├── .gitignore
├── Makefile
├── README.md
├── attacks
├── attack.py
├── loss_functions.py
└── modelreplace.py
├── defenses
└── fedavg.py
├── environment.yml
├── exps
├── cifar_fed.yaml
├── gen-run-yaml-file.py
├── imagenet_fed.yaml
├── list_exps__2023.Nov.25.md
└── mnist_fed.yaml
├── helper.py
├── markdown-explanation
├── FedMLSec.md
├── Figure_4_ba_norm.png
├── Figure_full-image-pattern.png
├── code-structures.md
└── model-replacement-attack.png
├── metrics
├── accuracy_metric.py
├── metric.py
└── test_loss_metric.py
├── models
├── MnistNet.py
├── __init__.py
├── model.py
├── resnet.py
├── resnet_cifar.py
├── resnet_tinyimagenet.py
└── simple.py
├── synthesizers
├── attack_models
│ ├── autoencoders.py
│ └── unet.py
├── complex_synthesizer.py
├── iba_synthesizer.py
├── pattern_synthesizer.py
├── physical_synthesizer.py
├── singlepixel_synthesizer.py
└── synthesizer.py
├── tasks
├── batch.py
├── cifar10_task.py
├── fl_user.py
├── imagenet_task.py
├── mnist_task.py
└── task.py
├── test-lib
├── test-log.py
├── test-write-file.ipynb
└── test.log
├── training.py
└── utils
├── parameters.py
├── process_tiny_data.sh
├── tinyimagenet_reformat.py
└── utils.py
/.gitignore:
--------------------------------------------------------------------------------
1 | .DS_Store
2 | FedML/
3 | config/
4 | PFL-Non-IID/
5 | 3DFed/
6 | OOD_Federated_Learning/
7 | RLBackdoorFL/
8 | __pycache__/
9 | *.pyc
10 | saved_models/
11 | .data/
12 | wandb/
13 | *.zip
14 | exps/run*
15 | env-variables.md
16 | synthesizers/checkpoint/
17 | synthesizers/atkmodel/
--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
1 | .ONESHELL:
2 |
3 | CONDAPATH = $$(conda info --base)
4 | ENV_NAME = aba
5 |
6 | install:
7 | conda env create -f environment.yml
8 | ${CONDAPATH}/envs/$(ENV_NAME)/bin/pip install -r requirements.txt
9 |
10 | install-mac:
11 | conda env create -f environment.yml
12 | conda install nomkl
13 | ${CONDAPATH}/envs/$(ENV_NAME)/bin/pip install -r requirements.txt
14 |
15 | update:
16 | # conda env update --prune -f environment.yml
17 | ${CONDAPATH}/envs/$(ENV_NAME)/bin/pip install -r requirements.txt --upgrade
18 |
19 | clean:
20 | conda env remove --name $(ENV_NAME)
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 | # Table of contents
3 | - [Table of contents](#table-of-contents)
4 | - [Description](#description)
5 | - [Overview of project](#overview-of-project)
6 | - [How to develop from this project](#how-to-develop-from-this-project)
7 | - [Dataset for Backdoor Attack in FL](#dataset-for-backdoor-attack-in-fl)
8 | - [Durability](#durability)
9 | - [Working with FedML](#working-with-fedml)
10 | - [Survey Papers for Machine Learning Security](#survey-papers-for-machine-learning-security)
11 | - [Paper Backdoor Attack in ML/ FL](#paper-backdoor-attack-in-ml-fl)
12 | - [Code for Backdoor Attack in ML/ FL](#code-for-backdoor-attack-in-ml-fl)
13 | - [Other Resources for Backdoor Attack in ML/ FL](#other-resources-for-backdoor-attack-in-ml-fl)
14 | - [Backdoor Attack code resources in FL](#backdoor-attack-code-resources-in-fl)
15 |
16 |
17 | # Description
18 | This github project provided a fast integration for readers to work in the field of backdoor attacks in machine learning and federated learning.
19 |
20 |
21 |
22 | # Overview of project
23 | - Attack methods: DBA, LIRA, IBA, BackdoorBox, 3DFed, Chameleon, etc.
24 | - Defense methods: Krum, RFA, FoolsGold, etc.
25 |
26 | # How to develop from this project
27 | - Define dataset in `tasks` folder.
28 | - Define your own attack method in `.attacks` folder. Default attack method is adding trigger to the training dataset and training the model with the poisoned dataset.
29 | - Define your own defense method in `defenses` folder. Default defense method is FedAvg.
30 | - Define your own model in `models` folder and config for experiment in `exps` folder.
31 | - All the experiments are inherited from the 3 base `.yaml` files in `exps` folder for 3 datasets: `mnist_fed.yaml` (MNIST), `cifar_fed.yaml` (CIFAR-10), `imagetnet_fed.yaml` (Tiny ImageNet).
32 | - The base setting for each experiment contains 100 clients, in which 4 clients are attackers, 10 clients participate in each round, and 2 rounds are performed for benign training, and 5 rounds are performed for attack training.
33 | - The dataset is divided by dirichlet distribution with $\alpha = 0.5$.
34 | - The pre-trained model is downloaded from [Google Drive (DBA)](https://drive.google.com/file/d/1wcJ_DkviuOLkmr-FgIVSFwnZwyGU8SjH/view).
35 | ---
36 | Here is the example of running the code:
37 | ```
38 | python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.24/cifar10_fed_100_10_4_0.5_0.05.yaml
39 |
40 | python training.py --name mnist --params ./exps/run_mnist__2023.Nov.24/mnist_fed_100_10_4_0.5_0.05.yaml
41 |
42 | python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.24/tiny-imagenet_fed_100_10_4_0.5_0.05.yaml
43 | ```
44 | In these commands, the `--name` argument is the name of experiment, and the `--params` argument is the path to the `.yaml` file of experiment setting.
45 |
46 | ---
47 |
48 | For more commands, please refer to file `./exps/run-yaml-cmd.md`. Please note that the `./exps/run-yaml-cmd.md` file is generated by the `./exps/gen-run-yaml-file.py` file. Refer to the `./exps/gen-run-yaml-file.py` to generate different commands for your own experiments.
49 |
50 |
51 | # Dataset for Backdoor Attack in FL
52 |
53 | |Dataset|Case|Description|
54 | | :--- | :--- | :--- |
55 | |MNIST|Case -|The MNIST database of handwritten digits, has a training set of 60,000 examples, and a test set of 10,000 examples.|
56 | CIFAR-10|Case -|The CIFAR-10 dataset consists of 60000 32x32 colour images in 10 classes, with 6000 images per class. There are 50000 training images and 10000 test images|
57 | CIFAR-100|Case -|The CIFAR-100 dataset consists of 60000 32x32 colour images in 100 classes, with 600 images per class., 500 training images and 100 testing images per class.|
58 | Tiny ImageNet|Case -|The Tiny ImageNet contains 200 image classes, a training dataset of 100,000 images, a validation dataset of 10,000 images, and a test dataset of 10,000 images (50 validation and 50 test images per class). All images are of size 64×64|
59 | |EMNIST|Case -|There are 62 classes (10 digits, 26 lowercase, 26 uppercase), 814255 samples, 697932 training samples, 116323 test samples.
60 |
61 | [Edge-case backdoors](https://proceedings.neurips.cc/paper/2020/hash/b8ffa41d4e492f0fad2f13e29e1762eb-Abstract.html)
62 |
63 |
69 |
70 |
71 |
72 |
77 |
78 | # Durability
79 |
80 |
81 |
82 | # Working with FedML
83 | - [FedML README.md](https://github.com/FedML-AI/FedML/blob/master/python/fedml/core/security/readme.md)
84 |
85 | Types of Attacks in FL setting:
86 | - Byzantine Attack
87 | - DLG Attack (Deep Leakage from Gradients)
88 | - Backdoor Attack
89 | - Model Replacement Attack
90 |
91 | # Survey Papers for Machine Learning Security
92 |
93 | | Title | Year | Venue | Code | Dataset | URL | Note |
94 | | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
95 | |A Survey on Fully Homomorphic Encryption: An Engineering Perspective|2017|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3124441)||
96 | |Generative Adversarial Networks: A Survey Toward Private and Secure Applications|2021|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3459992)||
97 | |A Survey on Adversarial Recommender Systems: From Attack/Defense Strategies to Generative Adversarial Networks|2021|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3439729)||
98 | |Video Generative Adversarial Networks: A Review|2022|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3487891)||
99 | |Taxonomy of Machine Learning Safety: A Survey and Primer|2022|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3551385)||
100 | |Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses|2022|ACM Computing Surveys|||[link](https://arxiv.org/pdf/2012.10544.pdf)||
101 | |Generative Adversarial Networks: A Survey on Atack and Defense Perspective|2023|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3615336)||
102 | |Trustworthy AI: From Principles to Practices|2023|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3555803)||
103 | |Deep Learning for Android Malware Defenses: A Systematic Literature Review|2022|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3571156)||
104 | |Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses|2022|IEEE TPAMI|||[link](https://arxiv.org/pdf/2012.10544.pdf)||
105 | |A Comprehensive Review of the State-of-the-Art on Security and Privacy Issues in Healthcare|2023|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3571156)||
106 | |A Comprehensive Survey of Privacy-preserving Federated Learning: A Taxonomy, Review, and Future Directions|2023|ACM Computing Surveys|||[link](https://dl.acm.org/doi/pdf/10.1145/3460427)||
107 | |Recent Advances on Federated Learning: A Systematic Survey|2023|arXiv|||[link](https://arxiv.org/pdf/2301.01299.pdf)||
108 | |Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmark|2023|arXiv|||[link](https://arxiv.org/pdf/2311.06750v1.pdf)||
109 | |Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions|2024|Engineering Applications of Artificial Intelligence|||[link](https://www.sciencedirect.com/science/article/abs/pii/S0952197623013507)||
110 |
111 | ## Paper Backdoor Attack in ML/ FL
112 | - [How to Backdoor Federated Learning](https://arxiv.org/pdf/1807.00459.pdf)
113 | - [Attack of the Tails: Yes, You Really Can Backdoor Federated Learning](https://arxiv.org/pdf/2007.05084v1.pdf)
114 | - [DBA: Distributed Backdoor Attacks against Federated Learning](https://openreview.net/pdf?id=rkgyS0VFvr)
115 |
116 | ## Code for Backdoor Attack in ML/ FL
117 |
118 | | Title | Year | Venue | Code | Dataset | URL | Note |
119 | | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
120 | |Practicing-Federated-Learning||Github|[link](https://github.com/FederatedAI/Practicing-Federated-Learning/)|
121 | |Attack of the Tails: Yes, You Really Can Backdoor Federated Learning||NeurIPS'20|[link](https://github.com/ksreenivasan/OOD_Federated_Learning)|
122 | |DBA: Distributed Backdoor Attacks against Federated Learning||ICLR'20|[link](https://github.com/AI-secure/DBA)|
123 | |LIRA: Learnable, Imperceptible and Robust Backdoor Attacks ||ICCV'21|[link](https://github.com/khoadoan106/backdoor_attacks/tree/main)|
124 | |Backdoors Framework for Deep Learning and Federated Learning||AISTAT'20, USENIX'21|[link](https://github.com/ebagdasa/backdoors101)|
125 | |BackdoorBox: An Open-sourced Python Toolbox for Backdoor Attacks and Defenses|2023|Github|[link](https://github.com/THUYimingLi/BackdoorBox)|
126 | |3DFed: Adaptive and Extensible Framework for Covert Backdoor Attack in Federated Learning||IEEE S&P'23|[link](https://github.com/haoyangliASTAPLE/3DFed)|
127 | |Neurotoxin: Durable Backdoors in Federated Learning||ICML'22|[link](https://proceedings.mlr.press/v162/zhang22w/zhang22w.pdf)|||Durability
128 | |Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning||ICML'23|[link](https://github.com/ybdai7/Chameleon-durable-backdoor)|||Durability
129 | |PerDoor: Persistent Backdoors in Federated Learning using Adversarial Perturbations||COINS'23|[link](https://ieeexplore.ieee.org/abstract/document/10189281)|
130 | ## Other Resources for Backdoor Attack in ML/ FL
131 | - [List of papers on data poisoning and backdoor attacks](https://github.com/penghui-yang/awesome-data-poisoning-and-backdoor-attacks)
132 | - [Proceedings of Machine Learning Research](https://proceedings.mlr.press/)
133 | - [Backdoor learning resources](https://github.com/THUYimingLi/backdoor-learning-resources)
134 | - Google Scholar:
135 | - [Avi Schwarzschild, Post Doc at CMU](https://scholar.google.com/citations?user=WNvQ7AcAAAAJ&hl=en)
136 | - [Yiming Li, Research Professor at Zhejiang University](https://scholar.google.com/citations?user=mSW7kU8AAAAJ&hl=zh-CN)
137 | - [Nicolas Papernot, Assistant Professor at University of Toronto](https://scholar.google.com/citations?user=cGxq0cMAAAAJ&hl=en)
138 |
139 | # Backdoor Attack code resources in FL
140 | In FL community, there are many code resources for backdoor attack, in which each of them has its own FL scenario (e.g., hyperparameters, dataset, attack methods, defense methods, etc.).
