A method for defending member reasoning attacks in federated learning based on adversarial interference

Abstract

The present invention relates to a method for defending against member reasoning attacks of federated learning based on adversarial interference, and belongs to the technical field of federated learning privacy protection in machine learning. The method establishes a mechanism for defending against member reasoning attacks of federated learning. Before each participant uploads model parameters trained with local data, a carefully designed adversarial interference is added to the model parameters, so that the attack accuracy rate obtained by the attacker after performing member reasoning attacks on the model trained with this defense mechanism is as close to 50% as possible, and the impact on the performance of the target model is reduced as much as possible, thereby simultaneously meeting the needs of user data privacy protection and collaborative training of high-performance models in federated learning scenarios.

Description

Technical Field

[0001] The present invention relates to a method for defending against member reasoning attacks on federated learning based on adversarial interference, which aims to defend against member reasoning attacks suffered by participants when they collaboratively train machine learning models in a federated learning scenario, thereby realizing privacy protection of the participants' local data, and belongs to the technical field of federated learning privacy protection in machine learning. Background Art

[0002] Machine learning mainly studies how to use computers to simulate or realize human activities, and is one of the research hotspots in the field of artificial intelligence. After decades of development, machine learning has been widely used in data mining, computer vision, natural language processing, medical diagnosis and other fields, with excellent performance.

[0003] In recent years, the rapid development of information technology has promoted the exponential growth of data. In order to achieve the training of machine learning models that support high performance and large-scale training data, distributed machine learning using multi-node collaborative training models has entered the field of vision of technical personnel. As user privacy has become increasingly important, Google proposed a special distributed machine learning technology, namely federated learning, in 2016. This technology solves the privacy protection problem of user local data by keeping user data locally.

[0004] Federated learning is a distributed machine learning technology that enables multiple participants to collaboratively train machine learning models while protecting local data privacy. Federated learning includes a server and multiple participants (i.e., clients). The specific process is as follows: the server distributes the global model to multiple participants, each participant trains the model with local data and sends the model parameters to the server, the server aggregates all received model parameters and uses the aggregated model parameters to update the global model, and repeats the above steps until the training is terminated. Since participants do not need to expose local data, they only need to upload model parameters, so federated learning protects the privacy of participants' local data.

[0005] However, although participants no longer have to upload local data, the model parameters exchanged between participants and the server contain information related to the training data, which makes federated learning vulnerable to member inference attacks.

[0006] Membership inference attacks can infer whether data is used in training models. Once the attacker succeeds, the privacy of participants is at risk of being leaked. For example, when using medical data from multiple hospitals to jointly train a model, if the attacker has the ability to determine whether the data is used in training the model, it may be possible to infer the patient's health status. Therefore, it is necessary to study how to defend against membership inference attacks.

[0007] In order to simultaneously meet the needs of user data privacy protection and collaborative training of high-performance models in federated learning scenarios, appropriate technical methods must be adopted to train high-performance models while protecting user data privacy. Summary of the invention

[0008] The purpose of the present invention is to solve the technical problem that the existing federated learning is vulnerable to member reasoning attacks, thereby leaking the privacy of user local data. According to the process of federated learning and the characteristics of member reasoning attacks, a federated learning member reasoning attack defense method based on adversarial interference is creatively proposed.

[0009] The innovation of the present invention lies in: establishing a federated learning member reasoning attack defense mechanism. Before each participant uploads the model parameters trained using local data, carefully designed adversarial interference is added to the model parameters, so that the attacker's attack accuracy after performing member reasoning attacks on the model trained using this defense mechanism is as close to 50% as possible (the attack result is close to the attack result of random guessing) and the impact on the target model performance is minimized, thereby simultaneously meeting the needs of user data privacy protection and collaborative training of high-performance models in federated learning scenarios.

[0010] The present invention is implemented by the following technical means.

[0011] This method is based on the federated learning member reasoning attack defense model, which includes the federated learning training model Membership Inference Attack Defense Model and model data

[0012] Among them, the federated learning training model is the set of participants who participate in the training of local models in federated learning and servers involved in federated learning model aggregation and distribution The union of, that is, for The number of participants in the federated learning training model The participants and the server in the training process work together to train the machine learning model based on the average aggregation algorithm. Average aggregation means that the server averages all the model parameters received and uses the average as the model parameter of the new global model.

