A defense method, device and storage medium for a poisoning attack on federated learning

Abstract

The application provides a defense method, device and storage medium for a poisoning attack of federated learning. The method comprises the following steps: obtaining a loss function value of a local model in a local training process and a parameter value update amount of each parameter rank in each iteration; calculating a change contribution value of each parameter rank to a model loss change based on the parameter value update amount and the loss function value; screening out a first preset number of parameter ranks with larger change contribution values in the parameter ranks of each local model, and establishing a first parameter rank set of each local model; screening out a second preset number of parameter ranks with higher frequencies based on the occurrence frequencies of the parameter ranks in the first parameter rank set, and establishing a second parameter rank set; positioning model parameters in each local model based on the second parameter rank set, calculating a regularization closeness between the local models based on the model parameters, and calculating a poisoning probability parameter based on the regularization closeness.

Description

Technical Field

[0001] This invention relates to the field of federated learning technology, and in particular to a method, apparatus, and storage medium for defending against poisoning attacks on federated learning. Background Technology

[0002] Federated learning, due to its privacy and efficiency advantages in training mechanisms, is an effective method for applying deep learning to large-scale distributed systems. Unlike traditional centralized deep learning schemes that require sharing all users' local private data for deep learning model training, federated learning schemes do not require local clients to share their private data with any other clients, enabling collaborative training of a global deep learning model while ensuring user privacy. Specifically, in a federated learning system, each client trains its local model using local data and sends this model to a central server. The central server aggregates the local models to obtain the global model and then sends this model back to the clients for the next iteration. Therefore, federated learning systems are generally more efficient than centralized systems.

[0003] However, federated learning systems are vulnerable to poisoning attacks launched by malicious clients. The central server of a federated learning system does not have direct access to the local private data of each client, making it unable to control the behavior of each client. Malicious clients can launch targeted poisoning attacks by maliciously modifying local training datasets or local model updates to be uploaded, thereby disabling the global model and reducing the security of the federated learning system itself.

[0004] Currently, existing defense strategies against poisoning attacks on federated learning typically involve deploying a powerful poisoning model detector on the central server to detect poisoned models and refuse their inclusion in the global model aggregation, thereby mitigating the threat of poisoning attacks. Usually, a large number of local model parameters need to be accumulated before detection, and an anomaly detection model is trained offline to detect poisoned models in the federated learning system. Existing detection-based defense methods still face some problems: (1) The number of parameters in deep neural network models is usually huge, and detection models usually cannot directly process high-dimensional data. Existing methods reduce the dimensionality by randomly selecting parameters for subsequent model detection. Although simple to implement, it is not targeted. (2) These studies are all based on offline detection models. In real-world scenarios, the training data collected by each client usually faces heterogeneity and time-varying problems. The pre-collected training data and the training data that participate in distributed learning later have data distribution drift, which leads to the detection model obtained by offline training usually facing gradient shift problems, affecting the defense performance of the detection model. Summary of the Invention

[0005] In view of this, the embodiment of the present application provides a defense method against poisoning attacks of federated learning to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present application provides a defense method against poisoning attacks of federated learning, which is based on a distributed architecture including a server end and a plurality of node ends connected to the server end, and the steps of the method include,

[0007] Obtaining the loss function value calculated by each iteration in the local training process of the local model at the node end and the parameter value update amount at each parameter rank in each iteration;

[0008] Based on the parameter value update amount and the loss function value, the change contribution value of each parameter rank to the model loss change is calculated;

[0009] In each parameter rank of the local model, the first preset number of parameter ranks with larger change contribution values are screened out, and the first parameter rank set of each local model is established;

[0010] Based on the occurrence frequency of each parameter rank in all first parameter rank sets, the second preset number of parameter ranks with higher frequency are screened out, and the second parameter rank set is established;

[0011] Based on the second parameter rank set, the model parameters in each local model are located, the regularization intimacy between local models is calculated based on the model parameters, and the poisoning probability parameter is calculated based on the regularization intimacy between each local model and other local models.

[0012] With the above scheme, the present application proposes an important model parameter selection algorithm for gradients, which selectively selects model parameters for subsequent poisoning model detection, and proposes an online unsupervised poisoning model detection method, which does not need to collect model data in advance to train an offline detection model, but only needs to determine whether each local model is attacked according to the current training situation, avoiding the problem of performance decline in defense caused by heterogeneous time-varying training data.

