Method and apparatus for processing hidden channel based on federated learning gradient vector

Abstract

The present application relates to the technical field of network security, and discloses a hidden channel processing method and device based on a federated learning gradient vector, which is used for realizing controllable construction and accurate blocking of a gradient hidden channel under the premise of guaranteeing the convergence performance of a federated learning model.The hidden channel processing method based on the federated learning gradient vector comprises the following steps: obtaining an original gradient vector of a current round of federated learning, calculating, for each dimension, a first sensitivity index reflecting the influence degree of model performance and a second sensitivity index reflecting the inherent noise level; determining the processing strength of each dimension according to the two indexes, including the signal modulation strength for constructing the hidden channel and the interference strength for blocking the hidden channel; when it is necessary to transmit hidden information, modulating the gradient value according to the signal modulation strength and then uploading the server; when it is necessary to block the hidden channel, adding noise according to the interference strength and then uploading the server or directly used for aggregation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for processing covert channels based on federated learning gradient vectors. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, allows participants to train models locally and only upload gradient updates to the server, which then aggregates and distributes the global model, thus enabling collaborative training without sharing the original data. However, existing federated learning security mechanisms suffer from the following technical shortcomings: First, the impact of each dimension of the gradient vector on model performance varies significantly, and the inherent noise levels of each dimension during normal training are also different. Existing technologies cannot simultaneously evaluate the attributes of these two dimensions without introducing additional computational overhead, making it difficult to distinguish between normal gradient fluctuations and potential covert information modulation. Second, existing attack methods mainly target model poisoning or data inference, failing to leverage the dimensional redundancy of the gradient vector to establish covert channels while ensuring model convergence performance, and further failing to dynamically adjust the embedding strategy according to changes in model training progress. Third, existing defense methods mainly employ techniques such as differential privacy or gradient pruning, which apply uniform noise or pruning thresholds to all gradient dimensions. This results in excessive noise in important dimensions, damaging model accuracy, and insufficient noise in unimportant dimensions, failing to effectively block covert communication, and failing to quantitatively reduce the covert channel capacity to a controllable range. Fourth, existing technologies cannot simultaneously achieve active utilization and passive blocking of covert channels within the same framework, making it difficult for federated learning systems to meet the integrated needs of security assessment and defense deployment when facing gradient covert channel threats. Summary of the Invention

[0003] This invention provides a method and apparatus for processing covert channels based on federated learning gradient vectors, which solves the problem in the prior art that the covert channel cannot be controllably constructed and accurately blocked under the premise of distinguishing the differentiated attributes of each dimension because the gradient vectors are only aggregated as a whole or noise of uniform intensity is added.

[0004] The first aspect of this invention provides a method for processing covert channels based on gradient vectors in federated learning, comprising: obtaining the original gradient vector uploaded by participants in the current round of federated learning, the original gradient vector containing multiple dimensions; calculating a first sensitivity index and a second sensitivity index for each dimension of the original gradient vector, the first sensitivity index reflecting the degree of influence of the corresponding dimension on model performance, and the second sensitivity index reflecting the inherent noise level of the corresponding dimension during normal training; determining the processing intensity of each dimension according to the first sensitivity index and the second sensitivity index, the processing intensity including the signal modulation intensity for constructing the covert channel and the interference intensity for blocking the covert channel; when it is necessary to transmit covert information to other participants, modulating the gradient value of the corresponding dimension according to the information to be transmitted covertly and the signal modulation intensity to obtain a modulated gradient vector, and uploading the modulated gradient vector to a server; when it is necessary to block the covert channel in the system, adding noise to the gradient value of the corresponding dimension according to the interference intensity to obtain a noisy gradient vector, and uploading the noisy gradient vector to the server or directly using it for aggregation.

[0005] In one feasible implementation, the step of calculating a first sensitivity index and a second sensitivity index for each dimension in the original gradient vector includes: calculating the degree of influence of the corresponding dimension on the model output change based on the second derivative information of the loss function for each dimension or its approximate estimate, as the first sensitivity index; and calculating the statistical dispersion of the gradient value fluctuation range of each dimension in multiple training batches or multiple federated learning rounds, as the second sensitivity index.

[0006] In one feasible implementation, determining the processing intensity of each dimension based on the first sensitivity index and the second sensitivity index includes: marking dimensions with a first sensitivity index lower than a first preset threshold and a second sensitivity index higher than a second preset threshold as modifiable dimensions and including them in a set of modifiable dimensions; for each dimension in the set of modifiable dimensions, assigning corresponding signal modulation intensity and interference intensity based on the relative magnitude of its first sensitivity index and second sensitivity index, wherein dimensions with smaller first sensitivity index are assigned greater intensity, and dimensions with larger second sensitivity index are assigned greater intensity; and setting the signal modulation intensity and interference intensity of other dimensions not marked as modifiable dimensions to zero.

[0007] In one feasible implementation, the step of modulating the gradient value of the corresponding dimension according to the information to be covertly transmitted and the signal modulation intensity to obtain the modulated gradient vector includes: encrypting and forward error correction encoding the information to be covertly transmitted to generate a bit sequence to be embedded; establishing a one-to-one correspondence between each bit in the bit sequence and each dimension in the set of modifiable dimensions according to a preset pseudo-random mapping rule; for each mapped dimension, modifying the original gradient value of the corresponding dimension with a deterministic offset according to the value of the corresponding bit and the signal modulation intensity corresponding to the corresponding dimension; merging all modified dimensions with other unmodified dimensions to obtain the modulated gradient vector.

[0008] In one feasible implementation, the step of encrypting and forward error correction encoding the information to be covertly transmitted to generate a bit sequence to be embedded includes: acquiring the original information to be covertly transmitted and encrypting the original information using a symmetric encryption algorithm combined with a shared key to generate ciphertext data; applying forward error correction encoding to the ciphertext data and adding redundant check bits according to a preset encoding rate to generate an encoded bit stream with error correction capability; and dividing the encoded bit stream according to a preset group length to form multiple bit groups to be embedded, each group being used to map to a set of modifiable dimensions in a federated learning round.