[0013] Membership Inference Attack Defense Model It is an attack model Noise Generator and Noise Optimizer The union of, that is, Among them, the attack model It is a model trained for membership inference attacks. It infers the probability of a successful membership inference attack on the local model trained by the participant, that is, the risk of being attacked by membership inference; Noise Generator Responsible for interacting with the attack model, first initialize the noise according to the local model parameter value, and add it to the local model trained by the participant, and then use the attack model to attack the noisy model. When the attack model attacks the noisy model with a high attack accuracy, the noise generator increases the generated noise. When the attack model attacks the noisy model with a low attack accuracy, the noise generator reduces the generated noise. The noise generator modifies the generated noise according to the feedback of the attack model, thereby obtaining a carefully designed adversarial noise, and finally achieving the trained target model while maximizing the reduction of the member's reasoning attack accuracy while minimizing the loss of model accuracy.

[0014] Since each participant adds noise to the locally generated model parameters and sends them to the server, if the server directly averages and aggregates these model parameters, the noise will accumulate, which means that the noise in the global model will increase linearly with the number of participants, thus affecting the model accuracy of the final trained target model. Therefore, the noise optimizer is used The noise is optimized, that is, the scaling factor of the noise added by each participant to the local model parameters is determined so that the noise in the aggregated global model is independent of the number of participants, thereby ensuring the model accuracy of the target model.

[0015] Attack Model Noise Generator and Noise Optimizer The relationship is: Participant training make and Continuously interact, and eventually Generate the minimum noise to resist membership inference attack, and then use Determine the scaling factor of the noise, and finally add the scaled noise to the local model parameters and send the noise-added parameters to the server.

[0016] Federated learning training model and Membership Inference Attack Defense Model The relationship between participants and servers is: Conduct federated learning model training. Each participant uses local data to train a local model and then uses it Constructing carefully designed noise and optimizing it, the server uses The scaling factor is calculated based on the number of participants and randomly sent to each participant. The participant scales the noise according to the scaling factor and adds it to the local model parameters, and then follows Continue to perform federated learning model training (i.e. participants upload local model parameters with noise, and the server aggregates the model parameters and updates the global model). This is one round of federated learning. Repeat the above process for multiple rounds until the model training is terminated.

[0017] The data set of the model data is The elements in the collection represent the sequence number of each piece of data; The Chinese Communist Party Data, including training datasets used by participants to train models locally and a test dataset for testing the model Right now is the training data set The number of data in Is the test data set The amount of data in .

[0018] Model data and federated learning training model The relationship is specifically: the participant set The i-th participant The training data set we have is represented as The test set is represented as gather yes A subset of yes A subset of Training dataset in model data Divided equally and were The test data set in the model data is owned by participants Divided equally and were Owned by the participants, and and i is greater than or equal to 1 and less than or equal to

[0019] A method for defending against federated learning member reasoning attacks based on adversarial interference includes the following steps:

[0020] Step 1: Based on the number of participants The training data set and test dataset Divide into copy, get and Allocate the divided data to each participant Each participant uses the data he owns to train a local model and obtain model parameters.

[0021] Step 2: Participants train the attack model and allow the noise generator and the attack model to interact continuously to obtain the minimum noise that can make the attack accuracy of the attack model on the noisy local model as close to 50% as possible (making the attack result close to the attack result of random guessing), so that the attack model cannot distinguish whether a certain data is the training data used to train the local model, thereby protecting the local privacy of the participants.

[0022] Specifically, step 2 may include the following steps:

[0023] Step 2.1: Using the signal-to-noise ratio (SNR), generate a noise vector that conforms to the Gaussian distribution according to equations 1, 2, and 3.

[0024] First, set the minimum signal-to-noise ratio SNR min and maximum signal-to-noise ratio SNR max , where SNR min To make the generated noise 0, SNR max Make the generated noise close to the parameters of the local model.

[0025] Then, take And use this signal-to-noise ratio to generate an initialization noise according to Equations 1, 2, and 3.

[0026]

[0027]

[0028]

[0029] Among them, n is the local model parameter, SNR is the signal-to-noise ratio that controls the size of the generated noise, ps represents the original signal strength, and pn represents the noise signal strength. It means that the noise generated according to the signal-to-noise ratio has a mean of 0 and a standard deviation of Gaussian distributed noise, N represents Gaussian distribution.

[0030] Step 2.2: Add the initialization noise to the local model parameters and train the attack model using the ml_privacy_meter tool.