141 | Thus, we provide a list of popular code resources for backdoor attack in FL as follows:
142 | - [Attack of the Tails: Yes, You Really Can Backdoor Federated Learning - NeurIPS'20](https://github.com/ksreenivasan/OOD_Federated_Learning)
143 | - [DBA: Distributed Backdoor Attacks against Federated Learning ICLR'20](https://github.com/AI-secure/DBA)
144 | - [How To Backdoor Federated Learning - AISTATS'20](https://github.com/ebagdasa/backdoors101)
145 | - [Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks - ICML'21](https://github.com/aks2203/poisoning-benchmark)
146 | - [Learning to Backdoor Federated Learning - ICLR'23 Workshop](https://github.com/HengerLi/RLBackdoorFL/tree/main)
147 | - [Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning - ICML'23](https://github.com/ybdai7/Chameleon-durable-backdoor)
148 | - [FedMLSecurity: A Benchmark for Attacks and Defenses in Federated Learning and Federated LLMs - arXiv'23](https://github.com/FedML-AI/FedML/blob/master/python/fedml/core/security/readme.md)
149 | - [IBA: Towards Irreversible Backdoor Attacks in Federated Learning - NeurIPS'23](https://github.com/sail-research/iba)
150 |
151 |
--------------------------------------------------------------------------------
/attacks/attack.py:
--------------------------------------------------------------------------------
1 | import logging
2 | from typing import Dict, List
3 |
4 | import torch
5 | from torch.utils.data import DataLoader
6 | from synthesizers.synthesizer import Synthesizer
7 | from attacks.loss_functions import compute_all_losses_and_grads
8 | from utils.parameters import Params
9 | import math
10 | logger = logging.getLogger('logger')
11 |
12 |
13 | class Attack:
14 | params: Params
15 | synthesizer: Synthesizer
16 | local_dataset: DataLoader
17 | loss_tasks: List[str]
18 | fixed_scales: Dict[str, float]
19 | ignored_weights = ['num_batches_tracked']#['tracked', 'running']
20 |
21 | def __init__(self, params, synthesizer):
22 | self.params = params
23 | self.synthesizer = synthesizer
24 | self.loss_tasks = ['normal', 'backdoor']
25 | self.fixed_scales = {'normal':0.5, 'backdoor':0.5}
26 |
27 | def perform_attack(self, _) -> None:
28 | raise NotImplemented
29 |
30 | def compute_blind_loss(self, model, criterion, batch, attack, fixed_model=None):
31 | """
32 |
33 | :param model:
34 | :param criterion:
35 | :param batch:
36 | :param attack: Do not attack at all. Ignore all the parameters
37 | :return:
38 | """
39 | batch = batch.clip(self.params.clip_batch)
40 | loss_tasks = self.loss_tasks.copy() if attack else ['normal']
41 | batch_back = self.synthesizer.make_backdoor_batch(batch, attack=attack)
42 | scale = dict()
43 |
44 | if len(loss_tasks) == 1:
45 | loss_values = compute_all_losses_and_grads(
46 | loss_tasks,
47 | self, model, criterion, batch, batch_back
48 | )
49 | else:
50 | loss_values = compute_all_losses_and_grads(
51 | loss_tasks,
52 | self, model, criterion, batch, batch_back,
53 | fixed_model = fixed_model)
54 |
55 | for t in loss_tasks:
56 | scale[t] = self.fixed_scales[t]
57 |
58 | if len(loss_tasks) == 1:
59 | scale = {loss_tasks[0]: 1.0}
60 | blind_loss = self.scale_losses(loss_tasks, loss_values, scale)
61 |
62 | return blind_loss
63 |
64 | def scale_losses(self, loss_tasks, loss_values, scale):
65 | blind_loss = 0
66 | # import IPython; IPython.embed()
67 | # exit(0)
68 | for it, t in enumerate(loss_tasks):
69 | self.params.running_losses[t].append(loss_values[t].item())
70 | self.params.running_scales[t].append(scale[t])
71 | if it == 0:
72 | blind_loss = scale[t] * loss_values[t]
73 | else:
74 | blind_loss += scale[t] * loss_values[t]
75 | self.params.running_losses['total'].append(blind_loss.item())
76 | return blind_loss
77 |
78 | def scale_update(self, local_update: Dict[str, torch.Tensor], gamma):
79 | for name, value in local_update.items():
80 | value.mul_(gamma)
81 |
82 | def get_fl_update(self, local_model, global_model) -> Dict[str, torch.Tensor]:
83 | local_update = dict()
84 | for name, data in local_model.state_dict().items():
85 | if self.check_ignored_weights(name):
86 | continue
87 | local_update[name] = (data - global_model.state_dict()[name])
88 |
89 | return local_update
90 |
91 | def check_ignored_weights(self, name) -> bool:
92 | for ignored in self.ignored_weights:
93 | if ignored in name:
94 | return True
95 |
96 | return False
97 |
98 | def get_update_norm(self, local_update):
99 | squared_sum = 0
100 | for name, value in local_update.items():
101 | if 'tracked' in name or 'running' in name:
102 | continue
103 | squared_sum += torch.sum(torch.pow(value, 2)).item()
104 | update_norm = math.sqrt(squared_sum)
105 | return update_norm
--------------------------------------------------------------------------------
/attacks/loss_functions.py:
--------------------------------------------------------------------------------
1 | import time
2 |
3 | import torch
4 | from torch.nn import functional as F, Module
5 |
6 | from models.model import Model
7 | from utils.parameters import Params
8 | from utils.utils import record_time
9 |
10 | def compute_all_losses_and_grads(loss_tasks, attack, model, criterion,
11 | batch, batch_back,
12 | fixed_model=None):
13 | loss_values = {}
14 | for t in loss_tasks:
15 | if t == 'normal':
16 | loss_values[t] = compute_normal_loss(attack.params,
17 | model,
18 | criterion,
19 | batch.inputs,
20 | batch.labels)
21 | elif t == 'backdoor':
22 | loss_values[t] = compute_backdoor_loss(attack.params,
23 | model,
24 | criterion,
25 | batch_back.inputs,
26 | batch_back.labels)
27 | elif t == 'eu_constraint':
28 | loss_values[t] = compute_euclidean_loss(attack.params,
29 | model,
30 | fixed_model)
31 | elif t == 'cs_constraint':
32 | loss_values[t] = compute_cos_sim_loss(attack.params,
33 | model,
34 | fixed_model)
35 |
36 | return loss_values
37 |
38 |
39 | def compute_normal_loss(params: Params, model, criterion, inputs, labels):
40 | t = time.perf_counter()
41 | outputs = model(inputs)
42 | record_time(params, t, 'forward')
43 | loss = criterion(outputs, labels)
44 | loss = loss.mean()
45 |
46 | return loss
47 |
48 | def compute_backdoor_loss(params, model, criterion, inputs_back, labels_back):
49 | t = time.perf_counter()
50 | outputs = model(inputs_back)
51 | record_time(params, t, 'forward')
52 | loss = criterion(outputs, labels_back)
53 | loss = loss.mean()
54 |
55 | return loss
56 |
57 | def compute_euclidean_loss(params: Params,
58 | model: Model,
59 | fixed_model: Model):
60 | size = 0
61 | for name, layer in model.named_parameters():
62 | size += layer.view(-1).shape[0]
63 | sum_var = torch.cuda.FloatTensor(size).fill_(0)
64 | size = 0
65 | for name, layer in model.named_parameters():
66 | sum_var[size:size + layer.view(-1).shape[0]] = (layer - \
67 | fixed_model.state_dict()[name]).view(-1)
68 | size += layer.view(-1).shape[0]
69 |
70 | loss = torch.norm(sum_var, p=2)
71 |
72 | return loss
73 |
74 | def get_one_vec(model: Module):
75 | size = 0
76 | for name, layer in model.named_parameters():
77 | size += layer.view(-1).shape[0]
78 | sum_var = torch.cuda.FloatTensor(size).fill_(0)
79 | size = 0
80 | for name, layer in model.named_parameters():
81 | sum_var[size:size + layer.view(-1).shape[0]] = (layer.data).view(-1)
82 | size += layer.view(-1).shape[0]
83 |
84 | return sum_var
85 |
86 | def compute_cos_sim_loss(params: Params,
87 | model: Model,
88 | fixed_model: Model):
89 | model_vec = get_one_vec(model)
90 | target_var = get_one_vec(fixed_model)
91 | cs_sim = F.cosine_similarity(params.fl_weight_scale*(model_vec-target_var)\
92 | + target_var, target_var, dim=0)
93 | loss = 1e3 * (1 - cs_sim)
94 | return loss
95 |
96 | def compute_noise_ups_loss(params: Params,
97 | backdoor_update,
98 | noise_masks,
99 | random_neurons):
100 | losses = []
101 | for i in range(len(noise_masks)):
102 | UPs = []
103 | for j in random_neurons:
104 | if 'MNIST' not in params.task:
105 | UPs.append(torch.abs(backdoor_update['fc.weight'][j] + \
106 | noise_masks[i].fc.weight[j]).sum() \
107 | + torch.abs(backdoor_update['fc.bias'][j] + \
108 | noise_masks[i].fc.bias[j]))
109 | else:
110 | UPs.append(torch.abs(backdoor_update['fc2.weight'][j] + \
111 | noise_masks[i].fc2.weight[j]).sum() \
112 | + torch.abs(backdoor_update['fc2.bias'][j] + \
113 | noise_masks[i].fc2.bias[j]))
114 | UPs_loss = 0
115 | for j in range(len(UPs)):
116 | if 'Imagenet' in params.task:
117 | UPs_loss += 5e-4 / UPs[j]
118 | else:
119 | UPs_loss += 1e-1 / UPs[j] # (UPs[j] * params.fl_num_neurons)
120 | noise_masks[i].requires_grad_(True)
121 | UPs_loss.requires_grad_(True)
122 | losses.append(UPs_loss)
123 | return losses
124 |
125 | def compute_noise_norm_loss(params: Params,
126 | noise_masks,
127 | random_neurons):
128 | size = 0
129 | layer_name = 'fc2' if 'MNIST' in params.task else 'fc'
130 | for name, layer in noise_masks[0].named_parameters():
131 | if layer_name in name:
132 | size += layer.view(-1).shape[0]
133 | losses = []
134 | for i in range(len(noise_masks)):
135 | sum_var = torch.cuda.FloatTensor(size).fill_(0)
136 | noise_size = 0
137 | for name, layer in noise_masks[i].named_parameters():
138 | if layer_name in name:
139 | for j in range(layer.shape[0]):
140 | if j in random_neurons:
141 | sum_var[noise_size:noise_size + layer[j].view(-1).shape[0]] = \
142 | layer[j].view(-1)
143 | noise_size += layer[j].view(-1).shape[0]
144 | if 'MNIST' in params.task:
145 | loss = 8e-2 * torch.norm(sum_var, p=2)
146 | else:
147 | loss = 3e-2 * torch.norm(sum_var, p=2)
148 | losses.append(loss)
149 | return losses
150 |
151 | def compute_lagrange_loss(params: Params,
152 | noise_masks,
153 | random_neurons):
154 | losses = []
155 | size = 0
156 | layer_name = 'fc2' if 'MNIST' in params.task else 'fc'
157 | for name, layer in noise_masks[0].named_parameters():
158 | if layer_name in name:
159 | size += layer.view(-1).shape[0]
160 | sum_var = torch.cuda.FloatTensor(size).fill_(0)
161 | for i in range(len(noise_masks)):
162 | size = 0
163 | for name, layer in noise_masks[i].named_parameters():
164 | if layer_name in name:
165 | for j in range(layer.shape[0]):
166 | if j in random_neurons:
167 | sum_var[size:size + layer[j].view(-1).shape[0]] += \
168 | layer[j].view(-1)
169 | size += layer[j].view(-1).shape[0]
170 |
171 | if 'MNIST' in params.task:
172 | loss = 1e-1 * torch.norm(sum_var, p=2)
173 | else:
174 | loss = 1e-2 * torch.norm(sum_var, p=2)
175 | for i in range(len(noise_masks)):
176 | losses.append(loss)
177 | return losses
178 |
179 | def compute_decoy_acc_loss(params: Params,
180 | benign_model: Model,
181 | decoy: Model,
182 | criterion, inputs, labels):
183 | dec_acc_loss, _ = compute_normal_loss(params, decoy, criterion, \
184 | inputs, labels)
185 | benign_acc_loss, _ = compute_normal_loss(params, benign_model, criterion, \
186 | inputs, labels)
187 | if dec_acc_loss > benign_acc_loss:
188 | loss = dec_acc_loss
189 | else:
190 | loss = - 1e-10 * (dec_acc_loss)
191 |
192 | return loss
193 |
194 | def compute_decoy_param_loss(params:Params,
195 | decoy: Model,
196 | benign_model: Model,
197 | param_idx):
198 |
199 | if 'MNIST' not in params.task:
200 | param_diff = torch.abs(decoy.fc.weight[param_idx[0]][param_idx[1]] - \
201 | benign_model.state_dict()['fc.weight'][param_idx[0]][param_idx[1]])
202 | else:
203 | param_diff = torch.abs(decoy.fc1.weight[param_idx[0]][param_idx[1]] - \
204 | benign_model.state_dict()['fc1.weight'][param_idx[0]][param_idx[1]])
205 |
206 | threshold = 10 # 30
207 | if(param_diff.item() > threshold):
208 | loss = 1e-10 * param_diff
209 | else:
210 | loss = - 1e1 * param_diff
211 |
212 | return loss
213 |
214 | def get_grads(params, model, loss):
215 | t = time.perf_counter()
216 | grads = list(torch.autograd.grad(loss.mean(),
217 | [x for x in model.parameters() if
218 | x.requires_grad],
219 | retain_graph=True, allow_unused=True))
220 | record_time(params, t, 'backward')
221 |
222 | return grads
--------------------------------------------------------------------------------
/attacks/modelreplace.py:
--------------------------------------------------------------------------------
1 | import torch
2 | # from attack import Attack
3 | from attacks.attack import Attack
4 | from tasks.fl_user import FLUser
5 | import logging
6 | logger = logging.getLogger('logger')
7 |
8 | class ModelReplace(Attack):
9 |
10 | def __init__(self, params, synthesizer):
11 | super().__init__(params, synthesizer)
12 | self.loss_tasks.append('cs_constraint')
13 | self.fixed_scales = {'normal':0.3,
14 | 'backdoor':0.3,
15 | 'cs_constraint':0.4}
16 |
17 | def perform_attack(self, _, user: FLUser, epoch):
18 | if self.params.fl_number_of_adversaries <= 0 or \
19 | epoch not in range(self.params.poison_epoch,\
20 | self.params.poison_epoch_stop):
21 | return
22 |
23 | folder_name = f'{self.params.folder_path}/saved_updates'
24 | file_name = f'{folder_name}/update_{user.user_id}.pth'
25 | loaded_params = torch.load(file_name)
26 | logger.info(f"Loaded update user id: {user.user_id} from {file_name} with scale {self.params.fl_weight_scale}")
27 | self.scale_update(loaded_params, self.params.fl_weight_scale)
28 | torch.save(loaded_params, file_name)
29 |
30 | # for i in range(self.params.fl_number_of_adversaries):
31 | # file_name = f'{folder_name}/update_{i}.pth'
32 | # torch.save(loaded_params, file_name)
--------------------------------------------------------------------------------
/defenses/fedavg.py:
--------------------------------------------------------------------------------
1 | import math
2 | from typing import List, Any, Dict
3 | import torch
4 | import logging
5 | import os
6 | from utils.parameters import Params
7 |
8 | logger = logging.getLogger('logger')
9 | os.environ['KMP_DUPLICATE_LIB_OK'] = 'True'
10 |
11 | class FedAvg:
12 | params: Params
13 | ignored_weights = ['num_batches_tracked']#['tracked', 'running']
14 |
15 | def __init__(self, params: Params) -> None:
16 | self.params = params
17 |
18 | # FedAvg aggregation
19 | def aggr(self, weight_accumulator, _):
20 | # logger.info(f"Aggregating {len(self.params.fl_weight_contribution.keys())} participants")
21 |
22 | # weight_contrib = self.params.fl_weight_contribution
23 |
24 | for user_id, weight_contrib_user in self.params.fl_weight_contribution.items():
25 | # logger.info(f"Aggregating participant: {user_id} with weight: {weight_contrib_user}")
26 | loaded_params = self.params.fl_local_updated_models[user_id]
27 | self.accumulate_weights(weight_accumulator, \
28 | {key:(loaded_params[key] * weight_contrib_user ).to(self.params.device) for \
29 | key in loaded_params})
30 |
31 | # for idRound, userID in enumerate(self.params.fl_round_participants):
32 | # weight_contrib_user = self.params.fl_weight_contribution[userID]
33 | # # updates_name = '{0}/saved_updates/update_{1}.pth'\
34 | # # .format(self.params.folder_path, userID)
35 | # # # logger.info(f"Aggregating participant {userID} path: {updates_name}")
36 |
37 | # # loaded_params = torch.load(updates_name)
38 | # loaded_params = self.params.fl_local_updated_models[userID]
39 | # self.accumulate_weights(weight_accumulator, \
40 | # {key:(loaded_params[key] * weight_contrib_user ).to(self.params.device) for \
41 | # key in loaded_params})
42 |
43 | def accumulate_weights(self, weight_accumulator, local_update):
44 | for name, value in local_update.items():
45 | weight_accumulator[name].add_(value)
46 |
47 | def get_update_norm(self, local_update):
48 | squared_sum = 0
49 | for name, value in local_update.items():
50 | if 'tracked' in name or 'running' in name:
51 | continue
52 | squared_sum += torch.sum(torch.pow(value, 2)).item()
53 | update_norm = math.sqrt(squared_sum)
54 | return update_norm
55 |
56 | def add_noise(self, sum_update_tensor: torch.Tensor, sigma):
57 | noised_layer = torch.FloatTensor(sum_update_tensor.shape)
58 | noised_layer = noised_layer.to(self.params.device)
59 | noised_layer.normal_(mean=0, std=sigma)
60 | sum_update_tensor.add_(noised_layer)
61 |
62 | def check_ignored_weights(self, name) -> bool:
63 | for ignored in self.ignored_weights:
64 | if ignored in name:
65 | return True
66 |
67 | return False
--------------------------------------------------------------------------------
/environment.yml:
--------------------------------------------------------------------------------
1 | name: aba # Name of the Conda environment
2 |
3 | channels:
4 | - defaults # You can add other channels if needed
5 |
6 | dependencies:
7 | - python=3.8 # Python version
8 | - numpy=1.21.2 # Example package with version
9 | - pandas=1.3.3 # Another package with a specific version
10 | - pytorch=1.9.0 # PyTorch version
11 | - torchvision=0.10.0 # Torchvision version
12 | - pip # Install pip
13 | - pip:
14 | # - torchattacks==3.1.0 # Install torchattacks
15 | # - torchsummary==1.5.1 # Install torchsummary
16 | # - torchmetrics==0.5.1 # Install torchmetrics
17 | # - torch_optimizer==0.1.0 # Install torch_optimizer
18 | - tqdm==4.62.3 # Install tqdm
19 | - matplotlib==3.4.3 # Install matplotlib
20 | - seaborn==0.11.2 # Install seaborn
21 | # - scikit-learn==0.24.2 # Install scikit-learn
22 | # - scikit-image==0.18.3 # Install scikit-image
23 | # - opencv-python==
--------------------------------------------------------------------------------
/exps/cifar_fed.yaml:
--------------------------------------------------------------------------------
1 | task: Cifar10
2 | synthesizer: IBA
3 |
4 | random_seed: 42
5 | batch_size: 256
6 | test_batch_size: 512
7 | lr: 0.005
8 | momentum: 0.9
9 | decay: 0.0005
10 | epochs: 1500
11 | poison_epoch: 0
12 | poison_epoch_stop: 1500
13 | save_on_epochs: [] # [30, 50, 80, 100, 120, 150, 170, 200]
14 | optimizer: SGD
15 | log_interval: 100
16 |
17 | poisoning_proportion: 0.5
18 | backdoor_label: 8
19 |
20 | resume_model: saved_models/cifar_pretrain/model_last.pt.tar.epoch_200
21 |
22 | save_model: True
23 | log: True
24 |
25 | transform_train: True
26 |
27 | fl: True
28 | fl_total_participants: 100
29 | fl_no_models: 10
30 | fl_local_epochs: 2
31 | fl_poison_epochs: 5
32 | # fl_poison_epochs: 15
33 | fl_eta: 1 # 0.8`3
34 | fl_sample_dirichlet: True
35 | fl_dirichlet_alpha: 0.5
36 |
37 | fl_number_of_adversaries: 4
38 | fl_weight_scale: 1
39 | fl_adv_group_size: 2
40 | # fl_single_epoch_attack: 200
41 |
42 | attack: ModelReplace
43 | defense: 'FedAvg'
44 | fl_num_neurons: 5
45 | noise_mask_alpha: 0 # 0.5
46 | lagrange_step: 0.1
--------------------------------------------------------------------------------