[0013] In some embodiments of the present application, the steps of the method further include determining whether the local model is poisoned based on the poisoning probability parameter corresponding to the local model and the preset poisoning probability threshold, and if the local model is determined to be poisoned, the model parameters uploaded by the node end to the server end do not participate in the aggregation calculation of the server end.

[0014] In some embodiments of the present application, the step of screening out the first preset number of parameter ranks with larger change contribution values in each parameter rank of the local model includes establishing a first parameter index for each local model according to the change contribution value and the first preset number, and screening out the first preset number of parameter ranks based on the first parameter index.

[0015] In some embodiments of the present application, the step of screening out a second preset number of parameter rankings with higher frequencies based on the frequency of occurrence of each parameter ranking in all the first parameter ranking sets comprises: establishing a second parameter index based on the frequency of occurrence of each parameter ranking in all the first parameter ranking sets and the second preset number; and screening the second preset number of parameter rankings based on the second parameter index.

[0016] In some embodiments of the present application, the step of calculating the change contribution value of each parameter ranking to the change in model loss based on the parameter value update amount and the loss function value further comprises: calculating a gradient value corresponding to the current loss function value; and calculating the change contribution value according to the gradient value and the parameter value update amount.

[0017] In some embodiments of the present application, the change contribution value is calculated according to the gradient value and the parameter value update amount based on the following formula:

[0018] ;

[0019] is the change contribution value of the parameter ranking k at the i-th iteration of the current training round, E is the total number of training rounds, e is any one of the first E training rounds, t represents the number of iterations, is the gradient value of the parameter ranking k at the i-th iteration of the current training round, t is the parameter value update amount of the parameter ranking at the i-th iteration of the current training round. k t

[0020] In some embodiments of the present application, in the step of calculating the regularization affinity between local models based on the model parameters after positioning the model parameters in each local model based on the second parameter ranking set, the model parameters positioned by each local model based on the second parameter ranking set are constructed into a first parameter set, and the regularization affinity between local models is calculated based on the model parameters in the first parameter set.

[0021] In some embodiments of the present application, the regularization affinity between local models is calculated based on the model parameters according to the following formula:

[0022] ;

[0023] represents the regularization affinity between local models i and local model j ​​Regularized intimacy between them D Represents the distance function. Represents the local model i The first parameter set, Represents the local model j The first parameter set, Represents the local model i The variance of the model parameters in the first parameter set. This represents the total number of local models. l for Any one of the local models, Represents the local model l The first parameter set.

[0024] In some embodiments of the present invention, the poisoning probability parameter is calculated based on the regularized affinity between each local model and other local models, according to the following formula:

[0025] ;

[0026] Represents the local model i The probability parameter of poisoning Indicates information about the local model i The superposition operation, Represents the local model i and local model j Regularized intimacy between them.

[0027] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0028] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0029] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0030] Figure 1 This is a schematic diagram of one embodiment of the defense method against poisoning attacks in federated learning according to the present invention;

[0031] Figure 2This is a schematic diagram illustrating another implementation of the defense method against poisoning attacks in federated learning according to the present invention.

[0032] Figure 3 This is a schematic diagram illustrating the experimental results of the label-flipping attack.

[0033] Figure 4 This is a schematic diagram illustrating the experimental results of a clean label attack.

[0034] Figure 5 This is a schematic diagram of the system architecture of the present invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0036] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0037] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0038] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0039] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0040] like Figure 1 , 5 As shown, one aspect of the present invention provides a defense method against poisoning attacks on federated learning. The method is based on a distributed architecture, which includes a server and multiple nodes connected to the server. The steps of the method include...

[0041] In some embodiments of the present application, each node end is provided with a calculation model of the same structure, which can be a convolutional neural network model, and the steps of federated learning generally include local learning performed at the node end, the process of local learning generally includes multiple iterative calculations, each iterative calculation updates the parameters in the calculation model by calculating the loss function, in the steps of federated learning, the updated parameters of local learning are uploaded to the server end, the parameters uploaded by each node end are averaged and aggregated at the server end, the parameters after the average aggregation are sent to each node end, and the parameters of the calculation model of each node end are updated again, completing a round of federated learning.

[0042] The process of each round of federated learning is the process of local learning, uploading the updated parameters of local learning to the server end, and sending the parameters after the average aggregation to each node end.