[0031] Specifically, each participant From locally owned Select from the training data Data from Select from the test data Items of data, Will include datasets and Input the configuration information including the noise model, the ratio of attack model training data and test data, and the selected information of the selected layers of the noise model used in the membership inference attack (for example, the output label of the last layer of the noise model and the gradient of the last two layers used in the membership inference attack) to the ml_privacy_meter tool;

[0032] The tool The data is input into the noise model, and the information obtained from the specified layer of the model is used as the feature, with the label 1, so as to obtain the member data set; The data is input into the noise model, and the information obtained from the specified layer of the model is used as a feature with a label of 0, thus obtaining a non-member data set;

[0033] Then, according to the division ratio of training data and test data, a set ratio of data is selected from the member data set and the non-member data set respectively and aggregated together as the training data set of the attack model, and the remaining data is aggregated together as the test data set of the attack model, so as to train the attack model on the noise model and perform member reasoning attack to obtain the attack accuracy. The attack accuracy (member reasoning risk) is the percentage of data correctly predicted by the attack model to the total predicted data.

[0034] Step 2.3: After using the attack model to attack the noise-added model, the SNR is continuously modified according to the attack model feedback, so that the attack accuracy of the final attack model is as close to 50% as possible.

[0035] Specifically, step 2.3 may include the following steps:

[0036] Step 2.3.1: When the attack model is used to attack the noisy local model, after obtaining the risk of the model being attacked by member reasoning (ie, the attack accuracy), the risk value is judged.

[0037] If the risk is greater than 0.5+ε, it means that the generated noise is too small, and the noise generator increases the minimum signal-to-noise ratio SNR. min , the smaller the SNR value is, the larger the norm of the generated noise is.

[0038] If the risk is less than 0.5-ε, the generated noise is too large and the noise generator reduces the maximum signal-to-noise ratio SNR max .

[0039] Among them, ε is the threshold at which the attack model accuracy deviates from 0.5. The setting of this threshold makes the attack accuracy of the attack model on the local model with the final noise added as close to 50% as possible.

[0040] Step 2.3.2: Take Using this updated SNR, generate new noise according to equations 1, 2, and 3;

[0041] Step 2.3.3: Repeat steps 2.3.1 to 2.3.2, and continuously modify the minimum signal-to-noise ratio (SNR) based on the feedback from the attack model. min and maximum signal-to-noise ratio SNR max ,make Approach the desired value until the set number of rounds is reached.

[0042] Step 3: The server uses the noise optimizer to obtain the noise scaling factor according to equations 4 and 5, and randomly sends it to each participant. The participant scales the noise using the scaling factor, adds the noise to the local model parameters and sends it to the server:

[0043]

[0044]

[0045] Where m is the number of participants, γ 1 ,γ 2 ,…,γ m are the scaling factors of the noise generated by m participants respectively; x is a variable calculated according to the number of participants m.

[0046] Step 4: The server receives the model parameters sent by all participants, calculates the average of these model parameters, and uses the averaged model parameters as the new global model parameters.

[0047] Step 5: The server sends the global model parameters to all participants, allowing them to update their local models. At this point, one round of federated learning model training is completed.

[0048] Repeat steps 1 to 5 until the specified number of training rounds is reached, thereby completing the training of the federated learning model that can defend against member reasoning attacks, and using the model to defend against member reasoning attacks.

[0049] Beneficial Effects

[0050] This method adds adversarial interference to the model parameters uploaded by the participants to defend against gradient-based membership inference attacks, thereby protecting the privacy of the participants' local data. It can protect the privacy of the user's local data while minimizing the degradation of the performance of the trained model.

[0051] Compared with the prior art, this method has the following advantages:

[0052] 1. The present invention is applicable to the defense against reasoning attacks of federated learning members, protecting the local data privacy of participants;

[0053] 2. The present invention considers the privacy leakage problem caused by participants sending model parameters to the server after training the local model in the federated learning training model process. By adding carefully constructed noise to the model parameters, the member reasoning attack defense solution based on adversarial interference is applicable to the scenario of defending against gradient-based member reasoning attacks;

[0054] 3. The present invention proposes a solution of using a noise generator and a noise optimizer to address the problem of constructed noise, so that the constructed noise can defend against member reasoning attacks while minimizing the model accuracy loss of the target model, that is, reducing the impact of noise on the performance of the target model finally trained, thereby simultaneously meeting the needs of user data privacy protection and collaborative training of high-accuracy models in federated learning scenarios;

[0055] 4. A large amount of data proves that this method can achieve a member reasoning attack accuracy of nearly 50% by adding carefully designed noise to the model parameters of locally trained federated learning, while reducing the accuracy loss of the target model. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of the learning member reasoning attack defense model of the method of the present invention. DETAILED DESCRIPTION

[0057] The following is a detailed description of the process of the present invention "a method for defending against federated learning member reasoning attacks based on adversarial interference" in conjunction with the accompanying drawings and embodiments, and its advantages are described. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the scope of protection of the present invention.

