Federated learning free-rider defense method and device based on model weight iteration

Abstract

The invention discloses a federated learning free-rider defense method and device based on model weight iteration. First, a federated learning training environment is initialized; a server sends an initial global model to each client to start federated learning training; each client performs federated training and generates a local model, saves model parameters after training, and calculates an update change frequency F matrix; each client uploads local model parameters and a weight change frequency matrix to a server; the server obtains a global model through an aggregation algorithm, calculates the Euclidean distance between each client and the average change frequency of each weight, and marks clients with abnormal Euclidean distance and average frequency; the server sends the updated global model to each client; the above steps are repeated, and each time a client uploads parameters, the server performs a screening, and when a client is marked abnormally three times, it is considered to be a free-rider attacker and is kicked out of the federated learning training.

Description

Technical Field

[0001] The present invention belongs to the field of federated learning, and in particular relates to a free-rider defense method and device based on model weight iteration. Background Art

[0002] With the rise of the Internet of Things and edge computing, big data is often not confined to a single whole, but distributed in many aspects. How to safely and effectively update and share models in multiple locations is a new challenge faced by various computing methods. People began to seek a way to solve the problem of data islands and user privacy. Federated learning emerged as a very potential solution. Its main innovation is that it provides a distributed machine learning framework with privacy protection features, and can collaborate with thousands of participants in a distributed manner to iteratively train a specific machine learning model. Each participant does not share data, which greatly protects privacy and security, and the training effect is better than centralized learning.

[0003] At present, the application fields of federated learning are becoming more and more extensive. However, in the federated learning environment, how to ensure fairness is a major problem, because the final aggregated model has high commercial value, which increases the risk of malicious clients hoping to obtain the aggregated model without local data or by reducing local training costs and overhead. Such malicious clients are commonly known as free-rider attackers. They have no local data or only a small amount of data, but can also obtain a better model through federated learning. In this way, there is an unfair phenomenon that low-contribution clients obtain the same model as high-contribution clients. This greatly damages the rights and interests of other normal clients.

[0004] Among the current free-rider attacks, there are some common attack methods: free-rider attacks that simulate normal client training by adding specific noise; using the global model received in each round, instead of just generating a random update matrix with the same dimension as the global model, it is possible to construct a more complex fake gradient update, and generate a fake gradient update by subtracting the two global models received previously. The second type of free-rider attack is stronger and is called an incremental weight attack. In response to the current attack methods, the current defense free-rider mechanism in federated learning is mainly based on the outlier detection mechanism, which is used to detect malicious attackers who provide abnormal updates; based on the verification of the verification data set, the contribution value of each client is determined, and the free-rider behavior is prevented according to the contribution value. These methods all have certain defects. First of all, these methods are not ideal in the face of multiple free-rider attacks. Secondly, the premise that the federated learning framework uses the verification data set itself does not conform to the data-free sharing of federated learning.

[0005] In the face of disguised free-rider attacks and multiple free-rider attacks, how to better ensure the fairness and privacy security of federated learning has become a focus of attention. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention proposes a free-rider defense method and device based on model weight iteration.

[0007] To achieve the above-mentioned invention object, the technical solution of the present invention is as follows: a federated learning free-rider defense method based on model weight iteration, specifically comprising the following steps:

[0008] (1) Initialize the federated learning training environment;

[0009] (2) The server sends the initial global model to each client and starts federated learning training;

[0010] (3) Each client performs federated training and generates a local model. After the local training is completed, the model parameters are saved and the update change frequency F matrix of the weight W of the second-to-last layer of the local model during each training is calculated;

[0011] (4) After each client completes local training, it uploads the local model parameters and weight change frequency matrix to the server. The server obtains the global model through an aggregation algorithm, calculates the Euclidean distance between each client and the average change frequency of each weight, and marks clients with abnormal Euclidean distance and average frequency.

