Backdoor attack defense method and device for federated learning
By using the robust filter RFOut-1d in the federated learning system to identify and filter model updates of adversarial clients, the federated learning system is solved, and the model performance is maintained and accuracy in practical applications is achieved.
Patent Information
- Application Number
- CN202110897437.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-08-05
- Publication Date
- 2025-04-04
- Estimated Expiration
- 2041-08-05
AI Technical Summary
Federated learning systems are vulnerable to backdoor attacks, resulting in reduced model performance and difficult to detect and defend against.
Defend backdoor attacks by using the robust filter RFOut-1d during model training, identifying and filtering potential adversarial clients and eliminating their model updates.
Effectively eliminate the impact of backdoor attacks on the model, maintain model performance, and ensure the accuracy of the model in practical applications.
Smart Images
Figure CN113779563B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method and device for defending against backdoor attacks in federated learning. Background Art
[0002] With the development of big data, edge computing, large cloud computing platforms, and various open source frameworks, artificial intelligence technologies such as machine learning have been applied to various industries at an unprecedented rate. However, while artificial intelligence technology brings opportunities, it also brings new challenges, such as data privacy and security. In order to strengthen the protection of user data privacy and the security management of data, the use of data is restricted, which makes Internet data scattered in different enterprises and organizations, forming a "data island" phenomenon, and the data of all parties cannot be directly shared or exchanged. The recent rise of federated learning is a feasible direction to solve the "data island" problem while ensuring data privacy and security.
[0003] Federated learning is an emerging learning paradigm based on distributed training of learning models among a group of clients under the coordination of a central server, while isolating the training data among these clients. Federated learning is a method of protecting user privacy and is designed for decentralized scenarios. But at the same time, modern machine learning algorithms may be subject to various adversarial attacks in actual application scenarios, including data and model update process poisoning, model circumvention, model theft, and data reasoning attacks on users' private training data. Federated learning is also vulnerable to adversarial attacks. Its distributed nature and inaccessible nature of data hinder the defense against these malicious attacks. Adversarial attacks against federated learning are more hidden and difficult to detect.
[0004] Currently, the most common defense solutions used in federated learning scenarios are based on adjusting the aggregation operator. Since attacks on learning models are usually performed by clients, a representative measure is to perform more robust update aggregation, such as the Byzantine-robust aggregation rule. However, due to the concealment of backdoor attacks, these defense measures are not effective enough against backdoor attacks. Summary of the invention
[0005] In view of the problems existing in the prior art, the present invention provides a method and device for backdoor attack defense of federated learning.
[0006] In a first aspect, the present invention provides a method for defending against backdoor attacks in federated learning, comprising:
[0007] Establish and train a federated learning-based image classification model;
[0008] Classify the image to be classified according to the trained image classification model;
[0009] Among them, the image classification model training method is as follows:
[0010] For target round model learning, respectively obtain initial local model parameters of target model update dimensions obtained by each client in the target round model learning;
[0011] Determining outliers in each initial local model parameter based on a mean value and a standard deviation of each initial local model parameter;
[0012] The initial local model parameters of the client corresponding to the abnormal value are updated to the average value of the initial local model parameters to obtain new local model parameters of each client;
[0013] Calculating the average value of each of the new local model parameters to obtain the aggregate model parameter of the target round model learning corresponding to the target model update dimension;
[0014] Based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, an image classification model is obtained after training.
[0015] Optionally, determining the abnormal value in each initial local model parameter based on the average value and standard deviation of each initial local model parameter includes:
[0016] If it is determined that the difference between the target initial local model parameter and the average value of the initial local model parameters is greater than or equal to a preset multiple of the standard deviation, the value of the target initial local model parameter is determined as an abnormal value.
[0017] Optionally, the preset multiple is 3.
[0018] Optionally, the distribution of each of the initial local model parameters follows Gaussian distribution.
