A label flipping attack and defense method for a machine learning model

Abstract

The application discloses a label flipping attack method for a machine learning model and a defense method thereof. In the label flipping attack method, firstly, training data to be attacked is selected by performing condensed hierarchical clustering on the training data, label flipping attack is performed on the selected training data, and then a classification model is trained by using a obtained contaminated data set to implement the attack; in view of the above attack, a small pure set and the contaminated training data are used, the TrAdaBoost method is used to update the weight of the contaminated data, the attacked data is identified according to the updated weight, the data without a label or with a wrong label is re-labeled, a new training set including the contaminated training set and the small pure set is obtained, and the classification model is re-trained by using the new training set to improve the model performance; the label flipping attack can be quickly and accurately performed on the training data vulnerable to contamination, and the suspicious contaminated data can be found, and the label flipping attack can be prevented by disinfecting the contaminated data.

Description

TECHNICAL FIELD

[0001] The application relates to a label flipping attack and defense method for a machine learning model and belongs to the technical fields of machine learning and network security. BACKGROUND

[0002] The data of a traditional machine learning model can come from uncertain or untrusted third parties, and an attacker can use the uncertainty of the data source to carry out a data poisoning attack. As a subclass of the data poisoning attack, the label flipping attack can be used by the attacker to attack the classification model by injecting a small amount of malicious data into the training data or modifying the training data. In recent years, methods of the label flipping attack have emerged in an endless stream, which brings great security risks to the classification model. The defense methods against the label flipping attack are also increasing. The traditional method based on the K-nearest neighbor algorithm cannot effectively defend against the label flipping attack in an Internet of Things (IoT) or an uncertain environment with a high noise rate.

[0003] Machine learning is increasingly used in malware defense, which has attracted people's attention to the robustness of machine learning in an adversarial environment. Improving the robustness of the classification model has become one of the focuses of research. Many research works have proved that a detection system with a high noise rate or uncertainty is vulnerable to the label flipping attack. In a complex network environment such as the IoT, the label flipping attack is particularly significant. An attacker can easily reduce the performance of the classification model by injecting malicious data or maliciously modifying the training data. Nowadays, there have been instances of attackers trying to attack the Android malware detection system of the IoT system. The label flipping attack seriously threatens network security. Although defense methods against the label flipping attack have emerged in an endless stream, the model test accuracy obtained by the current defense method is still low and needs to be updated and improved. New defense methods need to be proposed against the label flipping attack. SUMMARY

[0004] The technical problem to be solved by the application is to provide a label flipping attack and defense method for a machine learning model, which has good robustness, improves the annotation quality of the training data and the classification performance of the model, and protects data security.

[0005] To solve the above problems, the technical scheme adopted by the application is as follows:

[0006] The label flipping attack and defense method for a machine learning model, the label flipping attack method adopts the following steps:

[0007] Step one, for the training sample data to be subjected to the label flipping attack, the following operations are performed:

[0008] 1.4) performing agglomerative hierarchical clustering on the training data;

[0009] 1.5) Select susceptible sample data based on the clustering results;

[0010] 1.6) Perform a label flipping attack on the susceptible data selected in step 1.2 to obtain a contaminated training set;

[0011] Step 2: Inputting the contaminated training set obtained in Step 1 into common classification models such as MLP, LR, SVM, DT, and AdaBoost for training will reduce the performance of the classification model.

[0012] The defense method employs the following steps:

[0013] Step 3: For the contaminated training set obtained in Step 1, update the weights of the training samples using the TrAdaBoost algorithm to obtain training samples with different weights. Then, select the training samples whose weight values ​​are greater than a certain threshold, and consider these samples to have been attacked; the certain threshold is 3.9-4.2.

[0014] Step 4: Relabel the attacked training samples obtained in Step 3 to obtain a relabeled training set;

[0015] Step 5: Use the new training set obtained in Step 4 to train the MLP, LR, SVM, DT, and AdaBoost classification models to obtain MLP, LR, SVM, DT, and AdaBoost classification models with higher performance.

[0016] The specific steps for identifying contaminated training samples in step three of this invention are as follows:

[0017] S1: Use a small, clean dataset and a contaminated training set as input to the TrAdaBoost algorithm; the TrAdaBoost algorithm first initializes the weights of the training data using the following formula:

[0018]

[0019] In formula (1): These are the initial weights for the contaminated training set and the clean set, where n represents the number of samples in the clean set and m represents the number of samples in the contaminated training set.