[0012] (5) The server sends the updated global model to each client and continues the federated learning training;

[0013] (6) Repeat steps (2) to (5) above. Each time the client uploads parameters, the server performs a screening. When a client is marked as abnormal three times, it is considered to be a free-rider attacker and is kicked out of the federated learning training.

[0014] Furthermore, in step (3), each client performs federated training and generates a local model. The steps for obtaining model parameters are specifically as follows:

[0015] Normal clients participating in the training perform each round of training and obtain updated local training model parameters as follows:

[0016]

[0017] Among them, (x, y) are D k The data and labels in the dataset, L is used to calculate the cross entropy loss function between the predicted results and the true results, After local training The weight parameters of the model, The client local model after being sent;

[0018] The malicious client participating in the training has normal training in the first three rounds. After three rounds, it adds the global model M sent by the current server. j and the global model M sent by the server in the previous round j-1 Parameter difference; get the updated parameter G of the free-rider attack client model f for:

[0019] G f =M j -M j-1

[0020] Add the updated parameters to the model sent by the server in this round for disguise; generate a new local model The formula is as follows:

[0021]

[0022] Furthermore, the step of calculating the update change frequency F matrix of the weight W of the penultimate layer of the local model during each training is specifically as follows:

[0023] First, select the weights of the second-to-last layer of the local model, and initialize a matrix with all values ​​​​of 0 according to the number of weights to record the frequency of weight changes during each local model training;

[0024] Then, in each round of local training, the absolute value of the updated parameters of each weight in each round of training is recorded; the absolute values ​​of all weight update parameters are summed and divided by the number of weights to calculate the dynamic threshold TV;

[0025] Then count the change frequency of each weight. If the weight change value is greater than the threshold, the weight change frequency of this round is increased by 1. If it is less than the threshold, the weight change frequency of this round remains unchanged, and the frequency matrix is ​​updated accordingly.

[0026] Finally, the overall frequency matrix of local weight changes is updated, and the weight change frequency matrix of the i-th round is equal to the sum of the weight change frequency matrices of the previous i rounds.

[0027] Furthermore, the model aggregation formula described in step (4) is as follows:

[0028]

[0029] Among them, G t+1 is the aggregation model after server-side aggregation, G t is the aggregated model after the previous round of training aggregation, To train the model locally, Scale the model weights.

[0030] Furthermore, in step (4), the Euclidean distance d between each client and the average change frequency f of each weight are calculated. avg , the specific formula is as follows:

[0031]

[0032] Among them, x and y are two different client weight change frequency matrices;

[0033]

[0034] Among them, F i is the number of times each weight in the matrix changes, and n is the number of weights.

[0035] The present invention provides a federated learning free-rider defense device based on model weight iteration, comprising one or more processors for implementing the above-mentioned federated learning free-rider defense method based on model weight iteration.

[0036] The present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used to implement the above-mentioned federated learning free-rider defense method based on model weight iteration.

[0037] The technical concept of the present invention is: the model weight iteration is an effective defense method starting from the training process of normal clients and free-riding clients. The free-riding attacker can simulate the result of the normal client model parameter change very well, but because the free-rider has no data for training, it is difficult to simulate the change of the normal client model weight during the training process. This is the most essential difference. The model weight update frequency uses this point to record the information of the model during the training process to defend against free-riding. And each time it is uploaded to the server, the server can perform a screening, and the weight update frequency will be accumulated in each round, so the difference between normal clients and abnormal clients will become larger and larger. The frequency of change of different weights is actually an indirect explanation of the model being trained. The model contains sensitive neurons and insensitive neurons, so in each round of training, the weight updates of some sensitive neurons to the input data features are larger than the parameter changes of insensitive neurons. Free-riding does not have this difference because the free-riding client has no local data and it is difficult to distinguish sensitive neurons from insensitive neurons without training. Even if sensitive neurons and insensitive neurons are found, it is still difficult to simulate the weight change frequency and average weight change frequency of normal clients. Therefore, based on this method, the defense effect is significant and can effectively defend against single or multiple malicious clients.

