  Federated machine learning which enables resource constrained node devices
(e.g., mobile phones and IoT devices) to learn a shared model while keeping the
training data local, can provide privacy, security and economic benefits by
designing an effective communication protocol. However, the communication
protocol amongst different nodes could be exploited by attackers to launch data
poisoning attacks, which has been demonstrated as a big threat to most machine
learning models. In this paper, we attempt to explore the vulnerability of
federated machine learning. More specifically, we focus on attacking a
federated multi-task learning framework, which is a federated learning
framework via adopting a general multi-task learning framework to handle
statistical challenges. We formulate the problem of computing optimal poisoning
attacks on federated multi-task learning as a bilevel program that is adaptive
to arbitrary choice of target nodes and source attacking nodes. Then we propose
a novel systems-aware optimization method, ATTack on Federated Learning
(AT2FL), which is efficiency to derive the implicit gradients for poisoned
data, and further compute optimal attack strategies in the federated machine
learning. Our work is an earlier study that considers issues of data poisoning
attack for federated learning. To the end, experimental results on real-world
datasets show that federated multi-task learning model is very sensitive to
poisoning attacks, when the attackers either directly poison the target nodes
or indirectly poison the related nodes by exploiting the communication
protocol.
