Blockchain-based federated learning backdoor attack defense method and device

Abstract

The present invention discloses a method and device for defending against backdoor attacks of federated learning based on blockchain, comprising: after a client participating in federated learning requests an independent communication channel from the blockchain, a locally trained local model is uploaded to a central server after being cached in the independent communication channel; after the central server prunes the received local model to form a pruned model, a disturbance is added to the pruned model and the pruned model is stored in a verification account book; the client downloads the pruned model with added disturbance corresponding to local data from the verification account book through the independent communication channel to perform model verification, and uploads the verification result to the central server; the central server selects a credible pruned model according to the verification result and performs model aggregation to obtain a global model, so as to ensure the security and robustness of federated learning.

Description

Technical Field

[0001] The present invention belongs to the field of defense technology for federated learning, and specifically relates to a method and device for defending against backdoor attacks in federated learning based on blockchain. Background Art

[0002] To train multi-party machine learning (ML) models, users must provide and share their training data, which can incur expensive communication costs or violate user privacy. Federated learning (FL) is a recent solution to both of these issues. When training across mobile devices, the data remains on the client device, and only the model parameters are transmitted to the server for aggregation. This allows clients to independently compute model updates locally while maintaining a basic level of privacy.

[0003] However, federated learning has proven to be a risky design trade-off. Clients, previously only passive data providers, can now observe intermediate model states and provide arbitrary updates as part of the decentralized training process. This creates an unrestricted opportunity for malicious clients to manipulate the training process. In particular, an adversary posing as an honest client can send false updates that maliciously influence the properties of the trained model, causing it to misclassify specific categories, a process known as a backdoor attack. The goal of a backdoor attack is to ensure that the learned model performs differently on certain target subtasks while maintaining good overall performance on the main task. For example, in image classification, an attacker might want the model to misclassify some green cars as birds while ensuring that other cars are correctly classified.

[0004] Because backdoor attacks can generate large updates, a reasonable defense is for the server to simply ignore updates with a size above a certain threshold. More complex schemes involve clipping updates to keep them within bounds. Existing work has long demonstrated that such constraints are effective in defending against backdoor attacks, but there is a trade-off with clipping. Because there is no a priori bound on the size of model updates, clipping can have two opposing consequences: Clipping can undermine the model's unbiasedness. If the clipping parameter is too small, the average clipped model may point in very different directions, failing to defend against backdoor attacks. If the clipping parameter is too large, it removes features from the model, reducing overall accuracy. Because servers in federated learning lack data, they cannot verify the appropriateness of clipping, hindering the proper implementation of clipping constraints.

[0005] As a decentralized, immutable, and shared distributed ledger and database, blockchain is well-suited to addressing the privacy and security challenges currently faced by federated learning. The blockchain's open nature and tamper-proof nature allow for a certain degree of interaction between the server and client in federated learning, alleviating the awkwardness of tailoring constraints in practical implementation. Therefore, combining blockchain with federated learning can enhance the security and stability of federated learning systems.

[0006] Since backdoor attacks have posed a major threat to the practical application of federated learning, enhancing the robustness and security of federated learning so that it can be effectively and safely applied in real life has become an increasing focus of attention. Summary of the Invention

[0007] In view of the above, the purpose of the present invention is to provide a method and device for defending against backdoor attacks in federated learning based on blockchain, so as to ensure the security and robustness of federated learning.

[0008] In a first aspect, an embodiment of the present invention provides a method for defending against backdoor attacks in federated learning based on blockchain, comprising the following steps:

[0009] After the client participating in federated learning requests an independent communication channel from the blockchain, the locally trained local model is cached in the independent communication channel and then uploaded to the central server;

[0010] After the central server prunes the received local model to form a pruned model, it adds perturbations to the pruned model and stores it in the verification ledger;

[0011] The client downloads the perturbed pruned model corresponding to the local data from the verification ledger through an independent communication channel for model verification, and uploads the verification results to the central server;

[0012] The central server selects the trusted pruned models based on the verification results and aggregates the models to obtain the global model.

[0013] In a second aspect, an embodiment of the present invention provides a defense device for blockchain-based federated learning backdoor attacks, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the defense method for blockchain-based federated learning backdoor attacks described in the first aspect is implemented.

