Method for realizing member inference attack by controlling convolution kernel parameters

Abstract

The invention relates to the field of federated learning privacy security, in particular to a method for realizing member inference attack by controlling convolution kernel parameters. Firstly, an attacker designs convolution kernel parameters according to feature distribution of a part of a convolution region of a target sample, then records a non-zero gradient position of the target sample on a convolution kernel after back propagation, and sends a global model to a participant for local training, and finally, when the participant uploads a model update, the target sample is updated. And an attacker compares whether the non-zero gradient position of the manipulated convolution kernel is consistent with the recorded non-zero gradient position, so that member inference attack is implemented in a federated learning scene, and the technical problem that the traditional member inference attack cannot fully utilize a federated learning framework to improve the attack performance is solved.

Description

Technical Field

[0001] The present invention relates to the fields of machine learning, federated learning, and membership inference attacks. More specifically, it relates to the convolution kernel construction and model training of machine learning models, distributed model training technology in federated learning, and membership inference attacks that determine whether a target sample exists in a model training set. Background Art

[0002] The field of machine learning has made significant progress in the past few years, and deep learning has become a key component of this field. The training and application of deep learning models rely heavily on large amounts of user data. This training sample data contains a wealth of personal privacy information, such as personal identification information and image information. With the widespread adoption of deep learning applications, the risk of privacy leaks is also increasing dramatically.

[0003] Federated learning, a distributed data processing method in the field of machine learning, achieves privacy protection by ensuring that model training data does not leave the domain, addressing the privacy leakage of local training sample data. Furthermore, in the field of machine learning, the membership inference attack proposed by Shokri et al. has been recognized as a major privacy threat in recent years. Membership inference attacks are used to determine whether a target sample exists in the training dataset of the target model. However, classic membership inference attacks are performed during the model inference phase, making them difficult to extend to federated learning scenarios. Because federated learning involves multiple participants training the model, classic membership inference does not know to which participant the inferred member sample belongs.

[0004] Previous researchers have proposed solutions to effectively carry out membership inference attacks in federated learning scenarios. Pasquini et al. proposed a machine learning-based approach to construct a model with membership inference attack capabilities, enabling membership inference attacks against specific target participants in federated learning scenarios. This approach uses a custom loss function and selected target samples to train a set of model parameters. This allows the model with these parameters to reveal the presence of the target samples during the training phase of the federated learning model. This mechanism also exploits gradient suppression attacks to undermine the secure aggregation protocol of federated learning, allowing all participants' model updates to still reveal the target participant's model update information after aggregation. Summary of the Invention

[0005] This paper proposes a method for implementing a membership inference attack by manipulating convolution kernel parameters. The attack involves a target participant, non-target participants, and an attacker. Using target samples and discriminant convolutional constructs, the attacker injects discriminant convolutions into the modified model, allowing the federated learning participant to train the model locally, revealing the presence of the target sample in the local training set.

