Attack detection and defense method for federated learning model in mobile scene

Abstract

The invention relates to the technical field of federated learning model reliable training and safe aggregation, in particular to an attack detection and defense method for a federated learning model in a mobile scene, which comprises the following steps: using a block chain to store equipment information, and finishing selection of federated learning users by a server under the condition that the server is not in contact with equipment; the equipment judges the authenticity of the received training task by using a zero-knowledge proof method; the equipment performs encryption transmission on the local model by using the proving key to resist model parameter reasoning attack; and the block chain verifies the validity of the local model by using the verification key and the Pearson commitment, so that the safe aggregation of the federal learning global model is realized. The method has the advantages of being high in attack detection speed, few in needed communication and computing resources and low in algorithm complexity.

Description

Technical Field

[0001] The present invention relates to the technical field of reliable training and secure aggregation of federated learning models, and in particular to an attack detection and defense method for a federated learning model in a mobile scenario. Background Art

[0002] In dynamic scenarios, federated learning supports the collaborative training of models by heterogeneous mobile devices without sharing raw data, which brings benefits including, but not limited to, better provision of low-latency intelligent services and seamless message transmission for mobile devices. However, existing federated learning frameworks are vulnerable to attacks, resulting in privacy leakage and biased global models. In dynamic scenarios (such as the Internet of Vehicles), the leakage of sensitive information, such as location and driving habits, may hinder customers from training models. More importantly, biased prediction models may cause serious accidents. In addition, the mobility of devices leads to limited communication time between devices and edge servers, so the requirements for latency are more stringent. Therefore, how to efficiently detect and resist malicious attacks and achieve secure aggregation of federated learning models without leaking device privacy information is a difficulty in deploying federated learning models in dynamic scenarios. Summary of the invention

[0003] The purpose of the present invention is to solve the shortcomings existing in the prior art, and to provide an attack detection and defense method for a federated learning model in a mobile scenario, which quantifies the reliability of the device based on the mobile characteristics, computing resources and communication resources of the device; using the zero-knowledge proof method, the edge server generates a proof key, a verification key and a secret function, and completes the user selection of the federated learning model without any contact with the device; before the device performs local training, it will judge the authenticity of the training task based on the received global model parameters and their commitments, so as to avoid waste of resources and normal training of the real federated learning model; using Pedersen commitment and a concise non-interactive zero-knowledge proof method, the authenticity and reliability of the local model are verified more efficiently, and the contribution value of the local model is evaluated; using the contribution value obtained by the above information, its weight in the global model aggregation is determined to reduce the one-sided influence of the global model.

[0004] In order to achieve the above-mentioned object, the present invention adopts the following technical solution: an attack detection and defense method for a federated learning model in a mobile scenario, comprising the following steps:

[0005] Step S11: The mobile device requests a service from the edge server;

[0006] Step S12: The edge server generates a federated learning model, a zero-knowledge proof parameter secret function s(x) for device selection, a proof key α, a verification key β, and a zero-knowledge proof parameter secret function e for local model verification according to the characteristics of the requested service.t (ω), proof key α * , verification key β * and Pedersen commitment parameters (p, g, q, h);

[0007] Step S13: The edge server completes the device selection based on zero-knowledge proof;

[0008] Step S14: The edge server broadcasts the federated learning global model of the task and the secret function e of the zero-knowledge proof of local model verification t (ω) and the proof key α * , and commitment to this round of global models Send verification key β to participating devices * To blockchain;

[0009] Step S15: The device determines the authenticity of the received training task;

[0010] Step S16: The device performs local training and generates a certificate about the local model of this round of iteration;

[0011] Step S17: The blockchain verifies the reliability of the received local model;

[0012] Step S18: The blockchain signs the verified local model and uploads the proof, commitment and signature to the edge server;

[0013] Step S19: When the edge server receives the local model, it adds the valid signature and Pedersen commitment of the local model, performs weighted averaging on the model, and updates the global model;

[0014] Preferably, in step S13, the edge server completes the selection of the device based on zero-knowledge proof, and the specific steps are as follows:

[0015] Step S201: The edge server generates a threshold Pedersen commitment for the task based on the task characteristics. The calculation formula is as follows:

[0016]

[0017] Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, r thr It is the minimum requirement of the mission for equipment reliability;

[0018] Step S202: The edge server sends the secret function s0(x) and the proof key α to the mobile device, and the verification key β to the blockchain;

[0019] Step S203: The mobile device uses the certification key α to encrypt the secret function s(x) to generate a certification and Pedersen promised and send it to the blockchain;

[0020] Step S204: The blockchain uses the zero-knowledge verification key β to verify the received step S205 Perform verification. If the verification is successful, go to step S205; otherwise, go to step S207;

[0021] Step S205: Send the verified certificate to the edge server;

[0022] Step S206: The edge server randomly selects 5 devices to complete the local model based on the valid proof;

[0023] Step S207: reject the training request of the device.

