<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="yoo-kwak-2022-backdoor">
    <titleInfo>
        <title>Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Ki</namePart>
        <namePart type="given">Yoon</namePart>
        <namePart type="family">Yoo</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Nojun</namePart>
        <namePart type="family">Kwak</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2022-12</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Yoav</namePart>
            <namePart type="family">Goldberg</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Zornitsa</namePart>
            <namePart type="family">Kozareva</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Yue</namePart>
            <namePart type="family">Zhang</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Abu Dhabi, United Arab Emirates</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
    </relatedItem>
    <abstract>Recent advances in federated learning have demonstrated its promising capability to learn on decentralized datasets. However, a considerable amount of work has raised concerns due to the potential risks of adversaries participating in the framework to poison the global model for an adversarial purpose. This paper investigates the feasibility of model poisoning for backdoor attacks through rare word embeddings of NLP models. In text classification, less than 1% of adversary clients suffices to manipulate the model output without any drop in the performance of clean sentences. For a less complex dataset, a mere 0.1% of adversary clients is enough to poison the global model effectively. We also propose a technique specialized in the federated learning scheme called gradient ensemble, which enhances the backdoor performance in all experimental settings.</abstract>
    <identifier type="citekey">yoo-kwak-2022-backdoor</identifier>
    <identifier type="doi">10.18653/v1/2022.emnlp-main.6</identifier>
    <location>
        <url>https://aclanthology.org/2022.emnlp-main.6</url>
    </location>
    <part>
        <date>2022-12</date>
        <extent unit="page">
            <start>72</start>
            <end>88</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling
%A Yoo, Ki Yoon
%A Kwak, Nojun
%Y Goldberg, Yoav
%Y Kozareva, Zornitsa
%Y Zhang, Yue
%S Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing
%D 2022
%8 December
%I Association for Computational Linguistics
%C Abu Dhabi, United Arab Emirates
%F yoo-kwak-2022-backdoor
%X Recent advances in federated learning have demonstrated its promising capability to learn on decentralized datasets. However, a considerable amount of work has raised concerns due to the potential risks of adversaries participating in the framework to poison the global model for an adversarial purpose. This paper investigates the feasibility of model poisoning for backdoor attacks through rare word embeddings of NLP models. In text classification, less than 1% of adversary clients suffices to manipulate the model output without any drop in the performance of clean sentences. For a less complex dataset, a mere 0.1% of adversary clients is enough to poison the global model effectively. We also propose a technique specialized in the federated learning scheme called gradient ensemble, which enhances the backdoor performance in all experimental settings.
%R 10.18653/v1/2022.emnlp-main.6
%U https://aclanthology.org/2022.emnlp-main.6
%U https://doi.org/10.18653/v1/2022.emnlp-main.6
%P 72-88

Markdown (Informal)

[Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling](https://aclanthology.org/2022.emnlp-main.6) (Yoo & Kwak, EMNLP 2022)

• Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling (Yoo & Kwak, EMNLP 2022)

ACL

• Ki Yoon Yoo and Nojun Kwak. 2022. Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 72–88, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.