[0009] In one feasible implementation, the step of adding noise to the gradient value of the corresponding dimension according to the interference intensity to obtain a noisy gradient vector includes: calculating the minimum noise power required to reduce the covert channel transmission capacity of the corresponding dimension to below a preset threshold based on the total number of participants in the current federated learning round and the first and second sensitivity indices of each dimension; sampling random noise values ​​that match the minimum noise power from a preset noise distribution, wherein the type of the noise distribution is compatible with the differential privacy protocol used by the federated learning system; superimposing the random noise values ​​onto the original gradient values ​​of the corresponding dimensions respectively, and merging all the superimposed dimensions into a noisy gradient vector.

[0010] In one feasible implementation, the step of calculating the minimum noise power required to reduce the covert channel transmission capacity of the corresponding dimension to below a preset threshold based on the total number of participants in the current federated learning round and the first and second sensitivity indices of each dimension includes: estimating the maximum signal modulation intensity that the attacker may use in the corresponding dimension under the premise of satisfying the model convergence constraint based on the first sensitivity index, wherein the maximum signal modulation intensity is negatively correlated with the first sensitivity index; determining the upper limit of the maximum signal modulation intensity based on the second sensitivity index, such that the maximum signal modulation intensity does not exceed a certain proportion of the natural fluctuation range represented by the second sensitivity index; combining the total number of participants and the maximum signal modulation intensity constrained by the upper limit, calculating the minimum noise power required to make the effective signal-to-noise ratio of the corresponding dimension lower than the lower limit required for reliable decoding, and multiplying the calculation result by a preset safety margin coefficient as the minimum noise power of the corresponding dimension.

[0011] A second aspect of the present invention provides a covert channel processing device based on federated learning gradient vectors, comprising: an acquisition module for acquiring the original gradient vector uploaded by participants in the current round of federated learning, the original gradient vector containing multiple dimensions; a calculation module for calculating a first sensitivity index and a second sensitivity index for each dimension in the original gradient vector, the first sensitivity index reflecting the degree of influence of the corresponding dimension on model performance, and the second sensitivity index reflecting the inherent noise level of the corresponding dimension during normal training; a determination module for determining the processing intensity of each dimension based on the first sensitivity index and the second sensitivity index, the processing intensity including the signal modulation intensity for constructing the covert channel and the interference intensity for blocking the covert channel; a first processing module for modulating the gradient value of the corresponding dimension according to the information to be covertly transmitted and the signal modulation intensity when it is necessary to transmit covert information to other participants, obtaining a modulated gradient vector, and uploading the modulated gradient vector to a server; and a second processing module for adding noise to the gradient value of the corresponding dimension according to the interference intensity when it is necessary to block the covert channel in the system, obtaining a noisy gradient vector, and uploading the noisy gradient vector to the server or directly for aggregation.

[0012] A third aspect of the present invention provides an electronic device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the electronic device to execute the above-described covert channel processing method based on federated learning gradient vectors.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described covert channel processing method based on federated learning gradient vectors.

[0014] The technical solution provided by this invention obtains the original gradient vector uploaded by participants in the current round of federated learning. The original gradient vector contains multiple dimensions. For each dimension of the original gradient vector, a first sensitivity index and a second sensitivity index are calculated. The first sensitivity index reflects the degree of influence of the corresponding dimension on model performance, and the second sensitivity index reflects the inherent noise level of the corresponding dimension during normal training. The processing intensity of each dimension is determined based on the first sensitivity index and the second sensitivity index. The processing intensity includes the signal modulation intensity for constructing a covert channel and the interference intensity for blocking the covert channel. When it is necessary to transmit covert information to other participants, the gradient value of the corresponding dimension is modulated according to the information to be transmitted covertly and the signal modulation intensity to obtain a modulated gradient vector, and the modulated gradient vector is uploaded to the server. When it is necessary to block the covert channel in the system, noise is added to the gradient value of the corresponding dimension according to the interference intensity to obtain a noisy gradient vector, and the noisy gradient vector is uploaded to the server or directly used for aggregation. In this embodiment of the invention, by calculating a first sensitivity index reflecting the degree of influence on model performance and a second sensitivity index reflecting the level of inherent noise for each dimension of the federated learning gradient vector, and accordingly determining the signal modulation strength for constructing the covert channel or the interference strength for blocking the covert channel for each dimension, it is possible to achieve reliable embedding and transmission of covert information using dimensions with high inherent noise and low performance impact without significantly affecting the global model convergence performance. On the other hand, precise noise adapted to the sensitivity of each dimension is applied to the potential covert channel, making the channel capacity controllable. At the same time, this scheme incorporates attack and defense into the same processing framework, which can be used for red team security assessment and security hardening of federated learning platforms. Moreover, the defense side supports the direct use of the noisy gradient vector for security aggregation, and is compatible with existing federated learning protocols. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of an embodiment of the covert channel processing method based on federated learning gradient vectors in this invention. Figure 2 This is a schematic diagram of an embodiment of the covert channel processing device based on federated learning gradient vectors in this invention. Figure 3 This is a schematic diagram of another embodiment of the covert channel processing device based on federated learning gradient vectors in this invention. Figure 4 This is a schematic diagram of one embodiment of the electronic device in this invention. Detailed Implementation

[0016] This invention provides a method and apparatus for processing covert channels based on federated learning gradient vectors. By calculating a first sensitivity index reflecting the degree of influence on model performance and a second sensitivity index reflecting the level of inherent noise for each dimension of the gradient vector, and determining the signal modulation intensity or interference intensity of each dimension according to the index, the covert channel can be constructed and accurately blocked under the premise of ensuring model convergence performance.

