug. 2019.

[6] A. Roy, S. Siddiqui, and D. Gupta, ”A Survey on Federated Learning and its Applications,” Journal of Artificial Intelligence Research, vol. 10, no. 2, pp. 45-55, Feb. 2020.

R24-053

Peiris B.L.H.D – IT21110184

25 of 96

THANK YOU!

R24-053

Peiris B.L.H.D – IT21110184

26 of 96

Component 2 : �HydraGuard: Backdoor immunity in FL Environments.

J.P.A.S.Pathmendre – IT21085376

R24-053

J.P.A.S Pathmendra– IT21085376

27 of 96

BACKGROUND

J.P.A.S.Pathmendre – IT21085376

R24-053

28 of 96

BACKGROUND

What is the main attack that local models commonly face?

What are the main types of backdoor attacks on local models?

What are the main Types of data poisoning attacks?

J.P.A.S.Pathmendre – IT21085376

R24-053

29 of 96

RESEARCH PROBLEM

J.P.A.S.Pathmendre – IT21085376

R24-053

30 of 96

RESEARCH PROBLEM

J.P.A.S.Pathmendre – IT21085376

Continuous attacks are more aggressive than single-shot attacks.

Detecting and Rejecting malicious weights leads to data loss, and data breaches and reduces module accuracy.

Existing defense mechanisms need big computational power and violate the essence of the FL.

Unreliable Predictions.

R24-053

31 of 96

RESEARCH GAP

J.P.A.S.Pathmendre – IT21085376

R24-053

32 of 96

RESEARCH GAP

Zhang, K., Tao, G., Xu, Q., Cheng, S., An, S., Liu, Y., Feng, S., Shen, G., Chen, P.Y., Ma, S. and Zhang, X., 2022. Flip: A provable defense framework for backdoor mitigation in federated learning. arXiv preprint arXiv:2210.12873.

J.P.A.S.Pathmendre – IT21085376

33 of 96

RESEARCH GAP

J.P.A.S.Pathmendre – IT21085376

R24-053

34 of 96

OBJECTIVES

J.P.A.S.Pathmendre – IT21085376

R24-053

35 of 96

OBJECTIVE

Developing a robust preventive and detective mechanism against backdoor attacks in FL systems without Reducing accuracy lost or without computational overhead.

J.P.A.S.Pathmendre – IT21085376

R24-053

36 of 96

SUB OBJECTIVE

Reducing ASR and gaining ACC in FL local models against backdoor attacks without computational overhead.

Get more performances than SOTA defenses mechanisms .

Trigger the attacks and get the accuracy levels of the implementation and analyze them.