[0020] S2: After multiple iterations of the TrAdaBoost algorithm, training samples are assigned new weights. During the weight update process, if a sample in the contaminated set is misclassified, its weight is reduced; otherwise, its weight is increased. If a sample in the pure set is misclassified, its weight is increased; otherwise, its weight is reduced. The formula for weight update is as follows:

[0021]

[0022] In formula (2): x represents the weight coefficients of the contaminated training set and the clean set after t iterations. i Let c(x) represent the i-th sample. i ) represents sample x i The true category to which it belongs, h t This refers to the classifier obtained by calling learner; N represents the number of iterations, and ln is the symbol for the natural logarithm, which represents the logarithm with the constant e as the base.

[0023] S3: Determine whether the sample weights in the contaminated training set meet the conditions. If they do, it means that the sample has been attacked and is a contaminated sample; otherwise, it is considered that the sample has not been attacked.

[0024] The TrAdaBoost algorithm for updating weights in step three of this invention uses the TrAdaBoost algorithm to iteratively update and finally obtain the weights of the contaminated training samples.

[0025] The agglomerative hierarchical clustering of training data described in step 1.2 of this invention finds training samples with ambiguous boundaries by performing agglomerative hierarchical clustering on the training data, and then performs a label flipping attack on them.

[0026] The specific threshold value described in this invention is 3.95.

[0027] The effects achieved by adopting the above technical solution are as follows:

[0028] The TrAdaBoost algorithm is a transfer learning algorithm often used to train classification models effectively when data samples are insufficient. Initially, each sample in the training data is assigned a weight. When a sample in the source domain is misclassified, it is considered difficult to classify, so its weight is increased. This increases the proportion of that sample in the next training iteration. Through multiple iterations, the classification model is eventually trained, improving its accuracy.

[0029] Label flipping attacks can harm users by modifying their data; therefore, sanitizing the attacked training data is crucial for reducing or avoiding the impact of label flipping attacks and for evaluating and improving malicious code detection systems. The attack strategy proposed in this invention can effectively attack training data through agglomerative hierarchical clustering technology, significantly reducing the model's classification accuracy. The proposed defense method relabels training samples using the TrAdaBoost algorithm, ensuring similarity to the original data sample labels and effectively improving the robustness of the classification model.

[0030] The application can adjust training parameters, regulate system training methods, and improve flexibility and adaptability of the method. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is a flowchart of the method of the application. DETAILED DESCRIPTION

[0032] The application will be further described in detail below in combination with the drawings and specific embodiments.

[0033] As Figure 1 shown, a label flipping attack method for a machine learning model and a defense method thereof adopt the following steps:

[0034] Step 1, select training sample data to be subjected to label flipping attack, and perform the following operations on the training data:

[0035] 1.1) cluster the training data, and use the agglomerative hierarchical clustering algorithm in the application to cluster the training data into two categories of benign samples and malicious samples, mark the benign samples as 0, and mark the malicious samples as 1;

[0036] 1.2) select sample data susceptible to pollution according to the clustering result, that is, training data samples with ambiguous boundaries between the two clusters of data after clustering, which have no clear class category and are suitable for label flipping attack; the agglomerative hierarchical clustering of the training data finds the training samples with ambiguous boundaries, and then label flipping attack is performed on them;

[0037] 1.3) perform label flipping attack on the susceptible training data samples selected in step 1.2, that is, mark the malicious data label as a benign data label, so that the generated training set will have a large number of false negative data, and finally a polluted training set will be obtained;

[0038] The specific method is as follows: first, perform agglomerative hierarchical clustering on the training data, which will be clustered into two clusters of benign samples and malicious samples, then according to the clustering result, calculate the cluster shadow value of each sample in a loop, and use it as a standard to judge whether the sample meets the attack condition; compare the obtained cluster shadow value with 0, if it is less than 0, it means that the sample is suitable for attack, and label flipping is performed on it, so that the sample will be marked with an incorrect label value; if the cluster shadow value is greater than 0, it means that the sample is stable and not suitable for attack, so the sample will keep its label unchanged; in this way, each sample is judged, and finally a polluted training set is obtained;

[0039] Step two, train the MLP, LR, SVM, DT, AdaBoost and other classification models with the contaminated training set obtained in step one. The model classification accuracy is used as an indicator to evaluate the performance of the model. If the model classification accuracy decreases, it means that the attack is successful;