/exps/gen-run-yaml-file.py:
--------------------------------------------------------------------------------
1 | import os
2 | from datetime import datetime
3 |
4 | str_write_to_file = ""
5 |
6 | def generate_exps_file(root_file='./exps/cifar_fed.yaml', name_exp = 'cifar10', EXPS_DIR="./exps/extras"):
7 | # read file as a string
8 | global str_write_to_file
9 | print(f'reading from root_file: {root_file}')
10 | str_write_to_file += f'# Dataset: {name_exp} \n**Reading default config from root_file: {root_file}**\n\n'
11 | str_write_to_file += '------------------------\n\n'
12 |
13 | fl_total_participants_choices = [100, 200]
14 | fl_no_models_choices = [10, 20]
15 | fl_dirichlet_alpha_choices = [0.5]
16 | fl_number_of_adversaries_choices = [4]
17 | fl_lr_choices = [0.05]
18 | resume_model_choices = [False, True]
19 | lis_resume_model = [
20 | 'resume_model: saved_models/tiny_64_pretrain/tiny-resnet.epoch_20',
21 | 'resume_model: saved_models/mnist_pretrain/model_last.pt.tar.epoch_10',
22 | 'resume_model: saved_models/cifar_pretrain/model_last.pt.tar.epoch_200',
23 | ]
24 |
25 | # EXPS_DIR = './exps/extras'
26 |
27 | os.makedirs(EXPS_DIR, exist_ok=True)
28 | exp_number = 0
29 |
30 | for fl_total_participants in fl_total_participants_choices:
31 | for fl_no_models in fl_no_models_choices:
32 | for fl_dirichlet_alpha in fl_dirichlet_alpha_choices:
33 | for fl_number_of_adversaries in fl_number_of_adversaries_choices:
34 | for fl_lr in fl_lr_choices:
35 | for resume_model in resume_model_choices:
36 |
37 | with open(root_file, 'r') as file :
38 | filedata = file.read()
39 |
40 | exp_number += 1
41 | str_write_to_file += f'## EXP ID: {exp_number:02d}\n'
42 | pretrained_str = 'pretrained' if resume_model else 'no_pretrained'
43 | print(f'`fl_total_participants: {fl_total_participants} fl_no_models: {fl_no_models} fl_dirichlet_alpha: {fl_dirichlet_alpha} fl_number_of_adversaries: {fl_number_of_adversaries} fl_lr: {fl_lr} resume_model: {resume_model}`\n\n')
44 | str_write_to_file += f'fl_total_participants: {fl_total_participants} fl_no_models: {fl_no_models} fl_dirichlet_alpha: {fl_dirichlet_alpha} fl_number_of_adversaries: {fl_number_of_adversaries} fl_lr: {fl_lr} resume_model: {resume_model}\n\n'
45 | filedata = filedata.replace('fl_total_participants: 100', f'fl_total_participants: {fl_total_participants}')
46 | filedata = filedata.replace('fl_no_models: 10', f'fl_no_models: {fl_no_models}')
47 | filedata = filedata.replace('fl_dirichlet_alpha: 0.5', f'fl_dirichlet_alpha: {fl_dirichlet_alpha}')
48 | filedata = filedata.replace('fl_number_of_adversaries: 4', f'fl_number_of_adversaries: {fl_number_of_adversaries}')
49 | filedata = filedata.replace('lr: 0.005', f'lr: {fl_lr}')
50 | # print(filedata)
51 |
52 | if not resume_model:
53 | for resume_model_path in lis_resume_model:
54 | if resume_model_path in filedata:
55 | filedata = filedata.replace(resume_model_path, f'resume_model: \n')
56 | # print?(filedata)
57 | # exit(0)
58 | # print(len(filedata), type(filedata))
59 | # print('------------------------')
60 | # write the file out again
61 |
62 | fn_write = f'{EXPS_DIR}/{name_exp}_fed_{fl_total_participants}_{fl_no_models}_{fl_number_of_adversaries}_{fl_dirichlet_alpha}_{fl_lr}_{pretrained_str}.yaml'
63 |
64 | if not os.path.exists(fn_write):
65 | with open(fn_write, 'w') as file:
66 | file.write(filedata)
67 |
68 | cmd = f'```bash\nCUDA_VISIBLE_DEVICES=0 python training.py --name {name_exp} --params {fn_write}\n```\n'
69 | print(cmd)
70 | str_write_to_file += f'{cmd}\n'
71 | print('------------------------')
72 | # if exp_number == 2:
73 | # exit(0)
74 |
75 |
76 | current_time = datetime.now().strftime('%Y.%b.%d')
77 |
78 | generate_exps_file(root_file='./exps/cifar_fed.yaml',
79 | name_exp = 'cifar10',
80 | EXPS_DIR=f"./exps/run_cifar10__{current_time}")
81 |
82 |
83 | generate_exps_file(root_file='./exps/mnist_fed.yaml',
84 | name_exp = 'mnist',
85 | EXPS_DIR=f"./exps/run_mnist__{current_time}")
86 |
87 | generate_exps_file(root_file='./exps/imagenet_fed.yaml',
88 | name_exp = 'tiny-imagenet',
89 | EXPS_DIR=f"./exps/run_tiny-imagenet__{current_time}")
90 |
91 | with open(f'./exps/run_exps__{current_time}.md', 'w') as file:
92 | file.write(str_write_to_file)
93 |
94 |
--------------------------------------------------------------------------------
/exps/imagenet_fed.yaml:
--------------------------------------------------------------------------------
1 | task: Imagenet
2 | synthesizer: Pattern
3 |
4 | data_path: .data/tiny-imagenet-200
5 |
6 | random_seed: 42
7 | batch_size: 256
8 | test_batch_size: 512
9 | lr: 0.001
10 | momentum: 0.9
11 | decay: 0.0005
12 | epochs: 1500
13 | poison_epoch: 0
14 | poison_epoch_stop: 1500
15 | save_on_epochs: [] # [10, 20, 30, 40, 50]
16 | optimizer: SGD
17 | log_interval: 100
18 |
19 | poisoning_proportion: 0.3
20 | backdoor_label: 8
21 |
22 | resume_model: saved_models/tiny_64_pretrain/tiny-resnet.epoch_20
23 |
24 | save_model: True
25 | log: True
26 | report_train_loss: False
27 |
28 | transform_train: True
29 |
30 | fl: True
31 | fl_no_models: 10
32 | fl_local_epochs: 2
33 | fl_poison_epochs: 10
34 | fl_total_participants: 100
35 | fl_eta: 1
36 | fl_sample_dirichlet: True
37 | fl_dirichlet_alpha: 0.5
38 |
39 | fl_number_of_adversaries: 4
40 | # fl_number_of_scapegoats: 0
41 | fl_weight_scale: 5
42 | fl_adv_group_size: 5
43 | # fl_single_epoch_attack: 10
44 |
45 | attack: ModelReplace
46 | defense: FedAvg
47 | fl_num_neurons: 100
48 | noise_mask_alpha: 0 # 0.5
49 | lagrange_step: 0.1
--------------------------------------------------------------------------------
/exps/list_exps__2023.Nov.25.md:
--------------------------------------------------------------------------------
1 | # Dataset: cifar10
2 | **Reading default config from root_file: ./exps/cifar_fed.yaml**
3 |
4 | ------------------------
5 |
6 | ## EXP ID: 01
7 | fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
8 |
9 | ```bash
10 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_100_10_4_0.5_0.05_no_pretrained.yaml
11 | ```
12 |
13 | ## EXP ID: 02
14 | fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
15 |
16 | ```bash
17 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_100_10_4_0.5_0.05_pretrained.yaml
18 | ```
19 |
20 | ## EXP ID: 03
21 | fl_total_participants: 100 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
22 |
23 | ```bash
24 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_100_20_4_0.5_0.05_no_pretrained.yaml
25 | ```
26 |
27 | ## EXP ID: 04
28 | fl_total_participants: 100 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
29 |
30 | ```bash
31 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_100_20_4_0.5_0.05_pretrained.yaml
32 | ```
33 |
34 | ## EXP ID: 05
35 | fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
36 |
37 | ```bash
38 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_200_10_4_0.5_0.05_no_pretrained.yaml
39 | ```
40 |
41 | ## EXP ID: 06
42 | fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
43 |
44 | ```bash
45 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_200_10_4_0.5_0.05_pretrained.yaml
46 | ```
47 |
48 | ## EXP ID: 07
49 | fl_total_participants: 200 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
50 |
51 | ```bash
52 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_200_20_4_0.5_0.05_no_pretrained.yaml
53 | ```
54 |
55 | ## EXP ID: 08
56 | fl_total_participants: 200 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
57 |
58 | ```bash
59 | CUDA_VISIBLE_DEVICES=0 python training.py --name cifar10 --params ./exps/run_cifar10__2023.Nov.25/cifar10_fed_200_20_4_0.5_0.05_pretrained.yaml
60 | ```
61 |
62 | # Dataset: mnist
63 | **Reading default config from root_file: ./exps/mnist_fed.yaml**
64 |
65 | ------------------------
66 |
67 | ## EXP ID: 01
68 | fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
69 |
70 | ```bash
71 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_100_10_4_0.5_0.05_no_pretrained.yaml
72 | ```
73 |
74 | ## EXP ID: 02
75 | fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
76 |
77 | ```bash
78 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_100_10_4_0.5_0.05_pretrained.yaml
79 | ```
80 |
81 | ## EXP ID: 03
82 | fl_total_participants: 100 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
83 |
84 | ```bash
85 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_100_20_4_0.5_0.05_no_pretrained.yaml
86 | ```
87 |
88 | ## EXP ID: 04
89 | fl_total_participants: 100 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
90 |
91 | ```bash
92 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_100_20_4_0.5_0.05_pretrained.yaml
93 | ```
94 |
95 | ## EXP ID: 05
96 | fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
97 |
98 | ```bash
99 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_200_10_4_0.5_0.05_no_pretrained.yaml
100 | ```
101 |
102 | ## EXP ID: 06
103 | fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
104 |
105 | ```bash
106 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_200_10_4_0.5_0.05_pretrained.yaml
107 | ```
108 |
109 | ## EXP ID: 07
110 | fl_total_participants: 200 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
111 |
112 | ```bash
113 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_200_20_4_0.5_0.05_no_pretrained.yaml