[0038] The beneficial effects of the present invention are: 1) The frequency of changes in model weights is used to defend against free-riding. There is no need to verify the data set. Only the frequency of changes in the second-to-last layer weights needs to be uploaded by each client. This method is simple, efficient, and has low overhead. 2) This method has high defense accuracy. Malicious clients are found by calculating the Euclidean distance of the frequency of changes in the model weights of each client and the average frequency of changes in the weights of each client. This method has a high accuracy rate. 3) In the scenario where the free-rider contains a small amount of data or contains multiple free-riding attackers, its defense effect is still significant. It is very difficult for attackers to bypass this defense method. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 It is a schematic diagram of the whole stages of the method of the present invention;

[0041] Figure 2 is a flow chart of the method of the present invention;

[0042] Figure 3 Schematic diagram of the device of the present invention. DETAILED DESCRIPTION

[0043] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0044] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0045] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0046] Reference Figure 1-2 , the present invention proposes a free-rider defense method based on model weight iteration, the steps are as follows:

[0047] (1) Initialization of the federated learning training environment;

[0048] The initialization is specifically as follows: setting the overall training round E, local data D, the overall number of devices k participating in federated learning, the number of normal clients participating in each round of training is k1, and the number of malicious clients participating in each round of training is k2.

[0049] (2) The server sends the initial global model to each client and starts federated learning training.

[0050] (3) Each client performs federated training and generates a local model. After the local training is completed, the model parameters are saved and the update change frequency F matrix of the weight W of the second-to-last layer of the local model is calculated during each training. Specifically, it includes the following sub-steps:

[0051] (3.1) Each client performs federated training and generates a local model, which includes the following sub-steps:

[0052] (3.1.1) Normal clients participating in training perform each round of training normally and generate local models At the same time, during each round of training, the update frequency of the weights of the penultimate layer of the model is counted. The model parameters of local training are updated as follows:

[0053]

[0054] Among them, (x, y) are D k The data and labels in the dataset, L is used to calculate the cross entropy loss function between the predicted results and the true results, After local training The weight parameters of the model, It is the client local model after being sent.

[0055] (3.1.2) Malicious clients participating in training, considering highly aggressive camouflage hitchhiking, the local client has a small amount of data consistent with other clients, the first three rounds of normal training, after three rounds by adding the global model M issued by the current server j and the global model M sent by the server in the previous round j-1 The parameter difference is used to disguise. At the same time, the update frequency of the weight of the second-to-last layer of the model is counted. The update parameter G of the free-rider attack client model f for:

[0056] G f=M j -M j-1 ;

[0057] Add the updated parameters to the model sent by the server in this round for disguise. Generate a new local model

[0058]

[0059] (3.2) Calculate the update change frequency F matrix of the weight W of the penultimate layer of the local model during each training, which specifically includes the following sub-steps:

[0060] (3.2.1) Select the weights of the second-to-last layer of the local model, and initialize a matrix with all values ​​​​zero based on the number of weights to record the frequency of weight changes during each local model training.

[0061] (3.2.2) Each round of local training records the absolute value of the update parameter of each weight in each round of training. The change of weight frequency is based on the dynamic threshold TV. The dynamic threshold TV is calculated by summing the absolute values ​​of all weight update parameters and dividing by the number of weights. The formula is as follows:

[0062]

[0063] Where n is the number of weights in this layer, w i The parameter size updated for the i-th weight.

[0064] (3.2.3) Count the change frequency of each weight. If the weight change value is greater than the threshold, the weight change frequency of this round is increased by 1. If it is less than the threshold, the weight change frequency of this round remains unchanged. This is used to update the frequency matrix.

