A longitudinal federated learning inference attack defense method
By calculating the Shapley values of the participants and adjusting the gradients, the problem of active label inference attacks in longitudinal federated learning is solved, thereby improving the fairness and security of the model.
Patent Information
- Application Number
- CN202210946007.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-08
- Publication Date
- 2025-12-12
- Estimated Expiration
- 2042-08-08
AI Technical Summary
Vertical federated learning is vulnerable to active labeling inference attacks, which can cause the model to favor the attacker and undermine system fairness.
By calculating the Shapley value of each participant through collaboration, gradient scaling is performed based on the impact of the model loss value to prevent high-contribution participants from training too quickly, enhance the training speed of low-contribution participants, and maintain system fairness.
It effectively resists active labeling inference attacks, maintains the fairness and security of vertical federated learning, is suitable for large-scale systems, and has a fast computation speed.
Smart Images
Figure CN115310625B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of federated learning privacy security, and particularly relates to a longitudinal federated learning inference attack defense method. BACKGROUND
[0002] With the explosive increase of terminal devices, a large amount of data is generated, and these data contain great value. However, due to the frequent privacy leakage events in recent years, more and more countries have begun to pay attention to the data privacy problem, and have enacted a series of privacy protection regulations to strictly limit the use of personal privacy data, which has brought challenges to traditional machine learning, and the "data island" problem is becoming increasingly serious. In this background, Google proposed the concept of federated learning. Unlike traditional machine learning, federated learning does not need to centralize data for model training, but aggregates the intermediate results of each participant's model, and the data is always saved locally during training, without the threat of privacy leakage.
[0003] Micro-bank further classifies federated learning into horizontal federated learning, longitudinal federated learning and federated transfer learning. Longitudinal federated learning is more common in China, for example, a bank and an Internet company jointly train a loan risk prediction model. The bank as the active party has fewer user features and labels, while the Internet company as the passive party has rich user features. In the longitudinal federated learning training process, the bank expands its own user feature dimension by using the data of the Internet company, so as to train a more accurate loan risk prediction model to assess whether the user will default on the loan.
[0004] However, it is difficult to ensure that all participants in longitudinal federated learning are trustworthy, and some participants will destroy the fairness of the longitudinal federated learning system, so that the final federated model is more biased towards the model of the participant. For example, the participant conducts active label inference attack, dynamically amplifies his own training gradient during the training process, so that his local model is trained faster and better, and gradually replaces the global model. Since this attack is only completed locally by the participant, and in some cases makes the federated model better, it is difficult to detect, so there is an urgent need for a technology to resist this attack and maintain the security of the longitudinal federated learning system. SUMMARY
[0005] In order to overcome the shortcomings of the prior art, the purpose of the present application is to provide a longitudinal federated learning inference attack defense method, which can resist active label inference attack and ensure the fairness of longitudinal federated learning.
[0006] To achieve the above-mentioned purpose of the application, the present application provides the following technical solutions:
[0007] A method for defending against longitudinal federated learning inference attacks, comprising the following steps:
[0008] Step 1, constructing a longitudinal federated learning system of multiple participants, wherein one participant simultaneously acts as a collaboration party to control the federated learning training process;
[0009] Step 2, performing federated learning of the longitudinal federated learning system of multiple participants, the collaboration party having a top model and data labels, and the participants having local models and data features; each participant trains a local model using its own local data set and uploads the model intermediate result to the collaboration party; after receiving the model intermediate results of all participants, the collaboration party inputs the different combination results into the top model to calculate the model loss value, and calculates the Shapley value of each participant to evaluate the contribution of each local model according to the model loss value; the collaboration party inputs the aggregated model intermediate results of all participants into the top model for further training, and then performs back propagation to obtain the gradient returned to each participant, which is scaled according to the previously calculated Shapley value to resist active label inference attacks; after receiving the gradient, each participant continues the back propagation process and performs the next round of federated learning;
[0010] Step 3, extracting the top model of the collaboration party and its local model after federated learning as a longitudinal federated learning model capable of defending against active label inference attacks for image recognition or loan risk prediction.
[0011] The collaboration party calculates the Shapley value according to the influence of different permutations and combinations on the model loss value of the top model.
[0012] When calculating the Shapley value, the reciprocal of the influence on the model loss value is taken as the marginal benefit of the participant, and the Shapley value calculation formula is used for calculation.
[0013] The collaboration party calculates the average contribution rate of each participant according to the Shapley value, and scales the gradient according to the average contribution rate, specifically:
[0014] The sum of the Shapley values of all participants is calculated, and the contribution rate of each participant is obtained by dividing the Shapley value of each participant by the sum, assuming that the average contribution rate of the participants is 1 divided by the number of participants, and the gradient is scaled by comparing the contribution rate of each participant with the average contribution rate;
[0015] For the case where a participant has a high contribution rate, the gradient returned to the participant is scaled down to prevent the local model from being replaced by the federated model due to the rapid training of the local model, and the classification relies more on the participant, which destroys the fairness of the longitudinal federated learning;
[0016] For the case of low contribution of the participant, the gradient returned to the participant is increased to improve the training progress speed of the participant, so that the federated model does not ignore the model and local data of the participant, and the fairness of the vertical federated learning is protected.