[0017] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] It is understood that the executing entity of this invention can be a covert channel processing device based on federated learning gradient vectors, or it can be a terminal or a server; the specific implementation is not limited here. This embodiment of the invention will be described using a server as an example.

[0019] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the covert channel processing method based on federated learning gradient vectors in this invention includes: 101. Obtain the original gradient vector uploaded by the participants in the current round of federated learning. The original gradient vector contains multiple dimensions. In each round of training in federated learning, the server distributes the current global model to all participants. Each participant uses its local data to perform several rounds of local iterative training on the model, calculating the model parameter update amount, i.e., the original gradient vector. This original gradient vector is an array of floating-point numbers, with its dimensions corresponding one-to-one with the number of model parameters. Each dimension represents the direction and magnitude of the adjustment of the corresponding parameter during training.

[0020] 102. For each dimension in the original gradient vector, calculate the first sensitivity index and the second sensitivity index of the corresponding dimension. The first sensitivity index reflects the degree of influence of the corresponding dimension on the model performance, and the second sensitivity index reflects the inherent noise level of the corresponding dimension in normal training. The first sensitivity metric characterizes the impact of this dimension on the final model performance. It is calculated by taking the second-order partial derivative of the loss function with respect to this dimension on multiple different batches of local data, and then performing a moving average on the results of each batch to obtain an approximate Fisher information value for this dimension at the current position. A larger value indicates a more significant impact of this dimension on the model output. The second sensitivity metric characterizes the inherent noise level of this dimension during normal training. It is calculated by statistically analyzing the gradient value changes of this dimension in the most recent federated learning rounds, and then calculating its standard deviation or variance as an estimate of the fluctuation amplitude. A larger value indicates that the gradient value of this dimension fluctuates more drastically during normal training, and subtle modifications are more easily buried in natural noise. After calculating the two metrics for each dimension, they are stored in association with the dimension's index.

[0021] It should be noted that the loss function mentioned in this scheme refers to any differentiable function used in federated learning model training to measure the difference between the model's predicted output and the true label, including but not limited to cross-entropy loss function, mean squared error loss function, hinge loss function, etc. The appropriate loss function can be selected according to the specific model type and learning task; this scheme does not impose any restrictions on this.

[0022] 103. Determine the processing intensity for each dimension based on the first sensitivity index and the second sensitivity index. The processing intensity includes the signal modulation intensity used to construct the covert channel and the interference intensity used to block the covert channel. First, a first threshold and a second threshold are set. Dimensions with a first sensitivity index lower than the first threshold and a second sensitivity index higher than the second threshold are selected and included in the set of modifiable dimensions. These dimensions have the characteristics of having little impact on the model and large natural fluctuations, making them suitable for subsequent operations. For dimensions with a first sensitivity index higher than the first threshold or a second sensitivity index lower than the second threshold, their processing intensity is set to zero, i.e., no modification is made. For each dimension in the set of modifiable dimensions, a processing intensity is assigned based on the relative magnitude of its first and second sensitivity indices: dimensions with smaller first sensitivity indices are allowed to be assigned larger processing indices; similarly, dimensions with larger second sensitivity indices are allowed to be assigned larger processing indices. The allocation results include two types of intensity values: one is the signal modulation intensity used to construct the covert channel, and the other is the interference intensity used to block the covert channel.

[0023] 104. When it is necessary to transmit covert information to other participants, the gradient value of the corresponding dimension is modulated according to the information to be transmitted covertly and the signal modulation strength to obtain the modulated gradient vector, and the modulated gradient vector is uploaded to the server. When a current participant needs to transmit hidden information to other participants in the federated learning process, the original information to be transmitted is first preprocessed: a symmetric encryption algorithm combined with a pre-shared key is used to encrypt the information, and then forward error correction coding is applied to the encrypted data, adding redundant check bits to form a bit sequence to be embedded. Subsequently, a pseudo-random permutation sequence is generated based on the pre-shared key and the current round number, establishing a mapping relationship between each bit in the bit sequence and each dimension in the set of modifiable dimensions, with each bit mapping to a unique dimension. For each mapped dimension, the corresponding signal modulation intensity is read, and the offset direction is determined based on the value of the bit: if the bit is a first logical value, a positive offset equal to the signal modulation intensity of that dimension is added to the original gradient value; if the bit is a second logical value, an equal positive offset is removed. After all mapped dimensions have undergone the above deterministic offset modification, they are merged with other unmodified dimensions to form a modulated complete gradient vector. Finally, the modulated gradient vector is uploaded to the server according to the federated learning protocol. The server then aggregates the gradients from other participants and distributes them to the global model. The receiver can extract the embedding information from the update differences of the global model.

[0024] 105. When it is necessary to block the covert channel in the system, add noise to the gradient value of the corresponding dimension according to the interference intensity to obtain the noisy gradient vector, and upload the noisy gradient vector to the server or use it directly for aggregation.

[0025] When the current federated learning system needs to block potential covert channels, it first estimates the maximum signal modulation strength that an attacker might use in that dimension for each modifiable dimension based on the first sensitivity index of that dimension: the smaller the first sensitivity index, the larger the estimated maximum signal modulation strength. Simultaneously, an upper limit constraint is applied to this estimate based on the second sensitivity index of that dimension to ensure that the maximum signal modulation strength does not exceed a certain proportion of the inherent noise level in the normal training of that dimension, thus preventing attackers from reducing the embedding strength to evade detection. Then, considering the total number of participants in the current federated learning round, the minimum noise power required to make the effective signal-to-noise ratio in that dimension lower than the lower limit required for reliable decoding is calculated: the larger the total number of participants, the more severe the signal attenuation of a single participant after aggregation, thus reducing the required minimum noise power accordingly. This minimum noise power is multiplied by a preset safety margin coefficient to obtain the final interference strength for that dimension. For each modifiable dimension, a random noise value is sampled from a preset noise distribution compatible with differential privacy protocols; the power of this noise value matches the calculated interference strength. This random noise value is then superimposed on the original gradient value of that dimension. For non-modifiable dimensions, no modifications are made or only a very small baseline noise is added. After processing all dimensions, a noisy, complete gradient vector is formed. Depending on the system deployment method, this noisy gradient vector can be uploaded to the server for regular aggregation, or, in scenarios using a secure aggregation protocol, it can be directly aggregated locally with the noisy gradient vectors of other participants. This prevents the server from observing the gradient values ​​of individual participants, thus blocking covert channels while maintaining compatibility with existing federated learning security mechanisms.