[0019] In a second aspect, the present invention further provides a backdoor attack defense device for federated learning, comprising:
[0020] The training module is used to build and train the federated learning-based image classification model;
[0021] A processing module, used for classifying the image to be classified according to the trained image classification model;
[0022] Wherein, the training module is specifically used for:
[0023] For target round model learning, respectively obtain initial local model parameters of target model update dimensions obtained by each client in the target round model learning;
[0024] Determining outliers in each initial local model parameter based on a mean value and a standard deviation of each initial local model parameter;
[0025] The initial local model parameters of the client corresponding to the abnormal value are updated to the average value of the initial local model parameters to obtain new local model parameters of each client;
[0026] Calculating the average value of each of the new local model parameters to obtain the aggregate model parameter of the target round model learning corresponding to the target model update dimension;
[0027] Based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, an image classification model is obtained after training.
[0028] Optionally, the training module is specifically used to:
[0029] If it is determined that the difference between the target initial local model parameter and the average value of the initial local model parameters is greater than or equal to a preset multiple of the standard deviation, the value of the target initial local model parameter is determined as an abnormal value.
[0030] Optionally, the preset multiple is 3.
[0031] Optionally, the distribution of each of the initial local model parameters follows Gaussian distribution.
[0032] In a third aspect, the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the federated learning backdoor attack defense method as described in the first aspect are implemented.
[0033] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the backdoor attack defense method for federated learning as described in the first aspect above.
[0034] The federated learning backdoor attack defense method and device provided by the present invention identify potential adversarial clients by means of detection and filtering during the model training process, filter out the model updates of these risky clients, thereby eliminating the impact and harm of backdoor attacks on the model, enabling the trained model to maintain good performance and ensuring the accuracy of the model in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0036] Figure 1 It is a flowchart of the backdoor attack defense method of federated learning provided by the present invention;
[0037] Figure 2 It is a flowchart of the RFOut-1d algorithm provided by the present invention;
[0038] Figure 3 It is a schematic diagram showing the mode key used in the mode key backdoor attack provided by the present invention;
[0039] Figure 4 It is a structural schematic diagram of the backdoor attack defense device of federated learning provided by the present invention;
[0040] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION
[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0042] In federated learning applications, adversarial attacks can be roughly divided into two categories, namely non-directional attacks and directional attacks, depending on the attack targets. The goal of non-directional attacks is to destroy the model so that it cannot achieve optimal performance in the main task. In directional attacks (commonly referred to as backdoor attacks), the opponent's goal is to make the model maintain good overall performance in the main task while showing poor performance in certain specific subtasks. Since the attack method of backdoor attacks is more covert and potentially more destructive, the present invention focuses on backdoor attacks and uses them as the main target of the proposed solution.
[0043] Adversarial clients have the ability to mislead the behavior of federated learning models, inject backdoor attacks, or destroy data privacy. The purpose of this invention is to identify potential adversarial clients through detection and filtering, filter out model updates of these risky clients, and thus eliminate the impact and harm of backdoor attacks on the model.
[0044] Figure 1 A flowchart of the backdoor attack defense method for federated learning provided by the present invention is shown in FIG. Figure 1 As shown, the method comprises the following steps:
[0045] Step 100: Establish an image classification model based on federated learning and perform training;
[0046] Among them, the image classification model training method is as follows:
[0047] For target round model learning, initial local model parameters of target model update dimensions obtained by each client in target round model learning are obtained respectively;
[0048] Determining outliers in each initial local model parameter based on a mean value and a standard deviation of each initial local model parameter;
[0049] The initial local model parameters of the client corresponding to the abnormal value are updated to the average value of each initial local model parameter to obtain the new local model parameters of each client;
[0050] The new local model parameters are averaged to obtain the aggregate model parameters of the target round model learning corresponding to the target model update dimension;
[0051] Based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, an image classification model is obtained after training is completed;
[0052] Specifically, since various backdoor attack methods may exist in the federated learning scenario, in order to enable the model trained based on federated learning to effectively defend against backdoor attacks, the present invention proposes an RFOut-1d (robust filter for one-dimensional outliers) federated aggregation operator based on filtering out outliers in the client model update distribution to produce more robust aggregation in each learning round.
