Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper proposes a distributed backdoor attack strategy, framed differently from the previous two main approches (1) the centralised backdoor approach and (2) the (less discussed in the paper) distributed fault tolerance approach (often named "Byzantine").

The authors show through experiments how their attack is more persistent than centralised backdoor attack.
The authors also compare two aggregation rules for federated learning schemes, (Fung et al 2018 & Pillutla et al 2019), suggesting that both rules are bypassed by the proposed distributed backdoor attack.

Strength:

what I found most interesting in the paper is Section 3.4, presenting an appreciable attempt to "interpret" poisoning. Together with Section 4. 
This kind of fine-grained analysis of poisoning is highly needed.

Weakness: 

in section 3.3, the authors compare against RFA and take what is claimed in Pillulata et al as granted (that RFA detects more nuanced outliers than the wort-case of the Byzantine setting (Blanchard et al 2017) ). In fact, there is more to the Byzantine setting than that, see e.g. Draco (Chen et al 2018 SysML), Bulyan (El Mhamdi et al 2018 ICML) and SignSGD (Bernstein et al 2019 ICLR) which have proposed more sophisticated approches to distributed robustness.
Since this paper is about distributed robustness and distributed attacks, it would be very informative to the community to illustrate DBA attack on these methods to have a more compelling message.

post rebuttal: thank your for your detailed reply, I acknowledge your new comparisons with the distributed robustness mechanisms of Krum and Bulyan, too bad time was short to compare with the other measures such as Draco and SignSGD.
review_title: Official Blind Review #3

final_score: rating: 8: Accept
review_content: The authors introduce the idea of distributed backdoor attacks in the FL framework, in which the dishonest participants in FL add local triggers to their training data to influence the global model to classify triggered images in a desired way. They show empirically that the learned models then are more likely to be successfully forced to misclassified images in which all the local triggers are present at test time, than are models learned using centralized backdoor attacks, where all attackers use the same trigger pattern (one of the same size as the concatenation of the local triggers, to be fair in the comparison). They then demonstrate that because the local triggers cause smaller corruptions in the model coefficients, these distributed attacks survive robust FL training algorithms (namely FoolsGold, and a recent robust regression based method) more often than centralized attacks. Similar experiments are conducted on the Loan text dataset, using appropriate analogs of local triggers, with similar results.

The paper contributes a novel model for conducting backdoor attacks in the FL setup, and shows that this model is more successful at attacking when training using robust FL algorithms than the standard centralized backdoor attack model. I lean towards accept, as this is a realistic attack model, and as such can further stimulate research into the robustification of FL model aggregation algorithms.
review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: This paper studies backdoor attacks under federated learning setting. To inject a certain backdoor pattern, existing work generate poisoning samples by blending the same pattern with different input samples. Even for federated learning where the adversary can control multiple parties, such as [1], all parties still use the same global backdoor pattern to generate poisoning samples locally. On the contrary, in this work, they decompose the global pattern into several small local patterns, and each adversarial party only uses a local pattern to generate poisoning samples. In their evaluation, they show that the backdoor attacks generated in this way are more effective, resilient to benign model parameter updates, and also survive better against existing defense algorithms against attacks in federated learning settings.

I think the topic studied in this paper is very important and meaningful, and I am convinced that by decomposing a global pattern into several smaller local pieces, the model parameter updates computed by each party should be more similar to benign updates and thus can better bypass the defense algorithms. Meanwhile, the evaluation is pretty comprehensive and it is good to see that the conducted backdoor attacks are effective. However, when there is no defense deployed in the training process, it is not intuitive to see why the proposed attack is more effective and persistent than the centralized attack, given that a smaller trigger usually results in a worse attack performance. Thus, I would like to see more possible explanation on it. Specifically, I have the following questions for clarification:

1. For the evaluation of DBA, I assume that there are 4 adversarial parties, controlling each of the 4 local triggers. When using centralized attacks, are there still 4 adversarial parties, although they share the same global trigger, or if there is only 1 adversarial party?

2. To evaluate A-S setting, I understand that it may be tricky to enable a fair comparison between the centralized attack and DBA. However, one explanation of why DBA is more persistent in this case is because the adversarial parameter updates happen 4x times compared to the centralized attack. Therefore, another baseline to check is to conduct centralized attacks with the same number of times as DBA, but each update includes 1/4 number of poisoning samples, so that the total number of poisoning samples included to compute the gradient update still stays the same.

3. Can the authors show if the decomposition is also useful for trigger patterns that are not necessarily regular shapes? For backdoor attacks, a line of work studies physical triggers, e.g., glasses in [2]. It is not natural to decompose such kind of patterns into several smaller pieces, unless the performance is significantly boosted.

4. Can the authors show concrete examples on how the attacks are generated? The details are especially unclear on LOAN. Specifically, which features are perturbed, what are the values assigned as the trigger, and what is the corresponding target label?

[1]  Bagdasaryan et al., How to backdoor federated learning.
[2] Chen et al., Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.

------------
Post-rebuttal comments

I appreciate the authors' great effort to address my concerns! I think the evaluation in the current version of the paper is pretty comprehensive and provides a valuable study, and I am happy to raise my score accordingly.
-------------
review_title: Official Blind Review #2

Meta-review: Thanks for the discussion, all. This paper proposes an attack strategy against federated learning. Reviewers put this in the top tier, and the authors responded appropriately to their criticisms. 
Decision: Accept (Poster)