[0024] Preferably, in the secret function s(x) of step S203, s(x) is a function that quantifies the reliability of the device based on computing resources, communication resources, distance from the edge server, and movement speed. The calculation formula is:

[0025]

[0026] Among them, t represents the tth global iteration of federated learning, x1 represents the frequency of the device’s central processor, x2 represents the number of required CPU cycles, x3 represents the vehicle’s computing reliability, x4 represents the communication bandwidth allocated to the device, x5 represents the communication link between the device and the edge server, x6 represents the distance between the device and the edge server, x7 represents the device’s transmit power, and N0 represents the channel noise.

[0027] Preferably, in step S203, the device generates a Pedersen commitment The calculation formula is:

[0028]

[0029] Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, is the reliability of device v.

[0030] Preferably, in step S15, the device determines the authenticity of the received training task, and the specific steps are as follows:

[0031] Step S301: The device receives the global model ω broadcast by the edge servert and Pedersen promised

[0032] Step S302: The device determines the global model ω t If it is a simple combination of {0,1}, go to step S304; otherwise, go to step S303;

[0033] Step S303: The device determines the received and Are they equal? ​​If they are equal, go to step S16; otherwise, go to step S304;

[0034] Step S304: reject this training task.

[0035] Preferably, in step S16, the device performs local training and generates a certificate about the local model of this round of iteration, and the specific steps are as follows:

[0036] Step S401: The device uses the data collected by itself to perform local model training. The formula is as follows:

[0037]

[0038] in, represents the local model parameters of vehicle v at the tth global iteration, represents the loss function of device v, is the data sample d v The loss function, D v Represents the number of data samples of the device, η v Represents the learning rate of device v during local model training, yes The gradient of

[0039] Step S402: The device generates a validity commitment for the local model

[0040]

[0041] Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, is the reliability of device v when performing local training at t global iterations;

[0042] Step S403: The device uses the secret function e t (ω) and the proof key α * Generate local model Proof

[0043] Step S404: Device upload commitment and proof To the blockchain.

[0044] Preferably, in step S17, the blockchain verifies the reliability of the received local model, and the specific steps are as follows:

[0045] Step S501: The blockchain receives the proof of the local model in step S16 and commitment

[0046] Step S502: Blockchain uses the data set submitted by device v during the registration process To verify the local model Is it trained with real data from device v?

[0047]

[0048] in, Represents the t-th local model of device v The contribution value of , test is the defined local model evaluation function, It is used to verify the tth local model If The value is in the last three places and Then go to step S505; otherwise, go to step S503;

[0049] Step S503: Blockchain gives sign:

[0050]

[0051] in, represents signature, Hash is a hash function, is the t-th model parameter of device v, It is used to verify the tth local model of the dataset.

[0052] Step S504: Blockchain will prove the local model Pedersen promises and signature Send to edge server;

[0053] Step S505: Wait for a new round of global iteration of federated learning.

[0054] Preferably, in step S19, the edge server quantifies the contribution value of the local model and uses it as a weight for weighted aggregation to complete the update of the local model. The specific calculation formula is as follows:

[0055]

[0056] Among them, ω t is the global model parameter at the tth iteration, are the local model parameters of device v at iteration t, yes The weight value is quantized The contribution is worth it, Represents a device dataset authenticated by blockchain.

[0057] Preferably, in steps S204 and S502, the verifier will accept each valid zero-knowledge proof π, effectively avoiding the one-sidedness of the global model and ensuring fairness between devices and the integrity of the global model, namely:

[0058]

[0059] Among them, s is the parameter vector of the secret function, crs is the public string, S is the arithmetic circuit of the secret function, ω is the model parameter, ver() represents the verification function, set() represents the parameter setting function, and pro() represents the proof function.

[0060] Preferably, in step S13 and step S17, no matter it is the process of device selection or local model reliability proof, the proof size is fixed, the proof process is concise, and the required delay is short, which is suitable for dynamic scenarios where the device moves.