[0053] In order to facilitate a clearer understanding of the technical solution of the present invention, the following first describes the possible backdoor attack methods that may exist in the federated learning scenario.
[0054] In order to facilitate the description of the attack and defense in the present invention, a series of symbols will be used to represent the corresponding objects. t represents the global model (also called the aggregate model) in the tth round of learning, represents the local model (also called local model) of the jth client in the tth round of learning, n is the total number of clients selected for each aggregation, and η is the server learning rate. Accordingly, the update of the global model in the tth round of learning is performed in equation (1) as follows:
[0055]
[0056] In this case, the present invention defines the backdoor attack scenario as one or more clients being coordinated to inject secondary or backdoor tasks into the global model. Typically, these attacks do not negatively impact the original task performance, which makes them more difficult to identify. Due to the distributed nature of the learning process, the number of clients participating in each aggregation is large, and if the proportion of adversarial clients is significantly lower than that of normal clients, the impact of adversarial clients will be ignored by the remaining clients and no effective attack will occur. For this reason, the present invention focuses on model poisoning backdoor attacks based on the model replacement paradigm.
[0057] If only one adversarial client is selected to use its backdoor model in round t To replace the global model E t ,The model optimizes the original task and the backdoor task by sending it to the federated learning server.
[0058]
[0059] in, is a promoting factor, It is a backdoor model for adversarial clients. Optimized backdoor task. Then, replacing equation (2) in equation (1) yields:
[0060]
[0061] According to the definition of federated learning, the federated learning model will eventually converge to a solution, so for normal clients, the present invention can assume Therefore, equation (3) can be rewritten as follows:
[0062]
[0063] As a result, the adversarial client replaces the global model with the backdoor model.
[0064] If multiple adversarial clients participate in the same round of learning, we assume that they can coordinate their attacks by distributing the boost factor β among the attackers.
[0065] The present invention believes that in the simulated attack scenario, the model update of the normal client will minimize the global task loss, while the model update of the adversarial client will optimize the global and backdoor task losses. Therefore, the present invention proposes a federated aggregation operator based on filtering out outliers in the client model update distribution (RFOut-1d) to produce more robust aggregation in each learning round t.
[0066] In an embodiment of the present invention, an image classification application scenario is taken as an example to illustrate. First, an image classification model based on federated learning is established. When the model is trained, potential adversarial clients are identified through detection and filtering, and the model updates of these risky clients are filtered out, thereby eliminating the impact and harm of backdoor attacks on the model.
[0067] Specifically, due to the high dimensionality of updates (usually from neural networks), in order to avoid information loss by applying dimensionality reduction techniques, the present invention performs univariate anomaly detection on each dimension of the model update. Therefore, for each dimension i∈{1,...,m}, where m is the dimension of the model update vector, the present invention considers the vector formed by the local model update of each client on that dimension Where n is the number of clients participating in the aggregation.
[0068] For any round of model learning, the initial local model parameters of each client on any model update dimension i obtained in this round of model learning can be obtained respectively, that is, U i ; Then, based on the mean and standard deviation of each initial local model parameter, the outliers in each initial local model parameter are determined.
[0069] Optionally, assuming that the distribution of each initial local model parameter follows a Gaussian distribution, the outliers in each initial local model parameter can be determined based on the method of detecting univariate outliers in a Gaussian distribution. In an embodiment of the present invention, it can be assumed that the model update of the client follows a Gaussian distribution of a certain round of learning, because the global aggregation model tends to converge to a common solution, which is an intuitive proof based on the central limit theorem, which states that the sum of independent random variables is very close to a Gaussian distribution. Let the distribution of the client local weights be each random variable, then their linear combination is close to a Gaussian distribution. Therefore, aggregating again and again, the result will converge to a Gaussian distribution. In particular, the data distribution of each dimension of the update converges to a univariate Gaussian distribution.