[0026] In this embodiment of the invention, by calculating a first sensitivity index reflecting the degree of influence on model performance and a second sensitivity index reflecting the level of inherent noise for each dimension of the federated learning gradient vector, and accordingly determining the signal modulation strength for constructing the covert channel or the interference strength for blocking the covert channel for each dimension, it is possible to achieve reliable embedding and transmission of covert information using dimensions with high inherent noise and low performance impact without significantly affecting the global model convergence performance. On the other hand, precise noise adapted to the sensitivity of each dimension is applied to the potential covert channel, making the channel capacity controllable. At the same time, this scheme incorporates attack and defense into the same processing framework, which can be used for red team security assessment and security hardening of federated learning platforms. Moreover, the defense side supports the direct use of the noisy gradient vector for security aggregation, and is compatible with existing federated learning protocols.

[0027] Furthermore, for each dimension in the original gradient vector, the first and second sensitivity indices for the corresponding dimension are calculated, including: calculating the degree of influence of the corresponding dimension on the model output change based on the second derivative information of the loss function for each dimension or its approximate estimate, as the first sensitivity index; and calculating the statistical dispersion of the gradient value fluctuation range of each dimension in multiple training batches or multiple federated learning rounds, as the second sensitivity index.

[0028] Specifically, for the first sensitivity metric, an approximate estimation method based on the second derivative information of the loss function for each dimension is adopted. In each federated learning round, participants randomly sample multiple mini-batches of data from their local dataset. For each batch, the gradient vector of the current model's loss function with respect to the model parameters is calculated. Then, for each dimension, the square of the gradient of that batch is used as an approximation of the second derivative of that dimension in that batch. An exponentially weighted moving average is applied to the approximate values ​​of all batches to obtain an approximate estimate of the Fisher information for each dimension. The larger this estimate is, the more sensitive that dimension is to changes in the loss function, meaning that modifications to that dimension will have a significant impact on model performance. For the second sensitivity metric, a gradient fluctuation amplitude analysis method is used. Participants record the gradient values ​​of each dimension in the most recent federated learning rounds. For each dimension, the standard deviation of these historical gradient values ​​is calculated. This standard deviation reflects the natural fluctuation amplitude of that dimension during normal training due to the randomness of data sampling and the dynamics of training. Dimensions with larger standard deviations have more drastic gradient value fluctuations during normal training, making small modifications to the gradient values ​​more easily buried in natural noise and undetected.

[0029] Furthermore, the processing intensity of each dimension is determined based on the first sensitivity index and the second sensitivity index, including: marking dimensions with a first sensitivity index lower than a first preset threshold and a second sensitivity index higher than a second preset threshold as modifiable dimensions and including them in the modifiable dimension set; for each dimension in the modifiable dimension set, assigning corresponding signal modulation intensity and interference intensity according to the relative magnitude of its first sensitivity index and second sensitivity index, wherein dimensions with smaller first sensitivity index are assigned greater intensity, and dimensions with larger second sensitivity index are assigned greater intensity; for other dimensions not marked as modifiable dimensions, their signal modulation intensity and interference intensity are set to zero.

[0030] Specifically, a first preset threshold is used to measure the sensitivity of a dimension to model performance, and a second preset threshold is used to measure the level of natural noise in a dimension. For each dimension, it is determined whether its first sensitivity index is lower than the first preset threshold, and simultaneously whether its second sensitivity index is higher than the second preset threshold. When both conditions are met, the dimension is marked as a modifiable dimension and added to the set of modifiable dimensions. These dimensions have the dual characteristics of "small impact on the model" and "large natural noise," making them suitable for subsequent operations. For each dimension in the set of modifiable dimensions, the processing intensity is assigned according to the specific values ​​of its first and second sensitivity indices: the smaller the first sensitivity index, the less significant the impact of the dimension on model performance, thus allowing for a larger signal modulation intensity and interference intensity; the larger the second sensitivity index, the stronger the natural noise masking ability of the dimension, thus also allowing for a larger processing intensity. For other dimensions not marked as modifiable dimensions, i.e., dimensions with a first sensitivity index higher than the first preset threshold or a second sensitivity index lower than the second preset threshold, their signal modulation intensity and interference intensity are both set to zero, indicating that no modifications or active noise are added to these dimensions to avoid unacceptable negative impacts on model convergence.

[0031] Furthermore, based on the information to be covertly transmitted and the signal modulation intensity, the gradient values ​​of the corresponding dimensions are modulated to obtain the modulated gradient vector. This includes: encrypting and forward error correction encoding the information to be covertly transmitted to generate a bit sequence to be embedded. Specifically, the original information to be covertly transmitted is obtained and encrypted using a symmetric encryption algorithm combined with a shared key to generate ciphertext data. Forward error correction encoding is applied to the ciphertext data, and redundant check bits are added according to a preset encoding rate to generate an error-correcting encoded bit stream. The encoded bit stream is divided according to a preset group length to form multiple bit groups to be embedded. Each group is used to map to a set of modifiable dimensions in a federated learning round. According to a preset pseudo-random mapping rule, a one-to-one correspondence is established between each bit in the bit sequence and each dimension in the set of modifiable dimensions. For each mapped dimension, the original gradient value of the corresponding dimension is modified with a deterministic offset based on the value of the corresponding bit and the signal modulation intensity corresponding to that dimension. All modified dimensions are merged with other unmodified dimensions to obtain the modulated gradient vector.

