Search

Federated Parameter-Efficient Fine-Tuning (FedPEFT) has emerged as a promising paradigm for privacy-preserving and efficient adaptation of Pre-trained Language Models (PLMs) in Federated Learning (FL) settings. It preserves data privacy by keeping the data decentralized and training the model on local devices, ensuring that raw data never leaves the user's device. Moreover, the integration of PEFT methods such as LoRA significantly reduces the number of trainable parameters compared to fine-tuning the entire model, thereby minimizing communication costs and computational overhead. Despite its potential, the security implications of FedPEFT remain underexplored. This paper introduces a novel security threat to FedPEFT, termed PEFT-as-an-Attack (PaaA), which exposes how PEFT can be exploited as an attack vector to circumvent PLMs' safety alignment and generate harmful content in response to malicious prompts. Our evaluation of PaaA reveals that with less than 1% of the model's parameters set as trainable, and a small subset of clients acting maliciously, the attack achieves an approximate 80% attack success rate using representative PEFT methods such as LoRA. To mitigate this threat, we further investigate potential defense strategies, including Robust Aggregation Schemes (RASs) and Post-PEFT Safety Alignment (PPSA). However, our empirical analysis highlights the limitations of these defenses, i.e., even the most advanced RASs, such as DnC and ClippedClustering, struggle to defend against PaaA in scenarios with highly heterogeneous data distributions. Similarly, while PPSA can reduce attack success rates to below 10%, it severely degrades the model's accuracy on the target task. Our results underscore the urgent need for more effective defense mechanisms that simultaneously ensure security and maintain the performance of the FedPEFT paradigm.

Battery-free sensor tags are devices that leverage backscatter techniques to communicate with standard IoT devices, thereby augmenting a network's sensing capabilities in a scalable way. For communicating, a sensor tag relies on an unmodulated carrier provided by a neighboring IoT device, with a schedule coordinating this provisioning across the network. Carrier scheduling--computing schedules to interrogate all sensor tags while minimizing energy, spectrum utilization, and latency--is an NP-Hard optimization problem. Recent work introduces learning-based schedulers that achieve resource savings over a carefully-crafted heuristic, generalizing to networks of up to 60 nodes. However, we find that their advantage diminishes in networks with hundreds of nodes, and degrades further in larger setups. This paper introduces RobustGANTT, a GNN-based scheduler that improves generalization (without re-training) to networks up to 1000 nodes (100x training topology sizes). RobustGANTT not only achieves better and more consistent generalization, but also computes schedules requiring up to 2x less resources than existing systems. Our scheduler exhibits average runtimes of hundreds of milliseconds, allowing it to react fast to changing network conditions. Our work not only improves resource utilization in large-scale backscatter networks, but also offers valuable insights in learning-based scheduling., Comment: 15 Pages, 12 Figures. Pre-print, under review

The recent development of Foundation Models (FMs), represented by large language models, vision transformers, and multimodal models, has been making a significant impact on both academia and industry. Compared with small-scale models, FMs have a much stronger demand for high-volume data during the pre-training phase. Although general FMs can be pre-trained on data collected from open sources such as the Internet, domain-specific FMs need proprietary data, posing a practical challenge regarding the amount of data available due to privacy concerns. Federated Learning (FL) is a collaborative learning paradigm that breaks the barrier of data availability from different participants. Therefore, it provides a promising solution to customize and adapt FMs to a wide range of domain-specific tasks using distributed datasets whilst preserving privacy. This survey paper discusses the potentials and challenges of synergizing FL and FMs and summarizes core techniques, future directions, and applications. A periodically updated paper collection on FM-FL is available at https://github.com/lishenghui/awesome-fm-fl.

We study how to mitigate the effects of energy attacks in the batteryless Internet of Things (IoT). Battery-less IoT devices live and die with ambient energy, as they use energy harvesting to power their operation. They are employed in a multitude of applications, including safety-critical ones such as biomedical implants. Due to scarce energy intakes and limited energy buffers, their executions become intermittent, alternating periods of active operation with periods of recharging their energy buffers. Experimental evidence exists that shows how controlling ambient energy allows an attacker to steer a device execution in unintended ways: energy provisioning effectively becomes an attack vector. We design, implement, and evaluate a mitigation system for energy attacks. By taking into account the specific application requirements and the output of an attack detection module, we tune task execution rates and optimize energy management. This ensures continued application execution in the event of an energy attack. When a device is under attack, our solution ensures the execution of 23.3% additional application cycles compared to the baselines we consider and increases task schedulability by at least 21%, while enabling a 34% higher peripheral availability.