[0043] The federated learning can be set to have multiple rounds.

[0044] In step S100, the loss function value calculated by each iteration of the local model at the node end in the local training process and the parameter value update amount at each parameter rank in each iteration are obtained.

[0045] In some embodiments of the present application, the parameter value update amount is the difference between the updated parameter value and the parameter value before the update of the same parameter rank in the iteration training.

[0046] In step S200, the change contribution value of each parameter rank to the change of model loss is calculated based on the parameter value update amount and the loss function value.

[0047] In some embodiments of the present application, the calculation models of each node end are of the same structure, and the parameters at the same parameter position are ranked in the same way in the calculation models of all node ends.

[0048] In some embodiments of the present application, the sum of all infinitesimal loss function change amounts in all iterations of local training can obtain the total amount of loss function change in the entire parameter space, and the loss change amount caused by the infinitesimal parameter value update amount in time, in this case, the loss function change amount can be estimated by the gradient, and the gradient can be obtained by deriving the loss function, therefore, based on the parameter value update amount and the loss function value, the change contribution value of the parameter at each parameter rank to the change of model loss can be obtained.

[0049] In step S300, the first preset number of parameter ranks with larger change contribution values are selected from the parameter ranks of each local model, and a first parameter rank set of each local model is established.

[0050] In some embodiments of the present application, in order to improve the calculation efficiency and reduce the calculation cost, a first preset number of parameter rankings with large change contribution values are screened out, and the parameter rankings in the first parameter ranking set of different local models can be different.

[0051] In step S400, a second preset number of parameter rankings with higher frequencies are screened out based on the frequency of each parameter ranking in all first parameter ranking sets, and a second parameter ranking set is established.

[0052] In some embodiments of the present application, if the parameter ranking appears in the first parameter ranking set of different node ends with a higher frequency, it indicates that the parameter position of the parameter ranking plays a more important role in the calculation model, thereby improving the accuracy of judging whether the model is poisoned.

[0053] In step S500, the model parameters in each local model are located based on the second parameter ranking set, the regularization affinity between the local models is calculated based on the model parameters, and the poisoning probability parameter is calculated based on the regularization affinity between each local model and other local models.

[0054] In some embodiments of the present application, the present scheme uses the concept of affinity to quantify the relationship between data, and based on this relationship, when the affinity between all other model parameters and the model parameters is insufficient, it is represented as an outlier, that is, detected as a poisoned model.

[0055] By using the above scheme, the present application proposes a gradient-based important model parameter selection algorithm, which can select model parameters for subsequent poisoned model detection in a targeted manner, and proposes an online unsupervised poisoned model detection method, which does not need to collect model data in advance to train an offline detection model, but only needs to determine whether each local model is attacked according to the current training situation, thereby avoiding the problem of performance degradation of the defense caused by the heterogeneous time-varying training data.

[0056] As shown in FIG. 6, Figure 2 In some embodiments of the present application, the steps of the method further include step S600 of determining whether the local model is poisoned based on the poisoning probability parameter corresponding to the local model and a preset poisoning probability threshold value, and if the local model is determined to be poisoned, the model parameters uploaded by the node end to the server do not participate in the aggregation calculation of the server.

[0057] In some embodiments of the present application, the calculated poisoning probability parameter is compared with the preset poisoning probability threshold value, and if the poisoning probability parameter is greater than the preset poisoning probability threshold value, the local model is determined to be poisoned, and in the federated learning process, the model parameters uploaded by the node end to the server do not participate in the average aggregation calculation of the server.

[0058] In some embodiments of the present application, the step of screening out the first preset number of parameter rankings with larger change contribution values in the parameter rankings of each local model comprises: establishing a first parameter index for each local model according to the change contribution values and the first preset number, and screening out the first preset number of parameter rankings based on the first parameter index.

[0059] In some embodiments of the present application, the first parameter index for each local model is established according to the change contribution values and the first preset number based on the following formula:

[0060] ;

[0061] The first parameter index of the local model i is represented by The first preset number is represented by The first preset number of parameter rankings with larger change contribution values is represented by .

[0062] In the above formula, if a parameter ranking belongs to the first preset number of parameter rankings with larger change contribution values, it is recorded as 1 in the first parameter index, otherwise it is recorded as 0.

