Privacy protection evaluation method and device based on diffusion model

Abstract

The invention discloses a privacy protection evaluation method and a privacy protection evaluation device based on a diffusion model. The method comprises the following steps: acquiring a self gradient obtained by an attacker client in a federated learning system in a local training process and a global gradient after server aggregation; dynamically estimating gradient information of the damaged benign client based on gradient differences in historical communication rounds, and mapping the gradient differences into low-dimensional condition vectors through a condition encoder; injecting the low-dimensional condition vector into a noise prediction network of a diffusion model through a cross attention mechanism, driving the diffusion model to generate virtual data, and training in a local model by using the virtual data to obtain a forged gradient; and according to the similarity loss between the forged gradient and the estimated gradient, alternately optimizing the parameters of the diffusion model and the generated virtual data until the similarity loss converges. According to the method, the gradients of other clients can be fitted more accurately, and the accuracy and authenticity of data reconstruction are effectively enhanced by utilizing a multi-round gradient difference guide diffusion model.

Description

Technical Field

[0001] This invention relates to the fields of data privacy protection, data security, and next-generation Internet application security, and in particular to a privacy protection assessment method and apparatus based on a diffusion model. Background Technology

[0002] Federated learning, as an important paradigm of distributed collaborative learning, is widely used in data-sensitive fields such as intelligent healthcare, financial risk control, and the Internet of Things. Its core objective is to achieve multi-party collaborative training by sharing model parameters rather than raw data, thereby theoretically ensuring data privacy. Related technologies construct a privacy protection system characterized by "data not leaving the domain" through collaborative operations of local data training, gradient uploading, and server-side aggregation. Specifically, this system covers the entire process from model initialization, local optimization, parameter aggregation to global updates, including key stages such as gradient calculation, communication compression, and differential privacy injection. With the continuous evolution of privacy attack techniques, especially the increasing maturity of data reconstruction methods based on gradient inverse reasoning, existing evaluation methods are no longer sufficient to fully reflect the privacy leakage risks under the federated learning framework.

[0003] However, existing privacy protection assessment methods directly employ Generative Adversarial Networks (GANs) or static gradient analysis techniques without fully considering attack paths from the client's perspective. This can lead to a simplistic assessment scenario, failing to effectively identify privacy theft attacks initiated by the client. Specifically, traditional methods suffer from insufficient reconstruction accuracy in high-resolution data scenarios and rely on server-side global gradient information, making it difficult to simulate the real-world constraint that clients can only access their own and aggregated gradients. While Gradient Guided Diffusion Models (GGDM) introduce a diffusion mechanism to improve data generation quality, their assessment scope remains limited to server-side attacks, failing to cover more covert privacy theft attacks initiated by the client. Therefore, existing technologies have significant limitations in evaluating the privacy protection capabilities of federated learning, failing to accurately reflect its security in complex attack environments, thus affecting the optimization and deployment effectiveness of privacy protection mechanisms. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] This invention proposes a privacy protection evaluation method based on a diffusion model, which aims to efficiently and effectively assess the privacy leakage risk under a federated learning framework. In particular, when facing more covert privacy theft attacks initiated from the client based on the diffusion model, the proposed method can be used to accurately reconstruct data by combining the powerful generative capabilities of the diffusion model to more effectively evaluate the effectiveness of privacy protection.

[0006] Another objective of this invention is to propose a privacy protection assessment device based on a diffusion model.

[0007] To achieve the above objectives, this invention proposes a privacy protection assessment method based on a diffusion model, comprising: S1, obtain the attacker's own gradient during local training in the federated learning system and the global gradient aggregated by the server; S2, based on the gradient differences in historical communication rounds, uses the exponential moving average technique to dynamically estimate the gradient information of the benign client, and maps the gradient differences into a low-dimensional conditional vector through a conditional encoder. S3 injects the low-dimensional conditional vector into the noise prediction network of the diffusion model through a cross-attention mechanism, drives the diffusion model to generate virtual data, and uses the virtual data to obtain fake gradients during local model training. S4, based on the similarity loss between the fake gradient and the estimated gradient, alternately optimize the parameters of the diffusion model and the generated virtual data until the similarity loss converges.

[0008] The privacy protection assessment method based on the diffusion model in this invention may also have the following additional technical features: In one embodiment of the present invention, S2 includes: S21, Calculate the difference between the attacker's own gradient and the global gradient in the current communication round, and then weight and fuse this difference with the EMA gradient of the previous round to obtain the estimated gradient of the current round; S22. Based on the distribution characteristics of the federated learning communication rounds, the decay factor in the exponential moving average is dynamically adjusted so that a smaller decay factor is used in the early stage of the communication round to quickly respond to gradient changes, and a larger decay factor is used in the later stage of the communication round to enhance the stability of the estimation.

[0009] In one embodiment of the present invention, S3 includes: S31, cross-attention calculation is performed between the low-dimensional conditional vector and the latent variables of the diffusion model at each time step to enhance the model's ability to perceive the data distribution implied by gradient differences. S32 uses a multi-head cross-attention mechanism to process gradient differences from multiple historical rounds in parallel, thereby improving the generation efficiency and data reconstruction accuracy of the diffusion model in multi-round federated learning.

