Federated learning method against backdoor attack

Abstract

Disclosed in the present invention is a federated learning method against a backdoor attack. Firstly, a few benign model updates having a relatively high confidence are selected by means of clustering-based voting, then the selected models are considered as benign modes of model updates, and on the basis of an anomaly detection method of a variational auto-encoder, more benign model updates are progressively selected from among the remaining candidate model updates, so that the scale of a group of the selected benign model updates is continuously expanded. The present invention does not depend on differential privacy, weight pruning, and learning rate adjustment and merely sightly changes a protocol of original federated learning, and therefore, on one hand, the impact on the accuracy of a global model is relatively small, and on the other hand, integration with existing federated learning systems is facilitated. Compared with existing federated learning methods against backdoor attacks, the present invention has relatively high adaptability.

Description

A federated learning method resistant to backdoor attacks Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and specifically relates to a federated learning method that is resistant to backdoor attacks. Background Art

[0002] Artificial intelligence (AI) has become a crucial technology driving socioeconomic development, deeply integrated into every aspect of our lives. With the continuous breakthroughs in core AI technologies, represented by deep learning, AI has become increasingly reliant on vast amounts of data for model training. This has led to the excessive collection and use of personal privacy data, leading to growing awareness and concerns about data privacy. The introduction of data regulatory policies and the emergence of related regulatory technologies have driven the development of privacy-preserving AI technologies and fostered the advancement of federated learning (FL), a computational paradigm that collaborates across multiple participants to train machine learning models while protecting data privacy.

[0003] Due to the inaccessibility of distributed data, FL is vulnerable to attacks by malicious clients, especially backdoor attacks, which neither significantly change the statistical properties of the model like Gaussian noise attacks nor cause obvious modifications to the training data like label flipping attacks, and are therefore more covert to existing defense methods based on model statistics and spectral analysis.

[0004] Existing work defends against targeted attacks in FL through the following approaches: (1) Byzantine robust aggregation [Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017]; (2) robust learning rate [Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. Defending against backdoors in federated learning with robust learning rate. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 9268–9276, 2021]; (3) a combination of weight clipping, noise superposition, and clustering options [Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, pages 2938–2948. PMLR, 2020]; (4) Provably secure FL relying on model ensembles [Chulin Xie, Minghao Chen, Pin-Yu Chen, and Bo Li. CRFL: Certifiably robust federated learning against backdoor attacks. In International Conference on Machine Learning, pages 11372–11382, 2021]; (5) Anomaly detection [Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen.Learning to detect malicious clients for robust federated learning.arXiv preprint arXiv:2002.00211,2020]. However, provably secure methods rely on certain assumptions to provide theoretical guarantees, and their performance can be weaker than empirical defenses in the real world because the assumptions may not always be met. Furthermore, they rely on a large ensemble of noisy models, which reduces inference efficiency and prevents the production of a single model that can be deployed to clients. The remaining approaches require a clear global boundary between benign and malicious model updates, which typically only occurs when: ① the statistical heterogeneity of the data is not complex, i.e., independent and identically distributed (IID) or simply pathologically non-IID, making it easy for model updates to form distinct clusters; and ② the proportion of poisoned data (PDR) is relatively high, causing malicious model updates to significantly deviate from benign model updates, e.g., a PDR of at least 50%. Furthermore, many defenses are evaluated only on a relatively small number of malicious clients, e.g., no more than 10% being malicious. In this case, even if a malicious model update escapes detection, the impact of the attack will not be significant. In summary, it may be more appropriate to design a federated learning method based on anomaly detection technology that is resistant to backdoor attacks and has less impact on global model accuracy. This is because it does not introduce noise and the original federated learning aggregation does not change significantly, maintaining a consistent optimization goal. However, directly adopting anomaly detection technology presents two major challenges:

[0005] Challenge 1 (Insufficient Benign Patterns): Due to the unpredictable distribution and trajectory deviation of model updates, each round of benign model updates lacks benign patterns.

[0006] Challenge 2 (Blurred Boundary): Since backdoor attacks have little impact on model parameters and federated learning faces data heterogeneity, the boundary between benign and malicious model updates is often unclear.