[0063] In some embodiments of the present application, the step of screening out the second preset number of parameter rankings with higher frequency based on the frequency of each parameter ranking in all first parameter ranking sets comprises: establishing a second parameter index based on the frequency of each parameter ranking in all first parameter ranking sets and the second preset number, and screening out the second preset number of parameter rankings based on the second parameter index.

[0064] In some embodiments of the present application, the second parameter index is established based on the frequency of each parameter ranking in all first parameter ranking sets and the second preset number according to the following formula:

[0065] ;

[0066] The second parameter index is represented by The second preset number is represented by The second preset number of parameter rankings with higher frequency is represented by .

[0067] In the above formula, if a parameter ranking belongs to the second preset number of parameter rankings with higher frequency, it is recorded as 1 in the second parameter index, otherwise it is recorded as 0.

[0068] The first preset number and the second preset number can be equal.

[0069] By using the above scheme, the local model parameters to be detected can be effectively reduced in dimension.​​

[0070] In some embodiments of the present application, if the local models a, b, and c are included in the distributed architecture, the first parameter ranking set a1 is (1, 3, 5) by the first parameter index of the local model a, (1, 3, 5) means that the parameter rankings 1, 3, and 5 are included in the first parameter ranking set a1, the first parameter ranking set b1 is (1, 2, 3) by the first parameter index of the local model b, (1, 2, 3) means that the parameter rankings 1, 2, and 3 are included in the first parameter ranking set b1, and the first parameter ranking set c1 is (1, 2, 4) by the first parameter index of the local model c, (1, 2, 4) means that the parameter rankings 1, 2, and 4 are included in the first parameter ranking set c1.

[0071] If the second preset number is 3, the top 3 with higher occurrence frequencies in the first parameter ranking sets a1, b1, and c1 are 1, 2, and 3 respectively, and the second parameter ranking set is (1, 2, 3).

[0072] In some embodiments of the present application, the step of calculating the change contribution value of each parameter ranking to the change of the model loss based on the parameter value update amount and the loss function value further includes calculating a gradient value corresponding to the current loss function value, and calculating the change contribution value according to the gradient value and the parameter value update amount.

[0073] In some embodiments of the present application, the gradient value is obtained by derivation of the loss function.

[0074] In some embodiments of the present application, the change contribution value is calculated according to the gradient value and the parameter value update amount based on the following formula:

[0075] ;

[0076] the change contribution value corresponding to the parameter ranking k at the i-th iteration of the current training round, E the total number of training rounds, e any one of the i-th training round, E the iteration number, t the gradient value corresponding to the parameter ranking at the i-th iteration of the current training round, k the parameter value update amount of the parameter ranking t at the i-th iteration of the current training round. the parameter value update amount of the parameter ranking k at the i-th iteration of the current training round. t

[0077] ​In some embodiments of the present application, in the step of ranking the model parameters in each local model based on the second parameter ranking set and calculating the regularization affinity between the local models based on the model parameters, the model parameters located by each local model based on the second parameter ranking set are constructed into a first parameter set, and the regularization affinity between the local models is calculated based on the model parameters in the first parameter set.

[0078] In some embodiments of the present application, if the second parameter ranking set is (1, 2, 3) and the parameter ranking of the parameter positions of the local models at each node end is 1, 2, and 3, the located model parameters are constructed into a first parameter set, and the regularization affinity between the local models is calculated based on the first parameter set of each local model.

[0079] In some embodiments of the present application, the regularization affinity between the local models is calculated based on the model parameters according to the following formula:

[0080] ;

[0081] denotes the local model , denotes the local model different from in all local models, denotes the regularization affinity between the local model i and the local model j , D denotes a distance function, denotes the first parameter set of the local model i , denotes the first parameter set of the local model j , denotes the variance of the model parameters in the first parameter set of the local model i , denotes the total number of local models, l is any one of the local models, denotes the first parameter set of the local model l .

[0082] In some embodiments of the present application, the distance function can be a cosine distance function or an Euclidean distance function, etc.

[0083] In some embodiments of the present application, the poisoning probability parameter is calculated based on the regularization affinity between each local model and other local models, and is calculated according to the following formula:

[0084] ;

[0085] denote local models , denote local models different from denote local models i , denote the poisoning probability parameters of local models i , denote the multiplication operations on local models i , j denote the regularization affinity between local models

[0086] In some embodiments of the present application, if there are , , three local models, if the poisoning probability parameter of local model is required, then the formula is = ; if there are , , , four local models, if the poisoning probability parameter of local model is required, then the formula is = ; if there are , , , , five local models, if the poisoning probability parameter of local model is required, then the formula is = .