[0010] In one embodiment of the present invention, S4 includes: S41, with the parameters of the diffusion model fixed, uses gradient descent to optimize the generated dummy data so that the fake gradient is closer to the estimated gradient; S42 uses fixed-generation virtual data to update the parameters of the diffusion model through backpropagation algorithm, thereby improving the model's data reconstruction capability in subsequent generation processes.

[0011] In one embodiment of the present invention, it further includes: S5 performs a structural similarity (SSIM) assessment on the generated virtual data to obtain an SSIM value, which quantifies the degree of similarity between the virtual data and the original data of the victimized benign client. Based on the comparison between the SSIM value and a preset threshold, it is determined whether the privacy protection mechanism under the federated learning framework meets the security requirements, and an assessment report is output.

[0012] To achieve the above objectives, another aspect of the present invention proposes a privacy protection assessment method and apparatus based on a diffusion model, comprising: The gradient acquisition module is used to acquire the attacker's own gradients obtained during local training in the federated learning system, as well as the global gradients aggregated by the server. The gradient estimation module is used to dynamically estimate the gradient information of the victimized benign client based on the gradient differences in historical communication rounds using the exponential moving average technique, and to map the gradient differences into low-dimensional conditional vectors through a conditional encoder. The conditional injection and data generation module is used to inject the low-dimensional conditional vector into the noise prediction network of the diffusion model through a cross-attention mechanism, drive the diffusion model to generate virtual data, and use the virtual data to obtain fake gradients in local model training. The model optimization module is used to alternately optimize the parameters of the diffusion model and the generated virtual data based on the similarity loss between the fake gradient and the estimated gradient, until the similarity loss converges.

[0013] The privacy protection evaluation method and apparatus based on the diffusion model of this invention can more accurately fit the gradients of other clients and effectively enhance the accuracy and authenticity of data reconstruction by using multi-round gradient difference guidance of the diffusion model, thereby better evaluating the potential privacy leakage risks in federated learning.

[0014] The concept of this invention is to introduce the diffusion model into the field of privacy protection evaluation of federated learning, and combine it with the dynamic gradient estimation method to expand the evaluation scope from privacy theft initiated from the server to scenarios where privacy theft is initiated from the client. This allows for a more comprehensive evaluation of the privacy protection capabilities of distributed collaborative learning, represented by federated learning. It also provides new ideas for the innovation of data privacy protection technologies in distributed collaborative learning such as federated learning, and has important theoretical significance and practical application value.

[0015] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0016] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a privacy protection assessment method based on a diffusion model according to an embodiment of the present invention; Figure 2 This is a structural diagram of a privacy protection evaluation device based on a diffusion model according to an embodiment of the present invention. Detailed Implementation

[0017] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] The following description, with reference to the accompanying drawings, outlines a privacy protection assessment method and apparatus based on a diffusion model, according to embodiments of the present invention.

[0020] Compared to traditional evaluation methods based on gradient reconstruction attacks, this invention leverages the powerful generative capabilities of diffusion models, guiding the optimization of the generative model through historical gradient differences, thereby further improving the quality and accuracy of reconstructed target data. Compared to traditional gradient-guided diffusion model evaluation methods, this invention overcomes the limitation of requiring server-side evaluation. It relies solely on multi-round dynamic gradient estimation methods to more accurately fit other client-side gradient-assisted diffusion models for reconstruction, making evaluation easier to implement in real-world scenarios. During the evaluation process, the diffusion model uses gradient differences as a condition, efficiently and accurately reconstructing the target data based on the generative model, gradually approximating the data distribution of the attacked benign participant, thus achieving more efficient privacy theft. This more efficient and covert theft also places new demands on privacy protection capabilities, allowing for a more comprehensive evaluation of the privacy protection effects of federated learning.

[0021] Figure 1 This is a flowchart of a privacy protection assessment method based on a diffusion model according to an embodiment of the present invention, such as... Figure 1 As shown, it includes: S1, obtain the attacker's own gradient obtained during local training in the federated learning system and the global gradient aggregated by the server.

[0022] Specifically, in federated learning systems, acquiring the attacker's own gradients obtained during local training and the global gradients aggregated by the server is a crucial preliminary step for implementing privacy-theft attacks and privacy protection assessments based on diffusion models. The core of this step lies in using gradient information from the model update process to provide a data foundation for subsequent dynamic gradient estimation and data reconstruction.

[0023] At the technical implementation level, in each iteration of federated learning, the attacker's client first performs local training, using its private dataset to optimize the currently received global model parameters using gradient descent, and calculates the local gradient update. This gradient is typically the gradient vector of the model parameters, and its dimension depends on the model structure. For example, in image classification tasks, if a ResNet-18 model is used, the dimension of the gradient vector may reach millions. Simultaneously, during the communication phase, the attacker's client receives the global gradient update broadcast by the server. This gradient is obtained by weighted averaging of all gradients uploaded by all clients using a federated averaging (FedAvg) algorithm.

[0024] In one embodiment of the present invention, a distributed collaborative learning framework, represented by federated learning, is established. In a federated learning system, there is a... One client { } and a central server Among them, there are malicious attacker clients. And the remaining benign clients Set global training objectives for federated learning. (A data classification objective) and the optimization algorithm used 。 The system follows these steps: Initialize the global model. (In round...) At that time, the server Initialize global model parameters This information is then broadcast to all clients. All clients then use this parameter as the starting parameter for their local training.