We present RETA (Relative Timing Analysis), a differential timing analysis technique to verify the impact of an update on the execution time of embedded software. Timing analysis is computationally expensive and labor intensive. Software updates render repeating the analysis from scratch a waste of resources and time, because their impact is inherently confined. To determine this boundary, in RETA we apply a slicing procedure that identifies all relevant code segments and a statement categorization that determines how to analyze each such line of code. We adapt a subset of RETA for integration into aiT, an industrial timing analysis tool, and also develop a complete implementation in a tool called DELTA. Based on staple benchmarks and realistic code updates from official repositories, we test the accuracy by analyzing the worst-case execution time (WCET) before and after an update, comparing the measures with the use of the unmodified aiT as well as real executions on embedded hardware. DELTA returns WCET information that ranges from exactly the WCET of real hardware to 148% of the new version's measured WCET. With the same benchmarks, the unmodified aiT estimates are 112% and 149% of the actual executions; therefore, even when DELTA is pessimistic, an industry-strength tool such as aiT cannot do better. Crucially, we also show that RETA decreases aiT's analysis time by 45% and its memory consumption by 8.9%, whereas removing RETA from DELTA, effectively rendering it a regular timing analysis tool, increases its analysis time by 27%.

We study how ambient energy harvesting may be used as an attack vector in the battery-less Internet of Things (IoT). Battery-less IoT devices rely on ambient energy harvesting and are employed in a multitude of applications, including safety-critical ones such as biomedical implants. Due to scarce energy intakes and limited energy buffers, their executions become intermittent, alternating periods of active operation with periods of recharging energy buffers. Through an independent exploratory study and a follow-up systematic analysis, we demonstrate that by exerting limited control on ambient energy one can create situations of livelock, denial of service, and priority inversion, without physical device access. We call these situations energy attacks. Using concepts of approximate intermittent computing and machine learning, we design a technique that can detect energy attacks with 92%+ accuracy, that is, up to 37% better than the baselines, and with up to one fifth of their energy overhead. Crucially, by design, our technique does not cause any additional energy failure compared to the regular intermittent processing. We conclude with directions to inspire defense techniques and a discussion on the feasibility of energy attacks.

Byzantine-robust federated learning aims at mitigating Byzantine failures during the federated training process, where malicious participants may upload arbitrary local updates to the central server to degrade the performance of the global model. In recent years, several robust aggregation schemes have been proposed to defend against malicious updates from Byzantine clients and improve the robustness of federated learning. These solutions were claimed to be Byzantine-robust, under certain assumptions. Other than that, new attack strategies are emerging, striving to circumvent the defense schemes. However, there is a lack of systematic comparison and empirical study thereof. In this paper, we conduct an experimental study of Byzantine-robust aggregation schemes under different attacks using two popular algorithms in federated learning, FedSGD and FedAvg . We first survey existing Byzantine attack strategies and Byzantine-robust aggregation schemes that aim to defend against Byzantine attacks. We also propose a new scheme, ClippedClustering , to enhance the robustness of a clustering-based scheme by automatically clipping the updates. Then we provide an experimental evaluation of eight aggregation schemes in the scenario of five different Byzantine attacks. Our results show that these aggregation schemes sustain relatively high accuracy in some cases but are ineffective in others. In particular, our proposed ClippedClustering successfully defends against most attacks under independent and IID local datasets. However, when the local datasets are Non-IID, the performance of all the aggregation schemes significantly decreases. With Non-IID data, some of these aggregation schemes fail even in the complete absence of Byzantine clients. We conclude that the robustness of all the aggregation schemes is limited, highlighting the need for new defense strategies, in particular for Non-IID datasets., Comment: This paper has been accepted for publication in IEEE Transactions on Big Data