[0040] The specific method is: the training set after being attacked is used as input to train the classification model, and the test set remains the original data; after the contaminated training set is input into the classification model, a large number of false negative data in the training set will mislead the model training, and the performance of the trained model will decrease, so a classification model with reduced performance is obtained. When the model is tested, a lower classification accuracy is obtained;

[0041] The defense method adopts the following steps:

[0042] Step three, update the weights of the contaminated training set obtained in step one using the TrAdaBoost algorithm; the source domain data set is composed of small pure sets, and the auxiliary data set is composed of contaminated training sets; in the TrAdaBoost algorithm, each sample in the training data is assigned an initial weight; when a sample in a source domain is misclassified, it is considered that the sample is difficult to classify, so the weight of the sample is increased, so that the proportion of the sample in the next training is increased; if a sample in the auxiliary data set is misclassified, it is considered that the sample is very different from the target data, so the weight of the sample is reduced, thereby reducing the proportion of the sample in the training of the classification model; in this way, each training sample will obtain an updated different weight, and according to the different weight values of each sample, the training samples that are most likely to be attacked can be identified. The data samples with weight values greater than a specific threshold of 3.95-4.2 are selected as the samples that are most likely to be attacked, and the optimal value is 3.95. When the sample value is greater than 3.95, it is considered that the sample is subjected to label flipping attack; because the samples with the weight value and the unattacked samples have obvious weight difference, the sample with the weight value of 3.95 is selected as the training sample that is most likely to be attacked;

[0043] The specific steps are as follows:

[0044] S1: combine a small pure data set and a contaminated training set into a new training set as the input of the TrAdaBoost algorithm; initialize the weights of the TrAdaBoost algorithm, and the initialization formula is:

[0045]

[0046] In formula (1): is the initialized weight value of the contaminated training set and the pure set, n represents the number of samples in the pure set, and m represents the number of samples in the contaminated training set;

[0047] S2: The initial weights in step S1 are updated through multiple iterations of the TrAdaBoost algorithm to obtain a new weight. During the weight update process, if a sample in the contaminated set is misclassified, its weight is reduced, indicating that the sample's distribution does not conform to the data distribution of the training model. Conversely, if the label of a sample in the contaminated training set is correctly identified, it indicates that the sample conforms to the data distribution of the training model, so its weight is increased. However, if a sample in the pure set is misclassified, its weight is increased, indicating that the training sample's information was not well learned during training, so a larger weight needs to be assigned to the sample during model training. Conversely, if a sample in the pure set is correctly identified, it indicates that the sample has been well learned, and a smaller weight can be assigned to the sample. The weight update calculation formula is as follows:

[0048]

[0049] In formula (2): x represents the weight coefficients of the contaminated training set and the clean set after t iterations. i Let c(x) represent the i-th sample. i ) represents sample x i The true category to which it belongs, h t This refers to the classifier obtained by calling learner; N represents the number of iterations, and ln is the symbol for the natural logarithm, which represents the logarithm with the constant e as the base.

[0050] During the execution of the TrAdaBoost algorithm, in order to obtain the optimal classification effect, after N iterations, the attacked samples and the unattacked samples will have completely different weight values; therefore, the weight values ​​can be used as a standard to distinguish between the attacked training samples and the pure training samples.

[0051] S3: Determine whether the weights of the samples in the contaminated training set meet the specific weight threshold of the attacked sample, which is 3.9-4.2, with the optimal value being 3.95. If the sample weights are greater than the specific threshold of 3.95, it means that the sample has been subjected to a label flipping attack and that the sample's existing label has been incorrectly labeled, indicating that the sample has been contaminated. Otherwise, it is considered that the sample has not been attacked and that the sample has been correctly labeled, so the sample's existing label value remains unchanged.

[0052] The training set samples obtained through the above steps closely approximate the data distribution of the original training set; the data obtained through the above steps can be used to train a classification model to achieve defense.

[0053] Step four, re-labeling the attacked training sample obtained in step three to obtain a re-labeled training set; the re-labeled training set can correct a large number of mislabeled labels, realize data sterilization, and obtain a training set similar to the original training set in distribution; the training set not only has good credibility and is suitable for model training, but also can protect the training set data subjected to label flipping attack to a great extent;

[0054] Step five, training the MLP, LR, SVM, DT, AdaBoost and other classification models using the new training set obtained by the above method, and the classification accuracy is greatly improved, which shows that the defense method against the label flipping attack proposed in the application has remarkable effect.