[0025] Local training phase on each client. (In the...) During round-robin communication, each client Receive global parameters According to the designed global training objectives The resulting loss function Use optimization algorithms Perform local training, see formula (1), where For learning rate, For loss function, This is a local dataset.

[0026]

[0027] Client parameters are aggregated on the central server. (Central server) Collect gradient updates from all clients and calculate global parameter updates using the Federal Average Algorithm, as shown in formula (2). This represents the total amount of data.

[0028]

[0029] Then update the global model: Subsequently, the central server... The updated parameters from this round of aggregation will be passed to each client. This completes the parameter update for federated learning. In a federated learning environment, each client... With central server Instead of directly exchanging data, the two systems only pass model parameters to each other, which theoretically protects the data privacy of each client to a certain extent.

[0030] This step applies to scenarios where malicious attacker clients exist within federated learning systems, especially during distributed training of high-dimensional data such as images and text. Attacker clients, by legitimately participating in the federated learning process, covertly collect gradient information, providing data support for subsequent virtual data generation and privacy-theft attacks.

[0031] This step provides high-quality input conditions for subsequent dynamic gradient estimation and diffusion model training, enabling attackers to more accurately fit the gradient distribution of benign clients, thereby improving the accuracy of data reconstruction and the stealth of attacks. By accurately acquiring and analyzing gradient information, this invention can more comprehensively evaluate the privacy protection capabilities of federated learning systems under client-initiated attacks, providing a quantitative basis for optimizing privacy protection mechanisms.

[0032] S2, based on the gradient differences in historical communication rounds, uses the exponential moving average technique to dynamically estimate the gradient information of the benign client, and maps the gradient differences into a low-dimensional conditional vector through a conditional encoder.

[0033] Specifically, the core of this step lies in dynamically estimating the gradient information of the benign victim client using the Exponential Moving Average (EMA) technique, and then using a conditional encoder to map the gradient differences into low-dimensional conditional vectors, which serve as the generation conditions for the diffusion model. This process plays a crucial role in privacy-theft attacks in federated learning, providing high-quality input conditions for subsequent virtual data generation and gradient forgery.

[0034] In some implementations, the malicious attacker client first collects the global gradient updates from multiple rounds of communication during the federated learning process, as well as its own locally trained gradient information. Preliminary gradient estimation is then performed using formula (4), which involves subtracting the attacker's local gradient from the global gradient and, combined with assumptions about the number of clients and data distribution, estimating the victim client's gradient. However, due to the noise and non-independence of gradient updates in federated learning, single-round estimation results often have significant biases. Therefore, this invention further employs the EMA technique to perform a weighted average of historical gradient differences to improve the stability and accuracy of the estimation.

[0035] In one embodiment of the present invention, the attacker client Based on historical gradient differences during federated learning The implicit data distribution information is used to dynamically estimate the gradient of participants. By leveraging the powerful generative capabilities and high fidelity of the generated data from the diffusion model, virtual data is generated guided by gradient differences. And obtain fake gradients through local training Based on the forged gradient and the estimated gradient of the victimized benign client. The differences between them are used to optimize and adjust the diffusion model. The parameters are optimized simultaneously using virtual data generated through a diffusion model. The similarity loss is calculated when the gradient forged by the attacker's client matches the estimated gradient of the benign victim's client. At convergence, the virtual data generated at this time It can be confidently concluded that this data is very close to the original data of the benign victim client. The specific implementation steps are as follows: Defining the diffusion model architecture. The basic model includes a forward-noise network. ,in For the first t Step-by-step noise-adding data; inverse noise reduction network ,in It is a latent variable. It is a time step; the inverse denoising network maps the two to the data space. Among the conditions The introduction of this feature is key to this invention. Gradient difference is embedded as a generation condition in the diffusion model, enabling efficient and accurate reconstruction of the target data based on the generative model. Specifically, a conditional encoder is constructed. The gradient difference in each round Mapped to a low-dimensional vector Therefore, it should be The noise prediction network for each diffusion step is injected through a cross-attention mechanism, as shown in Equation (3), where It is the attention mechanism function. It is a gradient difference encoding embedding function.

[0036]

[0037] Construction of training data for the diffusion model. Attackers exploit historical global gradient updates. gradients obtained by the attacker during local training Historical gradient differences can be calculated. By analyzing the historical gradient differences in each round Extracting statistical features to obtain implicit data distribution information In multi-user federated learning, the gradients of benign victim clients often need to be estimated. Specifically, assume a malicious attacker is involved... Federated learning rounds, recording global gradients in each round and its own gradient , combined Estimate the gradient of other participants .

[0038] Dynamic gradient estimation. From the perspective of a malicious attacker, the aggregated gradient contains gradient information from all clients. Assume that in the... The round-robin attacker performs basic gradient estimation using formula (4):

[0039] Next, exponentially weighted average gradient estimation is performed. To improve the accuracy of the estimation, malicious attackers will further estimate the gradient of the victimized benign client more accurately by using historical gradients. In this method, the exponential moving average (EMA) technique is used. The malicious attacker records and maintains a list of historical gradients and calculates the EMA gradient using the following formula (5):

[0040] in The decay factor is used to control the impact of historical gradients on the current estimate. It is a weighted average of the global aggregated gradients in historical records, plus the base estimated gradient. Used to represent the estimated benign client gradient.