[0058] Example 1

[0059] In this embodiment, a federated learning member reasoning attack defense model based on a federated learning member reasoning attack defense method based on adversarial interference is established. Figure 1 shown.

[0060] Figure 1 The following federated learning member inference attack defense scenarios are described.

[0061] In this scenario, there are 100 participants and 1 server. Participants train local models and upload parameters. The server aggregates the parameters and updates the global model, which is one round of federated learning training. In this scenario, a total of 100 federated learning rounds are performed. Each participant iterates 5 rounds each time when training the local model. The parameters of federated learning are set as batchsize = 128, learning rate = 0.1, momentum = 0.9, and milestones = [60, 90]. Batch size is the batch size, that is, the number of data in one training when the participant trains the local model. rate is the learning rate, momentum is the momentum, which means to what extent the original update direction should be retained, milestones are the start and end intervals of the learning rate update, [60,90] means that the learning rate does not change in the first 60 rounds of federated learning, the learning rate is reduced to 0.01 from 60 to 90 rounds, and the learning rate is reduced to 0.001 from 90 to 100 rounds; the target model is a fully connected network with four hidden layers of sizes 1024, 512, 256, and 128, using the ReLU activation function and SGD optimizer, and setting the random seed seed = 117 for the current GPU to maintain stable performance; the attack model uses the loss gradient and output of the last two layers of the target model as input features, and the input features Flattened into a one-dimensional vector, and a convolutional neural network with 100 convolution kernels of size (1, 100) is used to extract input features, the maximum pooling size is (1, 2), the sizes of the two fully connected layers are 128 and 64 respectively, and the attack model uses the ReLU activation function and Adam optimizer with a learning rate of 0.001; in the process of training the federated learning model, both the participants and the server are semi-honest and the two may collude with each other, which means that the attacker who performs the member reasoning attack has three capabilities: first, it can obtain an auxiliary dataset with a similar distribution to the dataset owned by the participant; second, it can obtain the model parameters of the local model trained by the participant; third, it can obtain the model structure of the target model, that is, it can launch a white-box member reasoning attack.

[0062] Relying on the above Figure 1 The model in the specific implementation of the method of the present invention includes the following steps:

[0063] Step 1: Based on the number of participants The training data set and test dataset Divide into Get and Allocate the divided data to each participant Each participant uses the data he owns to train a local model and obtain model parameters.

[0064] Specifically in this embodiment, the model data set The Purchase100 dataset (https: / / www.kaggle.com / c / acquire-valued-shoppers-challenge / data) contains the shopping records of thousands of online customers. The shopping records are divided into 100 categories based on the similarity of the purchases. The main task is to identify the purchase category of each user. Contains the training data set and test data set required for federated learning model training, with a total of data, including training data , test data 100 participants participated in model training in each round, and the training data set in the model data and test dataset Divided equally and were Each participant has 100 training data and 100 test data. Each participant uses the data he owns to train the local model and obtain the model parameters.

[0065] Step 2: The participant trains the attack model, allowing the noise generator and the attack model to continuously interact to obtain the minimum noise that can make the attack accuracy of the attack model on the noisy local model as close to 50% as possible (making the attack result close to the attack result of random guessing), so that the attack model cannot distinguish whether a certain data is the training data used to train the local model, thereby protecting the local privacy of the participant. Specifically:

[0066] Step 2.1: Set the minimum signal-to-noise ratio (SNR) min and maximum signal-to-noise ratio SNR max , where SNR min To make the generated noise 0, SNR max Make the generated noise close to the parameters of the local model, and get Then, the signal-to-noise ratio SNR is used to generate an initialization noise vector that conforms to the Gaussian distribution according to equations 1, 2, and 3.

[0067] Step 2.2: Add the initialization noise to the local model parameters and use the ml_privacy_meter tool to train the attack model; specifically in this embodiment, and 5000 data are selected to build the training set and test set of the attack model; for each participant, From locally owned Select from the training data Data from Select from the test data data, and combine the two data sets and The noise model and attack model are divided into 10% of training data and test data, and the member inference attack uses the loss gradient and output of the last two layers of the noise model. These configuration information are input into ml_privacy_meter.

[0068] The tool The data is input into the noise model, and the loss gradient and output of the last two layers of the model are used as features, with the label 1, to obtain the member data set; The data are input into the noise model, and the loss gradient and output of the last two layers of the model are used as features, with the label 0, to obtain a non-member data set; then, according to the division ratio of training data and test data of 10%, 90% of the data are selected from the member data set and the non-member data set respectively and aggregated together as the training data set of the attack model, and the remaining 10% of the data are aggregated together as the test data set of the attack model, so as to train the attack model on the noise model and perform member inference attack to obtain the attack accuracy.