114 | ```
115 |
116 | ## EXP ID: 08
117 | fl_total_participants: 200 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
118 |
119 | ```bash
120 | CUDA_VISIBLE_DEVICES=0 python training.py --name mnist --params ./exps/run_mnist__2023.Nov.25/mnist_fed_200_20_4_0.5_0.05_pretrained.yaml
121 | ```
122 |
123 | # Dataset: tiny-imagenet
124 | **Reading default config from root_file: ./exps/imagenet_fed.yaml**
125 |
126 | ------------------------
127 |
128 | ## EXP ID: 01
129 | fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
130 |
131 | ```bash
132 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_100_10_4_0.5_0.05_no_pretrained.yaml
133 | ```
134 |
135 | ## EXP ID: 02
136 | fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
137 |
138 | ```bash
139 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_100_10_4_0.5_0.05_pretrained.yaml
140 | ```
141 |
142 | ## EXP ID: 03
143 | fl_total_participants: 100 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
144 |
145 | ```bash
146 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_100_20_4_0.5_0.05_no_pretrained.yaml
147 | ```
148 |
149 | ## EXP ID: 04
150 | fl_total_participants: 100 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
151 |
152 | ```bash
153 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_100_20_4_0.5_0.05_pretrained.yaml
154 | ```
155 |
156 | ## EXP ID: 05
157 | fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
158 |
159 | ```bash
160 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_200_10_4_0.5_0.05_no_pretrained.yaml
161 | ```
162 |
163 | ## EXP ID: 06
164 | fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
165 |
166 | ```bash
167 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_200_10_4_0.5_0.05_pretrained.yaml
168 | ```
169 |
170 | ## EXP ID: 07
171 | fl_total_participants: 200 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: False
172 |
173 | ```bash
174 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_200_20_4_0.5_0.05_no_pretrained.yaml
175 | ```
176 |
177 | ## EXP ID: 08
178 | fl_total_participants: 200 fl_no_models: 20 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05 resume_model: True
179 |
180 | ```bash
181 | CUDA_VISIBLE_DEVICES=0 python training.py --name tiny-imagenet --params ./exps/run_tiny-imagenet__2023.Nov.25/tiny-imagenet_fed_200_20_4_0.5_0.05_pretrained.yaml
182 | ```
183 |
184 |
--------------------------------------------------------------------------------
/exps/mnist_fed.yaml:
--------------------------------------------------------------------------------
1 | task: MNIST
2 | synthesizer: Pattern
3 |
4 | random_seed: 42
5 | batch_size: 256
6 | test_batch_size: 512
7 | lr: 0.01
8 | momentum: 0.9
9 | decay: 0.0005
10 | epochs: 1500
11 | poison_epoch: 0
12 | poison_epoch_stop: 1500
13 | save_on_epochs: [] # [10, 20, 30, 40, 50]
14 | optimizer: SGD
15 | log_interval: 100
16 |
17 | poisoning_proportion: 1.0
18 | backdoor_label: 8
19 |
20 | resume_model: saved_models/mnist_pretrain/model_last.pt.tar.epoch_10
21 |
22 | save_model: True
23 | log: True
24 | report_train_loss: False
25 |
26 | transform_train: True
27 |
28 | fl: True
29 | fl_no_models: 10
30 | fl_local_epochs: 2
31 | fl_poison_epochs: 5
32 | fl_total_participants: 100
33 | fl_eta: 1
34 | fl_sample_dirichlet: True
35 | fl_dirichlet_alpha: 0.5
36 |
37 | fl_number_of_adversaries: 4
38 | fl_weight_scale: 5
39 | fl_adv_group_size: 2
40 | # fl_single_epoch_attack: 20
41 |
42 | attack: ModelReplace
43 | defense: FedAvg
44 | fl_num_neurons: 8
45 | noise_mask_alpha: 0 # 0.5
46 | lagrange_step: 0.1
--------------------------------------------------------------------------------
/helper.py:
--------------------------------------------------------------------------------
1 | import importlib
2 | import logging
3 | import os
4 | import random
5 | from shutil import copyfile
6 | from collections import defaultdict
7 |
8 | import numpy as np
9 | import torch
10 | import yaml
11 |
12 | from attacks.attack import Attack
13 | # from defenses.fedavg import FedAvg as Defense
14 | from synthesizers.synthesizer import Synthesizer
15 | from tasks.task import Task
16 | from utils.parameters import Params
17 | from utils.utils import create_logger
18 | import pandas as pd
19 | logger = logging.getLogger('logger')
20 |
21 |
22 | class Helper:
23 | params: Params = None
24 | task: Task = None
25 | synthesizer: Synthesizer = None
26 | # defense: Defense = None
27 | attack: Attack = None
28 |
29 | def __init__(self, params):
30 |
31 | self.params = Params(**params)
32 | self.times = {'backward': list(), 'forward': list(), 'step': list(),
33 | 'scales': list(), 'total': list(), 'poison': list()}
34 |
35 | if self.params.random_seed is not None:
36 | self.fix_random(self.params.random_seed)
37 |
38 | self.make_folders()
39 |
40 | self.make_task()
41 |
42 | self.make_synthesizer()
43 |
44 | self.make_attack()
45 |
46 | self.make_defense()
47 |
48 | self.accuracy = [[],[]]
49 |
50 | self.best_loss = float('inf')
51 |
52 | def make_task(self):
53 | name_lower = self.params.task.lower()
54 | name_cap = self.params.task
55 | module_name = f'tasks.{name_lower}_task'
56 | path = f'tasks/{name_lower}_task.py'
57 | logger.info(f'make task: {module_name} name_cap: {name_cap} path: {path}')
58 | try:
59 | task_module = importlib.import_module(module_name)
60 | task_class = getattr(task_module, f'{name_cap}Task')
61 | except (ModuleNotFoundError, AttributeError):
62 | raise ModuleNotFoundError(f'Your task: {self.params.task} should '
63 | f'be defined as a class '
64 | f'{name_cap}'
65 | f'Task in {path}')
66 | self.task = task_class(self.params)
67 |
68 | def make_synthesizer(self):
69 | name_lower = self.params.synthesizer.lower()
70 | name_cap = self.params.synthesizer
71 | module_name = f'synthesizers.{name_lower}_synthesizer'
72 | logger.info(f'make synthesizer: {module_name} name_cap: {name_cap}')
73 | try:
74 | synthesizer_module = importlib.import_module(module_name)
75 | task_class = getattr(synthesizer_module, f'{name_cap}Synthesizer')
76 | except (ModuleNotFoundError, AttributeError):
77 | raise ModuleNotFoundError(
78 | f'The synthesizer: {self.params.synthesizer}'
79 | f' should be defined as a class '
80 | f'{name_cap}Synthesizer in '
81 | f'synthesizers/{name_lower}_synthesizer.py')
82 | self.synthesizer = task_class(self.task)
83 |
84 | def make_attack(self):
85 | name_lower = self.params.attack.lower()
86 | name_cap = self.params.attack
87 | module_name = f'attacks.{name_lower}'
88 | logger.info(f'make attack: {module_name} name_cap: {name_cap}')
89 | try:
90 | attack_module = importlib.import_module(module_name)
91 | attack_class = getattr(attack_module, f'{name_cap}')
92 | except (ModuleNotFoundError, AttributeError):
93 | raise ModuleNotFoundError(f'Your attack: {self.params.attack} should '
94 | f'be defined either ThrDFed (3DFed) or \
95 | ModelReplace (Model Replacement Attack)')
96 | self.attack = attack_class(self.params, self.synthesizer)
97 |
98 | def make_defense(self):
99 | name_lower = self.params.defense.lower()
100 | name_cap = self.params.defense
101 | module_name = f'defenses.{name_lower}'
102 | try:
103 | defense_module = importlib.import_module(module_name)
104 | defense_class = getattr(defense_module, f'{name_cap}')
105 | except (ModuleNotFoundError, AttributeError):
106 | raise ModuleNotFoundError(f'Your defense: {self.params.defense} should '
107 | f'be one of the follow: FLAME, Deepsight, \
108 | Foolsgold, FLDetector, RFLBAT, FedAvg')
109 | self.defense = defense_class(self.params)
110 |
111 | def make_folders(self):
112 | log = create_logger()
113 | if self.params.log:
114 | os.makedirs(self.params.folder_path, exist_ok=True)
115 |
116 | fh = logging.FileHandler(
117 | filename=f'{self.params.folder_path}/log.txt')
118 | formatter = logging.Formatter('%(asctime)s - %(filename)s - Line:%(lineno)d - %(levelname)-8s - %(message)s')
119 |
120 | fh.setFormatter(formatter)
121 | log.addHandler(fh)
122 |
123 | with open(f'{self.params.folder_path}/params.yaml.txt', 'w') as f:
124 | yaml.dump(self.params, f)
125 | # log.info(f"Creating folder {self.params.folder_path}")
126 |
127 |
128 | def save_model(self, model=None, epoch=0, val_loss=0):
129 |
130 | if self.params.save_model:
131 | logger.info(f"Saving model to {self.params.folder_path}.")
132 | model_name = '{0}/model_last.pt.tar'.format(self.params.folder_path)
133 | saved_dict = {'state_dict': model.state_dict(),
134 | 'epoch': epoch,
135 | 'lr': self.params.lr,
136 | 'params_dict': self.params.to_dict()}
137 | self.save_checkpoint(saved_dict, False, model_name)
138 |
139 | if epoch in self.params.save_on_epochs:
140 | logger.info(f'Saving model on epoch {epoch}')
141 | self.save_checkpoint(saved_dict, False,
142 | filename=f'{self.params.folder_path}/model_epoch_{epoch}.pt.tar')
143 | if val_loss < self.best_loss:
144 | self.save_checkpoint(saved_dict, False, f'{model_name}_best')
145 | self.best_loss = val_loss
146 |
147 | logger.info(f"Done saving model to {self.params.folder_path}.")
148 | def save_update(self, model=None, userID = 0):
149 | folderpath = '{0}/saved_updates'.format(self.params.folder_path)
150 | # logger.info(f"Saving update to {folderpath}.")