[0006] The purpose of the present invention is achieved through the following technical methods: A method for implementing a membership inference attack by manipulating convolution kernel parameters, the method comprising: Step 1: In the initialization phase, the attacker selects a convolution region of the target sample to construct the corresponding recognition convolution; Step 2: The attacker initializes a verification model with the same structure as the global model on the server side, injects the recognition convolution into the first convolution layer of the verification model, and inserts the HardTanh activation function between the recognition convolution and the next layer. The attacker uses the target sample to perform forward propagation and backward propagation in the verification model to obtain the gradients of each model parameter, and records the positions of all non-zero gradient parameters in the recognition convolution of the verification model. Step 3: Inject the recognition convolution into the first convolution layer of the model, and insert the Hard Tanh activation function between the recognition convolution and the next layer structure. Send the processed model to the target participants. After receiving the model sent by the server, each participant uses the local training set to train the model. After the training is completed, upload their own model. Step 4: During the server aggregation model update phase, the attacker receives the model updates uploaded by each participant on the server. By comparing the gradients generated by the target participant's model update on the recognition convolution with those of the verification model, the attacker can determine whether the target sample exists in the target participant's local training set. The beneficial effects of this scheme are: compared with previous methods, this method does not require the use of additional sample sets to assist in attack implementation, the attacker needs less attack knowledge, and the time overhead of attack implementation is less, and the attack accuracy is higher. Furthermore, in step 1, the method for manipulating the convolution kernel parameters to construct the identification convolution consists of two components: zero value constraint and maximum and minimum value constraint. In the zero value constraint, the identification convolution sets a large value on the convolution kernel weight parameter corresponding to the zero element of the selected convolution area of ​​the target sample, and the remaining weight parameters are set to zero. In the maximum and minimum value constraint, the larger and smaller value intervals are set according to the maximum and minimum values ​​respectively, and the convolution area contains N big The larger eigenvalue μ big and N small The smaller eigenvalue μ small , the larger eigenvalue μ in the selected convolution region of the target sample big The corresponding weight parameter of the recognition convolution is set to in is a regulation factor, ε is a scaling factor, and the selected convolution region of the target sample has a smaller eigenvalue μ small The corresponding weight parameter of the recognition convolution is set to The remaining weight parameters are set to zero. This convolution kernel setting makes the feature extraction value equal to Then set the bias to The feature extraction value is made equal to zero, and a non-zero gradient can be generated after passing through the HardTanh activation function. Furthermore, in step 2, the attacker inserts the recognition convolution into the first convolution layer of the model to obtain the verification model, and inserts the HardTanh activation function between the recognition convolution and the next layer structure. The target sample is used to perform forward propagation and backward propagation of the model to generate parameter gradients, and the parameter position p with non-zero gradient in the recognition convolution of the verification model is recorded, where p is a tuple with three values, and the three elements represent the channel subscript, row subscript and column subscript respectively. A position tuple p can uniquely identify the position of a non-zero gradient parameter of the recognition convolution. The adversary records all the non-zero gradient parameter positions of the recognition convolution of the verification model as a set P = {p1, p2, ...}. Furthermore, in step 3, the attacker injects the recognition convolution into the first convolutional layer of the model and inserts a Hard Tanh activation function between the recognition convolution and the next layer. The processed model is then sent to the target participant. Each participant receives the model sent by the server and trains it using samples from the local training set. Once the training loss reaches the required value, the model training is considered complete and each participant uploads the updated model. Furthermore, in step 4, during the server aggregation model update phase, the attacker receives the model updates uploaded by each participant on the server, and compares the gradient generated by the target participant's model update on the recognition convolution with the verification model through the previously recorded non-zero gradient position set P = {p1, p2, ...}. If there is a non-zero gradient at each position in the set P = {p1, p2, ...}, it is judged that the target sample exists in the local training set of the target participant. If there is no non-zero gradient at any position in the set P = {p1, p2, ...}, it is judged that the target sample does not exist in the local training set of the target participant. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical methods of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0008] Figure 1 Flowchart of steps for implementing membership inference attack by manipulating convolution kernel parameters Figure 2This is a diagram of a framework for implementing a member inference attack based on recognition convolution according to an embodiment of the present invention; Figure 3 Flowchart for implementing membership inference attack based on identification convolution; Figure 4 This is a comparison chart of the experimental results of the member inference attack accuracy of the embodiment of the present invention and the existing design in the FedSGD scenario; Figure 5 A comparison chart of the accuracy of member inference attacks between the embodiment of the present invention and the existing design in the FedAVG scenario Specific implementation