[0061] Compared with the prior art: The beneficial effects of the present invention are:

[0062] 1. The present invention realizes user selection and model verification of federated learning under the contactless condition between the edge server and the device in the mobile scenario, and protects the privacy information of the device.

[0063] 2. The present invention judges the authenticity of the local model of federated learning based on proofs and Pedersen commitments. Every valid proof will be received, which improves the comprehensiveness of the federated learning model; any false proof will be detected and broadcast to all users, which enhances the security of the federated learning model.

[0064] 3. In the present invention, the proof size is fixed, the required proof calculation and signaling overhead is small, and the delay is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 is a flow chart of the present invention;

[0066] Figure 2 Schematic diagram of a device selection method based on zero-knowledge proof in an embodiment of the present invention;

[0067] Figure 3 Schematic diagram of a model reliability verification method based on authenticated zero-knowledge proof in an embodiment of the present invention. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present invention will be described clearly and completely below so that those skilled in the art can better understand the advantages and features of the present invention, thereby making a clearer definition of the protection scope of the present invention. The embodiments described in the present invention are only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention.

[0069] Example

[0070] The global model aggregation scheme of the present invention is weighted average, that is:

[0071]

[0072] Among them, ω t is the global model parameter at the tth iteration, are the local model parameters of device v at iteration t, yes The weight value is quantized The contribution is worth it, Represents a device dataset authenticated by blockchain.

[0073] A method for detecting and defending against attacks on a federated learning model in a mobile scenario comprises the following steps:

[0074] Step S11: The mobile device requests a service from the edge server;

[0075] Step S12: The edge server generates a federated learning model according to the characteristics of the requested service, zero-knowledge proof parameters for device selection (secret function s(x), proof key α, verification key β), and zero-knowledge proof parameters for local model verification (secret function e t (ω), proof key α * , verification key β * ) and Pedersen commitment parameters (p, g, q, h);

[0076] Step S13: The edge server completes the device selection based on zero-knowledge proof;

[0077] Step S14: The edge server broadcasts the federated learning global model of the task and the secret function e of the zero-knowledge proof of local model verification t(ω) and the proof key α * , and commitment to this round of global models Give participants equipment;

[0078] Step S15: The device determines the authenticity of the received training task;

[0079] Step S16: The device performs local training and generates a certificate about the local model of this round of iteration;

[0080] Step S17: The blockchain verifies the reliability of the received local model;

[0081] Step S18: The blockchain signs the verified local model and uploads the proof, commitment and signature to the edge server;

[0082] Step S19: The edge server receives the local model. When the local model has a valid signature and Pedersen commitment, the model is weighted averaged and the global model is updated; otherwise, go to step S20;

[0083] Step S20: This round of iteration ends, and a new round of cycle begins with step S13.

[0084] Specifically, in step S13, the edge server completes the selection of the device based on zero-knowledge proof, and the specific steps are as follows:

[0085] Step S201: The edge server generates a threshold Pedersen commitment for the task based on the task characteristics. The calculation formula is as follows:

[0086]

[0087] Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, r thr It is the minimum requirement of the mission for equipment reliability;

[0088] Step S202: The edge server sends the secret function s0(x) and the proof key α to the mobile device, and the verification key β to the blockchain;

[0089] Step S203: The mobile device uses the certification key α to encrypt the secret function s(x) to generate a certification and Pedersen promised and send it to the blockchain;

[0090] Step S204: The blockchain uses the zero-knowledge verification key β to verify the received step S205 Perform verification. If the verification is successful, go to step S205; otherwise, go to step S207;

[0091] Step S205: Send the verified certificate to the edge server;

[0092] Step S206: The edge server randomly selects 5 devices to complete the local model based on the valid proof;

[0093] Step S207: reject the training request of the device.

[0094] In the secret function s(x) of step S203, s(x) is used to quantify the reliability of the device based on computing resources, communication resources, distance from the edge server, and movement speed. The calculation formula is:

[0095]

[0096] Among them, t represents the tth global iteration of federated learning, x1 represents the frequency of the device’s central processor, x2 represents the number of required CPU cycles, x3 represents the vehicle’s computing reliability, x4 represents the communication bandwidth allocated to the device, x5 represents the communication link between the device and the edge server, x6 represents the distance between the device and the edge server, x7 represents the device’s transmit power, and N0 represents the channel noise.

[0097] In step S203, the device generates a Pedersen commitment The calculation formula is:

[0098]

[0099] Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, is the reliability of device v.

