Federated learning enables collaborative model training without directly sharing data, which can prove essential for applications that handle personal or sensitive information. Elena Rodríguez-Royce and Fernando Pérez-Gonzalez from the University of Vigo in Spain, in collaboration with Fabio Blau, Maura Pintor and Batista Biggio from the University of Cagliari in Italy, presented a new approach to address a critical weakness within this framework: collusion between participants. Their work introduces BlackCATT, a black-box collusion-aware traitor tracking method, which represents the first general solution for collusion tolerance in federated learning that extends beyond shallow networks and linearly separable tasks. By introducing a new collusion-aware embedding loss and optimizing the trigger set, BlackCATT significantly improves both convergence and malicious actor identification accuracy. Additionally, the team’s BlackCATT+FR extension incorporates functional regularization to maintain model performance even in the face of potential incompatibilities caused by watermarks, making federated learning systems more practical and robust.
Scientists have developed BlackCATT, a new method for tracking leaked machine learning models in federated learning systems, even when multiple parties are colluding to hide the possibility that multiple data owners may conspire to create a model that obfuscates its origin. BlackCATT overcomes these limitations through a new collusion-aware embedding loss term and enhances the robustness of the tracking mechanism. Instead of relying on a predetermined set of triggers, the system iteratively optimizes these triggers, improving both the convergence of the training process and the accuracy of traitor tracking. The core of BlackCATT lies in this collusion-aware embedded loss condition, designed to withstand coordinated attacks in which multiple parties attempt to hide the origin of a leaked model. The effectiveness of BlackCATT has been confirmed across a variety of architectures and datasets, demonstrating its broad applicability and robustness. This versatility is especially important given the diversity of machine learning models and data types. The researchers elaborate that BlackCATT has established a system that can work effectively with diverse model structures and data types, demonstrating wide applicability and inherent robustness. Additionally, the researchers introduced BlackCATT+FR, an extension that incorporates functional regularization to address update incompatibility issues that can occur with certain model architectures, such as models that employ batch normalization layers. This ensures that the watermarking process does not compromise the performance of the underlying machine learning task, while promoting a shared feature space between copies of the model. In this study, we introduce this functional regularization technique for models that are susceptible to update incompatibilities, especially those that utilize architectures with batch normalization layers. The study confirmed that this functional regularization successfully alleviates problems arising from watermark differences and maintains the integrity of the primary task in parallel with the traitor tracking functionality. To address update incompatibilities, the team developed BlackCATT+FR, which incorporates function regularization and utilizes auxiliary samples at the aggregator stage to facilitate a shared feature space across all model copies. Functional regularization encourages the model to learn similar representations, mitigating performance degradation that may be caused by the watermarking process. This approach favors a black-box setup and reflects a realistic scenario where the full model parameters of a potentially leaked copy are not accessible. The watermark was therefore embedded as a specific sample-label pair, effectively creating a hidden signature within the model’s input and output behavior. This approach enables BlackCATT to work effectively with more complex architectures and datasets, unlike previous methods that often focused on shallow networks and linearly separable tasks. Iterative optimization of the trigger was achieved through a gradient-based approach, continuously adjusting the trigger example to maximize watermark visibility and minimize interference with the main learning task. The relentless pursuit of data privacy is reshaping machine learning, but security measures often introduce new vulnerabilities. Federated learning promised a solution to training models on distributed data without actually sharing it, but the risk of compromised models being leaked by malicious participants remained a major concern. Now, researchers have unveiled BlackCATT, a system designed to not only identify the source of leaked models, but also to identify when multiple parties collude to conceal their involvement. “Traitor tracking” in machine learning has long been hampered by the difficulty of embedding identifying markers or watermarks without compromising model performance or making them easily detectable. Existing techniques have struggled in the face of complex networks or, importantly, when multiple malicious actors collaborate to erase evidence. BlackCATT addresses this issue by optimizing and iteratively refining the watermark itself to remain robust against coordinated attacks. The proven compatibility of this system with a variety of model architectures and datasets suggests a level of practical adaptability that has been lacking in this field to date. However, broad coverage does not mean foolproof security. Although this study confirms the effectiveness of this approach, the lack of concrete quantitative metrics leaves open the question of how resilient BlackCATT is against sophisticated and adaptive adversaries. Future research will undoubtedly focus on quantifying this resilience and exploring the limits of collusive resistance. Additionally, the challenge is to develop ways to seamlessly integrate these tracking mechanisms into existing federated learning frameworks, effectively respond when a breach is detected, and move beyond identification to remediation and prevention. The next generation of these systems may incorporate dynamic watermarking, constantly evolving trace signals to stay one step ahead of potential attackers.
