Login | Signup

Using Ml to Protect Ml: Defending Against Malicious Clients In Public, Large-Scale Privacy-Preserving Model Training Scenarios

Raunak Singh

June 30, 2026

ISBN: 979-8-89480-841-3

Georgia Institute of Technology


In machine learning applications using sensitive, distributed big data, i.e., medical data, voting records, etc., it must be assured that model training data cannot be recovered or exposed publicly. Currently, this inhibits wide-scale analysis of sensitive data across research institutions and industry partners. Next-generation models must be trained collectively, introducing a new set of security risks to the confidentiality of sensitive data. These security risks, such as model inversion, reconstruction attacks, etc., allow adversaries to extract the sensitive data on which models have been trained. To address this issue, differentially private training architectures, such as SplitFed Learning, have been introduced; these architectures keep sensitive data on-site and secure while training the model using information from the public gradients and following a distributed machine learning computing pattern. Still, they do not prevent the intrusion of malicious clients who can send incorrect data to collective training servers to leak parts of the sensitive data on which the model is trained. This paper addresses this vulnerability, developing robust detection mechanisms against adversaries who insert less than 1/3 of malicious clients into training and attempt to reveal sensitive data. Specifically, we propose a novel reinforcement learning machine-learning-based solution that can consistently defend against fixed and variable-based distance attacks from malicious clients and actively train itself to recognize malicious clients in numerous public model training scenarios. We then perform tests on publicly available datasets using edge devices and demonstrate the resilience of our approach against state-of-the-art attacks.

References

  1. K. Rahul, R. K. Banyal, and N. Arora, ‘A systematic review on big data applications and scope for industrial processing and healthcare sectors’, Journal of Big Data, vol. 10, no. 1, p. 133, Aug. 2023.

  2. L. Daniel, ‘100 Million Americans’ Medical Records Exposed In Massive Data Breach’. [Online]. Available: https://www.forbes.com/sites/larsdaniel/2024/10/28/100-million-americans-medical-records-exposed-in-massive-data-breach/. [Accessed: 13-Nov-2024].

  3. D. Amodei and D. Hernandez, ‘AI and compute’, 16-May-2018. [Online]. Available: https://openai.com/index/ai-and-compute/. [Accessed: 13-Nov-2024].

  4. C. Dwork, F. McSherry, K. Nissim, and A. Smith, ‘Calibrating Noise to Sensitivity in Private Data Analysis’.

  5. P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar, ‘Split learning for health: Distributed deep learning without sharing raw patient data’, no. arXiv:1812.00564. arXiv, 03-Dec-2018.

  6. J. Konečný, B. McMahan, and D. Ramage, ‘Federated Optimization:Distributed Optimization Beyond the Datacenter’, no. arXiv:1511.03575. arXiv, 11-Nov-2015.

  7. C. Thapa, M. A. P. Chamikara, S. Camtepe, and L. Sun, ‘SplitFed: When Federated Learning Meets Split Learning’, no. arXiv:2004.12088. arXiv, 16-Feb-2022.

  8. M. Lecuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana, ‘Certified Robustness to Adversarial Examples with Differential Privacy’, in 2019 IEEE Symposium on Security and Privacy (SP), 2019, pp. 656–672.

  9. A. T. Z. Ismail and R. M. Shukla, ‘Analyzing the vulnerabilities in SplitFed Learning: Assessing the robustness against Data Poisoning Attacks’, no. arXiv:2307.03197. arXiv, 04-Jul-2023.

  10. M. A. Khan, V. Shejwalkar, A. Houmansadr, and F. M. Anwar, ‘Security Analysis of SplitFed Learning’, no. arXiv:2212.01716. arXiv, 03-Dec-2022.

  11. A. Kumaar, R. M. Shukla, and A. N. Patra, ‘Fortifying SplitFed Learning: Strengthening Resilience Against Malicious Clients’. 21-May-2024.

  12. P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, ‘Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent’, in Advances in Neural Information Processing Systems, 2017, vol. 30.

  13. T. Wang, Z. Zheng, and F. Lin, ‘Federated Learning Framework Based on Trimmed Mean Aggregation Rules’, SSRN Electronic Journal, 2022.

  14. D. Cao, S. Chang, Z. Lin, G. Liu, and D. Sun, ‘Understanding Distributed Poisoning Attack in Federated Learning’, in 2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS), 2019, pp. 233–239.

  15. W. Wan et al., ‘MISA: Unveiling the Vulnerabilities in Split Federated Learning’, no. arXiv:2312.11026. arXiv, 19-Dec-2023.

  16. G. Baruch, M. Baruch, and Y. Goldberg, ‘A Little Is Enough: Circumventing Defenses For Distributed Learning’, in Advances in Neural Information Processing Systems, 2019, vol. 32.

  17. V. Shejwalkar and A. Houmansadr, ‘Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning’, in Proceedings 2021 Network and Distributed System Security Symposium, 2021.

  18. A. Ziller et al., ‘PySyft: A Library for Easy Federated Learning’, 2021, pp. 111–139.

  19. C. Shen and W. Xue, ‘An Experiment Study on Federated LearningTestbed’, no. arXiv:2103.10579. arXiv, 19-Mar-2021.

  20. P. Tschandl, ‘The HAM10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions’. Harvard Dataverse, 2018.

  21. E. Erdoğan, A. Küpçü, and A. E. Çiçek, ‘UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks against Split Learning’, in Proceedings of the 21st Workshop on Privacy in the Electronic Society, 2022, pp. 115–124.

  22. ‘Introduction to gRPC’. [Online]. Available: https://grpc.io/docs/what-is-grpc/introduction/. [Accessed: 30-Dec-2024].