[0007] Summary of the Invention

[0008] In view of the above, the present invention provides a federated learning method that is resistant to backdoor attacks. It modifies the original federated aggregation algorithm and no longer directly aggregates all received model updates. Instead, it selects a subset from the received model update set for aggregation through two key steps: "cluster-based voting" and "progressive selection", thereby excluding malicious model updates.

[0009] A federated learning method that is resistant to backdoor attacks. During a round of federated learning, participants first download a global model from a central server and then use their own datasets to train and update the parameters of the local global model. The difference between the parameters of the updated local global model and the initially downloaded global model in this round is the model update. Participants then upload the model update to the central server.

[0010] After receiving N model updates, the central server selects a benign model update from a decentralized perspective through cluster-based voting, if the benign model updates are in the majority. N is the number of participants in federated learning.

[0011] A differential training set is constructed based on the selected benign model updates, and a variational autoencoder is trained using the set;

[0012] Construct a difference validation set, use the variational autoencoder to reconstruct the data in the set, and gradually expand the group of selected benign models based on the reconstruction error;

[0013] The central server executes the federated averaging algorithm on all selected benign model updates to obtain a global model without backdoors and distributes it to participants for the next round of federated learning.

[0014] Furthermore, the benign model update is a model update obtained by the participant using a data set without injected triggers for training, whereas the model update obtained by the participant using a data set based on injected triggers for training is a malicious model update.

[0015] Furthermore, the specific implementation method of the central server mining benign model updates is as follows: first, the model update set received by the central server is recorded as where Δw i is the model update uploaded by the i-th participant, i is a natural number and 1≤i≤N; let the global model be a neural network with L layers, for the model update Δw i The m-th layer parameter Δw in i,m , choose the zero vector and the distance Δw i,m The farthest K-1 model updates are used as the initial point of the K-means algorithm. After clustering, Δw i,m It will vote for all model updates in its cluster, where m is a natural number and 1≤m≤L. In this way, each model update will cast L votes, with each vote having a weight of 1. Finally, the model updates with the highest votes will form a set of benign model updates with high confidence, denoted as

[0016] Furthermore, in obtaining the set After that, the central server first calculates the Cartesian product The difference in model update in the difference training set is formed, and any difference data in the difference training set is Δw a -Δw b , Δw a and Δw b For collection Update any two different models in the dataset; then use the difference training set to train a variational autoencoder, whose input is any difference data in the difference training set, and the output is a vector of the same dimension, and the variational autoencoder can generate an output that is as similar as possible to the input.

[0017] Furthermore, take the set The complement of Any difference data in the difference validation set is Δw c - Δw d , where Δw c For any model update in the complement, Δw d For collection Update any model in the , use the variational autoencoder to reconstruct each difference data in the difference validation set, select several difference data with the smallest average reconstruction error, and replace Δw in these difference data c Add to Collection middle.

[0018] Furthermore, the reconstruction error is measured by the mean square error between the variational autoencoder input data and the reconstructed data.

[0019] Furthermore, when the group of benign model updates is expanded, the latest set Update the difference training set and fine-tune the variational autoencoder to determine: if the set If the number of exceeds the set threshold, the federated average algorithm is executed on it; otherwise, the latest set is used Update the difference validation set, and then expand the benign model update again by reconstruction until the set The number exceeds the set threshold.

[0020] Based on the above technical solution, the present invention has the following beneficial technical effects:

[0021] 1. This invention enables a federated learning method that is resistant to backdoor attacks. It does not rely on differential privacy, weight clipping, or learning rate adjustment, and only makes minor changes to the original federated learning protocol. This has little impact on the accuracy of the global model and is easy to integrate with existing federated learning systems.

[0022] 2. Through cluster-based voting and progressive selection, the present invention can steadily select a group of benign model updates for aggregation when benign and malignant model updates do not obviously cluster in different locations; compared with existing federated learning methods that resist backdoor attacks, the present invention has stronger adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] FIG1 is a schematic diagram of the architecture of a federated learning system that resists backdoor attacks according to the present invention.

[0024] FIG2 is a schematic diagram of the process flow of the anti-backdoor attack federated learning method of the present invention in one round of federated aggregation. DETAILED DESCRIPTION

[0025] In order to describe the present invention more specifically, the technical solution of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] The system architecture of the federated learning method that is resistant to backdoor attacks in the present invention is shown in Figure 1. The system mainly includes two parts: a central server and participants. The central server is responsible for coordinating the execution of the federated learning method by each participant, while the participants are responsible for local training, submitting model updates, and receiving aggregated results from the central server.