[0070] Optionally, determining the outliers in each initial local model parameter based on the mean value and standard deviation of each initial local model parameter includes:
[0071] If it is determined that the difference between the target initial local model parameter and the average value of each initial local model parameter is greater than or equal to a preset multiple of the standard deviation, the value of the target initial local model parameter is determined as an abnormal value.
[0072] Specifically, the standard deviation method can be applied for univariate anomaly detection. It filters out those values whose difference between the validation value and the mean value is greater than or equal to δ times the standard deviation. In formal terms, μ i Replace those that satisfy
[0073] The value of μ i and σ i U i The mean and standard deviation of is the parameter of dimension i of the model update of client j in the tth round of learning. δ can be set according to actual model training experience and is not limited here. Optionally, the value of δ can be 3. The present invention uses mean estimation because it will filter out the participation of outliers in the aggregation as the model updates of subsequent clients are aggregated.
[0074] Finally, the federated aggregate RFOut-1d consists of the one-dimensional average of the unfiltered parameters. Formally, the aggregate model parameters E obtained in each dimension i in the t-th round of learning are t [i] is:
[0075]
[0076]
[0077] in is the result vector after applying the rule of equation (5)
[0078] Therefore, the aggregate model parameters of each model update dimension corresponding to each round of model learning can be obtained, and the image classification model can be obtained after the training is completed.
[0079] Figure 2 A schematic diagram of the flow chart of the RFOut-1d algorithm provided by the present invention is shown in FIG. Figure 2 As shown in the figure, the value of δ is set to 3. For any round of model learning, the initial local model parameters of each client on any model update dimension i obtained in this round of model learning can be obtained respectively, and those abnormal values whose difference with the average value is greater than or equal to 3 times the standard deviation are filtered out, and then μ i Replace the outliers and obtain new local model parameters for each client. Finally, take the average of the new local model parameters to obtain the aggregate model parameters for any model update dimension corresponding to this round of model learning.
[0080] In addition to filtering out clients that are likely to be attackers, RFOut-1d optimizes the learning process by enabling faster convergence to a general solution. In addition, it can be combined with other aggregation mechanisms as defenses, such as norm threshold updates or weak differential privacy.
[0081] Step 101: Classify the image to be classified according to the trained image classification model.
[0082] Specifically, after the above-mentioned image classification model based on federated learning is trained, the image to be classified can be classified according to the trained image classification model.
[0083] The backdoor attack defense method for federated learning provided by the present invention identifies potential adversarial clients by means of detection and filtering during the model training process, filters out model updates of these risky clients, thereby eliminating the impact and harm of backdoor attacks on the model, and can enable the trained model to maintain good performance, thereby ensuring the accuracy of the model in practical applications.
[0084] In order to better understand the above-mentioned backdoor attack defense method provided by the present invention, the attack environment simulated by the present invention to verify the performance of the defense mechanism is introduced below.
[0085] 1. Adversarial Attacks
[0086] Regarding attacks, this invention defines two taxonomies:
[0087] 1) Depending on which part of the federated learning model is attacked, a distinction is made between model poisoning and data poisoning attacks. In practice, the two are almost equivalent, as data poisoning leads to model poisoning. However, data poisoning attacks and some model poisoning attacks may be ineffective, as these attacks are likely to be eliminated in an aggregation of many clients. For this reason, these attacks are often combined with model replacement techniques, whereby an adversarial model (or multiple models) is augmented to replace the global model in the aggregation.
[0088] 2) Based on the purpose of the attack, a distinction is made between non-targeted attacks (Byzantine attacks) and targeted attacks (backdoor attacks). The former aims to try to affect the performance of the model, while the latter aims to secretly inject secondary or backdoor tasks into the global model. The second type of attacks may be more harmful because they may endanger the integrity of the global model without being discovered. In addition, since adversarial client models optimize both the original task and the adversarial task, they are also more difficult to detect during the aggregation process. The second type is also the type of attack that the present invention mainly targets.