[0065] (3.2.4) Update the overall frequency matrix of local weight changes, the formula is as follows:

[0066]

[0067] Among them, the weight change frequency matrix of the i-th round is equal to the sum of the weight change frequency matrices of the previous i rounds.

[0068] (4) After each client completes local training, it uploads the local model parameters and weight change frequency matrix to the server, which performs corresponding processing, specifically:

[0069] The server obtains the global model through an aggregation algorithm based on the model parameters uploaded by each terminal device; it identifies free riders based on the uploaded weight change frequency matrix information and defends against them.

[0070] (4.1) Aggregate the uploaded model. The aggregation formula is as follows:

[0071]

[0072] Among them, G t+1 is the aggregation model after server-side aggregation, G t is the aggregated model after the previous round of training aggregation, It is a model trained locally by a normal client or a local model updated and generated by a malicious client after disguise. Scale the model weights.

[0073] (4.2) Based on the weight change frequency matrix of each client, calculate the Euclidean distance d between each client and the average change frequency f of each weight avg , the formula is as follows:

[0074]

[0075] Where x and y are two different client weight change frequency matrices.

[0076]

[0077] Among them, F i is the number of times each weight in the matrix changes, and n is the number of weights.

[0078] i is the number of times each weight in the matrix changes, and n is the number of weights.

[0079] (4.3) The server marks the clients with abnormal Euclidean distance and average frequency.

[0080] (5) The server sends the updated global model to each client and continues the federated learning training.

[0081] (6) Repeat steps (2) to (5) above. Each time the client uploads parameters, the server will perform a screening. When a client is marked as abnormal three times, it is considered to be a free-rider attacker and is kicked out of the federated learning training.

[0082] In the embodiment of the present invention, we considered four attack methods to test our defense method for free-rider attack:

[0083] Method 1: The free rider does not contain data, and adds specific random noise to simulate normal client training;

[0084] Method 2: The free rider does not contain data, and the attacker adds the currently issued global model M j and the global model M issued in the previous round j-1 The parameters are poor to disguise.

[0085] Method 3: The free rider has a small amount of data. The first three rounds of training are normal. After three rounds, the attacker adds the currently issued global model M j and the global model M issued in the previous round j-1 The parameters are poor to disguise.

[0086] Method 4: Scenario with multiple free-rider attackers.

[0087] Through the test of the above four free-rider attacks, the experimental results show that the frequency matrix of the disguised free-rider is very different from the frequency matrix of the fair client, which leads to the abnormality of the Euclidean distance. At the same time, the average frequency of free-riders is generally smaller than the average frequency of fair clients. When the server performs abnormal screening, it is easy to identify malicious clients based on these two indicators, and the defense effect is significant.

[0088] Corresponding to the aforementioned embodiment of the federated learning free-rider defense method based on model weight iteration, the present invention also provides an embodiment of the federated learning free-rider defense device based on model weight iteration.

[0089] See also Figure 3 An embodiment of the present invention provides a federated learning free-rider defense device based on model weight iteration, comprising one or more processors for implementing the federated learning free-rider defense method based on model weight iteration in the above embodiment.

[0090] The embodiment of the federated learning free-rider defense device based on model weight iteration of the present invention can be applied to any device with data processing capability, and the device with data processing capability can be a device or apparatus such as a computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capability in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution. From the hardware level, if Figure 3 As shown, it is a hardware structure diagram of any device with data processing capability where the federated learning free-rider defense device based on model weight iteration of the present invention is located, except Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0091] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0092] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0093] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the federated learning free-rider defense method based on model weight iteration in the above embodiment is implemented.

