User data reconstruction attack method oriented to deep federal learning

Abstract

The invention discloses a user data reconstruction attack method oriented to deep federal learning, which can reconstruct private data of a specific user and consider that attacks are implemented by amalicious server, so that negative effects are prevented from being introduced into an original shared model compared with a conventional attack method which can only reconstruct category representation data. Furthermore, the method introduces a multi-task generative adversarial model to simulate the distribution of user data, and the model is used for training the authenticity and category of aninput sample and the identification of the user identity to which the model belongs, so that the quality of the generated sample is improved. In order to better distinguish different users, the method introduces an optimized user data representative calculation method to describe user characteristics participating in federal learning, and the method is used for supervising training of a generative adversarial model. For an existing federal learning architecture concerning privacy protection, privacy leakage can be caused by a data reconstruction attack based on a multi-task generative adversarial model provided by the invention.

Description

technical field [0001] The invention relates to a user data reconstruction attack method oriented to deep federated learning, and belongs to the field of artificial intelligence security. Background technique [0002] In recent years, deep learning techniques have been increasingly applied in the network field, such as learning tasks combined with group perception. Utilizing traditional centralized training methods requires storing crowdsourced data locally, which usually brings about problems such as large-capacity data transmission, high computing requirements, and privacy leaks. Therefore, as a mobile edge computing framework for deep learning, the collaborative learning framework has received extensive attention and research, which can enable multiple data sources to benefit from the shared model trained by all data without uploading data to the central storage. [0003] The federated learning framework is one of the current mainstream collaborative learning frameworks:...

AI Technical Summary

Problems solved by technology

Existing attack methods usually consider a malicious user to attack a target and infer its data privacy, but usually only infer the category representative data. For example, for a face recognition task, existing attack methods can infer the general sample, but it is impossible to reconstruct the sample of the ID owned by a specific user. Although such a general sample can characterize the characteristics of the category, it cannot actually cause a privacy leak

This is because malicious users can only access the updated model from the server, which is aggregated from the last round of updates of all users, and cannot attack specific targets.

In addition, existing attack methods require modifying the structure of the shared model to carry out the attack, and introduce malicious effects into the regular collaborative learning process. Such assumptions are beyond the attack capability of a malicious user and cause performance degradation of the shared model. , easy to be detected by the system, that is, the concealment of the attack is poor

[0005] The present invention believes that the existing federated learning-oriented data reconstruction attack method is based on the assumption of too strong attacker capabilities, which cannot be implemented in actual scenarios, and cannot infer directional and valuable private information, so a kind of Data reconstruction attack on user-level private data based on malicious server

Images