[0089] Regarding backdoor attacks, backdoor attacks have a set of hyperparameters or properties to configure their behavior, defined as follows:
[0090] Number of backdoor tasks: In the input instance backdoor attack, due to the difference in client distribution, this paper regards each client sample as a specific backdoor task. Therefore, the number of backdoor tasks corresponds to the number of clients. The samples of the backdoor dataset are selected from these clients, which is called S backdoor In the pattern-key backdoor attack, since the attack should be generalized, it can be considered that it can be solved by only one backdoor task (one pattern).
[0091] Number of adversarial clients: The number of clients that are influenced and adjusted to perform the backdoor task. The local training dataset of each adversarial client j is composed of their original training dataset and backdoor dataset S backdoor The union of In the input instance backdoor attack, S backdoor corresponds to the sample set from each backdoor task. As for the pattern key backdoor attack, S backdoor It consists of all samples that have been reversed according to a specific pattern.
[0092] Sampling and frequency of adversarial clients: The frequency of adversarial clients in the subset of clients selected for each aggregate is a key factor. According to the conclusions of the relevant literature, the proportion of adversarial clients required for an effective attack is too high and unrealistic when using random sampling. Therefore, the solution of the present invention focuses on fixed-frequency attacks, that is, autonomously determining the number of adversarial clients participating in the attack for each aggregate.
[0093] 2. Description of the problem of simulated attack
[0094] The problem to be solved by the present invention in simulating an attack environment is to resist the attack to be executed in the corresponding attack environment and ensure the security and integrity of the model.
[0095] In order to simulate the attack environment, the present invention selects two backdoor attacks based on data manipulation. These attacks differ in how the data is poisoned, specifically:
[0096] Input instance backdoor attack: The goal of the attack is to cause the federated learning model to misclassify certain specific samples of the input distribution, thereby favoring a certain goal. For example, in a facial recognition system for entering a room, a person (specific input) who does not have permission to enter the room is allowed to enter.
[0097] Pattern-key backdoor attack: In this case, the goal is to misclassify some samples modified according to a specific pattern in favor of a specific goal. For example, in the same situation as the previous example, all people wearing purple glasses (the pattern) are allowed in.
[0098] 3. Attack scenario configuration
[0099] A. Dataset
[0100] Regarding the datasets needed for the simulation scenarios, the general idea of the present invention is to use classic machine learning datasets and distribute them among clients according to different data distributions. However, while it is possible to simulate the non-independent and identically distributed characteristics of data distribution, it is quite complicated to simulate the data specialization between clients so that they represent their own characteristics. For this reason, the present invention decided to use a jointly defined dataset and selected the following image classification datasets included in the LEAF benchmark:
[0101] 1) Digits FEMNIST: The federated version of the EMNIST digits dataset, where each client corresponds to an original writer.
[0102] 2) CelebA: An image classification dataset consisting of celebrity face images, each with 40 binary attribute annotations. The present invention associates each celebrity with a client. The present invention uses it as a binary image classification dataset and selects specific attributes as targets, especially Smiling (CelebA-S) and Attractive (CelebA-A).
[0103] Using a joint dataset may result in insufficient data for some clients. Therefore, the present invention sets a minimum number of samples k for each client and discards clients that do not meet this condition. For the CelebA dataset, the present invention uses k=30, and for FEMNIST, the present invention sets k=8 because it is the minimum number of samples for each client.