[0069] Step 2.3: After using the attack model to attack the noise-added model, the SNR is continuously modified according to the attack model feedback, so that the attack accuracy of the final attack model is as close to 50% as possible.

[0070] Specifically in this embodiment, the signal-to-noise ratio SNR is continuously adjusted according to the feedback of the attack model, that is, the attack accuracy, and the signal-to-noise ratio SNR=15 is obtained, so that the noise vector conforming to the Gaussian distribution generated according to Formula 1, Formula 2 and Formula 3 meets the requirements of resisting member reasoning attacks.

[0071] Step 3: The server uses the noise optimizer to obtain the scaling factors of the 100 noises generated by the 100 participants according to Equations 4 and 5 and randomly sends them to each participant. The participant scales the noise using the scaling factors, adds the noise to the locally trained model parameters and sends them to the server.

[0072] Step 4: The server receives the model parameters sent by all participants and averages these model parameters, and uses the averaged model parameters as the new global model parameters.

[0073] Step 5: The server sends the global model parameters to all participants, allowing them to update their local models. This completes one round of federated learning model training. Then, steps 1, 2, 3, 4, and 5 are repeated until 100 rounds have been reached, completing the training of the federated learning model that can defend against member reasoning attacks.

[0074] Use the attack model to attack the target model finally trained and calculate the attack accuracy A att =0.51, using the target model obtained by the final training The training data set is used to make predictions and calculate the training accuracy A train =0.96, yes Test data set data to make predictions and calculate the test accuracy A test =0.91, calculate A train and A test The difference between the two is the generalization error E gen =0.05.

[0075] Repeat the above steps (skipping the noise optimization part of step 2 and step 3) to train the undefended federated learning model. The model parameters and model data are the same as those of the federated learning model with defense. Use the attack model to attack the target model finally trained and calculate the attack accuracy A′ att =0.73, using the final trained target model The training data set is used to predict and calculate the training accuracy A′ train =0.98, yes Test data set data to make predictions and calculate the test accuracy A′ test =0.93, calculate A′ train and A′ test The difference between the two is the generalization error E′ gen =0.05.

[0076] The results show that when the Purchase100 dataset and a four-layer fully connected neural network are used as the target model, the attack accuracy of the attack model against the target model trained without the defense method is 73%, and the attack accuracy against the target model trained with the defense method is 51%. That is, the target model trained with the defense method has greatly improved its defense capability against member reasoning attacks, and the attack accuracy has dropped from 73% to 51%, approaching the attack result of random guessing. Moreover, the training accuracy of the target model trained without the defense method is only 2% lower than that of the target model trained with the defense method, and the same is true for the test accuracy, which means that the performance of the target model is not significantly affected by the use of the defense method. In addition, the generalization error of the target model trained without the defense method is the same as that of the target model trained with the defense method. These results show that the use of the defense method effectively defends against member reasoning attacks while ensuring the performance of the target model, while meeting the needs of user data privacy protection and collaborative training of high-performance models in federated learning scenarios.

[0077] Example 2

[0078] This embodiment compares the results of the method of the present invention in various scenarios to verify that the defense method of the present invention is applicable to various data sets and target model structures. For the Purchase100 data set, a fully connected neural network is used as the target model; for the CIFAR10 data set (http: / / www.cs.toronto.edu / ~kriz / cifar.html), the AlexNet model for image classification is used as the target model; for the CIFAR100 data set (http: / / www.cs.toronto.edu / ~kriz / cifar.html), the AlexNet model and the DenseNet12 model are used as the target models, respectively, and the DenseNet12 corresponds to the DenseNet-BC (depth L=100, the number of feature maps output by each network layer k=12); when using different data sets and target model structures for undefended (skipping the noise optimization part of step 2 and step 3) and defended federated learning model training, due to the limitation of the Cifar100 data set, the number of participants in Cifar100-DenseNet12 needs to be set to 20, and the other parameter values ​​involved remain consistent.

[0079] The performance results of the models trained without defense and with defense methods under different datasets and target model structures are shown in Table 1.