[0094] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capability and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0095] In summary, the federated learning free-rider defense method based on model weight iteration proposed in the present invention uses the information of model weight update frequency to defend against free-rider attacks. This is an effective defense method starting from the model training process. Free-rider attackers can simulate the results of normal client model parameter changes very well, but it is difficult for them to simulate the changes of normal client model parameters during the training process. The frequency of model weight update utilizes this point. The local client updates the frequency by recording whether the parameter changes of all weights in the penultimate layer exceed the set dynamic threshold, thereby defending against free-riding. This defense method can perform an abnormal client screening every time the client uploads information. At the same time, in an environment where there are free riders, the difference in model weight update frequency between normal clients and abnormal clients will become larger and larger. The defense effect is significant and can effectively defend against single or multiple malicious free-riding clients.

[0096] The specific implementation methods described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A federated learning free-rider defense method based on model weight iteration, characterized in that: The specific steps include: (1) Initialize the federated learning training environment; (2) The server sends the initial global model to each client and starts federated learning training; (3) Each client performs federated training and generates a local model. After the local training is completed, the model parameters are saved and the update change frequency F matrix of the weight W of the second-to-last layer of the local model during each training is calculated; In step (3), each client performs federated training and generates a local model. The specific steps for obtaining model parameters are as follows: Normal clients participating in the training perform each round of training and obtain updated local training model parameters as follows: Among them, (x, y) are D k The data and labels in the dataset, L is used to calculate the cross entropy loss function between the predicted results and the true results, After local training The weight parameters of the model, The client local model after being sent; The malicious client participating in the training has normal training in the first three rounds. After three rounds, it adds the global model M sent by the current server. j and the global model M sent by the server in the previous round j-1 Parameter difference; get the updated parameter G of the free-rider attack client model f for: G f =M j -M j-1 Add the updated parameters to the model sent by the server in this round for disguise; generate a new local model The formula is as follows: The step of calculating the update change frequency F matrix of the weight W of the penultimate layer of the local model during each training is specifically as follows: First, select the weights of the second-to-last layer of the local model, and initialize a matrix with all values ​​​​of 0 according to the number of weights to record the frequency of weight changes during each local model training; Then, in each round of local training, the absolute value of the updated parameters of each weight in each round of training is recorded; the absolute values ​​of all weight update parameters are summed and divided by the number of weights to calculate the dynamic threshold TV; Then count the change frequency of each weight. If the weight change value is greater than the threshold, the weight change frequency of this round is increased by 1. If it is less than the threshold, the weight change frequency of this round remains unchanged, and the frequency matrix is ​​updated accordingly. Finally, the overall frequency matrix of local weight changes is updated. The frequency matrix of weight changes in the i-th round is equal to the sum of the frequency matrices of weight changes in the previous i rounds. (4) After each client completes local training, it uploads the local model parameters and weight change frequency matrix to the server. The server obtains the global model through an aggregation algorithm, calculates the Euclidean distance between each client and the average change frequency of each weight, and marks clients with abnormal Euclidean distance and average frequency. (5) The server sends the updated global model to each client and continues the federated learning training; (6) Repeat steps (2) to (5) above. Each time the client uploads parameters, the server performs a screening. When a client is marked as abnormal three times, it is considered to be a free-rider attacker and is kicked out of the federated learning training.

2. The federated learning free-rider defense method based on model weight iteration according to claim 1 is characterized in that: The model aggregation formula described in step (4) is as follows: Among them, G t+1 is the aggregation model after server-side aggregation, G t is the aggregated model after the previous round of training aggregation, To train the model locally, Scale the model weights.

3. The federated learning free-rider defense method based on model weight iteration according to claim 1 is characterized in that: In step (4), the Euclidean distance d between each client and the average change frequency f of each weight are calculated. avg , the specific formula is as follows: Among them, x and y are two different client weight change frequency matrices; Among them, F i is the number of times each weight in the matrix changes, and n is the number of weights.

4. A federated learning free-rider defense device based on model weight iteration, characterized in that: It includes one or more processors for implementing the federated learning free-rider defense method based on model weight iteration as described in any one of claims 1-3.

5. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement the federated learning free-rider defense method based on model weight change as described in any one of claims 1-3.

Images