151 |
152 | # if not os.path.exists(folderpath):
153 | # os.makedirs(folderpath)]
154 | # import IPython; IPython.embed()
155 | # exit(0)
156 | os.makedirs(folderpath, exist_ok=True)
157 | update_name = '{0}/update_{1}.pth'.format(folderpath, userID)
158 | torch.save(model, update_name)
159 | # logger.info(f"Saving update to {update_name}.")
160 |
161 | def remove_update(self):
162 | for i in range(self.params.fl_total_participants):
163 | file_name = '{0}/saved_updates/update_{1}.pth'.format(self.params.folder_path, i)
164 | if os.path.exists(file_name):
165 | os.remove(file_name)
166 | os.rmdir('{0}/saved_updates'.format(self.params.folder_path))
167 | if self.params.defense == 'Foolsgold':
168 | for i in range(self.params.fl_total_participants):
169 | file_name = '{0}/foolsgold/history_{1}.pth'.format(self.params.folder_path, i)
170 | if os.path.exists(file_name):
171 | os.remove(file_name)
172 | os.rmdir('{0}/foolsgold'.format(self.params.folder_path))
173 |
174 | def record_accuracy(self, main_acc, backdoor_acc, epoch):
175 | self.accuracy[0].append(main_acc)
176 | self.accuracy[1].append(backdoor_acc)
177 | name = ['main', 'backdoor']
178 | acc_frame = pd.DataFrame(columns=name, data=zip(*self.accuracy),
179 | index=range(self.params.start_epoch, epoch+1))
180 | filepath = f"{self.params.folder_path}/accuracy.csv"
181 | acc_frame.to_csv(filepath)
182 | logger.info(f"Saving accuracy record to {filepath}")
183 |
184 | def set_bn_eval(m):
185 | classname = m.__class__.__name__
186 | if classname.find('BatchNorm') != -1:
187 | m.eval()
188 |
189 | def save_checkpoint(self, state, is_best, filename='checkpoint.pth.tar'):
190 | if not self.params.save_model:
191 | return False
192 | torch.save(state, filename)
193 |
194 | if is_best:
195 | copyfile(filename, 'model_best.pth.tar')
196 |
197 | @staticmethod
198 | def fix_random(seed=1):
199 | from torch.backends import cudnn
200 |
201 | logger.warning('Setting random_seed seed for reproducible results.')
202 | random.seed(seed)
203 | torch.manual_seed(seed)
204 | torch.cuda.manual_seed_all(seed)
205 | cudnn.deterministic = False
206 | cudnn.enabled = True
207 | cudnn.benchmark = True
208 | np.random.seed(seed)
209 |
210 | return True
211 |
--------------------------------------------------------------------------------
/markdown-explanation/FedMLSec.md:
--------------------------------------------------------------------------------
1 | Table of Contents
2 | -----------------
3 |
4 |
5 | # Setup Python Environment
6 | - Set the name of environment in both files: `environment.yml` and `Makefile`. The default name is `aba`, aka "all backdoor attacks" and then run following commands:
7 | ```
8 | make install
9 | ```
10 |
11 | # Guideline for custome training (Atk vs Def)
12 |
13 | ## Data Customization
14 | - [Data Loader](https://github.com/FedML-AI/FedML/blob/master/doc/en/simulation/user_guide/data_loader_customization.md)
15 |
16 | ## Datasets and Models Customization
17 | - [Datasets and Models](https://github.com/FedML-AI/FedML/blob/master/doc/en/simulation/user_guide/datasets-and-models.md#datasets-and-models)
18 | - [FedML Data](https://github.com/FedML-AI/FedML/tree/master/python/fedml/data)
19 |
20 | ## Attack Customization
21 | ### [Model Replacement Attack (MRA)](https://arxiv.org/pdf/1807.00459.pdf)
22 | - [Code](https://github.com/ebagdasa/backdoors101) is in `fedlearn-backdoor-attacks/3DFed/attacks/modelreplace.py`
23 | 
24 |
25 |
26 | ## Defense Customization
27 |
28 | ## Training Customization
29 |
30 | ## Evaluation Customization
31 |
32 | ## Visualization Customization
33 |
34 | ## Result Customization
35 |
36 |
37 | ## Flow of the code:
38 | ### [3DFed (ThrDFed) - S&P'23](https://github.com/haoyangliASTAPLE/3DFed)
39 | - Init data, attack, defense method in `fedlearn-backdoor-attacks/3DFed/helper.py`
40 | - Run fl round in `fedlearn-backdoor-attacks/3DFed/training.py`
41 | - Sample user for round (fl_no_models/ fl_total_participants)
42 | - Init FLUser (user_id, compromised, train_loader)
43 | - Single epoch attack: user_id = 0 is attacker, compromised = True
44 | - Otherwise: check if epoch in attack_epochs, if yes, check list adversaries
45 | - Training for each user
46 | - If user is attacker, run attack for only user_id = 0 [missing other attackers], that means training models on poisoned data
47 | - Otherwise, run defense for all users
48 | - Perform Attack and aggregate results
49 | - check update_global_model with weight: 1/total_participants (self.params.fl_eta / self.params.fl_total_participants)
50 | - Limitation: Currently, dump fl_no_models (set = fl_total_participants) models in each round into file, only one attacker is supported (other attackers is duplicated from attacker 0)
51 | ### [DBA - ICLR'20 (Distributed Backdoor Attack)](https://github.com/AI-secure/DBA)
52 | - List of adversarial clients in config file: adversary_list: [17, 33, 77, 11]
53 | - no_models: K = 10
54 | - number_of_total_participants: N = 100
55 | - agent_name_keys: id of client that participate in each round (K/ N)
56 | - agent_name_keys = benign + adv (check adv first, then benign); set epoch attack for each client in .yaml file
57 | In each communication round:
58 | - Check the trigger is global pattern or local pattern
59 | - Get poison batch data from adversary_index (-1, 0, 1, 2, 3)
60 |
61 |
62 | ### [Attack of the Tails: Yes, You Really Can Backdoor Federated Learning - NeurIPS'20](https://github.com/ksreenivasan/OOD_Federated_Learning)
63 |
64 | Load poisoned dataset (in `simulated_averaging.py`):
65 | ```python
66 | poisoned_train_loader, vanilla_test_loader, targetted_task_test_loader, num_dps_poisoned_dataset, clean_train_loader = load_poisoned_dataset(args=args)
67 | ```
68 |
69 | Two modes (fixed-freq mode or fixed-pool mode):
70 | ```python
71 | Intotal: N (num_nets) clients, K (part_nets_per_round) clients are participating in each round
72 |
73 | - Fixed-freq Attack (`FrequencyFederatedLearningTrainer`):
74 | - "attacking_fl_rounds":[i for i in range(1, args.fl_round + 1) if (i-1)%10 == 0]
75 | - poison_type in ["ardis": ["normal-case", "almost-edge-case", "edge-case"], "southwest"]
76 | - Training in each communication round:
77 | - if round in attacking_fl_rounds, run attack
78 | - One attacker, and K-1 benign clients
79 | - For attacker, run attack in `adversarial_local_training_period` epochs
80 | - data_loader = `poisoned_train_loader`
81 | - Check defense_technique in ["krum", "multi-krum"]: eps=self.eps*self.args_gamma**(flr-1); else eps=self.eps
82 | - Test on `vanilla_test_loader` and `targetted_task_test_loader`
83 | - Check model_replacement scale models with ratio: total_num_dps_per_round/num_dps_poisoned_dataset
84 | - Print norm before and after scale
85 | - For benign clients, run normal training in `local_training_period` epochs
86 | - data_loader = `clean_train_loader`
87 | - otherwise
88 | - run normal training with K benign clients
89 | - Aggregate models
90 | - using
91 | - TODO: check prox-attack
92 |
93 | - test function:
94 | - check dataset:
95 | - dataset in ["mnist", "emnist"]:
96 | - target_class = 7
97 | - task in ["raw-task", "targeted"]
98 | - poison_type in ["ardis"]
99 | - dataset in ["cifar10"]:
100 | - target_class = 2 for greencar in ("howto", "greencar-neo"),
101 | - target_class = 9 for southwest
102 | - TODO: check backdoor acc calculation (line 248-253)
103 |
104 | - Fixed-pool Attack:
105 | - In each round of communication, randomly select K clients to participate in the training
106 | - selected_attackers from "__attacker_pool" (numpy random choice attacker_pool_size/ num_nets)
107 | - selected_benign_clients
108 | All attackers are sharing the same poisoned dataset
109 | - Training the same as Fixed-freq Attack for each attacker
110 |
111 | - defense_technique in ["no-defense", "norm-clipping", "weak-dp", "krum", "multi-krum", "rfa"]
112 | ```
113 | For more details, check `FedML` [dataset](https://github.com/FedML-AI/FedML/tree/master/python/fedml/data/edge_case_examples)
114 |
115 | ### [How To Backdoor Federated Learning (AISTATS'20)](https://github.com/ebagdasa/backdoors101)
116 | - Generate trigger in file `synthesizers/pattern_synthesizer.py`. The 2 images below are the pattern of the trigger and image with trigger.