[0041] This step is applicable to multi-user scenarios in federated learning systems with multiple benign clients. A malicious attacker participates in training locally and records historical gradients, gradually building a gradient profile of the victim clients. The generation of conditional vectors provides input for the subsequent conditional generation process of the diffusion model, enabling the generated virtual data to more accurately match the training behavior of the victim clients.

[0042] This step effectively alleviates the problem of incomplete gradient information in federated learning through dynamic gradient estimation, improving the robustness of gradient reconstruction. Simultaneously, mapping gradient differences to low-dimensional conditional vectors reduces the input dimensionality of the diffusion model, improving generation efficiency and data fidelity, laying the foundation for subsequent high-precision data reconstruction. This method demonstrates stronger concealment and adaptability against privacy-theft attacks, thus providing a more comprehensive evaluation of the privacy protection capabilities of federated learning systems.

[0043] Furthermore, S2 includes: S21, calculate the difference between the attacker's own gradient and the global gradient in the current communication round, and then weight and fuse this difference with the EMA gradient of the previous round to obtain the estimated gradient of the current round.

[0044] Specifically, in the dynamic gradient estimation step, the attacker client calculates the difference between its own gradient and the global gradient in the current communication round, and then weights and fuses this difference with the exponential moving average (EMA) gradient from the previous round to obtain the estimated gradient for the current round. This step is a key step in achieving high-precision data reconstruction in this invention, and its technical implementation is based on the statistical characteristics of gradient updates in federated learning and the conditional generation mechanism of the diffusion model.

[0045] This step relies on modeling and statistical analysis of the gradient update process. In the federated learning framework, the global gradient is a weighted average of the gradients of all clients; therefore, an attacker can infer the gradient distribution of other clients by comparing their own gradient with the global gradient. By introducing the EMA mechanism, historical gradient fluctuations can be effectively smoothed, improving the robustness of the estimation.

[0046] In practical applications, this step is typically performed locally on the attacker's client, without requiring additional communication with the server, thus ensuring the stealth of the attack. Through multiple rounds of iterative gradient estimation and fusion, the attacker can gradually approximate the true gradient distribution of the benign client, providing high-quality input for the subsequent conditional generation of the diffusion model.

[0047] S22. Based on the distribution characteristics of the federated learning communication rounds, the decay factor in the exponential moving average is dynamically adjusted so that a smaller decay factor is used in the early stage of the communication round to quickly respond to gradient changes, and a larger decay factor is used in the later stage of the communication round to enhance the stability of the estimation.

[0048] Specifically, in the dynamic gradient estimation step, this invention dynamically models the gradient information in each round of federated learning communication using the Exponential Moving Average (EMA) technique, and adaptively adjusts the smoothing factor in the EMA according to the distribution characteristics of the communication rounds to improve the accuracy and stability of gradient estimation. In some implementations, the core of this step lies in utilizing the difference between the global gradient update in each round of communication in federated learning and the attacker's local gradient to construct a gradient difference sequence, and then using the EMA to perform a weighted average of these differences, thereby more accurately estimating the gradient information of benign clients.

[0049] At the application level, this step is suitable for client-initiated privacy-stealing attacks in federated learning. Attackers continuously record and analyze gradient differences through the interaction between local training and global parameters. Combined with dynamic EMA estimation methods, they gradually approximate the gradient distribution of a benign client, providing high-quality gradient guidance conditions for subsequent data reconstruction based on a diffusion model.

[0050] This method of dynamically adjusting the EMA decay factor effectively alleviates the problem of inaccurate gradient estimation in traditional static EMA in federated learning. Especially when the client launches an attack, it can more covertly and accurately simulate the gradient behavior of benign clients, thereby significantly improving the generation quality and attack success rate of the diffusion model in data reconstruction tasks. This step provides crucial technical support for subsequent virtual data generation and privacy protection evaluation, enhancing the practicality of this invention in complex federated learning environments and the realism of attack simulations.

[0051] S3 injects low-dimensional conditional vectors into the noise prediction network of the diffusion model through a cross-attention mechanism, driving the diffusion model to generate virtual data, and using the virtual data to obtain fake gradients during local model training.

[0052] Specifically, the attacker's client injects a low-dimensional conditional vector into the noisy prediction network of the diffusion model via a cross-attention mechanism to drive the diffusion model to generate virtual data. This virtual data is then used to train the model locally to generate fake gradients. This step is the core of the client-side privacy-stealing attack in this invention, and its technical implementation is based on the deep integration of the diffusion model's conditional generation capability and gradient guidance mechanism.

[0053] This step is crucial for privacy protection evaluation in federated learning. It overcomes the limitations of traditional methods that rely on server-side attacks, enabling attackers to launch more covert data reconstruction attacks from the client's perspective. By combining dynamic gradient estimation with the conditional generation mechanism of the diffusion model, the accuracy and diversity of the reconstructed data are significantly improved, providing an effective means to evaluate the robustness of privacy protection mechanisms on the client side.