[0080] First, the defense methods trained under four different dataset-target model structures can significantly reduce the attack accuracy and the attack accuracy is as close to 50% as possible, approaching the attack result of random guessing, which shows that the defense method is suitable for member reasoning attack defense under a variety of datasets and target model structures, and has superior defense effect; secondly, the training accuracy of the target model trained without the defense method under four different dataset-target model structures is not significantly different from the training accuracy of the target model trained with the defense method, and the test accuracy is also the same, which shows that the defense method can ensure that the performance of the target model will not be affected by the defense under a variety of datasets and target model structures. The performance of the target model deteriorates with the increase of the defense method; finally, the generalization error of the target model trained without the defense method under four different dataset-target model structures is not significantly different from that of the target model trained with the defense method, which indicates that the defense method can ensure the generalization performance of the target model without being affected under a variety of datasets and target model structures; In general, these results indicate that the defense method can effectively defend against member reasoning attacks while ensuring the performance of the target model under a variety of different dataset-target model structures, and at the same time meets the needs of user data privacy protection and collaborative training of high-performance models in federated learning scenarios, that is, the defense method is suitable for a variety of datasets and target model structures.

[0081] Table 1 Performance of models trained without and with defense methods under different datasets and target model structures

[0082]

[0083] Example 3

[0084] This embodiment compares the method described in the present invention with a variety of federated learning member reasoning attack defense methods to verify that the defense method of the present invention has better member reasoning attack defense effect than other defense methods and can maintain lower performance loss.

[0085] Cifar10 is used as the data set and the AlexNet model is used as the target model; the target model trained without using the defense method has an attack accuracy of 79%, a training accuracy of 95%, and a training loss of 0.1%; the defense method proposed in the present invention has an attack accuracy of 53%, a training accuracy of 95%, and a training loss of 0.1%.

[0086] The first defense method for comparison (https: / / dl.acm.org / doi / abs / 10.1145 / 3243734.3243855) is a federated learning member inference attack defense method Ad-reg based on adversarial regularization; the adversarial regularization factor λ of Ad-reg is set to 2, and Ad-reg has an attack accuracy of 59%, a training accuracy of 99%, and a training loss of 0.5%; the results show that the defense method of the present invention has lower attack accuracy and smaller training loss than Ad-reg.

[0087] The second defense method (https: / / www.ndss-symposium.org / wp-content / uploads / 2019 / 02 / ndss2019_03A-1_Salem_paper.pdf) uses L2 regularization and dropout respectively to prevent model overfitting and thus achieve defense against member reasoning attacks; L2 regularization is to add an L2 regularization term to the loss function, and dropout is to randomly disable some neurons; the L2 generalization factor and the dropout rate are set to 0.001 and 0.5, respectively. The defense method using L2 regularization has an attack accuracy of more than 60%, a training accuracy of 90%, and a training accuracy loss of 0.2%, and the defense method using dropout has an attack accuracy of more than 60%, a training accuracy of 83%, and a training loss of 0.38%; the results show that the defense method of the present invention has lower attack accuracy and smaller training loss than the second defense method.

[0088] The third defense method for comparison (https: / / dl.acm.org / doi / abs / 10.1145 / 2976749.2978318) is a federated learning member reasoning attack defense method DPSGD based on differential privacy. This method defends against member reasoning attacks by adding differential privacy noise that conforms to the Gaussian distribution to the local model parameters trained by the participants; setting δ=0.00001, ε=2, DPSGD has an attack accuracy of 63%, a training accuracy of 94% and a test loss of 10%, while the defense method of the present invention has only a test loss of 1%; the results show that the defense method of the present invention has lower attack accuracy and smaller test loss than Ad-reg.

[0089] The above results show that the defense method of the present invention can achieve better member reasoning attack defense effect while maintaining the performance of the target model compared with other defense methods.

[0090] Example 4

[0091] This embodiment compares the results of the method described in the present invention in various scenarios to verify that the defense method of the present invention is applicable to scenarios with a variety of numbers of participants, that is, changes in the number of participants will not affect the defense effect of the defense method and can still maintain a low performance loss.

[0092] Different data sets, target model structures, and numbers of participants were set, and the defense method of the present invention was used to train the model and calculate the attack accuracy and generalization error of the target model. The results are shown in Table 2. The results show that under different data sets, target model structures, and numbers of participants (50, 100, and 150, respectively), the attack accuracy of the target model can be close to 50%, and the generalization error does not change significantly; in general, when the number of participants changes, the defense method of the present invention can still maintain the performance of the target model while achieving superior member reasoning attack defense effects.