[0032] Specifically, in the encryption phase, participants obtain the original information to be transmitted covertly, use a pre-shared symmetric key, and employ a symmetric encryption algorithm to encrypt the original information, generating ciphertext data. This encryption step ensures the confidentiality of the transmitted content, preventing unauthorized parties from directly reading the information content from gradient modifications. In the forward error correction coding phase, participants apply a forward error correction coding algorithm to the encrypted ciphertext data, adding redundant check bits according to a preset coding rate to generate an coded bitstream with error correction capabilities. This coding step ensures that even if the signal of some dimensions is attenuated or distorted to a certain extent due to the superposition of gradients from other participants during server aggregation, the receiver can still recover the original data through the redundant information. In the packet segmentation phase, participants segment the coded bitstream according to a preset packet length, forming multiple bit packets to be embedded. The size of each packet corresponds to the number of bits that the modifiable dimension set can carry in a single federated learning round. Each packet is used to map to the modifiable dimension set in a federated learning round, thereby enabling long message transmission across multiple rounds. In the pseudo-random mapping phase, participants use a pre-shared key and the current round number as seeds to generate a permutation sequence through a pseudo-random function. This permutation sequence establishes a one-to-one correspondence between each bit in the bit group and each dimension in the set of modifiable dimensions. Different rounds use different seeds, causing the mapping relationship to change dynamically with each round, increasing the difficulty of analysis for attackers. In the offset modification phase, for each mapped dimension, participants read the value of that bit and the corresponding signal modulation intensity. If the bit value is the first logical value, a positive offset of the signal modulation intensity is added to the original gradient value; if the bit value is the second logical value, an equal positive offset is subtracted from the original gradient value. After all mapped dimensions have undergone the above deterministic offset modification, they are merged with other unmodified dimensions to form a modulated complete gradient vector, which is finally uploaded to the server according to the federated learning protocol.

[0033] Furthermore, noise is added to the gradient values ​​of the corresponding dimensions according to the interference intensity to obtain the noisy gradient vector. This includes: calculating the minimum noise power required to reduce the covert channel transmission capacity of the corresponding dimension to below a preset threshold based on the total number of participants in the current federated learning round and the first and second sensitivity indices for each dimension. Specifically, the maximum signal modulation intensity that the attacker may use in the corresponding dimension under the premise of satisfying the model convergence constraint is estimated based on the first sensitivity index. The maximum signal modulation intensity is negatively correlated with the first sensitivity index. The upper limit of the maximum signal modulation intensity is determined based on the second sensitivity index, so that the maximum signal modulation intensity is... The intensity does not exceed a certain proportion of the natural fluctuation range characterized by the second sensitivity index. Combining the total number of participants and the maximum signal modulation intensity after upper limit constraint, the minimum noise power that makes the effective signal-to-noise ratio of the corresponding dimension lower than the lower limit required for reliable decoding is calculated. The calculation result is multiplied by a preset safety margin coefficient and taken as the minimum noise power of the corresponding dimension. Random noise values ​​matching the minimum noise power are sampled from a preset noise distribution. The type of noise distribution is compatible with the differential privacy protocol used by the federated learning system. The random noise values ​​are superimposed on the original gradient values ​​of the corresponding dimensions, and all superimposed dimensions are merged into a noisy gradient vector.

[0034] Specifically, in the minimum noise power calculation phase, the participants first estimate the maximum signal modulation intensity that the attacker might use in that dimension based on the first sensitivity index of each modifiable dimension. This estimation follows the principle that the smaller the first sensitivity index, the less significant the impact on model performance; therefore, the larger the maximum signal modulation intensity the attacker can use while satisfying convergence constraints, and the two are negatively correlated. Subsequently, the participants impose an upper limit constraint on this estimate based on the second sensitivity index of that dimension: ensuring that the maximum signal modulation intensity does not exceed a certain proportion of the inherent noise level in normal training for that dimension. This is because if the embedding intensity significantly exceeds the natural fluctuation range, it is easily identified as an anomaly by statistical detection methods. After this double constraint, the participants, combined with the total number of participants in the current federated learning round, calculate the minimum noise power required to make the effective signal-to-noise ratio in that dimension lower than the lower limit required for reliable decoding. The total number of participants is introduced because during server aggregation, the signal of a single participant will attenuate to one-half of the original total number of participants. Therefore, the more participants there are, the more severe the signal attenuation, and the less noise power needs to be added. Participants multiply the calculated minimum noise power by a preset safety margin coefficient, which is greater than one, to provide additional safety boundaries and ensure that covert channels cannot be established under various adverse conditions. During the noise sampling phase, participants sample random noise values ​​from a preset noise distribution compatible with differential privacy protocols. This distribution typically has zero mean, and the sampling process ensures that the power of the noise values ​​matches the calculated interference intensity. For each modifiable dimension, participants superimpose the sampled random noise values ​​onto the original gradient value for that dimension. For non-modifiable dimensions, no additions are made, or only a very small amount of baseline noise is added to maintain consistency. After processing all dimensions, a noisy, complete gradient vector is formed. Depending on the system deployment scenario, participants can choose to upload this noisy gradient vector to the server for regular aggregation, or, in scenarios employing secure aggregation protocols, directly aggregate it locally with the noisy gradient vectors of other participants. This prevents the server from observing the gradient values ​​of individual participants, thus blocking covert channels while maintaining compatibility with existing federated learning security mechanisms.