The recent breakthroughs in machine learning (ML) and deep learning (DL) have catalyzed the design and development of various intelligent systems over wide application domains. While most existing machine learning models require large memory and computing power, efforts have been made to deploy some models on resource-constrained devices as well. A majority of the early application systems focused on exploiting the inference capabilities of ML and DL models, where data captured from different mobile and embedded sensing components are processed through these models for application goals such as classification and segmentation. More recently, the concept of exploiting the mobile and embedded computing resources for ML/DL model training has gained attention, as such capabilities allow (i) the training of models via local data without the need to share data over wireless links, thus enabling privacy-preserving computation by design, (ii) model personalization and environment adaptation, and (ii) deployment of accurate models in remote and hardly accessible locations without stable internet connectivity. This work targets to summarize and analyze state-of-the-art systems research that allows such on-device model training capabilities and provide a survey of on-device training from a systems perspective., Comment: This paper has been accepted to ACM Transactions on Sensor Networks (TOSN), September 2024. DOI: https://doi.org/10.1145/3696003

Federated learning (FL) facilitates distributed training across different IoT and edge devices, safeguarding the privacy of their data. The inherent distributed structure of FL introduces vulnerabilities, especially from adversarial devices aiming to skew local updates to their advantage. Despite the plethora of research focusing on Byzantine-resilient FL, the academic community has yet to establish a comprehensive benchmark suite, pivotal for impartial assessment and comparison of different techniques. This paper presents Blades, a scalable, extensible, and easily configurable benchmark suite that supports researchers and developers in efficiently implementing and validating novel strategies against baseline algorithms in Byzantine-resilient FL. Blades contains built-in implementations of representative attack and defense strategies and offers a user-friendly interface that seamlessly integrates new ideas. Using Blades, we re-evaluate representative attacks and defenses on wide-ranging experimental configurations (approximately 1,500 trials in total). Through our extensive experiments, we gained new insights into FL robustness and highlighted previously overlooked limitations due to the absence of thorough evaluations and comparisons of baselines under various attack settings.

Novel backscatter communication techniques enable battery-free sensor tags to interoperate with unmodified standard IoT devices, extending a sensor network's capabilities in a scalable manner. Without requiring additional dedicated infrastructure, the battery-free tags harvest energy from the environment, while the IoT devices provide them with the unmodulated carrier they need to communicate. A schedule coordinates the provision of carriers for the communications of battery-free devices with IoT nodes. Optimal carrier scheduling is an NP-hard problem that limits the scalability of network deployments. Thus, existing solutions waste energy and other valuable resources by scheduling the carriers suboptimally. We present DeepGANTT, a deep learning scheduler that leverages graph neural networks to efficiently provide near-optimal carrier scheduling. We train our scheduler with relatively small optimal schedules obtained from a constraint optimization solver, achieving a performance within 3% of the optimal scheduler. Without the need to retrain, DeepGANTT generalizes to networks 6x larger in the number of nodes and 10x larger in the number of tags than those used for training, breaking the scalability limitations of the optimal scheduler and reducing carrier utilization by up to 50% compared to the state-of-the-art heuristic. Our scheduler efficiently reduces energy and spectrum utilization in backscatter networks., Comment: 11 pages (excluding references). Submitted version that was accepted to IPSN 2023 (not the camera-ready version). Camera-ready version available here: https://doi.org/10.1145/3583120.3586957

Federated learning provides a communication-efficient and privacy-preserving training process by enabling learning statistical models with massive participants while keeping their data in local clients. However, standard federated learning techniques that naively minimize an average loss function are vulnerable to data corruptions from outliers, systematic mislabeling, or even adversaries. In addition, it is often prohibited for service providers to verify the quality of data samples due to the increasing concern of user data privacy. In this paper, we address this challenge by proposing Auto-weighted Robust Federated Learning (arfl), a novel approach that jointly learns the global model and the weights of local updates to provide robustness against corrupted data sources. We prove a learning bound on the expected risk with respect to the predictor and the weights of clients, which guides the definition of the objective for robust federated learning. The weights are allocated by comparing the empirical loss of a client with the average loss of the best p clients (p-average), thus we can downweight the clients with significantly high losses, thereby lower their contributions to the global model. We show that this approach achieves robustness when the data of corrupted clients is distributed differently from benign ones. To optimize the objective function, we propose a communication-efficient algorithm based on the blockwise minimization paradigm. We conduct experiments on multiple benchmark datasets, including CIFAR-10, FEMNIST and Shakespeare, considering different deep neural network models. The results show that our solution is robust against different scenarios including label shuffling, label flipping and noisy features, and outperforms the state-of-the-art methods in most scenarios.