[0027] To benefit from the federated learning system (obtaining a more accurate model), participants participate in it. Their devices upload model parameters to the central server and download aggregated model parameters from the central server. In a round of federated learning, a participant first downloads the global model, creating a copy of it. They then use their own dataset to update the parameters of this copy. The difference between the parameters of the updated global model and the initially downloaded global model is called a model update.

[0028] Malicious participants (attackers) will inject triggers into their own datasets and update the global model based on the training data injected with the triggers, so that the model updates they submit will enable the global model to recognize the triggers and make specific erroneous outputs. The model updates submitted by malicious participants are called malicious model updates; while the model updates obtained by normal participants using datasets without injected triggers are called benign model updates.

[0029] The federated learning method of the present invention is executed in each round of federated learning to replace the original federated averaging algorithm. As shown in FIG2 , the federated learning method of the present invention starts after the central server receives N model updates (denoted as ), including the following steps:

[0030] 1. Considering that for a specific model update, the model updates closer to it are most likely to have the same stance as it. That is, if the model update is benign, the few model updates closest to it are often also benign, and vice versa. Therefore, through voting, it is possible to mine benign model updates from a decentralized perspective when the benign model updates account for the majority among the N model updates received by the central server in this round.

[0031] Suppose the model parameters are a neural network with L layers. For the m-th layer parameter Δw of the i-th model update in i,m , regard it as an agent with the right to vote, and it casts its vote in the following way: Select the 0 vector and the K - 1 model updates farthest from Δw i,m as the initial points of the K-means algorithm (K < N). After dividing the N received model updates into K clusters, Δw i,m votes for all the model updates in its cluster. In this way, each model update Δw i votes a total of L times, and in this embodiment, the weight of each vote is uniformly set to 1; the entire voting process is carried out on the central server, which is actually equivalent to having the central server select benign model updates from the perspectives of each model update respectively.

[0032] 2. The model updates with the highest votes are regarded as benign model updates with high confidence, denoted as The "voting based on clustering" step ends here, where

[0033] 3. Using the set of benign model updates obtained in the previous step as the benign pattern of model updates, referring to the form of the Cartesian product, obtain the differences between pairs of model updates in The differences between pairs of model updates in form a set i where Δw j and Δw are any different

[0034] 4. Using the data in to train a Variational Auto-Encoder (VAE). The goal of the training process is to make this VAE have the following function: Given a data in, this VAE can generate an output as similar as possible to the original input.

[0035] 5. According to the latest Update as in step 3 Then based on the updated Fine-tuning the VAE.

[0036] 6. For collections Each model in updates Δw i as well as Each model in updates Δw j , build Model difference Δw i -Δw j , using these model differences as the input of VAE, let VAE try to reconstruct these Δw i -Δw j , select The model update Δw with the minimum average reconstruction error i Add to where the reconstruction error can be measured by the mean square error (MSE) between the original input data and the reconstructed data. For each model update Δw i For example, the average reconstruction error refers to the Among the model differences, Δw i of The average of the reconstruction errors of the model differences.

[0037] 7. If If the number of model updates exceeds M, execute step 8; otherwise, execute step 5.

[0038] 8. Return

[0039] After the method is completed, The model updates contained in execute the federated averaging algorithm to obtain a global model without backdoors and distribute it to participants for the next round of federated learning.

[0040] Most existing methods for defending against backdoor attacks in federated learning use a centralized, global perspective to determine which model updates are malicious. Because backdoor attacks neither significantly alter the model's statistical properties like Gaussian noise attacks nor significantly modify the training data like label flipping attacks, they have a smaller impact on the distribution of model parameters and therefore tend to appear randomly scattered across space, making it difficult to distinguish benign from malicious model updates from a global perspective. If model updates are examined from the perspective of a particular model update, the closest model updates may have the same purpose (i.e., if the model update is benign, then the closest model updates are more likely to be benign). Assuming that both benign and infected model updates wish to exclude each other from the aggregation, if each model update is assumed to be a voting agent that votes for the model updates closest to it, then benign model updates may receive more votes when benign model updates are in the majority. In addition, if the selected benign model updates are used as benign patterns and benign model updates are gradually selected, more benign model updates can be included in the global model more safely, because this gradual expansion approach enables more and more benign patterns to be referenced when screening benign model updates from the remaining candidate model updates.