117 |
119 | - All the original images and trigger images are normalized to [mean, std] of the original dataset
120 |
121 |
122 |
124 |
126 |
{level}: {message}
\n"
72 | # return formatted
73 |
74 | # # Create a FileHandler and set the HTML formatter
75 | # file_handler = FileHandler('logs.html', mode='a', encoding='utf-8')
76 | # html_formatter = HTMLFormatter()
77 | # file_handler.setFormatter(html_formatter)
78 |
79 | # # Add the FileHandler to the logger
80 | # logger.addHandler(file_handler)
81 |
82 |
83 | # Log messages
84 | # logger.debug("This is a debug message")
85 | # logger.info("This is an info message")
86 | # logger.warning("This is a warning message")
87 | # logger.error("This is an error message")
88 | # logger.critical("This is a critical message")
89 |
90 |
91 | # # write logger to html file
92 | # import numpy as np
93 | # from PIL import Image
94 | # from torchvision import transforms
95 | # trans = transforms.Compose([transforms.ToTensor()])
96 | # img = np.random.randint(0, 255, size=(3, 224, 224), dtype=np.uint8)
97 |
98 | # demo_img = trans(img)
99 |
100 | # demo_array = np.moveaxis(demo_img.numpy()*255, 0, -1)
101 | # print(Image.fromarray(demo_array.astype(np.uint8)))
102 |
103 | # from matplotlib import pyplot as plt
104 | # plt.imshow(img)
105 | # plt.show()
--------------------------------------------------------------------------------
/test-lib/test-write-file.ipynb:
--------------------------------------------------------------------------------
1 | {
2 | "cells": [
3 | {
4 | "cell_type": "code",
5 | "execution_count": 13,
6 | "metadata": {},
7 | "outputs": [
8 | {
9 | "name": "stdout",
10 | "output_type": "stream",
11 | "text": [
12 | "840 \n",
13 | "fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05\n",
14 | "python training.py --name cifar10 --params /home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_cifar10__2023.Nov.24/cifar10_fed_100_10_4_0.5_0.05.yaml\n",
15 | "------------------------\n",
16 | "fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05\n",
17 | "python training.py --name cifar10 --params /home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_cifar10__2023.Nov.24/cifar10_fed_200_10_4_0.5_0.05.yaml\n",
18 | "------------------------\n",
19 | "796 \n",
20 | "fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05\n",
21 | "python training.py --name mnist --params /home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_mnist__2023.Nov.24/mnist_fed_100_10_4_0.5_0.05.yaml\n",
22 | "------------------------\n",
23 | "fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05\n",
24 | "python training.py --name mnist --params /home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_mnist__2023.Nov.24/mnist_fed_200_10_4_0.5_0.05.yaml\n",
25 | "------------------------\n",
26 | "863 \n",
27 | "fl_total_participants: 100 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05\n",
28 | "python training.py --name tiny-imagenet --params /home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_tiny-imagenet__2023.Nov.24/tiny-imagenet_fed_100_10_4_0.5_0.05.yaml\n",
29 | "------------------------\n",
30 | "fl_total_participants: 200 fl_no_models: 10 fl_dirichlet_alpha: 0.5 fl_number_of_adversaries: 4 fl_lr: 0.05\n",
31 | "python training.py --name tiny-imagenet --params /home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_tiny-imagenet__2023.Nov.24/tiny-imagenet_fed_200_10_4_0.5_0.05.yaml\n",
32 | "------------------------\n"
33 | ]
34 | }
35 | ],
36 | "source": [
37 | "import os\n",
38 | "from datetime import datetime\n",
39 | "\n",
40 | "\n",
41 | "def generate_exps_file(root_file='/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/cifar_fed.yaml', name_exp = 'cifar10', EXPS_DIR=\"/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/extras\"):\n",
42 | " # read file as a string\n",
43 | " print(f'reading from root_file: {root_file}')\n",
44 | " with open(root_file, 'r') as file :\n",
45 | " filedata = file.read()\n",
46 | " fl_total_participants_choices = [100, 200]\n",
47 | " fl_no_models_choices = [10]\n",
48 | " fl_dirichlet_alpha_choices = [0.5]\n",
49 | " fl_number_of_adversaries_choices = [4]\n",
50 | " fl_lr_choices = [0.05]\n",
51 | " # EXPS_DIR = '/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/extras'\n",
52 | " \n",
53 | " os.makedirs(EXPS_DIR, exist_ok=True)\n",
54 | "\n",
55 | " for fl_total_participants in fl_total_participants_choices:\n",
56 | " for fl_no_models in fl_no_models_choices:\n",
57 | " for fl_dirichlet_alpha in fl_dirichlet_alpha_choices:\n",
58 | " for fl_number_of_adversaries in fl_number_of_adversaries_choices:\n",
59 | " for fl_lr in fl_lr_choices:\n",
60 | " print(f'fl_total_participants: {fl_total_participants} fl_no_models: {fl_no_models} fl_dirichlet_alpha: {fl_dirichlet_alpha} fl_number_of_adversaries: {fl_number_of_adversaries} fl_lr: {fl_lr}')\n",
61 | " filedata = filedata.replace('fl_total_participants: 100', f'fl_total_participants: {fl_total_participants}')\n",
62 | " filedata = filedata.replace('fl_no_models: 10', f'fl_no_models: {fl_no_models}')\n",
63 | " filedata = filedata.replace('fl_dirichlet_alpha: 0.5', f'fl_dirichlet_alpha: {fl_dirichlet_alpha}')\n",
64 | " filedata = filedata.replace('fl_number_of_adversaries: 4', f'fl_number_of_adversaries: {fl_number_of_adversaries}')\n",
65 | " filedata = filedata.replace('lr: 0.005', f'lr: {fl_lr}')\n",
66 | " # print(len(filedata), type(filedata)) \n",
67 | " # print('------------------------')\n",
68 | " # write the file out again\n",
69 | " fn_write = f'{EXPS_DIR}/{name_exp}_fed_{fl_total_participants}_{fl_no_models}_{fl_number_of_adversaries}_{fl_dirichlet_alpha}_{fl_lr}.yaml'\n",
70 | " if not os.path.exists(fn_write):\n",
71 | " with open(fn_write, 'w') as file:\n",
72 | " file.write(filedata)\n",
73 | " \n",
74 | " cmd = f'python training.py --name {name_exp} --params {fn_write}'\n",
75 | " print(cmd)\n",
76 | " print('------------------------')\n",
77 | "\n",
78 | "current_time = datetime.now().strftime('%Y.%b.%d')\n",
79 | "\n",
80 | "generate_exps_file(root_file='/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/cifar_fed.yaml', \n",
81 | " name_exp = 'cifar10', \n",
82 | " EXPS_DIR=f\"/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_cifar10__{current_time}\")\n",
83 | "\n",
84 | "\n",
85 | "generate_exps_file(root_file='/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/mnist_fed.yaml', \n",
86 | " name_exp = 'mnist', \n",
87 | " EXPS_DIR=f\"/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_mnist__{current_time}\")\n",
88 | "\n",
89 | "generate_exps_file(root_file='/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/imagenet_fed.yaml', \n",
90 | " name_exp = 'tiny-imagenet', \n",
91 | " EXPS_DIR=f\"/home/vishc2/tuannm/fedlearn-backdoor-attacks/exps/run_tiny-imagenet__{current_time}\")\n",
92 | "\n"
93 | ]
94 | },
95 | {
96 | "cell_type": "code",
97 | "execution_count": null,
98 | "metadata": {},
99 | "outputs": [],
100 | "source": []
101 | }
102 | ],
103 | "metadata": {
104 | "kernelspec": {
105 | "display_name": "cardio",
106 | "language": "python",
107 | "name": "python3"
108 | },
109 | "language_info": {
110 | "codemirror_mode": {
111 | "name": "ipython",
112 | "version": 3
113 | },
114 | "file_extension": ".py",
115 | "mimetype": "text/x-python",
116 | "name": "python",
117 | "nbconvert_exporter": "python",
118 | "pygments_lexer": "ipython3",
119 | "version": "3.7.13"
120 | },
121 | "orig_nbformat": 4
122 | },
123 | "nbformat": 4,
124 | "nbformat_minor": 2
125 | }
126 |
--------------------------------------------------------------------------------
/test-lib/test.log:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mtuann/fedlearn-backdoor-attacks/b025e763558d1e3d6a5872be7d158e8c157e7bf1/test-lib/test.log
--------------------------------------------------------------------------------
/training.py:
--------------------------------------------------------------------------------
1 | import argparse
2 | import yaml
3 | from helper import Helper
4 | from datetime import datetime
5 | from tqdm import tqdm
6 | import wandb
7 |
8 | from utils.utils import *
9 | logger = logging.getLogger('logger')
10 |
11 | def train(hlpr: Helper, epoch, model, optimizer, train_loader, attack=False, global_model=None):
12 | criterion = hlpr.task.criterion
13 | model.train()
14 | # for i, data in tqdm(enumerate(train_loader)):
15 | for i, data in enumerate(train_loader):
16 | batch = hlpr.task.get_batch(i, data)
17 | model.zero_grad()
18 | loss = hlpr.attack.compute_blind_loss(model, criterion, batch, attack, global_model)
19 | loss.backward()
20 | optimizer.step()
21 | # import IPython; IPython.embed()
22 | # exit(0)
23 | # print(f"Epoch {epoch} batch {i} loss {loss.item()}")
24 |
25 | if i == hlpr.params.max_batch_id:
26 | break
27 | # metric = hlpr.task.report_metrics(epoch,
28 | # prefix=f'Backdoor {str(backdoor):5s}. Epoch: ')
29 | return
30 |
31 | def test(hlpr: Helper, epoch, backdoor=False, model=None):
32 | if model is None:
33 | model = hlpr.task.model
34 | model.eval()
35 | hlpr.task.reset_metrics()
36 | with torch.no_grad():
37 | for i, data in tqdm(enumerate(hlpr.task.test_loader)):
38 | batch = hlpr.task.get_batch(i, data)
39 | if backdoor:
40 | batch = hlpr.attack.synthesizer.make_backdoor_batch(batch,
41 | test=True,
42 | attack=True)
43 |
44 | outputs = model(batch.inputs)
45 | hlpr.task.accumulate_metrics(outputs=outputs, labels=batch.labels)
46 | metric = hlpr.task.report_metrics(epoch,
47 | prefix=f'Backdoor {str(backdoor):5s}. Epoch: ')
48 | return metric
49 |
50 | def run_fl_round(hlpr: Helper, epoch):
51 | global_model = hlpr.task.model
52 | local_model = hlpr.task.local_model
53 | round_participants = hlpr.task.sample_users_for_round(epoch)
54 |
55 | weight_accumulator = hlpr.task.get_empty_accumulator()
56 |
57 | logger.info(f"Round epoch {epoch} with participants: {[user.user_id for user in round_participants]} and weight: {hlpr.params.fl_weight_contribution}")
58 | # log number of sample per user
59 | logger.info(f"Round epoch {epoch} with participants sample size: {[user.number_of_samples for user in round_participants]} and sum: {sum([user.number_of_samples for user in round_participants])}")
60 |
61 | for user in tqdm(round_participants):
62 | hlpr.task.copy_params(global_model, local_model)
63 | optimizer = hlpr.task.make_optimizer(local_model)
64 | if user.compromised:
65 | # if not user.user_id == 0:
66 | # continue
67 |
68 | logger.warning(f"Compromised user: {user.user_id} in run_fl_round {epoch}")
69 | for local_epoch in tqdm(range(hlpr.params.fl_poison_epochs)): # fl_poison_epochs)):
70 | train(hlpr, local_epoch, local_model, optimizer,
71 | user.train_loader, attack=True, global_model=global_model)
72 |
73 | else:
74 | logger.warning(f"Non-compromised user: {user.user_id} in run_fl_round {epoch}")