We present a new machine learning-based attack that exploits network patterns to detect the presence of smart IoT devices and running services in the WiFi radio spectrum. We perform an extensive measurement campaign of data collection, and we build up a model describing the traffic patterns characterizing three popular IoT smart home devices, i.e., Google Nest Mini, Amazon Echo, and Amazon Echo Dot. We prove that it is possible to detect and identify with overwhelming probability their presence and the services running by the aforementioned devices in a crowded WiFi scenario. This work proves that standard encryption techniques alone are not sufficient to protect the privacy of the end-user, since the network traffic itself exposes the presence of both the device and the associated service. While more work is required to prevent non-trusted third parties to detect and identify the user's devices, we introduce Eclipse, a technique to mitigate these types of attacks, which reshapes the traffic making the identification of the devices and the associated services similar to the random classification baseline., Comment: 15 pages, 7 figures. Accepted for the 9th International Symposium On Security And Privacy On Internet of Things (SPIoT), 2020

Due to extremely low power consumption, backscatter has become the transmission mechanism of choice for battery-free devices that operate on harvested energy. However, a limitation of recent backscatter systems is that the communication range scales with the strength of the ambient carrier signal(ACS). This means that to achieve a long range, a backscatter tag needs to reflect a strong ACS, which in practice means that it needs to be close to an ACS emitter. We present TunnelScatter, a mechanism that overcomes this limitation. TunnelScatter uses a tunnel diode-based radio frequency oscillator to enable transmissions when there is no ACS, and the same oscillator as a reflection amplifier to support backscatter transmissions when the ACS is weak. Our results show that even without an ACS, TunnelScatter is able to transmit through several walls covering a distance of 18 meter while consuming a peak biasing power of 57 microwatts. Based on TunnelScatter, we design battery-free sensor tags, called TunnelTags, that can sense physical phenomena and transmit them using the TunnelScatter mechanism., Comment: This paper was presented at ACM MobiCom 2019

Visible Light Communication (VLC) is emerging as a means to network computing devices that ameliorates many hurdles of radio-frequency (RF) communications, for example, the limited available spectrum. Enabling VLC in wearable computing, however, is challenging because mobility induces unpredictable drastic changes in light conditions, for example, due to reflective surfaces and obstacles casting shadows. We experimentally demonstrate that such changes are so extreme that no single design of a VLC receiver can provide efficient performance across the board. The diversity found in current wearable devices complicates matters. Based on these observations, we present three different designs of VLC receivers that i) are individually orders of magnitude more efficient than the state-of-the-art in a subset of the possible conditions, and i) can be combined in a single unit that dynamically switches to the best performing receiver based on the light conditions. Our evaluation indicates that dynamic switching incurs minimal overhead, that we can obtain throughput in the order of MBit/s, and at energy costs lower than many RF devices.

After a decade of research in low-power data collection, reaching arbitrary nodes has received comparatively little attention. The leading protocol for low-power IPv6 routing, RPL, is no exception, as it is often studied in multipoint-to-point scenarios. As a result, downward routing (from root to node) is still notoriously difficult, holding back the emergence of Internet of Things applications that involve actuation. In this paper, we focus on achieving industrial-grade reliability levels (1e-5 failure rate) in downward routing with RPL. We make every packet count, and classify the different causes of packet loss. We show how to mitigate each source of packet loss, by (1) introducing a gradient metric that favors reliable links, (2) increasing neighborhood awareness for accurate link selection, and (3) ensuring a robust routing state maintenance and packet forwarding. We demonstrate RPL downward routing with loss rates in the order of 1e-5 in four different testbeds up to 352 nodes, in both sparse and dense settings. We also validate our solution on top of a low-power TSCH scheduler, and achieve sub-percent low duty cycles and a channel utilization of 0.07% at every node, spread over 16 channels.

