Federal learning data poisoning attack-oriented defense method and device

Abstract

The invention discloses a federal learning data poisoning attack-oriented defense method and device. The method comprises the steps that each client uses local data to train model parameters; each client uploads local model parameters to the server, and the server receives all the model parameters; the server calculates a reference basis u for comparison, and for any two local models wa and wb, the similarity of the two local models wa and wb relative to the reference basis u is calculated; whether a local model is malicious or not is judged by adopting an internal voting method; the credibility of each local model is calculated according to the votes obtained by each local model; and model weighted aggregation is carried out based on credibility to obtain a final global model, and defense of data poisoning attack is achieved based on the final global model. According to the method, the model of the malicious client can be endowed with a lower weight, and the influence of the malicious client on the global model is weakened during weighted aggregation, so that defense against data poisoning attacks is realized.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a defense method and device for federated learning data poisoning attacks. Background technique [0002] The development and application of machine learning is based on the collection and analysis of big data. However, the data from a single data source often has the problem of small data volume and few features, so it is not enough to train a model with good performance. The federated learning proposed by Google is a special distributed machine learning framework. The framework sends the training model to different clients. Different clients use local data to train the layout model, and then upload the trained local model to the center. Server, the central server aggregates the models to generate the final global model. This training method allows joint training of shared models with multi-source data, while keeping the data locally on the client to ensure...

AI Technical Summary

Problems solved by technology

[0005] The main purpose of the present invention is to overcome the defects in the prior art, provide a defense method and device for federated learning data poisoning attacks, and solve the problem of malicious clients The security problem of destroying the availability of shared models by tampering with local data (data poisoning attack)

Images