[0014] The technical solution provided above has at least the following beneficial effects: 1) combining federated learning with blockchain to implement buffer time constraints and exclude clients that cannot upload local models on time; 2) implementing pruning constraints on local models to limit the weight of backdoor local models, thereby playing a defensive role; 3) during the federated learning process, utilizing the openness and immutability of blockchain to send the pruning status back to the client, thereby determining the ideal pruning rate and protecting the global model from backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is a flowchart of a method for defending against a backdoor attack in federated learning based on blockchain in one embodiment;

[0017] Figure 2 This is a flowchart of a method for defending against backdoor attacks in blockchain-based federated learning in one embodiment. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0019] Backdoor attacks, a primary attack vector that impacts the robustness and security of federated learning, aim to ensure that the learned model performs differently on certain target subtasks while maintaining good overall performance on the primary task. Backdoor inputs trigger neurons that are dormant in the presence of clean inputs. These so-called backdoor neurons are implicitly recruited by the attack, requiring greater activation to identify the backdoor and trigger inappropriate behavior. Therefore, at the neuronal level, backdoor models differ from normal models. Based on the specificity of backdoor attacks and the open nature of blockchain, embodiments provide a method and apparatus for defending against backdoor attacks in blockchain-based federated learning. These methods can trim the amplitude of model updates to suppress the triggering of these backdoor neurons, thereby achieving the purpose of defending against backdoor attacks. Cross-validation with the client further improves the accuracy of the trimming constraints, ensuring that they do not compromise the effectiveness of the entire model.

[0020] Figure 1 This is a flowchart of a method for defending against a backdoor attack in federated learning based on blockchain in one embodiment; Figure 2This is a flowchart of a method for defending against backdoor attacks in federated learning based on blockchain in one embodiment. Figure 1 and Figure 2 As shown, the method for defending against backdoor attacks in federated learning based on blockchain provided by the embodiment includes the following steps:

[0021] S101: The client participating in federated learning requests the blockchain to obtain an independent communication channel.

[0022] In this embodiment, based on federated learning and incorporating the characteristics of blockchain, a backdoor attack defense method is designed. Each local client in the learning process is provided with a channel to store the locally updated consensus and ledger during the global model aggregation process. These channels are dedicated subnetworks that enable isolated communication between at least two peers. Only peers associated with the channel are authorized to read, submit, and verify transactions within the channel. A ledger is also established for each independent communication channel to record updated local models and transmission logs. Due to the cryptographic properties of blockchain, global models can be securely stored and traced.

[0023] In one embodiment, a client participating in federated learning must request to join the blockchain before starting federated learning. Upon receiving the request, the blockchain sends a channel list to the client. The client selects an independent communication channel from the list for communicating with the central server and then receives allocated federated learning-related data from the independent communication channel. Once the client selects an independent communication channel, it establishes a unique correspondence with the independent communication channel, enabling secure, isolated communication between the client and the central server.

[0024] In this embodiment, if the client is not yet registered, it needs to register itself for its pre-selected independent communication channel. After successful registration, the client is allocated federated learning-related data. The federated learning-related data includes information such as the secret key, initial model, and training rounds. The secret key is used for signature authentication between the client and the independent communication channel, and includes both a private key and a public key.

[0025] S102, the client performs local training and uploads the trained local model to the central server after caching it through an independent communication channel.

[0026] When the client obtains the initial model or the global model sent by the central server, it uses the local data set to perform the next round of update training on the model, and then uploads it to the central server after caching it through an independent communication channel.

[0027] To ensure the security of model transmission, the client trains the assigned initial model using a local dataset. The client then encrypts the updated local model using the secret key in the federated learning data and submits it to the corresponding independent communication channel. The independent communication channel securely decodes the encrypted local model using the secret key in the federated learning data and receives the local model. The client encrypts the local model using a private key for hashing, and the independent communication channel decrypts the encrypted local model using the public key.

[0028] In one embodiment, in order to filter out backdoor attack clients, a cache time is set for the independent communication channel corresponding to each client participating in the same federated learning task. The local models uploaded by the client are accumulated and cached in a cache pool. When the set cache time is reached, the local models cached in the cache pool are uploaded to the central server to filter out clients that cannot complete training on time.

[0029] Compared to normal clients, backdoor attack clients need to pre-generate backdoor data and use this data to train the model, thus leaving a backdoor. Therefore, backdoor attackers spend much more time than normal clients. By setting a cache time, some backdoor attack clients can be constrained, forcing them to terminate their submission round before completing the backdoor model. Furthermore, in distributed scenarios like federated learning and blockchain, device latency and downtime are common, which can also affect the global model. Setting a buffer pool can also help alleviate this problem.

[0030] S103: After the central server prunes the received local model to form a pruned model, it adds disturbance to the pruned model and stores it in the verification ledger.