[0104] B. Backdoor attack settings
[0105] Input instance backdoor attack setting: The present invention sets a target label and a sample set S backdoor , these samples come from clients belonging to other classes (original labels). The attack consists in classifying the maximum number of these samples using the target label without modifying any sample. Due to the particularity of each client, the present invention sets the number of backdoor tasks to the backdoor dataset S backdoor The number of clients of the obtained samples, the number of adversarial clients is set to the number of clients that have the backdoor dataset in their data and the attack frequency. Based on these parameters, the input instance backdoor attack of FEMNIST, CelebA-S and CelebA-A datasets is defined, which is set as follows:
[0106]
[0107] Pattern key backdoor attack setup: The present invention sets a target label and a pattern key. The attack consists of classifying all samples contaminated by the pattern key as the target label. Figure 3A schematic diagram showing the mode key used in the mode key backdoor attack provided by the present invention, as shown in FIG. Figure 3 As shown, in order to demonstrate the adversarial behavior of RFOut-1d, the present invention uses three patterns with different difficulty levels represented by the number of pixels, from left to right, 1 pixel pattern, 8 pixel pattern (cross with length 4) and 25 pixel pattern (square with side 5). The settings of the pattern key backdoor attack on the FEMNIST, CelebA-S and CelebA-A datasets are defined as follows:
[0108]
[0109] Based on the above simulated attack environment, the performance of the above backdoor attack defense method was verified. The experimental results show that RFOut-1d is a very effective defense scheme that can weaken the impact of backdoor attacks in all learning rounds to the point of (almost) making them ineffective. Compared with other defense measures, it does not hinder the federated learning process by maintaining (or even improving) the performance of the model in the original task. By screening out clients that deviate from this solution, it accelerates and optimizes the combination of the model with the general solution. While eliminating the impact of backdoor attacks, it maintains the performance of the federated learning model, and its performance is better than most current defense measures.
[0110] The federated learning backdoor attack defense device provided by the present invention is described below. The federated learning backdoor attack defense device described below and the federated learning backdoor attack defense method described above can be referenced to each other.
[0111] Figure 4 A schematic diagram of the structure of the backdoor attack defense device for federated learning provided by the present invention is shown in FIG. Figure 4 As shown, the device comprises:
[0112] A training module 400 is used to establish and train an image classification model based on federated learning;
[0113] The processing module 410 is used to perform classification processing on the image to be classified according to the trained image classification model;
[0114] The training module 400 is specifically used for:
[0115] For target round model learning, initial local model parameters of target model update dimensions obtained by each client in target round model learning are obtained respectively;
[0116] Determining outliers in each initial local model parameter based on a mean value and a standard deviation of each initial local model parameter;
[0117] The initial local model parameters of the client corresponding to the abnormal value are updated to the average value of each initial local model parameter to obtain the new local model parameters of each client;
[0118] The new local model parameters are averaged to obtain the aggregate model parameters of the target round model learning corresponding to the target model update dimension;
[0119] Based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, an image classification model is obtained after training.
[0120] Optionally, the training module 400 is specifically used to:
[0121] If it is determined that the difference between the target initial local model parameter and the average value of each initial local model parameter is greater than or equal to a preset multiple of the standard deviation, the value of the target initial local model parameter is determined as an abnormal value.
[0122] Optionally, the preset multiple is 3.
[0123] Optionally, the distribution of each initial local model parameter follows Gaussian distribution.
[0124] It should be noted here that the above-mentioned device provided by the present invention can implement all the method steps implemented by the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.
[0125] Figure 5 A schematic diagram of the structure of an electronic device provided by the present invention, such as Figure 5As shown, the electronic device may include: a processor (processor) 510, a communication interface (Communications Interface) 520, a memory (memory) 530 and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call the logic instructions in the memory 530 to execute the steps of any of the federated learning backdoor attack defense methods provided in the above embodiments, for example: establishing an image classification model based on federated learning and training it; classifying the images to be classified according to the trained image classification model; wherein the image classification model training method is as follows: for the target round model learning, respectively obtain the initial local model parameters of the target model update dimension obtained by each client in the target round model learning; based on the average value and standard deviation of each initial local model parameter, determine the outliers in each initial local model parameter; update the initial local model parameters of the client corresponding to the outlier to the average value of each initial local model parameter, and obtain new local model parameters for each client; calculate the average value of each new local model parameter to obtain the aggregate model parameters of the target model update dimension corresponding to the target round model learning; based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, obtain the image classification model after training.
[0126] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.