[0087] In some embodiments of the present application, the value of obtained is compared with a preset poisoning probability threshold value.

[0088] The preset poisoning probability threshold value can be 0.8, 0.85 or 0.9, etc.

[0089] In some embodiments of the present application, according to the poisoning probability of all local models in each round output by the above algorithm and a preset detection threshold value, we will output the discrimination result for the poisoned model, wherein when the local model is detected as a poisoned model (the predicted poisoning probability is greater than the threshold value, then it is determined as a poisoned model). In order to reduce the malicious influence of the poisoned model, the poisoned model detected is rejected to join the aggregation of the global model,

[0090] ;

[0091] N is the total number of local models, is the poisoning model detection result of the local model i , is the local training data set of the local model i , is the parameter in each parameter ranking of the local training model, is the aggregated model parameter, and in the formula, all local models are aggregated, that is, the local models are superimposed i to N .

[0092] By using the above scheme, according to the predicted label value, the detected local poisoning model is rejected to join the aggregation of the global model, so as to realize the defense of poisoning attack.

[0093] Considering that the parameter quantity of the deep neural network model is large, the detection model cannot directly detect high-dimensional data. Therefore, before online poisoning model detection, we need to select the parameters of each uploaded local model, that is, to realize effective dimension reduction. The existing research is to randomly select the parameters of the local model, and the random parameter selection is not targeted. Therefore, we propose an important model parameter selection algorithm based on gradient, which can select important model parameters for subsequent poisoning model detection.

[0094] Firstly, we calculate the importance of the local model parameters based on the gradient. The gradient itself represents the importance of the change of the model parameters with respect to the prediction result of the model, which can be used as an indicator to evaluate the importance of the parameters. Secondly, the gradient update is also used for the aggregation of the global model, and the important parameter selection based on the gradient is also conducive to the anomaly detection.

[0095] Experimental example:

[0096] In this experimental example, the public network intrusion detection data set UNSW-NB15 data set is used for verification, and two common poisoning attacks, label flipping attack and clean label attack, are considered.

[0097] As Figure 3 , 4As shown, first, we consider single-round attacks, and join the poisoning attack at T = 3, T = 5, T = 10, respectively, and compare with a variety of existing defense methods against poisoning attacks in federated learning, including methods based on robust aggregation, Krum and Geomed, and methods based on detection, VAE. The experimental results on the UNSW-15 dataset are shown in Table 1. As can be seen from Table 1, for the UNSW-NB15 dataset, when the label flipping attack or clean label attack is added, the overall accuracy and the accuracy of the target attack class of the federated learning baseline method (FedAvg) are significantly reduced compared to the case without attack, and the maximum is reduced to 0%. This illustrates the harmfulness of the label flipping attack and the clean label attack to the federated learning system, and it is necessary to use effective defense methods against poisoning attacks to protect the security of the federated learning system. However, our defense method has a significant improvement in accuracy compared to the defenseless federated learning baseline method (FedAvg), with a maximum of 99% improvement, and the performance is close to the ideal case without defense, proving that the proposed defense method can effectively alleviate the malicious effects of poisoning attacks. In addition, the existing defense methods Krum, Geomed and VAE also have a certain defense ability, and the performance is improved compared to the defenseless baseline method FedAvg, but in most cases the range of improvement of our proposed defense method is larger.

[0098] Table 1 Defense results of single-round poisoning attacks

[0099]

[0100] Secondly, we consider multi-round attacks, and the experimental results on the UNSW-15 dataset are shown in Fig 1 and Fig 2. Considering performing anomaly detection tasks on the UNSW-15 dataset, which belongs to a binary classification task and is an independent and identically distributed setting, distributed training is easy to converge, so we add poisoning attacks in the first communication round, and add poisoning attacks in each subsequent round. The experimental results show that for multi-round attacks, our method significantly improves compared to the baseline method FedAvg, and the improvement is more obvious compared to other defense methods, which proves that our method can still maintain high performance in defending multi-round continuous poisoning attacks. It is worth mentioning that, as Figure 3 As shown, the accuracy of Krum remains at 50%, and does not increase with the increase of iterations, while Krum has a certain defense ability for single-round attacks, as can be seen from Table 1, which shows that Krum has poor defense ability for continuous attacks. In contrast, on the UNSW-NB15 dataset, Geomed has good defense ability for multi-round label flipping attacks, and can achieve high accuracy in the later period, but the convergence of Geomed is still slower than our method.