[0009] The following is a clear and complete description of the technical methods in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and do not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0010] See also Figure 1 The present invention proposes a method for implementing a membership inference attack by manipulating convolution kernel parameters, comprising the following steps: S1: The attacker uses the local convolution region of the target sample to construct the recognition convolution S2: The attacker injects the recognition convolution into the global model of federated learning, performs forward propagation and back propagation, and records the non-zero gradient position of the recognition convolution. S3: The attacker sends the global model to federated learning participants for local model training S4: After the server receives the participant's model update, the attacker checks whether the location where the non-zero gradient of the identification convolution is generated is the same as the recorded location, thereby determining whether to implement the member inference attack Experimental data In this specific embodiment, the datasets used are CIFAR10, CIFAR100, and TinyImagenet200, public image classification machine learning datasets. CIFAR10 contains 50,000 training samples and 10,000 test samples from 10 different categories; CIFAR100 contains 50,000 training samples and 10,000 test samples from 100 different categories; and TinyImagenet200 contains 100,000 training samples and 10,000 test samples from 200 different categories. The experiment uses each of the three training sets for evaluation and comparison with previous methods. Implementation Process The following table shows the implementation process (pseudo-code algorithm) of a method for implementing a membership inference attack by manipulating convolution kernel parameters: Algorithm pseudocode line 1: The attacker uses the target sample to obtain the gradient of the parameter after the model is inferred. Line 2 of the algorithm pseudocode: The attacker records the location of non-zero gradients in the model's recognition convolution. Line 3 of the algorithm pseudocode: The attacker records the location of non-zero gradients in the recognition convolution of the model update uploaded by the target participant of the federated learning. Algorithm pseudocode lines 4-9: Compare the non-zero gradient positions one by one. If the non-zero gradient positions updated by the target participant model contain all the non-zero gradient positions recorded by the attacker, the method returns true, otherwise it returns false. Furthermore, the present invention compares the experimental results with existing canary-gradient attack methods. Specifically, the present invention compares a membership inference attack method that manipulates convolution kernel parameters with a membership inference attack method that manipulates model parameters based on machine learning. We use MIA Accuracy as the experimental evaluation criterion to verify the effectiveness of our proposed method of implementing a membership inference attack by manipulating convolution kernel parameters. The specific evaluation annotations are defined as follows: True positive (TP): The actual result is positive and the test result is also positive. True negative (TN): The actual result is negative and the test result is also negative. False positive (FP): The test result is positive even though the actual result is negative. False negative (FN): The test result is negative even though the test result is actually positive. MIA Accuracy: The percentage of samples correctly detected by the member inference attack to the total samples. The formula is as follows: For further information, see Figure 4 and Figure 5 Compared with the MIA Accuracy evaluation standard of the canary-gradient attack method proposed by Pasquini et al., the present invention effectively improves the MIA Accuracy evaluation standard of the attack.

[0011] The present invention implements the member inference attack method based on manipulating convolution kernel parameters, and the steps include: 1) Constructing the recognition convolution: Manipulating the convolution kernel parameters The method of constructing the recognition convolution consists of two components: zero value constraint and maximum and minimum value constraint. In the zero value constraint, the recognition convolution sets a large value on the convolution kernel weight parameter corresponding to the zero element of the selected convolution area of ​​the target sample, and the remaining weight parameters are set to zero. In the maximum and minimum value constraints, the larger and smaller value intervals are set according to the maximum and minimum values ​​respectively, and the convolution area contains N big The larger eigenvalue μ big and N small The smaller eigenvalue μ small , the larger eigenvalue μ in the selected convolution region of the target sample big The corresponding weight parameter of the recognition convolution is set to in is a regulation factor, ε is a scaling factor, and the selected convolution region of the target sample has a smaller eigenvalue μ small The corresponding weight parameter of the recognition convolution is set to The remaining weight parameters are set to zero. This convolution kernel setting makes the feature extraction value equal to Then set the bias to The feature extraction value is made equal to zero, and a non-zero gradient can be generated after passing through the HardTanh activation function. 2) Record the non-zero gradient position of the target sample on the recognition convolution: The attacker inserts the recognition convolution into the first convolution layer of the model to obtain the verification model, and inserts the HardTanh activation function between the recognition convolution and the next layer structure. Use the target sample to perform a forward propagation and backward propagation of the model to generate parameter gradients, and record the parameter position p with non-zero gradient in the recognition convolution of the verification model, where p is a tuple with three values, and the three elements represent the channel subscript, row subscript and column subscript respectively. A position tuple p can uniquely identify the position of a non-zero gradient parameter of the recognition convolution. The adversary records all the non-zero gradient parameter positions of the recognition convolution of the verification model as a set P = {p1, p2, ...}. 3) Participants train the model and upload model updates: The attacker injects the recognition convolution into the first convolutional layer of the model and inserts a Hard Tanh activation function between the recognition convolution and the next layer. The processed model is then sent to the target participant. Each participant receives the model from the server and trains it using samples from the local training set. Once the training loss reaches the required value, the model training is considered complete and each participant uploads the model update. 4) The server receives the model updates of the participants and implements the member inference attack: In the server aggregation model update phase, the attacker receives the model updates uploaded by each participant on the server, and compares the gradient generated by the target participant's model update on the recognition convolution with the verification model through the previously recorded non-zero gradient position set P = {p1, p2, ...}. If there is a non-zero gradient at each position in the set P = {p1, p2, ...}, it is judged that the target sample exists in the local training set of the target participant. If there is no non-zero gradient at any position in the set P = {p1, p2, ...}, it is judged that the target sample does not exist in the local training set of the target participant. This paper proposes a method for implementing a membership inference attack by manipulating convolution kernel parameters. This method addresses the technical issue that traditional membership inference attacks fail to fully leverage the federated learning framework to improve attack performance. By manipulating convolution kernel parameters to construct discriminative convolutions and combining them with the Hard Tanh activation function, the attack overhead is reduced. Furthermore, this method is implemented directly on the first convolutional layer of a convolutional model, effectively addressing the issue in previous studies where the attack effectiveness is affected by the size of the model structure.