[0054] In one embodiment of the invention, virtual data generation and gradient spoofing are performed. After the above steps, the architectural parameters of the diffusion model and the data for training the diffusion model are ready. Therefore, based on the current gradient-encoded conditions... The reverse diffusion process is performed to generate virtual data, as shown in formula (6), where It is a latent variable. It is a time step.

[0055]

[0056] in Indicates the first The virtual data generated by the diffusion model after each round of federated learning is then integrated to obtain a virtual dataset. The next step for malicious attackers is to use a global model. Perform local training using a virtual dataset. The fake gradient is calculated as follows: .

[0057] Furthermore, S3 includes: S31 performs cross-attention calculations between the low-dimensional conditional vector and the latent variables of the diffusion model at each time step to enhance the model's ability to perceive the data distribution implied by gradient differences.

[0058] Specifically, this step involves encoding the gradient difference information extracted from federated learning into a low-dimensional conditional vector and interacting it with the latent variables of the diffusion model during the denoising process, thereby guiding the model to more accurately capture the distribution characteristics of the target data during the generation process.

[0059] From a technical implementation perspective, the process first uses a conditional encoder to extract features and reduce the dimensionality of gradient differences in each round of federated learning, generating a low-dimensional conditional vector. This encoder typically employs a multilayer perceptron (MLP) or convolutional neural network (CNN) structure to map the gradient difference tensor into an embedding vector with semantic information. Subsequently, in the inverse denoising network of the diffusion model, this conditional vector is cross-attentioned with the latent variables at the current time step. The cross-attention mechanism achieves dynamic weighted fusion of conditional information with latent variables through linear transformations and dot product operations of three sets of tensors: query, key, and value, thereby enhancing the model's ability to perceive the data distribution implied by gradient differences.

[0060] This step is primarily applied to scenarios where malicious attackers attempt to steal privacy within a federated learning framework. By using gradient differences as a generation condition, attackers can locally leverage a diffusion model to progressively generate virtual data highly similar to the target client's original data. This allows for data reconstruction without directly accessing the original data, thus assessing the robustness of the privacy protection mechanism.

[0061] Furthermore, the technical effect of this step is to significantly improve the generative capability of the diffusion model under complex data distributions. By introducing a cross-attention mechanism, the model can more effectively utilize local and global information in gradient differences, improving the structural similarity (SSIM) and visual realism of the generated data, thereby enhancing the stealth and success rate of privacy-theft attacks. This technique provides a more comprehensive and accurate evaluation method for privacy protection assessment of federated learning, and has significant theoretical value and practical application significance.

[0062] S32 uses a multi-head cross-attention mechanism to process gradient differences from multiple historical rounds in parallel, thereby improving the generation efficiency and data reconstruction accuracy of the diffusion model in multi-round federated learning.

[0063] Specifically, the core of this step is to use the gradient difference information generated by multiple clients in the multi-round training process in federated learning as the generation condition of the diffusion model, and to perform feature fusion and information extraction through the attention mechanism, thereby improving the generation efficiency and reconstruction accuracy of the model in privacy theft attacks.

[0064] In some implementations, a multi-head cross-attention mechanism is embedded into the noise prediction network of the diffusion model to dynamically fuse feature representations of historical gradient differences during each round of denoising. Specifically, the attacker client first constructs a conditional encoder to encode the gradient differences (i.e., the difference between the local and global gradients) of each round into a low-dimensional conditional vector. This encoding process can employ a fully connected network or a Transformer encoding structure to extract statistical features and semantic information from the gradient differences. The encoded conditional vector serves as the query input for the cross-attention mechanism, while the embedded representations of historical gradient differences serve as the key and value inputs, thereby enabling parallel modeling and information exchange of gradient differences across multiple rounds.

[0065] Furthermore, the multi-head cross-attention mechanism computes multiple attention heads in parallel, capturing the correlation between gradient differences and data features from different subspaces. Each attention head independently calculates its attention weights, which are then linearly combined to obtain the final conditional feature output. In this way, the diffusion model obtains richer gradient conditional information at each denoising step, thereby more accurately guiding the generation process and approximating the true distribution of the target data.

[0066] In practical applications, this step is suitable for client-initiated privacy-stealing attacks within a federated learning framework. The attacker's client maintains a record of historical gradient differences locally and updates the conditional inputs of the diffusion model after each training round, continuously optimizing the generation of target data. This mechanism not only improves the structural fidelity of the generated data but also enhances the stealth and adaptability of the attack, enabling it to cope with complex privacy protection strategies in federated learning.

[0067] S4, based on the similarity loss between the fake gradient and the estimated gradient, alternately optimize the parameters of the diffusion model and the generated virtual data until the similarity loss converges.

[0068] This also includes fixing the parameters of the diffusion model, optimizing the generated virtual data using gradient descent to make the forged gradient closer to the estimated gradient; fixing the generated virtual data, and updating the parameters of the diffusion model through backpropagation to improve the model's data reconstruction capability in subsequent generation processes. In some implementations, this step first fixes the parameter architecture of the diffusion model and then performs gradient descent optimization on the generated virtual data. Specifically, the attacker's client uses the virtual dataset generated by the current diffusion model to perform local training based on the global model and calculates the forged gradient. Subsequently, this forged gradient is compared with the victim's estimated gradient obtained through dynamic gradient estimation methods to construct a similarity loss function. This loss function is usually quantified using metrics such as cosine similarity or mean squared error (MSE), with cosine similarity being widely used due to its sensitivity to gradient direction. For example, when the cosine similarity is greater than 0.9, the forged gradient can be considered to have highly approximated the estimated gradient, and the generated virtual data has high reconstruction quality.