[0031] After the cache time is reached, the updates in the buffer pool will be sent to the central server for pruning. Since backdoor attacks may generate large-scale updates, a reasonable defense is to standardize the updates so that they are constrained within the boundaries, thereby making the neurons implanted with backdoors in the model ineffective. In this embodiment, the central server prunes the received local model in the following manner to form a pruned model:

[0032]

[0033] in, is the i-th local model uploaded by the j-th independent communication channel in the v-th round, || ||2 represents the Euclidean distance of the local model, and C represents the cropping rate of the current round, which ranges from 1 to the Euclidean distance || ||2, that is, [1, || ||2]. The smaller the cropping rate, the larger the current cropping range. If the current cropping rate has exceeded the Euclidean distance of the model, no further cropping will be performed. Represents the pruned model formed by pruning.

[0034] The first cropping is performed at a relatively large cropping rate. After the model is cropped, the central server adds differential privacy noise to the resulting cropped model. This noise is added to appropriately perturb the parameters of the cropped model, preventing backdoor attackers from inferring the current cropping rate during verification and designing attacks within the constraints. Furthermore, the noise-perturbed cropped model is difficult to reason about, thereby protecting privacy. The central server then uploads the perturbed cropped model to the verification ledger.

[0035] In step S104, the client downloads the perturbed pruned model corresponding to the local data from the verification ledger through an independent communication channel for model verification, and uploads the verification results to the central server.

[0036] In this embodiment, the cropping ratio of the tailored model needs to be verified based on the local dataset to guide the adjustment of the cropping ratio. The specific process is as follows: After the client downloads the corresponding tailored model from the verification ledger, it verifies the accuracy of the tailored model using the local dataset and uploads the verification result via a separate communication channel. This delegates the model availability detection process to the client, which can detect anomalous updates by evaluating the update performance of its own data. Ideally, each client would measure the performance of all updated tailored models, resulting in the highest success rate for detecting attacks. However, in practice, downloading and evaluating all updated tailored models is clearly impossible due to prohibitive computational and communication costs. Since training data has different distributions across different clients, high detection rates can only be achieved when the selected client has sufficient data samples. To this end, a protocol is designed to dynamically assign tailored models to appropriate clients for evaluation, where clients will only evaluate tailored models on the data classes they own.

[0037] In one embodiment, the client uploads the class label of the local data at the same time as uploading the local model. The central server divides the clients according to the class label and divides the clients with at least two identical class labels into the same client group. When allocating the cropped model for verification, the central server allocates the cropped model to the client group with the same class label as the cropped model according to the class label for model verification.

[0038] For example, for a federated learning task for building a disease classification model for 10 categories, assume that client A's local data is labeled as Class 1 disease, Class 2 disease, and Class 5, client B's local data is labeled as Class 2 disease, Class 5 disease, and Class 7, and client B's local data is labeled as Class 2 disease, Class 4 disease, Class 5, and Class 8. When dividing clients into groups, since clients A, B, and C have local data for both Class 2 and Class 2 diseases, clients A, B, and C are assigned to the same client group, labeled as Class 1 disease and Class 2 disease. Based on this, when the central server assigns tailored models for verification, tailored models that can only classify Class 1 and Class 2 diseases will be assigned to the client group labeled as Class 1 disease and Class 2 disease based on the class labels. The clients in this client group will use their local data to verify the tailored models and upload the verification results to the central server.

[0039] In an embodiment, the class labels of local data are represented by binary vectors. When the amount of local data corresponding to each class label is greater than a set threshold, it is marked as 1, otherwise it is marked as 0. In this way, a binary vector representation with a length equal to the total number of federated learning task classifications is formed. After sorting the binary vector representations, clients with at least two identical class labels are screened and assigned to the same client group.

[0040] Specifically, when each client uploads an updated model, the central server requires it to report, via a binary vector, whether the number of data samples for each label exceeds a threshold. If sufficient data exists for a given class label, the vector is marked 1; otherwise, it is marked 0. In each round, based on updated local data, the central server aggregates and sorts the binary vectors, then selects clients with similar class labels to form client groups. After model pruning is complete, clients are divided based on class label similarity, and the pruned models are sent to similar clients rather than the original clients.

[0041] It's important to note that a backdoor attack client could potentially disrupt the cropping process by uploading incorrect verification results. However, since the central server has already identified a group of clients with similar identifiers to the backdoor attacker, simply comparing the verification results of clients in the same group can identify any malicious backdoor attack clients.

[0042] By repeating the model cropping and model verification process, the central server can optimize the cropping rate and achieve an ideal cropping effect. At this time, the backdoor features injected into the model will be largely erased and lose their effect.

[0043] S105: The central server selects the trusted pruned models based on the verification results and performs model aggregation to obtain a global model.