Claims

1. A method for implementing a membership inference attack by manipulating convolution kernel parameters, characterized in that: The technologies include: Step 1: In the initialization phase, the attacker selects the selected convolution region of the target sample to construct the corresponding recognition convolution; Step 2: The attacker initializes a verification model with the same structure as the global model on the server side, injects the recognition convolution into the first convolution layer of the verification model, and inserts the HardTanh activation function between the recognition convolution and the next layer. The attacker uses the target sample to perform forward propagation and backward propagation in the verification model to obtain the gradients of each model parameter, and records the positions of all non-zero gradient parameters in the recognition convolution of the verification model. Step 3: Inject the recognition convolution into the first convolution layer of the model, and insert the HardTanh activation function between the recognition convolution and the next layer structure. Send the modified model to the federated learning participants for local model training; Step 4: The attacker receives the model updates uploaded by each participant on the server, and compares the gradient generated by the target participant's model update on the recognition convolution with the verification model to determine whether the target sample exists in the target participant's local training set.

2. The method for implementing a member inference attack by manipulating convolution kernel parameters according to claim 1, characterized in that: The process of step 1 is specifically as follows: The method of constructing the recognition convolution consists of two components: zero value constraint and maximum and minimum value constraint. In the zero value constraint, the recognition convolution sets a large value on the convolution kernel weight parameter corresponding to the zero element of the selected convolution area of ​​the target sample, and the remaining weight parameters are set to zero. In the maximum and minimum value constraint, the larger and smaller value intervals are set according to the maximum and minimum values ​​respectively, and the convolution area contains N big The larger eigenvalue μ big and N small The smaller eigenvalue μ small , the larger eigenvalue μ in the selected convolution region of the target sample big The corresponding weight parameter of the recognition convolution is set to in is a regulation factor, ε is a scaling factor, and the selected convolution region of the target sample has a smaller eigenvalue μ small The corresponding weight parameter of the recognition convolution is set to The remaining weight parameters are set to zero. This convolution kernel setting makes the feature extraction value equal to Then set the bias to The feature extraction value is made equal to zero, and a non-zero gradient can be generated after passing through the HardTanh activation function.

3. The method for implementing a member inference attack by manipulating convolution kernel parameters according to claim 1, characterized in that: The process of step 2 is specifically as follows: The attacker inserts the recognition convolution into the first convolution layer of the model to obtain the verification model, and inserts the HardTanh activation function between the recognition convolution and the next layer structure. The target sample is used to perform forward propagation and backward propagation of the model to generate parameter gradients, and the parameter positions P with non-zero gradients in the recognition convolution of the verification model are recorded, where p is a tuple with three values, and the three elements represent the channel subscript, row subscript, and column subscript respectively. A position tuple p can uniquely identify the position of a non-zero gradient parameter of the recognition convolution. The adversary records all the non-zero gradient parameter positions of the recognition convolution of the verification model as a set P = {p1, p2...}.

4. The method for implementing a member inference attack by manipulating convolution kernel parameters according to claim 1, characterized in that: The process of step 3 is specifically as follows: The recognition convolution is injected into the first convolution layer of the model, and the HardTanh activation function is inserted between the recognition convolution and the next layer structure. The processed model is sent to the target participants. Each participant receives the model sent by the server and uses the samples of the local training set to train the model. Then, when the training loss value reaches the requirement, the model training is considered completed, and each participant uploads the model update.

5. The method for implementing a member inference attack by manipulating convolution kernel parameters according to claim 1, characterized in that: The process of step 4 is specifically as follows: The attacker receives the model updates uploaded by each participant on the server, and compares the gradient generated by the target participant's model update on the recognition convolution with the verification model through the non-zero gradient position set P = {p1, p2, ...} recorded in step 2. If there is a non-zero gradient at each position in the set P = {p1, p2, ...}, it is judged that the target sample exists in the local training set of the target participant. If there is no non-zero gradient at any position in the set P = {p1, p2, ...}, it is judged that the target sample does not exist in the local training set of the target participant.

Images