Long Range (LoRa) is a popular technology used to construct Low-Power Wide-Area Network (LPWAN) networks. Given the popularity of LoRa it is likely that multiple independent LoRa networks are deployed in close proximity. In this situation, neighbouring networks interfere and methods have to be found to combat this interference. In this paper we investigate the use of directional antennae and the use of multiple base stations as methods of dealing with inter-network interference. Directional antennae increase signal strength at receivers without increasing transmission energy cost. Thus, the probability of successfully decoding the message in an interference situation is improved. Multiple base stations can alternatively be used to improve the probability of receiving a message in a noisy environment. We compare the effectiveness of these two approaches via simulation. Our findings show that both methods are able to improve LoRa network performance in interference settings. However, the results show that the use of multiple base stations clearly outperforms the use of directional antennae. For example, in a setting where data is collected from 600 nodes which are interfered by four networks with 600 nodes each, using three base stations improves the Data Extraction Rate (DER) from 0.24 to 0.56 while the use of directional antennae provides an increase to only 0.32.

There is the long-standing assumption that radio communication in the range of hundreds of meters needs to consume mWs of power at the transmitting device. In this paper, we demonstrate that this is not necessarily the case for some devices equipped with backscatter radios. We present LoRea an architecture consisting of a tag, a reader and multiple carrier generators that overcomes the power, cost and range limitations of existing systems such as Computational Radio Frequency Identification~(CRFID). LoRea achieves this by: First, generating narrow-band backscatter transmissions that improve receiver sensitivity. Second, mitigating self-interference without the complex designs employed on RFID readers by keeping carrier signal and backscattered signal apart in frequency. Finally, decoupling carrier generation from the reader and using devices such as WiFi routers and sensor nodes as a source of the carrier signal. An off-the-shelf implementation of LoRea costs 70 USD, a drastic reduction in price considering commercial RFID readers cost 2000 USD. LoRea's range scales with the carrier strength, and proximity to the carrier source and achieves a maximum range of 3.4 kilometre when the tag is located at 1 meter distance from a 28 dBm carrier source while consuming 70 microwatts at the tag. When the tag is equidistant from the carrier source and the receiver, we can communicate upto 75 meter, a significant improvement over existing RFID readers., Comment: Accepted and presented at ACM SenSys 2017, Delft, Netherlands

Radio tomographic imaging (RTI) enables device free localisation of people and objects in many challenging environments and situations. Its basic principle is to detect the changes in the statistics of some radio quality measurements in order to infer the presence of people and objects in the radio path. However, the localisation accuracy of RTI suffers from complicated radio propagation behaviours such as multipath fading and shadowing. In order to improve RTI localisation accuracy, we propose to use inexpensive and energy efficient electronically switched directional (ESD) antennas to improve the quality of radio link behaviour observations, and therefore, the localisation accuracy of RTI. We implement a directional RTI (dRTI) system to understand how directional antennas can be used to improve RTI localisation accuracy. We also study the impact of the choice of antenna directions on the localisation accuracy of dRTI and propose methods to effectively choose informative antenna directions to improve localisation accuracy while reducing overhead. We evaluate the performance of dRTI in diverse indoor environments and show that dRTI significantly outperforms the existing RTI localisation methods based on omni-directional antennas.

Wireless low-power transceivers used in sensor networks such as IEEE 802.15.4 typically operate in unlicensed frequency bands that are subject to external interference from devices transmitting at much higher power. Communication protocols should therefore be designed to be robust against such interference. A critical building block of many protocols at all layers is agreement on a piece of information among a set of nodes. At the MAC layer, nodes may need to agree on a new time slot or frequency channel; at the application layer nodes may need to agree on handing over a leader role from one node to another. Message loss caused by interference may break agreement in two different ways: none of the nodes use the new information (time slot, channel, leader) and stick with the previous assignment, or - even worse - some nodes use the new information and some do not. This may lead to reduced performance or failures. In this paper we investigate the problem of agreement under interference and point out the limitations of the traditional message-based n-way handshake approach. We propose novel protocols that use jamming instead of message transmissions and show that they outperform the n-way handshake in terms of agreement probability, energy consumption, and time-to-completion both in the unicast case (two neighboring nodes agree) as well as in the broadcast case (any number of neighboring nodes agree).