[0044] In the embodiment, the central server adopts the following aggregation method when aggregating the trusted pruning model:

[0045]

[0046] Among them, w v 、w v+1 represents the global model updated in rounds v+1 and v, S represents the total amount of data, n k Indicates the amount of data owned by the k-th client, Represents the pruned model of round v. After the aggregation is completed, the central server sends the global model to the client through an independent communication channel and prepares for the next round of training.

[0047] The above embodiment provides a method for defending against backdoor attacks in federated learning based on blockchain. It utilizes the smart contract mechanism in the blockchain and requires the clients participating in the training to verify the accuracy after cropping on the server, and jointly determine the appropriate cropping rate to defend against backdoor attacks.

[0048] An embodiment also provides a defense device for blockchain-based federated learning backdoor attacks, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned defense method for blockchain-based federated learning backdoor attacks is implemented.

[0049] In specific applications, the memory can be local volatile memory such as RAM, non-volatile memory such as ROM, FLASH, floppy disk, mechanical hard disk, etc., or remote storage cloud. The processor can be a central processing unit (CPU), microprocessor (MPU), digital signal processor (DSP), or field programmable gate array (FPGA). These processors can be used to implement a blockchain-based federated learning backdoor attack defense step.

[0050] The specific implementation methods described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for defending against backdoor attacks in federated learning based on blockchain, characterized in that: The following steps are involved: After the client participating in federated learning requests an independent communication channel from the blockchain, the local model trained locally is cached in the independent communication channel and then uploaded to the central server. A cache time is set for the independent communication channel corresponding to each client participating in the same federated learning task. The local models uploaded by the client are accumulated and cached in the cache pool. When the set cache time is reached, the local models cached in the cache pool are uploaded to the central server to filter out clients that cannot complete training on time. After the central server prunes the receiving local model to form a pruned model, it adds disturbance to the pruned model and stores it in the verification ledger. The central server prunes the receiving local model to form a pruned model in the following manner: in, is the i-th local model uploaded by the j-th independent communication channel in the v-th round, || ||2 represents the Euclidean distance of the local model, C represents the cropping rate of the current round, and its value range is 1 to the Euclidean distance || ||2, represents the pruned model formed by pruning; The client downloads the perturbed pruning model corresponding to the local data from the verification ledger through an independent communication channel for model verification, and uploads the verification results to the central server; The central server selects the trusted pruned models based on the verification results and aggregates the models to obtain the global model.

2. The method for defending against backdoor attacks of federated learning based on blockchain as claimed in claim 1, characterized in that: Before federated learning, clients participating in federated learning need to request to join the blockchain. After receiving the request, the blockchain sends a channel list to the client. After the client selects an independent communication channel from the channel list for communicating with the central server, it receives the allocated federated learning related data from the independent communication channel.

3. The method for defending against backdoor attacks of federated learning based on blockchain as claimed in claim 1, characterized in that: After the client trains the assigned initial model using the local data set, it encrypts the updated local model according to the secret key in the federated learning-related data and submits it to the corresponding independent communication channel. The independent communication channel securely decodes the encrypted local model according to the secret key in the federated learning-related data and receives the local model.

4. The method for defending against backdoor attacks of federated learning based on blockchain as claimed in claim 1, characterized in that: A ledger is set up for each independent communication channel to record updated local models and transmission logs.

5. The method for defending against backdoor attacks of federated learning based on blockchain as claimed in claim 1, characterized in that: When the client uploads the local model, it also uploads the class label of the local data. The central server divides the clients according to the class label and divides the clients with at least two identical class labels into the same client group. When allocating the cropped model for verification, the central server allocates the cropped model to the client group with the same class label as the cropped model according to the class label for model verification.

6. The method for defending against backdoor attacks of federated learning based on blockchain as claimed in claim 5, characterized in that: The class labels of local data are represented by binary vectors. When the amount of local data corresponding to each class label is greater than the set threshold, it is marked as 1, otherwise it is marked as 0, thus forming a binary vector representation with a length equal to the total number of federated learning task classifications. After sorting the binary vector representations, clients with at least 2 identical class labels are screened and assigned to the same client group.

7. The method for defending against backdoor attacks of federated learning based on blockchain as claimed in claim 5, characterized in that: The central server uses the following aggregation method when aggregating the trusted pruned model: Among them, w v 、w v+1 represents the global model updated in rounds v+1 and v, S represents the total amount of data, n k represents the amount of data owned by the kth client, Represents the pruning model of round v.

8. A defense device for backdoor attacks of federated learning based on blockchain, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for defending against blockchain-based federated learning backdoor attacks as described in any one of claims 1 to 7 is implemented.

Images