[0127] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the steps of any of the federated learning backdoor attack defense methods provided in the above embodiments, for example: establishing an image classification model based on federated learning and training it; performing classification processing on the image to be classified according to the trained image classification model; wherein the image classification model training method is as follows: for the target round model learning, respectively obtain the initial local model parameters of the target model update dimension obtained by each client in the target round model learning; based on the average value and standard deviation of each initial local model parameter, determine the outliers in each initial local model parameter; update the initial local model parameters of the client corresponding to the outlier to the average value of each initial local model parameter, and obtain new local model parameters for each client; average the new local model parameters to obtain the aggregated model parameters of the target model update dimension corresponding to the target round model learning; based on the aggregated model parameters of each model update dimension corresponding to each round of model learning, obtain the image classification model after training.
[0128] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the federated learning backdoor attack defense methods provided in the above-mentioned embodiments, for example: establishing and training an image classification model based on federated learning; performing classification processing on the images to be classified according to the trained image classification model; wherein the image classification model training method is as follows: for the target round model learning, respectively obtain the initial local model parameters of the target model update dimension obtained by each client in the target round model learning; based on the average value and standard deviation of each initial local model parameter, determine the outliers in each initial local model parameter; update the initial local model parameters of the client corresponding to the outlier to the average value of each initial local model parameter, and obtain new local model parameters for each client; average the new local model parameters to obtain the aggregated model parameters of the target model update dimension corresponding to the target round model learning; based on the aggregated model parameters of each model update dimension corresponding to each round of model learning, obtain the image classification model after training.
[0129] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0130] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A backdoor attack defense method for federated learning, characterized in that: include: Establish and train a federated learning-based image classification model; Classify the image to be classified according to the trained image classification model; Among them, the image classification model training method is as follows: For target round model learning, respectively obtain initial local model parameters of target model update dimensions obtained by each client in the target round model learning; Determining outliers in each initial local model parameter based on a mean value and a standard deviation of each initial local model parameter; The initial local model parameters of the client corresponding to the abnormal value are updated to the average value of the initial local model parameters to obtain new local model parameters of each client; Calculating the average value of each of the new local model parameters to obtain the aggregate model parameter of the target round model learning corresponding to the target model update dimension; Based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, an image classification model is obtained after training is completed; The step of determining the abnormal value in each initial local model parameter based on the average value and standard deviation of each initial local model parameter comprises: If it is determined that the difference between the target initial local model parameter and the average value of each initial local model parameter is greater than or equal to a preset multiple of the standard deviation, the value of the target initial local model parameter is determined as an abnormal value, and the preset multiple is 3. The distribution of each initial local model parameter follows a Gaussian distribution.
2. A backdoor attack defense device for federated learning, characterized in that: include: The training module is used to build and train the federated learning-based image classification model; A processing module, used for classifying the image to be classified according to the trained image classification model; Wherein, the training module is specifically used for: For target round model learning, respectively obtain initial local model parameters of target model update dimensions obtained by each client in the target round model learning; Determining outliers in each initial local model parameter based on a mean value and a standard deviation of each initial local model parameter; The initial local model parameters of the client corresponding to the abnormal value are updated to the average value of the initial local model parameters to obtain new local model parameters of each client; Calculating the average value of each of the new local model parameters to obtain the aggregate model parameter of the target round model learning corresponding to the target model update dimension; Based on the aggregate model parameters of each model update dimension corresponding to each round of model learning, an image classification model is obtained after training is completed; The training module is specifically used for: If it is determined that the difference between the target initial local model parameter and the average value of each initial local model parameter is greater than or equal to a preset multiple of the standard deviation, the value of the target initial local model parameter is determined as an abnormal value, and the preset multiple is 3. The distribution of each initial local model parameter follows a Gaussian distribution.
3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the backdoor attack defense method of federated learning as described in claim 1 are implemented.
4. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the backdoor attack defense method of federated learning as claimed in claim 1 are implemented.
Citation Information
Patent Citations
Federated learning toilet vehicle attack defense method based on block chain
CN112714106A