[0093] Table 2 Performance of models trained by the defense method of the present invention under different data sets, target model structures and number of participants

[0094]

[0095] Example 5

[0096] This embodiment evaluates the portability of the defense method of the present invention in defending against data reconstruction attacks from the perspective of model gradients, and verifies that the defense method of the present invention is portable for defending against data reconstruction attacks. Data reconstruction attacks refer to the training data used to reconstruct the training model, which means that once the data reconstruction attack is successful, the attacker can also implement a member reasoning attack, because the attacker has mastered the training data, and any data in the training data is member data, otherwise it is non-member data; Zhu et al. proposed a gradient-based data reconstruction attack method (https: / / link.springer.com / chapter / 10.1007 / 978-3-030-63076-8_2): Assuming virtual input and labels and calculating virtual gradients, by optimizing the distance between the virtual gradient and the real gradient, the virtual data is close to the original data, thereby realizing data reconstruction; In order to evaluate the portability of the defense method of the present invention for data reconstruction attacks, it is necessary to add the noise generated by the defense method of the present invention according to different signal-to-noise ratios SNR to the gradient, and then perform a data reconstruction attack; The data set uses the data set provided by the data reconstruction attack method.

[0097] The results show that when the noise generated by the defense method of the present invention is not added and the data reconstruction attack is directly carried out, the attack can restore the original data; when the signal-to-noise ratio SNR is set to 25, 20 and 15 respectively and the noise generated according to the signal-to-noise ratio is added to the gradient, and then the data reconstruction attacks are carried out respectively, it is found that with the decrease of the signal-to-noise ratio, the effect of the data reconstruction attack gradually weakens. When SNR=15, the attack can no longer reconstruct the original data, that is, the attack fails; this result shows that the defense method of the present invention is portable for defending against data reconstruction attacks, that is, the adversarial interference generated by the defense method of the present invention can be used to defend against gradient-based data reconstruction attacks.

[0098] The above description describes the implementation mode of the present invention in combination with the drawings and embodiments. However, for those skilled in the art, several improvements can be made without departing from the principle of this patent, and these also belong to the scope of protection of this patent.

Claims

1. A method for defending against federated learning member reasoning attacks based on adversarial interference, characterized in that: The following steps are involved: Step 1: Based on the number of participants The training data set And the test dataset Divide into Get and Allocate the divided data to each participant Each participant uses the data they own to train a local model and obtain model parameters; Step 2: The participants train the attack model, allowing the noise generator and the attack model to continuously interact, and obtain the minimum noise that makes the attack model's attack accuracy on the noisy local model close to 50%, so that the attack model cannot distinguish whether a certain data is the training data used to train the local model; Step 3: The server uses the noise optimizer to obtain the noise scaling factor according to equations 4 and 5, and randomly sends it to each participant; the participant scales the noise using the scaling factor, adds the noise to the local model parameters and sends it to the server: Where m is the number of participants, γ1,γ2,…,γ m are the scaling factors of the noise generated by m participants respectively; x is a variable calculated according to the number of participants m; Step 4: The server receives the model parameters sent by all participants, calculates the average of these model parameters, and uses the averaged model parameters as the new global model parameters; Step 5: The server sends the global model parameters to all participants, allowing them to update their local models. At this point, one round of federated learning model training is completed. Repeat steps 1 to 5 until the specified number of training rounds is reached, thereby completing the training of the federated learning model that can defend against member reasoning attacks, and using the model to defend against member reasoning attacks.

