, starting from the most critical ones.
Unclear Threat Model. The threat model is provided in Section 4.1, and the authors (implicitly) use the general notation of goal, capabilities, knowledge (the strategy is explained later). However, the capabilities of the attacker are not well defined. Specifically, the paper says that the attacker can control a fraction ( α
) of the M clients. Hence, I ask: what can the attacker do with such clients? Can they perform any manipulation? Are some of the features not modifiable? Is such attacker subject to realistic constraints or feature dependencies? Is the perturbation magnitude bounded? I am referring to the well-known issue of ‘problem vs feature space’ attacks [B], because real attackers are subject to many real world constraints (and especially in networked systems [C, D, E]) and not all adversarial perturbations may be physically realizable ([F]). The authors should elucidate this issue, because it could differentiate between “fictional” and “practical” attacks, therefore defining whether the proposed method is applicable to solve real world problems. Moreover, the following is unclear:
• “There are α
fraction of agents that are malicious and total β
fraction of instances with backdoor trigger across all malicious agents.” I am unable to understand the relationship between α and β
. Is β
a subset of α ?
• From Equation 3 onwards, is h^{j} meant to denote h j
? Is there a need for the braces, or is it a typo?
• Please differentiate from h b e n i g n and h B
. The current notation is very confusing
Tradeoff. A common problem in adversarial ML countermeasures is that they may degrade baseline performance [G, H]. Hence, I am interested in knowing how the proposed method responds when there are no “malicious” clients (or when such clients behave legitimately). In this paper, I am unable to determine what is the baseline performance of the models in “non-adversarial” settings. Does such performance degrade after RVFR is applied? How does RVFR compare to previous works in these circumstances? Even if the baseline performance does not decrease, what is the overhead of the proposed RVFR with respect to past defenses? Figure 3 and 2 only show results for adversarial scenarios. In real circumstances, a defense should have some practical utility. Note that I would not reject the paper even if RVFR does have a significant “cost”. However, such cost must be known.
Very poor Introduction and Abstract. The Introduction fails to provide a concrete justification and enough context for the considered problem. Let me list all the issues I encountered while reading the introductory part of the paper:
• This statement in the abstract is vague: “However, unlike the standard horizontal federated learning, improving the robustness of robust VFL remains challenging.”. Specifically, why is it challenging? Just name a few reasons.
• This statement in the abstract is unclear: “ensure that with a low-rank feature subspace, a small number of attacked samples, and other mild assumptions”. What does this mean? The abstract should be more high-level. Such technicalities are not necessary.
• Please be consistent. In the Introduction: “In FL, a central server coordinates with multiple agents/clients”. Either use “client” or “agent”.
• I suggest mentioning [A] for a practical, recent and useful application of FL in a real world problem.
• This example is unclear: “In VFL, different agents hold different parts of features for the same set of training data. For example, in VFL for credit score prediction, Agent 1 may have the banking data of a user and Agent 2 may have the credit history of the same user, while the server holds corresponding labels.”. To me, it appears that Agent 1 and Agent 2 have different data, and hence represents a HFL problem (and I still do not understand the necessity of the last statement involving the ‘label’). Perhaps the authors should provide a visual example that better explains the difference between HFL and VFL.
• The Introduction still suffers of the same problem as the abstract. “However, it is challenging to defend against malicious attacks in VFL.”. Why? It is very annoying to read the abstract, not get a response to such question; and then re-reading the same concept in the Introduction, and not finding an answer even there. The impression is that the authors are trying to make the problem more difficult than what it currently is: if it is challenging, it should be clear.
• In the Introduction: “The fraction of malicious agents is relatively small”. Can you define such fraction? Does it have an upper boundary?
• The term “backdoor attacks” is never mentioned in the Introduction until the “contribution” paragraph. Such term should be better contextualized: not all poisoning attacks are backdoor attacks.
• I had to reach the Related Work section to understand why poisoning attacks in VFL are “challenging”. However, the motivation provided by the authors is confusing—to say the least. According to the paper, the challenge is “Backdoor attack against VFL is challenging since in the default setting the agent does not have the label information.” First, what is challenging exactly: the attack, or the defense? Second, what is such “default setting”? Third, why does the agent not have the label information? I believe the latter is due to the (poor) explanation provided in the early example in the introduction.
Minor issues:
• Please use the term “stage” (or “phase”) and not “time” to differentiate between training and testing/inference.
• Please add some text between Section 6 and 6.1
• In Section 6.1, the authors state “We study the classification task on two datasets: NUS-WIDE and CIFAR-10. Following (Liu et al., 2020), which proposed the backdoor attack against VFL, we use NUS-WIDE dataset to evaluate our defense.”. Does it mean that the defense is only evaluated on NUS-WIDE?
• In Section 6.2, the authors state “The noise variance is 0:05 for NUS-WIDE and 0:0001 for CIFAR-10 to preserve reasonable utility of the model.”. Please define what “utility” means in this statement.
• Figure 2: please maintain the same range for the y-axis. It does not only varies among the rows, but also among the columns.
• Figure 3 and Figure 2: the range of the y-axis should be the same for both figures.
• Use the same term to refer to figures. If the figures are named “Figures”, then use “Figures” in the text, and not “Fig.”
• What is the difference between “Backdoor Accuracy” and “Clean Accuracy” in Figures 2 and 3?
EXTERNAL REFERENCES
[A]: "Federated learning for predicting clinical outcomes in patients with COVID-19." Nature medicine (2021): 1-9.
[B]: "Intriguing properties of adversarial ml attacks in the problem space." 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020.
[C]: "Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems." ACM Digital Threats: Research and Practice. 2021.
[D]: "Constrained concealment attacks against reconstruction-based anomaly detectors in industrial control systems." ACM Annual Computer Security Applications Conference. 2020.
[E]: "Resilient networked AC microgrids under unbounded cyber attacks." IEEE Transactions on Smart Grid 11.5 (2020): 3785-3794.
[F]: "Improving robustness of ML classifiers against realizable evasion attacks using conserved features." 28th {USENIX} Security Symposium ({USENIX} Security 19). 2019.
[G]: "Adversarial example defense: Ensembles of weak defenses are not strong." 11th {USENIX} workshop on offensive technologies ({WOOT} 17). 2017.
[H]: "Deep reinforcement adversarial learning against botnet evasion attacks." IEEE Transactions on Network and Service Management 17.4 (2020): 1975-1987.
• This statement in the abstract is unclear: “ensure that with a low-rank feature subspace, a small number of attacked samples, and other mild assumptions”. What does this mean? The abstract should be more high-level. Such technicalities are not necessary.