[0041] The above description of the embodiments is intended to facilitate understanding and application of the present invention by those skilled in the art. It is apparent that those skilled in the art can readily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without requiring creative effort. Therefore, the present invention is not limited to the above embodiments. Any improvements or modifications made by those skilled in the art based on the disclosure of the present invention should fall within the scope of protection of the present invention.

Claims

1. A federated learning method that resists backdoor attacks. In a round of federated learning, participants first download a global model from a central server, and then use their own data sets to train and update the parameters of the local global model. The difference between the parameters of the updated local global model and the global model initially downloaded in this round is the model update. The participants then upload the model update to the central server. It is characterized by: After receiving N model updates, the central server selects the benign model update from a decentralized perspective through cluster-based voting when the benign model updates account for the majority. N is the number of participants in federated learning. A differential training set is constructed based on the selected benign model updates, and a variational autoencoder is trained using the set; Construct a difference validation set, use the variational autoencoder to reconstruct the data in the set, and gradually expand the group of selected benign model updates based on the reconstruction error; The central server executes the federated averaging algorithm on all selected benign model updates to obtain a global model without backdoors and distributes it to participants for the next round of federated learning.

2. The federated learning method according to claim 1, characterized in that: The benign model update is the model update obtained by the participant using the data set without injected triggers for training, whereas the model update obtained by the participant using the data set based on injected triggers for training is a malignant model update.

3. The federated learning method according to claim 1, characterized in that: The specific implementation method of the central server mining benign model updates is: first, the model update set received by the central server is recorded as Where Δw i is the model update uploaded by the i-th participant, i is a natural number and 1≤i≤N; let the global model be a neural network with L layers, for the model update Δw i The mth layer parameter Δw in i,m , choose the zero vector and the distance Δw i,m The farthest K-1 model updates are used as the initial point of the K-means algorithm. After clustering, Δw i,m The model updates in the cluster to which it belongs will be voted, m is a natural number and 1≤m≤L; in this way, each model update will cast L votes, each with a weight of 1; finally, the model updates with the highest votes will form a benign model update set with high confidence, denoted as 4. The federated learning method according to claim 3, characterized in that: In getting the collection After that, the central server first calculates the Cartesian product to obtain The difference in model update in the difference training set is formed. Any difference data in the difference training set is Δw a -Δw b , Δw a and Δw b For collection Update any two different models in the training set; then use the difference training set to train a variational autoencoder, whose input is any difference data in the difference training set, and the output is a vector of the same dimension, and the variational autoencoder can generate an output that is as similar to the input as possible.

5. The federated learning method according to claim 4, characterized in that: Get Collection The complement of Any difference data in the difference validation set is Δw c -Δw d , where Δw c For any model update in the complement, Δw d For collection Update any model in the difference validation set, use the variational autoencoder to reconstruct each difference data in the difference validation set, select several difference data with the smallest average reconstruction error, and replace Δw in these difference data c Add to Collection middle.

6. The federated learning method according to claim 5, characterized in that: The reconstruction error is measured by the mean square error between the variational autoencoder input data and the reconstructed data.

7. The federated learning method according to claim 5, characterized in that: When the population of benign model updates is expanded, the latest collection is used Update the difference training set and fine-tune the variational autoencoder to determine: if the set If the number of exceeds the set threshold, the federated average algorithm is executed on it; otherwise, the latest set is used Update the difference validation set, and then expand the benign model update again through reconstruction until the set The number exceeds the set threshold.

8. The federated learning method according to claim 1, characterized in that: This federated learning method does not rely on differential privacy, weight clipping, and learning rate adjustment, and only makes minor changes to the original federated learning protocol. On the one hand, it has little impact on the accuracy of the global model, and on the other hand, it is easy to integrate with the existing federated learning system; in addition, this method can steadily select a group of benign model updates for aggregation through clustering-based voting and progressive selection when benign and malignant model updates are not obviously clustered in different locations.

Images