[0035] In this embodiment of the invention, by calculating a first sensitivity index reflecting the degree of influence on model performance and a second sensitivity index reflecting the level of inherent noise for each dimension of the federated learning gradient vector, modifiable dimensions are selected and signal modulation intensity or interference intensity is allocated differentially. This achieves an optimal balance between offense and defense while ensuring the convergence performance of the global model. When transmitting covert information, encryption, forward error correction coding, pseudo-random mapping, and deterministic offset modulation ensure the reliability and covertness of information embedding, allowing successful demodulation by the receiver even after server aggregation. When blocking covert channels, the minimum noise power of each dimension is accurately calculated based on the total number of participants and the dual sensitivity indices, reducing the channel capacity to below a preset threshold. Simultaneously, noise sampling compatible with differential privacy is employed, supporting direct use for secure aggregation. This solution integrates attack and defense into the same processing framework, making it suitable for both red team security assessment of federated learning systems and platform security hardening, without requiring modification of the underlying federated learning protocol, thus possessing good compatibility and practical value.

[0036] The above describes the covert channel processing method based on federated learning gradient vectors in the embodiments of the present invention. The following describes the covert channel processing apparatus based on federated learning gradient vectors in the embodiments of the present invention. Please refer to [link to relevant documentation]. Figure 2 One embodiment of the covert channel processing device based on federated learning gradient vectors in this invention includes: The acquisition module 201 is used to acquire the original gradient vector uploaded by the participants in the current round of federated learning. The original gradient vector contains multiple dimensions. The calculation module 202 is used to calculate the first sensitivity index and the second sensitivity index for each dimension in the original gradient vector. The first sensitivity index reflects the degree of influence of the corresponding dimension on the model performance, and the second sensitivity index reflects the inherent noise level of the corresponding dimension in normal training. The determination module 203 is used to determine the processing intensity of each dimension based on the first sensitivity index and the second sensitivity index. The processing intensity includes the signal modulation intensity used to construct the covert channel and the interference intensity used to block the covert channel. The first processing module 204 is used to modulate the gradient value of the corresponding dimension according to the information to be transmitted covertly and the signal modulation intensity when it is necessary to transmit covert information to other participants, to obtain the modulated gradient vector, and to upload the modulated gradient vector to the server. The second processing module 205 is used to add noise to the gradient value of the corresponding dimension according to the interference intensity when it is necessary to block the covert channel in the system, to obtain the noisy gradient vector, and upload the noisy gradient vector to the server or directly use it for aggregation.

[0037] In this embodiment of the invention, by calculating a first sensitivity index reflecting the degree of influence on model performance and a second sensitivity index reflecting the level of inherent noise for each dimension of the federated learning gradient vector, and accordingly determining the signal modulation strength for constructing the covert channel or the interference strength for blocking the covert channel for each dimension, it is possible to achieve reliable embedding and transmission of covert information using dimensions with high inherent noise and low performance impact without significantly affecting the global model convergence performance. On the other hand, precise noise adapted to the sensitivity of each dimension is applied to the potential covert channel, making the channel capacity controllable. At the same time, this scheme incorporates attack and defense into the same processing framework, which can be used for red team security assessment and security hardening of federated learning platforms. Moreover, the defense side supports the direct use of the noisy gradient vector for security aggregation, and is compatible with existing federated learning protocols.

[0038] Please see Figure 3 Another embodiment of the covert channel processing device based on federated learning gradient vectors in this invention includes: The acquisition module 201 is used to acquire the original gradient vector uploaded by the participants in the current round of federated learning. The original gradient vector contains multiple dimensions. The calculation module 202 is used to calculate the first sensitivity index and the second sensitivity index for each dimension in the original gradient vector. The first sensitivity index reflects the degree of influence of the corresponding dimension on the model performance, and the second sensitivity index reflects the inherent noise level of the corresponding dimension in normal training. The determination module 203 is used to determine the processing intensity of each dimension based on the first sensitivity index and the second sensitivity index. The processing intensity includes the signal modulation intensity used to construct the covert channel and the interference intensity used to block the covert channel. The first processing module 204 is used to modulate the gradient value of the corresponding dimension according to the information to be transmitted covertly and the signal modulation intensity when it is necessary to transmit covert information to other participants, to obtain the modulated gradient vector, and to upload the modulated gradient vector to the server. The second processing module 205 is used to add noise to the gradient value of the corresponding dimension according to the interference intensity when it is necessary to block the covert channel in the system, to obtain the noisy gradient vector, and upload the noisy gradient vector to the server or directly use it for aggregation.

[0039] Optionally, the calculation module 202 can be specifically used for: Based on the second derivative information of the loss function for each dimension or its approximate estimate, the degree of influence of the corresponding dimension on the model output change is calculated as the first sensitivity index; the range of gradient value fluctuation of each dimension in multiple training batches or multiple federated learning rounds is statistically analyzed, and its statistical dispersion is calculated as the second sensitivity index.

[0040] Optionally, the determination module 203 can be specifically used for: Dimensions with a first sensitivity index lower than a first preset threshold and a second sensitivity index higher than a second preset threshold are marked as modifiable dimensions and included in the modifiable dimension set. For each dimension in the modifiable dimension set, a corresponding signal modulation intensity and interference intensity are assigned according to the relative magnitude of its first sensitivity index and second sensitivity index, wherein dimensions with smaller first sensitivity index are assigned larger intensity, and dimensions with larger second sensitivity index are assigned larger intensity. For other dimensions not marked as modifiable dimensions, their signal modulation intensity and interference intensity are set to zero.

