  Attacks on Federated Learning (FL) can severely reduce the quality of the
generated models and limit the usefulness of this emerging learning paradigm
that enables on-premise decentralized learning. However, existing untargeted
attacks are not practical for many scenarios as they assume that i) the
attacker knows every update of benign clients, or ii) the attacker has a large
dataset to locally train updates imitating benign parties. In this paper, we
propose a data-free untargeted attack (DFA) that synthesizes malicious data to
craft adversarial models without eavesdropping on the transmission of benign
clients at all or requiring a large quantity of task-specific training data. We
design two variants of DFA, namely DFA-R and DFA-G, which differ in how they
trade off stealthiness and effectiveness. Specifically, DFA-R iteratively
optimizes a malicious data layer to minimize the prediction confidence of all
outputs of the global model, whereas DFA-G interactively trains a malicious
data generator network by steering the output of the global model toward a
particular class. Experimental results on Fashion-MNIST, Cifar-10, and SVHN
show that DFA, despite requiring fewer assumptions than existing attacks,
achieves similar or even higher attack success rate than state-of-the-art
untargeted attacks against various state-of-the-art defense mechanisms.
Concretely, they can evade all considered defense mechanisms in at least 50% of
the cases for CIFAR-10 and often reduce the accuracy by more than a factor of
2. Consequently, we design REFD, a defense specifically crafted to protect
against data-free attacks. REFD leverages a reference dataset to detect updates
that are biased or have a low confidence. It greatly improves upon existing
defenses by filtering out the malicious updates and achieves high global model
accuracy