[0101] The embodiment of the present application also provides a device for defending against a poisoning attack of federated learning, which comprises a computer device, the computer device comprises a processor and a memory, the memory stores computer instructions, and the processor is used for executing the computer instructions stored in the memory, and the device realizes the steps of the method as described above when the computer instructions are executed by the processor.

[0102] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the aforementioned method for defending against a poisoning attack of federated learning. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0103] Those skilled in the art should understand that the exemplary components, systems and methods described in connection with the embodiments disclosed herein can be implemented in hardware, software or a combination thereof. Whether the implementation is in hardware or software depends on the specific application and design constraints imposed on the overall system. Those skilled in the art can use various methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave in a transmission medium or communication link.

[0104] It should be noted that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order of the steps, after understanding the spirit of the present application.

[0105] In the present application, the features described and / or exemplified for one embodiment can be used in the same way or in a similar way in one or more other embodiments, and / or in combination with or instead of the features of other embodiments.

[0106] The above merely illustrates the preferred embodiments of the present application, and is not used to limit the present application. The embodiments of the present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall within the scope of protection of the present application.

Claims

1. A defense method against poisoning attacks in federated learning, characterized in that, The method is based on a distributed architecture, which includes a server and multiple nodes connected to the server. The steps of the method include: Obtain the loss function value calculated in each iteration of the local model at the node during local training, and the parameter value update amount at each parameter position in each iteration; Calculate the contribution of each parameter ranking to the change in model loss based on the parameter update amount and the loss function value; In the parameter ranking of each local model, select the first preset number of parameters with larger change contribution values ​​and rank them to establish the first parameter ranking set of each local model; Based on the frequency of each parameter ranking in all first parameter ranking sets, select the second preset number of parameter rankings with higher frequencies and establish them as the second parameter ranking set; The model parameters in each local model are located based on the second parameter ranking set. The regularized affinity between local models is calculated based on the model parameters. The poisoning probability parameter is calculated based on the regularized affinity between each local model and other local models. The local model is determined to be infected based on the infection probability parameters corresponding to the local model and the preset infection probability threshold. If the local model is determined to be infected, the model parameters uploaded by the node to the server will not participate in the server's aggregation calculation.

2. The defense method against poisoning attacks on federated learning according to claim 1, characterized in that, The steps for selecting the first preset number of parameters with the largest contribution values ​​from the parameter ranking of each local model include: Based on the change contribution value and the first preset number, a first parameter index is established for each local model, and the first preset number of parameters are ranked based on the first parameter index.

3. The defense method against poisoning attacks on federated learning according to claim 1, characterized in that, The step of calculating the contribution of each parameter's ranking to the change in model loss based on the parameter update amount and the loss function value is still... include, Calculate the gradient value corresponding to the current loss function value, and calculate the change contribution value based on the gradient value and the parameter value update amount.

4. The defense method against poisoning attacks on federated learning according to claim 1, characterized in that, In the step of locating the model parameters in each local model based on the second parameter ranking set and calculating the regularized closeness between local models based on the model parameters, the model parameters located by each local model based on the second parameter ranking set are constructed as the first parameter set, and the regularized closeness between local models is calculated based on the model parameters in the first parameter set.

5. The defense method against poisoning attacks on federated learning according to claim 4, characterized in that, The regularized closeness between local models is calculated based on the model parameters using the following formula: ; Represents the local model i and local model j Regularized intimacy between them D Represents the distance function. Represents the local model i The first parameter set, Represents the local model j The first parameter set, Represents the local model i The variance of the model parameters in the first parameter set. This represents the total number of local models. l for Any one of the local models, Represents the local model l The first parameter set.

6. The defense method against poisoning attacks on federated learning according to claim 1 or 5, characterized in that, The poisoning probability parameter is calculated based on the regularized affinity between each local model and other local models, according to the following formula: ； Represents the local model i The probability parameter of poisoning Indicates information about the local model i The superposition operation, Represents the local model i and local model j Regularized intimacy between them.

7. A defense device against poisoning attacks on federated learning, characterized in that, The apparatus includes a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the apparatus implements the steps of the method as described in any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1-6.

Images