J.P.A.S.Pathmendre – IT21085376

R24-053

37 of 96

NOVELTY

J.P.A.S.Pathmendre – IT21085376

R24-053

38 of 96

NOVELTY

Componenet Digram

Requirments

J.P.A.S.Pathmendre – IT21085376

R24-053

39 of 96

Component Diagram

J.P.A.S.Pathmendre – IT21085376

R24-053

40 of 96

REQUIREMENTS

J.P.A.S.Pathmendre – IT21085376

R24-053

41 of 96

REQUIREMENTS

Non-Funtional

Funtional

Trigger Inversion

Reinitializing Linear Classifier

Measure Class Distance

DATA Set-MNIST

Maintain ACC and reducing ASR

Reduce Computational Overhead

Maintaining Model Accuracy

R24-053

42 of 96

Project Completion

J.P.A.S.Pathmendre – IT21085376

R24-053

43 of 96

90%

J.P.A.S.Pathmendre – IT21085376

R24-053

44 of 96

Resource Collection

J.P.A.S.Pathmendre – IT21085376

Connecting With Senior Researchers

Connecting With Industry Experts

R24-053

45 of 96

J.P.A.S.Pathmendre – IT21085376

Model Training Phase

Getting Results

Project Completion�Work Done Final Model

R24-053

46 of 96

J.P.A.S.Pathmendre – IT21085376

Loss Variation

Attack Success Rate

Model Accuracy

Variation

Project Completion�Test Results

R24-053

47 of 96

Project Completion�Research Findings

J.P.A.S.Pathmendre – IT21085376

R24-053

48 of 96

J.P.A.S.Pathmendre – IT21085376

Project Completion�Work Done-Frontend

R24-053

49 of 96

J.P.A.S.Pathmendre – IT21085376

Research Paper�

Conference Submissions

R24-053

50 of 96

REFERENCES

J.P.A.S.Pathmendre – IT21085376

R24-053

51 of 96

REFERENCES

Zhang, K., Tao, G., Xu, Q., Cheng, S., An, S., Liu, Y., Feng, S., Shen, G., Chen, P.Y., Ma, S. and Zhang, X., 2022. Flip: A provable defense framework for backdoor mitigation in federated learning. arXiv preprint arXiv:2210.12873.

Qin, Zeyu, et al. "Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks." arXiv preprint arXiv:2302.01677 (2023).

T. Gu, K. Liu, B. Dolan-Gavitt and S. Garg, "BadNets: Evaluating Backdooring Attacks on Deep Neural Networks," in IEEE Access, vol. 7, pp. 47230-47244, 2019, doi: 10.1109/ACCESS.2019.2909068.keywords: {Training;Machine learning;Perturbation methods;Computational modeling;Biological neural networks;Security;Computer security;machine learning;neural networks}

S. -M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi and P. Frossard, "Universal Adversarial Perturbations," 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA, 2017, pp. 86-94, doi: 10.1109/CVPR.2017.17. keywords: {Neural networks;Visualization;Optimization;Training;Computer architecture;Correlation;Robustness},

Mugunthan, Vaikkunth, Anton Peraire-Bueno, and Lalana Kagal. "Privacyfl: A simulator for privacy-preserving and secure federated learning." Proceedings of the 29th ACM International Conference on Information & Knowledge Management. 2020.

Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage. 2022. Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1354–1371.

J.P.A.S.Pathmendre – IT21085376

R24-053

52 of 96

Athauda A.M.I.R.B - IT21049354�Cyber Security

53 of 96

Component 3�

Athauda A.M.I.R.B – IT21049354

SECUNID:

Enhancing Global Model Security

R24-053

54 of 96

Introduction

Athauda A.M.I.R.B – IT21049354

R24-053

55 of 96

A global model is generated by a global server and multiple clients. The clients store their samples locally and only share the model with other nodes, which protects the privacy of the raw data. The central server then aggregates all the models into a global model, which is then sent back to the clients to improve model performance

Data poisoning & Model poisoning are two significant threats in global model

Athauda A.M.I.R.B – IT21049354

R24-053

56 of 96

Research Problem?

Athauda A.M.I.R.B – IT21049354

R24-053

57 of 96

Existing defenses, such as distance-based metrics (e.g., Krum, Trimmed-Mean), struggle to detect sophisticated attacks where malicious updates resemble legitimate ones.

Attackers alter their local model updates during training, sending manipulated updates to the central server, which degrades the global model's accuracy and reliability.

Current methods usually require some knowledge of the attacks,�1. Malicious participant ratio

2.Examing local datasets(compromise the privacy of participants)

3.Assuming IID data

Athauda A.M.I.R.B – IT21049354

R24-053

What are the limitations in traditional methods?

58 of 96

Research Gap

Athauda A.M.I.R.B – IT21049354

R24-053

59 of 96

Athauda A.M.I.R.B – IT21049354

R24-053

	RESEARCH A	RESEARCH B	RESEARCH C	PROPOSED SOLUTION
Robust outlier detection for security
Efficient handling of Non-IID data
Integrated approach for FL security & Non-IID data
Scalability to large FL network
Real world applicability across diverse domains
Adherence to Data Privacy Regulations
User-friendly system deployment
No special insfracture requirements

60 of 96

Objectives

Athauda A.M.I.R.B – IT21049354

R24-053

61 of 96

Main Objectives

Design a Framework for Protect the Global Model in Federated Learning Against Data and Model Poisoning Attacks

Sub Objectives

Parameters reserved by the participants are examine in each iteration using LayerCAM Augmented with Autoencoder

Evaluate the performances of the model against poisoning attacks on different datasets