2. A method for defending against federated learning member reasoning attacks based on adversarial interference as claimed in claim 1, characterized in that: The method is based on the federated learning member reasoning attack defense model as follows: Including federated learning training model Membership Inference Attack Defense Model and model data Among them, the federated learning training model is the set of participants who participate in the training of local models in federated learning and servers involved in federated learning model aggregation and distribution The union of, that is, for Number of participants in the federated learning training model The participants and the server in the network work together to train the machine learning model based on the average aggregation algorithm, where the average aggregation means that the server averages all the model parameters received and uses the average value as the model parameter of the new global model. Membership Inference Attack Defense Model It is an attack model Noise Generator and Noise Optimizer The union of, that is, Among them, the attack model It is a model trained for membership inference attacks. It infers the probability of a successful membership inference attack on the local model trained by the participant, that is, the risk of being attacked by membership inference; Noise Generator Responsible for interacting with the attack model. First, the noise is initialized according to the local model parameter value and added to the local model trained by the participant. Then, the attack model is used to attack the noisy model. When the attack accuracy of the attack model on the noisy model is high, the noise generator increases the generated noise. When the attack accuracy of the attack model on the noisy model is low, the noise generator reduces the generated noise. The noise generator modifies the generated noise according to the feedback of the attack model, thereby obtaining a carefully designed adversarial noise, and finally achieving the trained target model while minimizing the loss of model accuracy while maximizing the reduction of member reasoning attack accuracy. Using the Noise Optimizer Optimize the noise, i.e., determine the scaling factor of the noise added by each participant on the local model parameters so that the noise in the aggregated global model is independent of the number of participants, thereby ensuring the model accuracy of the target model; Attack Model Noise Generator and Noise Optimizer The relationship is: Participant training make and Continuously interact, and eventually Generate the minimum noise to resist membership inference attack, and then use Determine the scaling factor of the noise, and finally add the scaled noise to the local model parameters and send the noise-added parameters to the server; Federated learning training model and Membership Inference Attack Defense Model The relationship between participants and servers is: Conduct federated learning model training. Each participant uses local data to train a local model and then uses it Constructing carefully designed noise and optimizing it, the server uses The scaling factor is calculated based on the number of participants and randomly sent to each participant. The participant scales the noise according to the scaling factor and adds it to the local model parameters, and then follows Continue to train the federated learning model. This is one round of federated learning. After that, repeat the above process until the model training is terminated. The data set of the model data is The elements in the collection represent the sequence number of each piece of data; The Chinese Communist Party Data, including training datasets used by participants to train models locally and a test dataset for testing the model Right now is the training data set The number of data in Is the test data set The amount of data in Model data and federated learning training model The relationship is specifically: the participant set The i-th participant The training data set we have is represented as The test set is represented as gather yes A subset of yes A subset of Training dataset in model data Divided equally and were The test data set in the model data is owned by participants Divided equally and were Owned by the participants, and and i is greater than or equal to 1 and less than or equal to 3. A method for defending against federated learning member reasoning attacks based on adversarial interference as claimed in claim 1, characterized in that: Step 2 includes the following steps: Step 2.1: Using the signal-to-noise ratio (SNR), generate a noise vector that conforms to the Gaussian distribution according to equations 1, 2, and 3: First, set the minimum signal-to-noise ratio SNR min and maximum signal-to-noise ratio SNR max , where SNR min To make the generated noise 0, SNR max Make the generated noise close to the parameters of the local model; Then, take And use this signal-to-noise ratio to generate an initialization noise according to equations 1, 2, and 3; Among them, n is the local model parameter, SNR is the signal-to-noise ratio that controls the size of the generated noise, ps represents the original signal strength, and pn represents the noise signal strength. It means that the noise generated according to the signal-to-noise ratio has a mean of 0 and a standard deviation of Gaussian distribution noise, N represents Gaussian distribution; Step 2.2: Add the initialization noise to the local model parameters and train the attack model using the ml_privacy_meter tool; Each participant From locally owned Select from the training data Data from Select from the test data Items of data, Will include datasets and Input the configuration information including the noise model, the ratio of attack model training data and test data, and the selected layer of the noise model used in the membership inference attack to the ml_privacy_meter tool; The tool The data is input into the noise model, and the information obtained from the specified layer of the model is used as the feature, with the label 1, so as to obtain the member data set; The data is input into the noise model, and the information obtained from the specified layer of the model is used as a feature with a label of 0, thus obtaining a non-member data set; Then, according to the division ratio of training data and test data, a set ratio of data is selected from the member data set and the non-member data set respectively and aggregated together as the training data set of the attack model, and the remaining data is aggregated together as the test data set of the attack model, so as to train the attack model for the noise-added model and perform member inference attack to obtain the attack accuracy; Step 2.3: After using the attack model to attack the noise-added model, the SNR is continuously modified according to the attack model feedback, so that the attack accuracy of the final attack model is as close to 50% as possible.

4. A method for defending against federated learning member reasoning attacks based on adversarial interference as claimed in claim 3, characterized in that: Step 2.3 includes the following steps: Step 2.3.1: When the attack model is used to attack the noisy local model, after obtaining the risk of the model being attacked by member reasoning, the risk value is judged: If the risk is greater than 0.5+ε, it means that the generated noise is too small, and the noise generator increases the minimum signal-to-noise ratio SNR. min , the smaller the SNR value, the larger the norm of the generated noise; If the risk is less than 0.5-ε, the generated noise is too large and the noise generator reduces the maximum signal-to-noise ratio SNR max ; Among them, ε is the threshold value of the attack model accuracy that deviates from 0.

5. The setting of this threshold makes the attack accuracy of the attack model on the local model with the final noise added as close to 50% as possible; Step 2.3.2: Take Using this updated SNR, generate new noise according to equations 1, 2, and 3; Step 2.3.3: Repeat steps 2.3.1 to 2.3.2, and continuously modify the minimum signal-to-noise ratio (SNR) based on the feedback from the attack model. min and maximum signal-to-noise ratio SNR max ,make Approach the desired value until the set number of rounds is reached.

Images