[0100] Specifically, in step S15, the device determines the authenticity of the received training task, and the specific steps are as follows:

[0101] Step S301: The device receives the global model ω broadcast by the edge server t and Pedersen promised

[0102] Step S302: The device determines the global model ω t If it is a simple combination of {0,1}, go to step S304; otherwise, go to step S303;

[0103] Step S303: The device determines the received and Are they equal? ​​If they are equal, go to step S16; otherwise, go to step S304;

[0104] Step S304: reject this training task.

[0105] Specifically, in step S16, the specific steps of local model training and model proof generation are as follows:

[0106] Step S401: The device uses the data collected by itself to perform local model training. The formula is as follows:

[0107]

[0108] in, represents the local model parameters of vehicle v at the tth global iteration, represents the loss function of device v, is the data sample d v The loss function, D v Represents the number of data samples of the device, η v Represents the learning rate of device v during local model training, yes The gradient of

[0109] Step S402: The device generates a validity commitment for the local model

[0110]

[0111] Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, is the reliability of device v when performing local training at t global iterations;

[0112] Step S403: The device uses the secret function e t (ω) and the proof key α * Generate local model Proof

[0113] Step S404: Device upload commitment and proof To the blockchain.

[0114] Specifically, in step S17, the blockchain verifies the reliability of the received local model. The specific steps are as follows:

[0115] Step S501: The blockchain receives the proof of the local model in step S16 and commitment

[0116] Step S502: Blockchain uses the data set submitted by device v during the registration process To verify the local model Is it trained with real data from device v?

[0117]

[0118] in, Represents the t-th local model of device v The contribution value of teat is the defined local model evaluation function. It is used to verify the tth local model If The value is in the last three places and Then go to step S505; otherwise, go to step S503;

[0119] Step S503: Blockchain gives sign:

[0120]

[0121] in, represents signature, Hash is a hash function, is the t-th model parameter of device v, It is used to verify the tth local model of the dataset.

[0122] Step S504: Blockchain will prove the local model Pedersen promises and signature Send to edge server;

[0123] Step S505: Wait for a new round of global iteration of federated learning.

[0124] Among them, in steps S204 and S502, the verifier will accept each valid zero-knowledge proof, effectively avoiding the one-sidedness of the global model, ensuring fairness between devices and the integrity of the global model, that is:

[0125]

[0126] Among them, s is the parameter vector of the secret function, crs is the public string, S is the arithmetic circuit of the secret function, ver() represents the verification function, set() represents the parameter setting function, and pro() represents the proof function.

[0127] Among them, in step S13 and step S17, whether it is the process of device selection or local model reliability proof, the proof size is fixed, the proof process is concise, and the required delay is short, which is suitable for dynamic scenarios where the device moves.

[0128] In summary, the present invention realizes an attack detection and defense method for a federated learning model in a mobile scenario, knows the reliability value of a device and the contribution value of a local model without contacting the user, receives each valid proof, protects the privacy of the user, and ensures the comprehensiveness of the global model; any attacker cannot generate valid proofs and commitments even if they know the zero-knowledge proof and the Pedersen commitment parameters, effectively defends against malicious attacks, and accelerates the convergence of the model; the proof size is fixed, the required additional communication and computing overhead is small, and the algorithm complexity is low.

Claims

1. A method for detecting and defending against attacks on a federated learning model in a dynamic scenario, characterized in that: The steps include: Step S11: The mobile device requests a service from the edge server; Step S12: The edge server generates a federated learning model, a zero-knowledge proof parameter secret function s(x) for device selection, a proof key α, a verification key β, and a zero-knowledge proof parameter secret function e for local model verification according to the characteristics of the requested service. t (ω), proof key α * , verification key β * and Pedersen commitment parameters p, g, q, h; Step S13: The edge server completes the device selection based on zero-knowledge proof; Step S14: The edge server broadcasts the federated learning global model of the task and the secret function e of the zero-knowledge proof of local model verification t (ω) and the proof key α * , and commitment to this round of global models Send verification key β to participating devices * To blockchain; Step S15: The device determines the authenticity of the received training task; Step S16: The device performs local training and generates a certificate about the local model of this round of iteration; Step S17: The blockchain verifies the reliability of the received local model; Step S18: The blockchain signs the verified local model and uploads the proof, commitment and signature to the edge server; Step S19: When the edge server receives the local model, it adds the valid signature and Pedersen commitment of the local model, performs weighted averaging on the model, and updates the global model; Step S20: This round of iteration ends, and a new round of cycle begins with step S13.

2. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 1, characterized in that: In step S13, the edge server completes the selection of the device based on zero-knowledge proof, and the specific steps are as follows: Step S201: The edge server generates a threshold Pedersen commitment for the task based on the task characteristics. The calculation formula is as follows: Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, r thr It is the minimum requirement of the mission for equipment reliability; Step S202: The edge server sends the secret function s0(x) and the proof key α to the mobile device, and the verification key β to the blockchain; Step S203: The mobile device uses the certification key α to encrypt the secret function s(x) to generate a certification and Pedersen promised and send it to the blockchain; Step S204: The blockchain uses the zero-knowledge verification key β to verify the received step S205 Perform verification. If the verification is successful, go to step S205; otherwise, go to step S207; Step S205: Send the verified certificate to the edge server; Step S206: The edge server randomly selects 5 devices to complete the local model based on the valid proof; Step S207: reject the training request of the device.

3. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 2, characterized in that: In the secret function s(x) of step S203, s(x) is a function that quantifies the reliability of the device based on computing resources, communication resources, distance from the edge server, and movement speed. The calculation formula is: Among them, t represents the tth global iteration of federated learning, x1 represents the frequency of the device’s central processor, x2 represents the number of required CPU cycles, x3 represents the vehicle’s computing reliability, x4 represents the communication bandwidth allocated to the device, x5 represents the communication link between the device and the edge server, x6 represents the distance between the device and the edge server, x7 represents the device’s transmit power, and N0 represents the channel noise.

4. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 2, characterized in that: In step S203, the device generates a Pedersen commitment The calculation formula is: Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, is the reliability of device v.

5. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 1, characterized in that: In step S15, the device determines the authenticity of the received training task. The specific steps are as follows: Step S301: The device receives the global model ω broadcast by the edge server t and Pedersen promised Step S302: The device determines the global mode t If it is a simple combination of {0,1}, go to step S304; Otherwise, go to step S303; Step S303: The device determines the received and Are they equal? ​​If they are equal, go to step S16; Otherwise, go to step S304; Step S304: reject this training task.

6. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 1, characterized in that: In step S16, the device performs local training and generates a certificate about the local model of this round of iteration. The specific steps are as follows: Step S401: The device uses the data collected by itself to perform local model training. The formula is as follows: in, represents the local model parameters of vehicle v at the tth global iteration, represents the loss function of device v, is the data sample d v The loss function, D v Represents the number of data samples of the device, η v Represents the learning rate of device v during local model training, yes The gradient of Step S402: The device generates a validity commitment for the local model Among them, p and q are large prime numbers, and p is divisible by q. is the only subgroup of the q-order group of p generated by g, h is any element in the subgroup, a is a random factor, is the reliability of device v when performing local training at t global iterations; Step S403: The device uses the secret function e t (ω) and the proof key α * Generate local model Proof Step S404: Device upload commitment and proof To the blockchain.

7. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 1, characterized in that: In step S17, the blockchain verifies the reliability of the received local model, and the specific steps are as follows: Step S501: The blockchain receives the proof of the local model in step S16 and commitment Step S502: Blockchain uses the data set submitted by device v during the registration process To verify the local model Is it trained with real data from device v? in, Represents the t-th local model of device v The contribution value of , test is the defined local model evaluation function, It is used to verify the tth local model If The value is in the last three places and Then go to step S505; otherwise, go to step S503; Step S503: Blockchain gives sign: in, represents signature, Hash is a hash function, is the t-th model parameter of device v, It is used to verify the tth local model Datasets; Step S504: Blockchain will prove the local model Pedersen promises and signature Send to edge server; Step S505: Wait for a new round of global iteration of federated learning.

8. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 1, characterized in that: In step S19, the edge server quantifies the contribution value of the local model and uses it as the weight to perform weighted average on the local model to complete the update of the global model. The specific calculation formula is as follows: Among them, ω t is the global model parameter at the tth iteration, are the local model parameters of device v at iteration t, yes The weight value is quantized The contribution is worth it, Represents a device dataset authenticated by blockchain.

9. The attack detection and defense method for a federated learning model in a mobile scenario according to claim 2 or 7, characterized in that: In steps S204 and S502, the verifier will accept each valid zero-knowledge proof π, effectively avoiding the one-sidedness of the global model and ensuring fairness between devices and the integrity of the global model, namely: Among them, s is the parameter vector of the secret function, crs is the public string, S is the arithmetic circuit of the secret function, ω is the model parameter, ver() represents the verification function, set() represents the parameter setting function, and pro() represents the proof function.

Images