[0041] Optionally, the first processing module 204 includes: The generation unit 2041 is used to encrypt and forward error correction code the information to be secretly transmitted to generate a bit sequence to be embedded. Establishment unit 2042 is used to establish a one-to-one correspondence between each bit in the bit sequence and each dimension in the modifiable dimension set according to a preset pseudo-random mapping rule; The first processing unit 2043 is used to modify the original gradient value of the corresponding dimension by a deterministic offset for each mapped dimension according to the value of the corresponding bit and the signal modulation intensity corresponding to the corresponding dimension, and merge all the modified dimensions with other unmodified dimensions to obtain the modulated gradient vector.

[0042] Optionally, the generating unit 2041 can be specifically used for: The original information to be secretly transmitted is obtained and encrypted using a symmetric encryption algorithm combined with a shared key to generate ciphertext data. Forward error correction coding is applied to the ciphertext data, and redundant check bits are added according to a preset coding rate to generate an coded bit stream with error correction capability. The coded bit stream is divided according to a preset group length to form multiple bit groups to be embedded. Each group is used to map to a set of modifiable dimensions in a federated learning round.

[0043] Optionally, the first processing module 304 includes: The calculation unit is used to calculate the minimum noise power required to reduce the covert channel transmission capacity of the corresponding dimension to below a preset threshold, based on the total number of participants in the current federated learning round and the first and second sensitivity indicators of each dimension. The sampling unit is used to sample random noise values ​​that match the minimum noise power from a preset noise distribution. The type of noise distribution is compatible with the differential privacy protocol used by the federated learning system. The second processing unit is used to superimpose random noise values ​​onto the original gradient values ​​of the corresponding dimensions, and merge all the superimposed dimensions into a noisy gradient vector.

[0044] Optionally, the computing unit can be specifically used for: The maximum signal modulation intensity that the attacker may use in the corresponding dimension under the premise of satisfying the model convergence constraint is estimated based on the first sensitivity index. The maximum signal modulation intensity is negatively correlated with the first sensitivity index. The upper limit of the maximum signal modulation intensity is determined based on the second sensitivity index, so that the maximum signal modulation intensity does not exceed a certain proportion of the natural fluctuation range represented by the second sensitivity index. Combining the total number of participants and the maximum signal modulation intensity after the upper limit constraint, the minimum noise power that makes the effective signal-to-noise ratio in the corresponding dimension lower than the lower limit required for reliable decoding is calculated. The calculation result is multiplied by a preset safety margin coefficient and taken as the minimum noise power in the corresponding dimension.

[0045] In this embodiment of the invention, by calculating a first sensitivity index reflecting the degree of influence on model performance and a second sensitivity index reflecting the level of inherent noise for each dimension of the federated learning gradient vector, modifiable dimensions are selected and signal modulation intensity or interference intensity is allocated differentially. This achieves an optimal balance between offense and defense while ensuring the convergence performance of the global model. When transmitting covert information, encryption, forward error correction coding, pseudo-random mapping, and deterministic offset modulation ensure the reliability and covertness of information embedding, allowing successful demodulation by the receiver even after server aggregation. When blocking covert channels, the minimum noise power of each dimension is accurately calculated based on the total number of participants and the dual sensitivity indices, reducing the channel capacity to below a preset threshold. Simultaneously, noise sampling compatible with differential privacy is employed, supporting direct use for secure aggregation. This solution integrates attack and defense into the same processing framework, making it suitable for both red team security assessment of federated learning systems and platform security hardening, without requiring modification of the underlying federated learning protocol, thus possessing good compatibility and practical value.

[0046] above Figure 2 and Figure 3 The covert channel processing device based on federated learning gradient vectors in this embodiment of the invention will be described in detail from the perspective of modular functional entities. The electronic device in this embodiment of the invention will be described in detail from the perspective of hardware processing.

[0047] See Figure 4 As shown, the electronic device includes a processor 400 and a memory 401. The memory 401 stores machine-executable instructions that can be executed by the processor 400. The processor 400 executes the machine-executable instructions to implement the above-described covert channel processing method based on federated learning gradient vectors.

[0048] Furthermore, Figure 4 The electronic device shown also includes a bus 402 and a communication interface 403. The processor 400, the communication interface 403 and the memory 401 are connected via the bus 402.

[0049] The memory 401 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 403 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The bus 402 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0050] The processor 400 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 400 or by instructions in software form. The processor 400 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 401. The processor 400 reads the information in memory 401 and, in conjunction with its hardware, completes the method steps of the aforementioned embodiment.

[0051] The present invention also provides an electronic device, the computer device including a memory and a processor, the memory storing computer-readable instructions, which, when executed by the processor, cause the processor to perform the steps of the covert channel processing method based on federated learning gradient vectors in the above embodiments.

[0052] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the covert channel processing method based on federated learning gradient vectors.

[0053] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0054] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0055] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing covert channels based on federated learning gradient vectors, characterized in that, The covert channel processing method based on federated learning gradient vectors includes: Obtain the original gradient vector uploaded by the participants in the current round of federated learning. The original gradient vector contains multiple dimensions. For each dimension in the original gradient vector, calculate the first sensitivity index and the second sensitivity index of the corresponding dimension. The first sensitivity index reflects the degree of influence of the corresponding dimension on the model performance, and the second sensitivity index reflects the inherent noise level of the corresponding dimension during normal training. The processing intensity for each dimension is determined based on the first sensitivity index and the second sensitivity index. The processing intensity includes the signal modulation intensity for constructing the covert channel and the interference intensity for blocking the covert channel. When it is necessary to transmit covert information to other participants, the gradient value of the corresponding dimension is modulated according to the information to be transmitted covertly and the signal modulation intensity to obtain the modulated gradient vector, and the modulated gradient vector is uploaded to the server. When it is necessary to block covert channels in the system, noise is added to the gradient values ​​of the corresponding dimensions according to the interference intensity to obtain a noisy gradient vector, and the noisy gradient vector is uploaded to the server or used directly for aggregation.