[0069] Furthermore, after optimizing the virtual data, the parameters of the diffusion model are updated while keeping the currently generated virtual data fixed. This update process uses a backpropagation algorithm to propagate the gradient of the similarity loss function back to the denoising network of the diffusion model, thereby adjusting the model parameters to generate virtual samples that better match the distribution of the target data. In specific implementations, the denoising network of the diffusion model typically adopts a U-Net structure and incorporates a cross-attention mechanism to encode gradient differences as conditional information and inject it into the noise prediction process at each time step, thereby enhancing the alignment between the generated data and the real data in the gradient space.

[0070] In one embodiment of the invention, gradient matching is used to optimize the parameter architecture of the diffusion model, generating virtual data that more closely resembles the original data of the benign victim client. The first step is an inverse denoising network. This refers to updating the generator. The relevant parameter architecture of the fixed diffusion model. Optimize virtual data through gradient descent See formula (7).

[0071] The next step is to update the parameters of the diffusion model, fixing the current virtual data. The diffusion model parameters are updated by spoofing gradients and using the estimated gradient similarity loss between benign victim clients. See formula (8).

[0072] go through After several iterations, when the cosine similarity between the estimated gradient and the fake gradient is greater than 0.9, it can be considered with high confidence that the virtual data is close to the original data.

[0073] This step plays a crucial role in the overall privacy protection evaluation methodology. Through an alternating optimization mechanism, attackers can achieve high-fidelity reconstruction of other participants' data on the client side of federated learning, thus overcoming the limitation of traditional methods that only launch attacks on the server side. Simultaneously, this method utilizes the multi-step denoising process and conditional guidance mechanism of the diffusion model to significantly improve the structural authenticity and detail restoration capabilities of the reconstructed data, providing technical support for more covert and efficient privacy-stealing attacks, thereby enabling a more comprehensive evaluation of the privacy protection capabilities of federated learning systems.

[0074] The privacy protection assessment method based on the diffusion model in this invention can more accurately reconstruct the original data of benign clients in federated learning, effectively assess the risk of privacy theft attacks launched by clients, and improve the comprehensiveness and concealment of privacy protection assessment.

[0075] Furthermore, it also includes: S5 performs a structural similarity (SSIM) assessment on the generated virtual data to obtain an SSIM value, which quantifies the degree of similarity between the virtual data and the original data of the victimized benign client. Based on the comparison between the SSIM value and a preset threshold, it is determined whether the privacy protection mechanism under the federated learning framework meets the security requirements, and an assessment report is output.

[0076] At the technical implementation level, SSIM evaluation reflects the degree of similarity in overall structure between the generated virtual data and the original data by calculating a comprehensive score of three sub-indicators: brightness, contrast, and structural similarity within a local window. Specifically, for each round of federated learning, a sliding window mechanism is used to extract local features and calculate the SSIM value between the virtual data and the corresponding original data sample.

[0077] This step is primarily used for the quantitative evaluation of privacy protection mechanisms in federated learning systems. After completing multiple rounds of data reconstruction based on dynamic gradient estimation and diffusion models, the attacker compares the generated virtual data with the victim client's original data using SSIM (Simplified Identity Matrix) to determine whether it successfully approximates the real data distribution. This evaluation can be performed offline on the local client without interaction with the server, making it suitable for covert privacy-stealing attacks initiated from the client.

[0078] SSIM evaluation effectively reflects the fidelity of generated data in terms of structural information. Compared to traditional metrics such as mean squared error (MSE) or peak signal-to-noise ratio (PSNR), it better reflects the human visual system's perception of data differences. When the SSIM value approaches 1, it indicates that the attacker has successfully reconstructed virtual data that is highly similar to the original data, suggesting a significant risk of data leakage with current privacy protection mechanisms. Therefore, this step not only provides an intuitive quantitative basis for the effectiveness of privacy attacks but also provides crucial feedback for optimizing privacy protection strategies, thereby enhancing the comprehensiveness and practicality of this invention in the field of privacy evaluation.

[0079] This step can be deployed in the security audit module of a federated learning system, especially in distributed training scenarios involving highly sensitive data such as medical and financial data. The evaluation report can include the SSIM value for each round of attacks, attack success rate, a visual comparison of reconstructed data, and the parameter configuration of the diffusion model used by the attacker, providing system designers with intuitive quantitative evidence of privacy risks. By introducing SSIM as an evaluation metric, not only is the objectivity and interpretability of privacy breach assessment improved, but the shortcomings of traditional metrics based on pixel error or PSNR in terms of structural information loss are also overcome. Combined with the generation capabilities of dynamic gradient estimation and diffusion models, this evaluation method can more realistically reflect the actual defense effect of privacy protection mechanisms in complex attack scenarios, thus providing strong support for the privacy enhancement design of federated learning systems.