Athauda A.M.I.R.B – IT21049354

R24-053

62 of 96

Methodology

Athauda A.M.I.R.B – IT21049354

R24-053

63 of 96

SECUNID

Athauda A.M.I.R.B – IT21049354

R24-053

64 of 96

Project Completion

Athauda A.M.I.R.B – IT21049354

R24-053

65 of 96

Athauda A.M.I.R.B – IT21049354

R24-053

66 of 96

Athauda A.M.I.R.B – IT21049354

R24-053

Project Completion

Training dataset to 50 epochs

67 of 96

Athauda A.M.I.R.B – IT21049354

R24-053

Project Completion

68 of 96

Project Completion

Athauda A.M.I.R.B – IT21049354

R24-053

Heatmap without malicious participants

Heatmap with malicious participants

69 of 96

Research Paper

Athauda A.M.I.R.B – IT21049354

R24-053

70 of 96

Research Paper

Athauda A.M.I.R.B – IT21049354

R24-053

ICAC Submission

SNAMS2024 Submission

71 of 96

References

Athauda A.M.I.R.B – IT21049354

R24-053

72 of 96

[1] E. Isik-Polat, G. Polat, and A. Kocyigit, “ARFED: Attack-Resistant Federated averaging based on outlier elimination,” Future Generation Computer Systems, vol. 141, pp. 626–650, Apr. 2023, doi: https://doi.org/10.1016/j.future.2022.12.003.

[2] H. Zhang, Y. Zhang, X. Que, Y. Liang, and J. Crowcroft, “Efficient federated learning under non-IID conditions with attackers,” Oct. 2022, doi: https://doi.org/10.1145/3556557.3557951.

[3] D. Panagoda, C. Malinda, C. Wijetunga, L. Rupasinghe, B. Bandara, and C. Liyanapathirana, “Application of Federated Learning in Health Care Sector for Malware Detection and Mitigation Using Software Defined Networking Approach,” IEEE Xplore, Aug. 01, 2022. https://ieeexplore.ieee.org/document/9909488 (accessed Jun. 10, 2023).

[4] C. Zhou, Y. Sun, D. Wang, and Q. Gao, “Fed-Fi: Federated Learning Malicious Model Detection Method Based on Feature Importance,” Security and Communication Networks, vol. 2022, pp. 1–11, May 2022, doi: https://doi.org/10.1155/2022/7268347.

[5] Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients,” Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Aug. 2022, doi: https://doi.org/10.1145/3534678.3539231.

Athauda A.M.I.R.B – IT21049354

R24-053

73 of 96

Athauda A.M.I.R.B – IT21049354

R24-053

Thanks!

74 of 96

Securing Vertical Federated Learning Against Label

Inference Attacks Using Confusional Autoencoders,

Noise Addition, and Simplified Secure Multi-Party

Computation.

A.R.W.M.V.Hasaranga�IT21051548

�

A.R.W.M.V.Hasaranga– IT21051548

R24-053

75 of 96

Table Of Contents

Introduction

&�Background�

Research Problems &�Research Gap

Objectives�

System Design

Novelty Of The Approach

Research progress�

Research Completion

A.R.W.M.V.Hasaranga– IT21051548

R24-053

76 of 96

A.R.W.M.V.Hasaranga– IT21051548

R24-053

77 of 96

Background

Definition of VFL:

Vertical Federated Learning (VFL) involves multiple parties collaboratively learning a predictive model while keeping their training data local, particularly useful when datasets are split vertically among different entities.

Importance of Security in VFL:

Security is paramount as VFL involves sensitive data across various domains, making it susceptible to cyber attacks such as data breaches, eavesdropping, and inference attacks.

Security Challenges:

Despite advancements, VFL systems are vulnerable to sophisticated cyber threats, particularly label inference attacks which aim to infer sensitive information from the model outputs.

A.R.W.M.V.Hasaranga– IT21051548

R24-053

78 of 96

Limited Defense Mechanisms:

Current VFL security protocols are not robust enough to fully prevent label inference attacks, leading to potential data breaches. Lack of scalable solutions that balance privacy and performance.

Insufficient Mitigation Strategies:

Existing solutions may not effectively address all types of label inference attacks, especially sophisticated passive and active forms.

Existing methods for defending against label inference attacks in VFL are computationally expensive (e.g., Secure Multi-Party Computation).

Insufficient focus on lightweight mechanisms for privacy preservation in collaborative learning environments.