[0055] In practical applications, in order to improve efficiency and model performance, a larger data set can be selected for model training, and there will be more obvious defense effect; the parameters, thresholds and the like in each step can be freely selected and set; by training the MLP, LR, SVM, DT, AdaBoost and other classification models and testing the classification accuracy of each model, the experimental results show that under the condition of 20% label flipping rate, the classification accuracy can reach 90%, which shows that the proposed defense method has good effect.

[0056] The application can perform label flipping attack by condensing hierarchical clustering on training data, obtain a contaminated training set, and then correct the error labels of the data in the contaminated training set; without changing the sample data, the classification performance of the model subjected to label flipping attack is improved by modifying the label attribute of the data sample, and the robustness of the model is improved; at the same time, the method for obtaining the pure training set of the application is to re-label the contaminated data instead of removing the contaminated data, and the integrity of the training data is maintained.

[0057] The application can adjust the training parameters, regulate the system training mode, and improve the defense effectiveness against label flipping attack and the robustness of the model.

[0058] Finally, it should be explained that the above description is only a preferred embodiment of the application and is not intended to limit the application, and any modification, equivalent replacement or improvement made within the spirit and principle of the application should be included in the protection scope of the application.

Claims

1. A processing method for a machine learning model, the processing method consisting of a label flipping attack method and a defense method, characterized in that, The label flipping attack method adopts the following steps: Step one, for the training sample data to be subjected to label flipping attack, the following operations are performed: 1.1) performing agglomerative hierarchical clustering on the training data; 1.2) selecting susceptible sample data according to the clustering results; 1.3) performing label flipping attack on the susceptible data selected in step 1.2 to obtain a contaminated training set; Step two, inputting the contaminated training set obtained in step one into MLP, LR, SVM, DT, AdaBoost classification models for training, which will reduce the performance of the classification models; The defense method adopts the following steps: Step three, using TrAdaBoost algorithm to update the weights of the training samples in the contaminated training set obtained in step one, obtaining training samples with different weights, and then selecting training samples with weight values greater than a certain specific threshold as samples subjected to attack; the certain specific threshold is 3.9-4.2; The specific operation of identifying the contaminated training samples is as follows: S1: inputting a small pure data set and the contaminated training set into the TrAdaBoost algorithm; the TrAdaBoost algorithm first initializes the weights of the training data, and the initialization formula is: In formula (1): are initialized weight values of the contaminated training set and the pure set, n represents the number of samples in the pure set, and m represents the number of samples of the contaminated training set; S2: after the training samples are iterated multiple times by the TrAdaBoost algorithm, they will be assigned a new weight; in the process of updating the weight, if the contaminated set sample is misjudged, the weight of the sample is reduced, otherwise, the weight of the sample is increased; if the pure set sample is misjudged, the weight of the sample is increased, otherwise, the weight of the sample is reduced; the calculation formula of the weight update is as follows: In formula (2): denote the weight coefficients of the contaminated training set and the pure set after t iterations of updates, x i denote the i-th sample, c(x i ) denotes the true class to which the sample x i belongs, h t denotes the classifier obtained by calling the learner; N denotes the number of iterations, ln is the natural logarithm symbol, which denotes the logarithm with base e. S3: judging whether the weight of the sample in the contaminated training set meets the condition, if it meets the condition, it means that the sample is attacked, and it is a contaminated sample; otherwise, it is considered that the sample is not attacked; Step four, re-labeling the training samples subjected to attack obtained in step three to obtain a re-labeled training set; Step five, training the MLP, LR, SVM, DT, AdaBoost classification models using the new training set obtained in step four to obtain MLP, LR, SVM, DT, AdaBoost classification models with high performance.

2. The processing method for machine learning model according to claim 1, wherein, The TrAdaBoost algorithm for updating the weight in step three uses the TrAdaBoost algorithm to iteratively update the weight of the contaminated training sample.

3. The processing method for machine learning model according to claim 1, wherein, The agglomerative hierarchical clustering of the training data in step 1.2 finds the training samples with fuzzy boundaries by performing agglomerative hierarchical clustering on the training data, and then performs label flipping attack on them.

4. The processing method for machine learning model according to claim 1, wherein, The certain specific threshold is 3.95.

Images