75 | for local_epoch in range(hlpr.params.fl_local_epochs):
76 | train(hlpr, local_epoch, local_model, optimizer,
77 | user.train_loader, attack=False)
78 |
79 | local_update = hlpr.attack.get_fl_update(local_model, global_model)
80 |
81 | # hlpr.save_update(model=local_update, userID=user.user_id)
82 | # Do not save model to files, save it as a variable
83 | hlpr.task.adding_local_updated_model(local_update = local_update, user_id=user.user_id)
84 |
85 | # if user.compromised:
86 | # hlpr.attack.perform_attack(global_model, user, epoch)
87 | # hlpr.attack.local_dataset = deepcopy(user.train_loader)
88 |
89 | hlpr.defense.aggr(weight_accumulator, global_model, )
90 | # logger.info(f"Round {epoch} update global model")
91 |
92 | hlpr.task.update_global_model(weight_accumulator, global_model)
93 |
94 | def run(hlpr: Helper):
95 | metric = test(hlpr, -1, backdoor=False)
96 | logger.info(f"Before training main metric: {metric}")
97 |
98 | for epoch in range(hlpr.params.start_epoch,
99 | hlpr.params.epochs + 1):
100 | logger.info(f"Communication round {epoch}")
101 | run_fl_round(hlpr, epoch)
102 | metric = test(hlpr, epoch, backdoor=False)
103 | main_metric = hlpr.task.get_metrics()
104 |
105 | # logger.info(f"Epoch {epoch} main metric: {metric}")
106 | metric_bd = test(hlpr, epoch, backdoor=True)
107 | backdoor_metric = hlpr.task.get_metrics()
108 |
109 |
110 | wandb.log({'main_acc': main_metric['accuracy'], 'main_loss': main_metric['loss'],
111 | 'backdoor_acc': backdoor_metric['accuracy'], 'backdoor_loss': backdoor_metric['loss']},
112 | step=epoch)
113 | logger.info(f"Epoch {epoch} backdoor metric: {metric}")
114 |
115 | # hlpr.record_accuracy(metric, test(hlpr, epoch, backdoor=True), epoch)
116 |
117 | hlpr.save_model(hlpr.task.model, epoch, metric)
118 |
119 | def generate_exps_file(root_file='cifar_fed.yaml'):
120 | # read file as a string
121 | with open(root_file, 'r') as file :
122 | filedata = file.read()
123 | print(len(filedata), type(filedata))
124 | pass
125 |
126 | if __name__ == '__main__':
127 | parser = argparse.ArgumentParser(description='Backdoors')
128 | parser.add_argument('--params', dest='params', required=True)
129 | parser.add_argument('--name', dest='name', required=True)
130 | # python training.py --name mnist --params exps/mnist_fed.yaml
131 | # python training.py --name tiny-imagenet-200 --params exps/imagenet_fed.yaml
132 | # python training.py --name cifar10 --params exps/cifar_fed.yaml
133 | args = parser.parse_args()
134 | print(args)
135 | with open(args.params) as f:
136 | params = yaml.load(f, Loader=yaml.FullLoader)
137 | # print(params)
138 | # import IPython; IPython.embed()
139 | pretrained_str = 'pretrained' if params['resume_model'] else 'no_pretrained'
140 |
141 | params['name'] = f'vishc_{args.name}.{params["synthesizer"]}.{params["fl_total_participants"]}_{params["fl_no_models"]}_{params["fl_number_of_adversaries"]}_{params["fl_dirichlet_alpha"]}_{params["lr"]}_{pretrained_str}'
142 |
143 | params['current_time'] = datetime.now().strftime('%Y.%b.%d_%H.%M.%S')
144 | print(params)
145 | # exit(0)
146 | helper = Helper(params)
147 |
148 | # logger = create_logger()
149 |
150 | # logger.info(create_table(params))
151 |
152 | wandb.init(project="benchmark-backdoor-fl", entity="mtuann", name=f"{params['name']}-{params['current_time']}")
153 | try:
154 | run(helper)
155 | except Exception as e:
156 | print(e)
157 |
158 |
--------------------------------------------------------------------------------
/utils/parameters.py:
--------------------------------------------------------------------------------
1 | from collections import defaultdict
2 | from dataclasses import dataclass, asdict
3 | from typing import List, Dict
4 | import logging
5 | import torch
6 | logger = logging.getLogger('logger')
7 |
8 | @dataclass
9 | class Params:
10 |
11 | # Corresponds to the class module: tasks.mnist_task.MNISTTask
12 | # See other tasks in the task folder.
13 | task: str = 'MNIST'
14 | num_classes = 10 #TODO: update num_classes for TinyImageNet
15 |
16 | current_time: str = None
17 | name: str = None
18 | random_seed: int = None
19 | device: str = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
20 | # training params
21 | start_epoch: int = 1
22 | epochs: int = None
23 | poison_epoch: int = None
24 | poison_epoch_stop: int = None
25 | log_interval: int = 1000
26 |
27 | # model arch is usually defined by the task
28 | resume_model: str = None
29 | lr: float = None
30 | decay: float = None
31 | momentum: float = None
32 | optimizer: str = None
33 | # data
34 | data_path: str = '.data/'
35 | batch_size: int = 64
36 | test_batch_size: int = 100
37 | # Do not apply transformations to the training images.
38 | transform_train: bool = True
39 | # For large datasets stop training earlier.
40 | max_batch_id: int = None
41 | # No need to set, updated by the Task class.
42 | input_shape = None
43 |
44 | # attack params
45 | backdoor: bool = False
46 | backdoor_label: int = 8
47 | poisoning_proportion: float = 1.0 # backdoors proportion in backdoor loss
48 | synthesizer: str = 'pattern'
49 | backdoor_dynamic_position: bool = False
50 |
51 | # factors to balance losses
52 | fixed_scales: Dict[str, float] = None
53 |
54 | # optimizations:
55 | alternating_attack: float = None
56 | clip_batch: float = None
57 | # Disable BatchNorm and Dropout
58 | switch_to_eval: float = None
59 |
60 | # logging
61 | report_train_loss: bool = True
62 | log: bool = False
63 | save_model: bool = None
64 | save_on_epochs: List[int] = None
65 | save_scale_values: bool = False
66 | print_memory_consumption: bool = False
67 | save_timing: bool = False
68 | timing_data = None
69 |
70 | # Temporary storage for running values
71 | running_losses = None
72 | running_scales = None
73 |
74 | # FL params
75 | fl: bool = False
76 | fl_no_models: int = 100
77 | fl_local_epochs: int = 2
78 | fl_poison_epochs: int = None
79 | fl_total_participants: int = 200
80 | fl_eta: int = 1
81 | fl_sample_dirichlet: bool = False
82 | fl_dirichlet_alpha: float = None
83 | fl_diff_privacy: bool = False
84 | # FL attack details. Set no adversaries to perform the attack:
85 | fl_number_of_adversaries: int = 0
86 | fl_single_epoch_attack: int = None
87 | fl_weight_scale: int = 1
88 |
89 | fl_round_participants: List[int] = None
90 | fl_weight_contribution: Dict[int, float] = None
91 |
92 | fl_local_updated_models: Dict[int, Dict[str, torch.Tensor]] = None
93 |
94 | attack: str = None #'ThrDFed' (3DFed), 'ModelRplace' (Model Replacement)
95 |
96 | #"Foolsgold", "FLAME", "RFLBAT", "Deepsight", "FLDetector"
97 | defense: str = None
98 | lagrange_step: float = None
99 | random_neurons: List[int] = None
100 | noise_mask_alpha: float = None
101 | fl_adv_group_size: int = 0
102 | fl_num_neurons: int = 0
103 |
104 | def __post_init__(self):
105 | # enable logging anyways when saving statistics
106 | if self.save_model or self.save_timing or \
107 | self.print_memory_consumption:
108 | self.log = True
109 |
110 | if self.log:
111 | self.folder_path = f'saved_models/' \
112 | f'{self.task}__{self.current_time}__{self.name}'
113 |
114 | self.running_losses = defaultdict(list)
115 | self.running_scales = defaultdict(list)
116 | self.timing_data = defaultdict(list)
117 |
118 | def to_dict(self):
119 | return asdict(self)
--------------------------------------------------------------------------------
/utils/process_tiny_data.sh:
--------------------------------------------------------------------------------
1 | unzip tiny-imagenet-200.zip -d ./
2 | if [ ! -d ../.data ];then
3 | mkdir ../.data
4 | else
5 | echo '../.data' dir exist
6 | fi
7 |
8 | mv ./tiny-imagenet-200 ../.data/
9 | echo move 'tiny-imagenet-200' dir to '../.data/tiny-imagenet-200'
10 | python tinyimagenet_reformat.py
11 |
--------------------------------------------------------------------------------
/utils/tinyimagenet_reformat.py:
--------------------------------------------------------------------------------
1 | import io
2 | import pandas as pd
3 | import glob
4 | import os
5 | from shutil import move
6 | from os.path import join
7 | from os import listdir, rmdir
8 |
9 | target_folder = '../.data/tiny-imagenet-200/val/'
10 |
11 | val_dict = {}
12 | with open(target_folder + 'val_annotations.txt', 'r') as f:
13 | for line in f.readlines():
14 | split_line = line.split('\t')
15 | val_dict[split_line[0]] = split_line[1]
16 |
17 | paths = glob.glob(target_folder + 'images/*')
18 | paths[0].split('/')[-1]
19 | for path in paths:
20 | file = path.split('/')[-1]
21 | file = file.split('\\')[-1]
22 | folder = val_dict[file]
23 | if not os.path.exists(target_folder + str(folder)):
24 | os.mkdir(target_folder + str(folder))
25 |
26 | for path in paths:
27 | file = path.split('/')[-1]
28 | file = file.split('\\')[-1]
29 | folder = val_dict[file]
30 | dest = target_folder + str(folder) + '/' + str(file)
31 | move(path, dest)
32 |
33 | os.remove('../.data/tiny-imagenet-200/val/val_annotations.txt')
34 | rmdir('../.data/tiny-imagenet-200/val/images')
35 | print('done reformat the validation images')
--------------------------------------------------------------------------------
/utils/utils.py:
--------------------------------------------------------------------------------
1 | import logging
2 | import os
3 | import time
4 |
5 | import colorlog
6 | import torch
7 |
8 | from utils.parameters import Params
9 |
10 | def record_time(params: Params, t=None, name=None):
11 | if t and name and params.save_timing == name or params.save_timing is True:
12 | torch.cuda.synchronize()
13 | params.timing_data[name].append(round(1000 * (time.perf_counter() - t)))
14 |
15 | def create_table(params: dict):
16 | data = f"\n| {'name' + ' ' * 21} | value | \n|{'-'*27}|----------|"
17 |
18 | for key, value in params.items():
19 | # data += '\n' + f"| {(25 - len(key)) * ' ' }{key} | {value} |"
20 | data += f"\n| {key: <25} | {value} "
21 |
22 | return data
23 |
24 | def create_logger():
25 | """
26 | Setup the logging environment
27 | """
28 | log = logging.getLogger() # root logger
29 | log.setLevel(logging.DEBUG)
30 | format_str = '%(asctime)s - %(filename)s - Line:%(lineno)d - %(levelname)-8s - %(message)s'
31 | date_format = '%Y-%m-%d %H:%M:%S'
32 | if os.isatty(2):
33 | cformat = '%(log_color)s' + format_str
34 | colors = {'DEBUG': 'bold_blue',
35 | 'INFO': 'bold_green',
36 | 'WARNING': 'bold_yellow',
37 | 'ERROR': 'bold_red',
38 | 'CRITICAL': 'bold_red'}
39 | formatter = colorlog.ColoredFormatter(cformat, date_format,
40 | log_colors=colors)
41 | else:
42 | formatter = logging.Formatter(format_str, date_format)
43 | stream_handler = logging.StreamHandler()
44 | stream_handler.setFormatter(formatter)
45 | log.addHandler(stream_handler)
46 | return logging.getLogger(__name__)
47 |
--------------------------------------------------------------------------------