Research Problem

A.R.W.M.V.Hasaranga– IT21051548

R24-053

79 of 96

Objectives And Sub Objectives

MAIN OBJECTIVE: �DEVELOP AND INTEGRATE ADVANCED DEFENSE MECHANISMS TO SECURE VERTICAL FEDERATED LEARNING SYSTEMS AGAINST ATTACKS.

DEVELOP A DEFENSE MECHANISM TO SECURE VFL AGAINST LABEL INFERENCE ATTACKS.

COMBINE CONFUSIONAL AUTOENCODERS, NOISE ADDITION, AND SIMPLIFIED SMC.

ENSURE MINIMAL IMPACT ON MODEL ACCURACY WHILE ENHANCING PRIVACY

A.R.W.M.V.Hasaranga– IT21051548

R24-053

80 of 96

Component diagram

A.R.W.M.V.Hasaranga– IT21051548

R24-053

81 of 96

Novelty of the Approach

Innovative Integration: �Introduction of confusional autoencoders for privacy in VFL. Noise addition to further obscure sensitive data. Simplified SMC framework for a lightweight and scalable solution.�

Targeting All Attack Forms: �This integration is designed to mitigate direct, passive, and active label inference attacks, a method not previously implemented.

Enhanced Data Protection: �Aims to significantly enhance data protection by keeping sensitive information encrypted and secure during all phases of computation.

Pioneering Security Solutions: �This unique combination has not been previously attempted, offering potential groundbreaking improvements in federated learning security.

A.R.W.M.V.Hasaranga– IT21051548

R24-053

82 of 96

Research Progress

Tested on MNIST dataset With Confusional auto encoder and noise addition.

Integrate 5 Fold method as a simplified version of SMPC

Minimal impact on model accuracy while increasing defense .

A.R.W.M.V.Hasaranga– IT21051548

R24-053

83 of 96

Research Completion

Trained autoencoder

A.R.W.M.V.Hasaranga– IT21051548

R24-053

84 of 96

Research Completion

Auto-encoder Dataset

A.R.W.M.V.Hasaranga– IT21051548

R24-053

85 of 96

Research Completion

Trained 5 folds

A.R.W.M.V.Hasaranga– IT21051548

R24-053

86 of 96

Research Completion

Results

Five folds Results

Combined confusion matrices

A.R.W.M.V.Hasaranga– IT21051548

R24-053

87 of 96

Front end

A.R.W.M.V.Hasaranga– IT21051548

R24-053

88 of 96

Research Paper

89 of 96

Research Paper

Conference submission

A.R.W.M.V.Hasaranga– IT21051548

R24-053

90 of 96

References

1]C. Fu, X. Zhang, S. Ji, J. Chen, J. Wu, S. Guo, J. Zhou, A. X. Liu, and T. Wang, “Label Inference Attacks Against Vertical Federated Learning,” in 2021 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, May 2021, pp. 1-17, doi: 10.1109/SP40001.2021.00001.
[2]H. Shi, Y. Xu, Y. Jiang, H. Yu and L. Cui, "Efficient Asynchronous Multi-Participant Vertical Federated Learning," in IEEE Transactions on Big Data, 2022, doi: 10.1109/TBDATA.2022.3201729.keywords: {Computational modeling;Stochastic processes;Training;Data models;Collaborative work;Privacy;Servers;Federated learning;privacy-preserving;asynchronous distributed computation},
[3]Y. Liu et al., “Batch Label Inference and Replacement Attacks in Black-Boxed Vertical Federated Learning,” arXiv:2112.05409 [cs.LG], Feb. 2022. [Online]. Available: 1
[4]H. Shi et al., “MVFLS: Multi-participant Vertical Federated Learning based on Secret Sharing,” in AAAI, vol. 35, no. 4, pp. 379-393, Feb. 2021, doi: 10.1609/aaai.v35i4.7010.

A.R.W.M.V.Hasaranga– IT21051548

R24-053

91 of 96

Athauda A.M.I.R.B – IT21049354

R24-053

Thank You

A.R.W.M.V.Hasaranga– IT21051548

R24-053

This Photo by Unknown Author is licensed under CC BY-SA

A.R.W.M.V.Hasaranga– IT21051548

R24-053