2. The covert channel processing method based on federated learning gradient vectors according to claim 1, characterized in that, The step of calculating the first sensitivity index and the second sensitivity index for each dimension of the original gradient vector includes: Based on the second derivative information of the loss function with respect to each dimension or its approximate estimate, the degree of influence of the corresponding dimension on the change of the model output is calculated as the first sensitivity index; The range of gradient value fluctuations for each dimension across multiple training batches or multiple federated learning rounds is statistically analyzed, and its statistical dispersion is calculated as a second sensitivity indicator.

3. The covert channel processing method based on federated learning gradient vectors according to claim 1, characterized in that, The step of determining the processing intensity of each dimension based on the first sensitivity index and the second sensitivity index includes: Dimensions with a first sensitivity index lower than a first preset threshold and a second sensitivity index higher than a second preset threshold are marked as modifiable dimensions and included in the modifiable dimension set. For each dimension in the set of modifiable dimensions, the corresponding signal modulation intensity and interference intensity are assigned according to the relative magnitude of its first sensitivity index and second sensitivity index, wherein the dimension with the smaller first sensitivity index is assigned a larger intensity, and the dimension with the larger second sensitivity index is assigned a larger intensity. For other dimensions that are not marked as modifiable, set their signal modulation strength and interference strength to zero.

4. The covert channel processing method based on federated learning gradient vectors according to claim 1, characterized in that, The step of modulating the gradient value of the corresponding dimension based on the information to be secretly transmitted and the signal modulation intensity to obtain the modulated gradient vector includes: The information to be secretly transmitted is encrypted and forward error-correcting encoded to generate a bit sequence to be embedded. According to the preset pseudo-random mapping rules, a one-to-one correspondence is established between each bit in the bit sequence and each dimension in the modifiable dimension set; For each mapped dimension, the original gradient value of the corresponding dimension is modified by a deterministic offset based on the value of the corresponding bit and the signal modulation intensity of the corresponding dimension. All modified dimensions are then merged with other unmodified dimensions to obtain the modulated gradient vector.

5. The covert channel processing method based on federated learning gradient vectors according to claim 4, characterized in that, The step of encrypting and forward error-correcting the information to be secretly transmitted to generate a bit sequence to be embedded includes: Obtain the original information to be secretly transmitted, and encrypt the original information using a symmetric encryption algorithm combined with a shared key to generate ciphertext data; Forward error correction coding is applied to the encrypted data, and redundant check bits are added according to a preset coding rate to generate an coded bit stream with error correction capability. The encoded bitstream is divided into multiple bit groups to be embedded according to a preset group length. Each group is used to map to a set of modifiable dimensions in a federated learning round.

6. The covert channel processing method based on federated learning gradient vectors according to claim 1, characterized in that, The step of adding noise to the gradient value of the corresponding dimension according to the interference intensity to obtain the noisy gradient vector includes: Based on the total number of participants in the current federated learning round and the first and second sensitivity indicators of each dimension, calculate the minimum noise power required to reduce the covert channel transmission capacity of the corresponding dimension to below the preset threshold. Random noise values ​​that match the minimum noise power are sampled from a preset noise distribution, wherein the type of the noise distribution is compatible with the differential privacy protocol used by the federated learning system; The random noise values ​​are superimposed onto the original gradient values ​​of the corresponding dimensions, and all the superimposed dimensions are merged into a noisy gradient vector.

7. The covert channel processing method based on federated learning gradient vectors according to claim 6, characterized in that, The step of calculating the minimum noise power required to reduce the covert channel transmission capacity of the corresponding dimension to below a preset threshold based on the total number of participants in the current federated learning round and the first and second sensitivity indices of each dimension includes: Based on the first sensitivity index, estimate the maximum signal modulation intensity that the attacker may use in the corresponding dimension under the premise of satisfying the model convergence constraint. The maximum signal modulation intensity is negatively correlated with the first sensitivity index. The upper limit of the maximum signal modulation intensity is determined according to the second sensitivity index, so that the maximum signal modulation intensity does not exceed a certain proportion of the natural fluctuation range characterized by the second sensitivity index; By combining the total number of participants and the maximum signal modulation intensity constrained by the upper limit, the minimum noise power required to make the effective signal-to-noise ratio in the corresponding dimension lower than the lower limit required for reliable decoding is calculated, and the calculation result is multiplied by a preset safety margin coefficient to obtain the minimum noise power in the corresponding dimension.

8. A covert channel processing device based on federated learning gradient vectors, characterized in that, The covert channel processing device based on federated learning gradient vectors includes: The acquisition module is used to acquire the original gradient vector uploaded by the participants in the current round of federated learning. The original gradient vector contains multiple dimensions. The calculation module is used to calculate a first sensitivity index and a second sensitivity index for each dimension in the original gradient vector. The first sensitivity index reflects the degree of influence of the corresponding dimension on the model performance, and the second sensitivity index reflects the inherent noise level of the corresponding dimension during normal training. The determination module is used to determine the processing intensity of each dimension based on the first sensitivity index and the second sensitivity index, wherein the processing intensity includes the signal modulation intensity for constructing the covert channel and the interference intensity for blocking the covert channel; The first processing module is used to modulate the gradient value of the corresponding dimension according to the information to be transmitted covertly and the signal modulation intensity when it is necessary to transmit covert information to other participants, to obtain the modulated gradient vector, and to upload the modulated gradient vector to the server. The second processing module is used to add noise to the gradient value of the corresponding dimension according to the interference intensity when it is necessary to block the covert channel in the system, to obtain the noisy gradient vector, and to upload the noisy gradient vector to the server or directly for aggregation.

9. An electronic device, characterized in that, The electronic device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the electronic device to execute the covert channel processing method based on federated learning gradient vectors as described in any one of claims 1-7.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the covert channel processing method based on federated learning gradient vectors as described in any one of claims 1-7.

Images