Federated learning poisoning detection method based on neuron distribution characteristics

Abstract

The invention discloses a federated learning poisoning detection method based on neuron distribution characteristics, which comprises the following steps: (1) obtaining a plurality of edge models trained and uploaded at clients, and according to the similarity of adjacent edge models uploaded for several times corresponding to each client, screening a plurality of edge models meeting screening requirements from the plurality of edge models uploaded each time to serve as candidate poisoning models; (2) screening at least one model from the candidate poisoning models as a poisoning model according to the distribution state of the model parameters, and removing the poisoning model, (3) inverting the poisoning model according to the sample data and the label to obtain poisoning patch data, optimizing the aggregation model parameters of the server according to the poisoning patch data, and obtaining an optimized aggregation model; and issuing the optimized aggregation model to the client bythe server to serve as an edge model of the client for edge training of the next round. The federated learning poisoning detection method can rapidly detect the poisoning model.

Description

technical field [0001] The invention belongs to the fields of federated learning and model safety monitoring, and in particular relates to a federated learning poisoning detection method based on neuron distribution characteristics. Background technique [0002] Google proposed federated learning to solve the problem of training machine learning models without direct access to various training data, especially for privacy-sensitive tasks. Using the local training data of participants, federated learning can train a continuously optimized global model. The applications for deploying federated learning in business models are broad and growing, such as loan status prediction, health status assessment (e.g. potential cancer risk assessment), and association prediction while typing. [0003] Raw data for each client is stored locally without exchange or transfer; instead, weight updates are narrowly updated to include the minimum information required for a specific learning task...

AI Technical Summary

Problems solved by technology

[0006] However, most of the currently proposed poisoning defense methods are federal poisoning defense methods. First, poisoning defense methods rely on the distance or similarity between observation models to judge, but in real life, the data of participants exists in the form of independent and identical distribution of data. The difference between the models is inherently large, so it cannot be correctly judged

Secondly, this method cannot find poisoned clients, and cannot prevent poisoning attacks from the source

Finally, stand-alone poisoning detection methods, such as NC (NeuralCleanse, neuron cleaning defense) and ABS (Artificial Brain Stimulation, artificial brain stimulation defense), cannot be deployed to each client, one is due to data privacy issues, and the other is because The computing resources of the client are already tight, and both NC and ABS require a large amount of computing to perform detection

Images