[0080] In one embodiment of the present invention, the effectiveness of the reconstruction attack and the effectiveness of privacy protection are evaluated. The present invention introduces a quantitative indicator, Structure Similarity Index Measure (SSIM), to evaluate the attack effectiveness, and uses the SSIM of the obtained reconstructed data to evaluate the privacy protection effectiveness of the privacy protection method. The specific steps are as follows: Evaluation of the effectiveness of the reconstructed attack-generated data. It is assumed that the original dataset from a benign client can be used for evaluation during the testing phase. After... The system employs federated learning and utilizes a diffusion-based privacy-theft attack to obtain virtual data. Then, extract each piece of virtual data. Calculate structural similarity, see formula (9), where It is the maximum value of a certain feature of the data. It is the data mean. and It is variance. It is covariance. , It is a coefficient. , Adjustable.

[0081]

[0082] Privacy Protection Effectiveness Evaluation. The privacy protection effectiveness of the distributed collaborative learning method can be evaluated by observing the SSIM value. Specifically, the closer the SSIM value is to 1, the weaker the privacy protection effect. The innovation of this invention lies in introducing a diffusion model, which significantly enhances the ability to reconstruct data, thus posing a greater threat to the privacy protection effectiveness of distributed collaborative learning methods. Furthermore, it utilizes a dynamic gradient estimation method to overcome the limitation of traditional reconstruction methods in capturing gradient information when the client launches a theft attack, increasing the stealth of the attack and expanding its scope. This allows for a more comprehensive and complete test and evaluation of its privacy protection effectiveness.

[0083] In summary, this invention utilizes a dynamic gradient estimation method to more accurately estimate the true gradients of other benign participants. It leverages gradient differences to guide the diffusion model and incorporates data distribution information implicit in historical gradient differences during federated learning. Through multiple rounds of iterative optimization of the generator model's parameters, the forged gradients obtained after training the generated virtual data on the local model can approximate the estimated gradients of benign participants to the greatest extent possible. In this way, malicious attackers, acting as federated learning participants, can initiate privacy theft from the client using the diffusion model, more accurately and covertly reconstructing the original data, thereby achieving effective evaluation of privacy protection in a wider range of scenarios. Furthermore, by analyzing the dynamic relationship between attack effectiveness and privacy protection mechanisms, this invention provides a deeper understanding of the potential risks of privacy leakage under distributed collaborative learning frameworks such as federated learning, and offers theoretical support for designing more robust privacy protection schemes.

[0084] To achieve the above embodiments, such as Figure 2 As shown, this embodiment also provides a privacy protection evaluation device 10 based on a diffusion model, including: The gradient acquisition module is used to acquire the attacker's own gradients obtained during local training in the federated learning system, as well as the global gradients aggregated by the server. The gradient estimation module is used to dynamically estimate the gradient information of the victimized benign client based on the gradient differences in historical communication rounds using the exponential moving average technique, and to map the gradient differences into low-dimensional conditional vectors through a conditional encoder. The conditional injection and data generation module is used to inject the low-dimensional conditional vector into the noise prediction network of the diffusion model through a cross-attention mechanism, drive the diffusion model to generate virtual data, and use the virtual data to obtain fake gradients in local model training. The model optimization module is used to alternately optimize the parameters of the diffusion model and the generated virtual data based on the similarity loss between the fake gradient and the estimated gradient, until the similarity loss converges.

[0085] Furthermore, the gradient estimation module is also used for: Calculate the difference between the attacker's own gradient and the global gradient in the current communication round, and then weight and fuse this difference with the EMA gradient of the previous round to obtain the estimated gradient of the current round. Based on the distribution characteristics of federated learning communication rounds, the decay factor in the exponential moving average is dynamically adjusted so that a smaller decay factor is used in the early stages of the communication rounds to quickly respond to gradient changes, and a larger decay factor is used in the later stages of the communication rounds to enhance the stability of the estimation.

[0086] Furthermore, the conditional injection and data generation module is also used for: Cross-attention calculation is performed between the low-dimensional conditional vector and the latent variables of the diffusion model at each time step to enhance the model's ability to perceive the data distribution implied by gradient differences. The gradient differences from multiple historical rounds are processed in parallel using a multi-head cross-attention mechanism to improve the generation efficiency and data reconstruction accuracy of the diffusion model in the multi-round federated learning process.

[0087] Furthermore, the model optimization module is also used for: With the parameters of the diffusion model fixed, the generated virtual data is optimized using gradient descent to make the fake gradient closer to the estimated gradient. The generated virtual data is fixed, and the parameters of the diffusion model are updated through the backpropagation algorithm to improve the model's data reconstruction capability in subsequent generation processes.

[0088] Furthermore, it also includes: The evaluation module is used to perform structural similarity (SSIM) evaluation on the generated virtual data to obtain an SSIM value, which quantifies the degree of similarity between the virtual data and the original data of the victimized benign client. Based on the comparison result of the SSIM value and a preset threshold, it determines whether the privacy protection mechanism under the federated learning framework meets the security requirements and outputs an evaluation report.

[0089] The privacy protection evaluation device based on the diffusion model in this invention introduces the diffusion model into the field of privacy protection evaluation of federated learning, and combines it with the dynamic gradient estimation method to expand the evaluation scope from privacy theft initiated by the server to scenarios where privacy theft is initiated by the client. This allows for a more comprehensive evaluation of the privacy protection capabilities of distributed collaborative learning methods, such as federated learning. It also provides new ideas for the innovation of data privacy protection technology in distributed collaborative learning methods such as federated learning, and has important theoretical significance and practical application value.

