Federated learning defense limits poisoning attacks in vehicle networks
Clean-label Poisoning Attack and Defense Game for Federated Learning in Vehicular Networks
Networking and Internet ArchitectureArtificial IntelligenceDistributed, Parallel, and Cluster ComputingMachine Learning
Summary
Federated learning lets cars share knowledge to detect problems without sharing raw data, but attackers can subtly poison this learning by tweaking data features without changing labels. The authors studied this attack in networks of moving vehicles and created a defense that spots and corrects suspicious data, keeping the system accurate. They used game theory to understand how attackers and defenders interact and found their defense reduces attacks even as more vehicles get compromised.
What this means in practice
- •For automotive system engineers: Design secure federated learning systems for connected cars to detect anomalies despite potential data attacks from compromised vehicles.
- •For network security teams: Deploy detection and relabeling defenses to maintain integrity in distributed learning across dynamic vehicle networks under attack.
Authors
Yalin E. Sagduyu, Tugba Erpek, Nathan Stephenson, Mengran Xue
Abstract
This paper studies interactions between clean-label poisoning attack and defense in vehicular networks using federated learning (FL). Basic Safety Message (BSM) classification for anomaly detection is modeled as a distributed learning problem over a vehicular network with dynamic topology. As a critical threat to FL, a feature-space clean-label attack is introduced, wherein benign samples are perturbed toward malicious feature extremes, degrading class separability while preserving labels. To counter this, a feature-consistency relabeling defense is proposed to detect and relabel suspicious samples. A game-theoretic framework is developed to capture attack-defense interactions and characterize equilibrium strategies based on attack effectiveness and cost parameters. Results show that the attack scales effectively with compromised nodes, while the proposed defense keeps attack success low without degrading clean accuracy and shifts equilibrium regions toward attack-averse regimes.