[0090] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0091] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A privacy protection assessment method based on a diffusion model, characterized in that, include: S1, obtain the attacker's own gradient during local training in the federated learning system and the global gradient aggregated by the server; S2, based on the gradient differences in historical communication rounds, uses the exponential moving average technique to dynamically estimate the gradient information of the benign client, and maps the gradient differences into a low-dimensional conditional vector through a conditional encoder. S3 injects low-dimensional conditional vectors into the noise prediction network of the diffusion model through a cross-attention mechanism, drives the diffusion model to generate virtual data, and uses the virtual data to train the local model to obtain fake gradients. S4, based on the similarity loss between the fake gradient and the estimated gradient, alternately optimize the parameters of the diffusion model and the generated virtual data until the similarity loss converges.

2. The method as described in claim 1, characterized in that, S2 includes: S21, Calculate the difference between the attacker's own gradient and the global gradient in the current communication round, and then weight and fuse this difference with the EMA gradient of the previous round to obtain the estimated gradient of the current round; S22. Based on the distribution characteristics of the federated learning communication rounds, the decay factor in the exponential moving average is dynamically adjusted so that a smaller decay factor is used in the early stage of the communication round to quickly respond to gradient changes, and a larger decay factor is used in the later stage of the communication round to enhance the stability of the estimation.

3. The method as described in claim 1, characterized in that, The S3 includes: S31, cross-attention calculation is performed between the low-dimensional conditional vector and the latent variables of the diffusion model at each time step to enhance the model's ability to perceive the data distribution implied by gradient differences. S32 uses a multi-head cross-attention mechanism to process gradient differences from multiple historical rounds in parallel, thereby improving the generation efficiency and data reconstruction accuracy of the diffusion model in multi-round federated learning.

4. The method as described in claim 1, characterized in that, The S4 includes: S41, with the parameters of the diffusion model fixed, uses gradient descent to optimize the generated dummy data so that the fake gradient is closer to the estimated gradient; S42 uses fixed-generation virtual data to update the parameters of the diffusion model through backpropagation algorithm, thereby improving the model's data reconstruction capability in subsequent generation processes.

5. The method as described in claim 1, characterized in that, Also includes: S5. The generated virtual data is evaluated using SSIM (Structural Similarity Scheme) to obtain an SSIM value, which quantifies the degree of similarity between the virtual data and the original data of the victimized benign client. Based on the comparison between the SSIM value and the preset threshold, it is determined whether the privacy protection mechanism under the federated learning framework meets the security requirements, and an evaluation report is output.

6. A privacy protection assessment device based on a diffusion model, characterized in that, include: The gradient acquisition module is used to acquire the attacker's own gradients obtained during local training in the federated learning system, as well as the global gradients aggregated by the server. The gradient estimation module is used to dynamically estimate the gradient information of the benign client based on the gradient differences in historical communication rounds using the exponential moving average technique, and to map the gradient differences into a low-dimensional conditional vector through a conditional encoder. The conditional injection and data generation module is used to inject the low-dimensional conditional vector into the noise prediction network of the diffusion model through a cross-attention mechanism, drive the diffusion model to generate virtual data, and use the virtual data to obtain fake gradients in local model training. The model optimization module is used to alternately optimize the parameters of the diffusion model and the generated virtual data based on the similarity loss between the fake gradient and the estimated gradient, until the similarity loss converges.

7. The apparatus as claimed in claim 6, characterized in that, The gradient estimation module is also used for: Calculate the difference between the attacker's own gradient and the global gradient in the current communication round, and then weight and fuse this difference with the EMA gradient of the previous round to obtain the estimated gradient of the current round. Based on the distribution characteristics of federated learning communication rounds, the decay factor in the exponential moving average is dynamically adjusted so that a smaller decay factor is used in the early stages of the communication rounds to quickly respond to gradient changes, and a larger decay factor is used in the later stages of the communication rounds to enhance the stability of the estimation.

8. The apparatus as claimed in claim 6, characterized in that, The condition injection and data generation module is also used for: Cross-attention calculation is performed between the low-dimensional conditional vector and the latent variables of the diffusion model at each time step to enhance the model's ability to perceive the data distribution implied by gradient differences. The gradient differences from multiple historical rounds are processed in parallel using a multi-head cross-attention mechanism to improve the generation efficiency and data reconstruction accuracy of the diffusion model in the multi-round federated learning process.

9. The apparatus as claimed in claim 6, characterized in that, The model optimization module is also used for: With the parameters of the diffusion model fixed, the generated virtual data is optimized using gradient descent to make the fake gradient closer to the estimated gradient. The generated virtual data is fixed, and the parameters of the diffusion model are updated through the backpropagation algorithm to improve the model's data reconstruction capability in subsequent generation processes.

10. The apparatus as claimed in claim 6, characterized in that, Also includes: The evaluation module is used to perform structural similarity (SSIM) evaluation on the generated virtual data to obtain an SSIM value, which quantifies the degree of similarity between the virtual data and the original data of the victimized benign client. Based on the comparison between the SSIM value and the preset threshold, it is determined whether the privacy protection mechanism under the federated learning framework meets the security requirements, and an evaluation report is output.

Images