[0017] The high-contribution participant and the low-contribution participant are judged according to the ratio of the contribution to the average contribution, and there is a robust interval, specifically:
[0018] For the case that the ratio of the contribution rate of the participant to the average contribution rate is greater than 2, that is, high contribution, and the ratio is less than 1 / 2, that is, low contribution, the gradient returned to the participant by the coordinator is multiplied by the reciprocal of the ratio of the contribution rate to the average contribution rate.
[0019] Compared with the prior art, the present application has the following beneficial effects:
[0020] The coordinator calculates the Shapley value of each participant and scales the gradient returned to each participant to effectively resist active label inference attacks, prevent high contribution of the participant from replacing the federated model or making the prediction result of the federated model more inclined to the data set of a certain participant, and also prevent low contribution of the participant from causing the federated model to ignore the model or data set of the participant, so as to resist active label inference attacks;
[0021] The coordinator does not need to repeatedly perform additional model training to evaluate the contribution of each participant, and the calculation speed is faster, which is suitable for large-scale vertical federated learning systems, and the low-contribution participant is accelerated for training, thereby maintaining the security of the vertical federated learning and promoting the formation of the federated learning ecology. BRIEF DESCRIPTION OF DRAWINGS
[0022] Figure 1 is a flowchart of the vertical federated learning inference attack defense method of the embodiment of the present application.
[0023] Figure 2 is a structure schematic diagram of the vertical federated learning system for image recognition or loan risk assessment of the embodiment of the present application.
[0024] Figure 3 is a time comparison diagram of the original vertical federated learning and the vertical federated learning after adding the defense method in one training round of the embodiment of the present application. DETAILED DESCRIPTION
[0025] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below with reference to the embodiments. It should be understood that the embodiments described herein are only used to explain the present application and do not limit the present application.
[0026] In view of the risk of active label inference attack after the federated learning system is widely deployed in image recognition or loan risk prediction scenarios, it is necessary to study an effective defense method for the problem of how to ensure the fairness of the model in federated learning. The present application aims to propose a federated learning inference attack defense method from the perspective of the collaboration party in the federated learning system, and the specific technical concept is that the active label inference attack initiated by the passive party in the federated learning system will make its own local model better trained, so as to make the trained federated model more biased towards the local model of the participant or the local data of the participant in the model prediction stage, so that the collaboration party can only judge the contribution of each participant to identify the participant who performs active label inference attack, and at the same time, the gradient returned by the coordinator to the participant is reduced to prevent the active label attack from destroying the fairness of the federated learning.
[0027] As shown in Figure 1 A federated learning inference attack defense method, comprising the following steps:
[0028] Step 1, constructing a federated learning system of multiple participants, one of which acts as a collaboration party to control the federated learning training process, and the federated learning system of multiple participants is used to construct an image recognition model or a loan risk prediction model through federated learning;
[0029] Step 2, according to the general architecture of the federated learning system, the participants have local samples and local models, one of which acts as a collaboration party and has a top model with classification ability; each participant trains a local model on its own local data set and sends the model intermediate result to the collaboration party after forward propagation; the collaboration party aggregates the uploaded model intermediate result and continues the forward propagation process; after the collaboration party completes the forward propagation process, it calculates the gradient by back propagation and sends the gradient to each participant, and the participant updates the local model after receiving the gradient and performs the next round of federated learning;
[0030] In the embodiment, the participant acting as the coordinator has a small amount of sample features and labels, and the other participants have a large amount of sample features but no labels; in the field of loan risk prediction, the participants have personal features of users, including age, gender, income, loan records, consumption records, etc., and based on the information of the personal features, a more accurate user loan risk prediction model can be realized by using federated learning; and in the field of image recognition, the participants have part of the pictures with classification labels, and one of the participants acts as the coordinator and has the labels, so as to train a more accurate image recognition model.
[0031] The local model of the participant in the embodiment is usually a deep learning model, such as a convolutional neural network model, a deep residual network model, a fully connected neural network model, etc., and the collaboration party is usually a four to five layer fully connected layer neural network model; both the top model and the local model include an input layer, a hidden layer and an output layer, and there is a connection relationship between different layers. Referring to Figure 2 , Figure 2 The circles in the figures represent neurons, and the lines between the neurons represent connection relationships, wherein the output layer of the local model and the input layer of the top model have the same dimension, so as to realize the training of the intermediate result in the model and the transmission of the back propagation gradient.
[0032] As shown in Figure 2 , enterprises A and B are participants, and enterprise B also serves as a coordinator, enterprise A will run a malicious optimizer to maliciously enlarge the gradient from the server and accelerate its own training process, so that the trained federal model is more biased to itself; therefore, the gradient returned by the coordinator to the participant in step 2 is dynamically adjusted to ensure the fairness of the vertical federal learning;
[0033] The federal learning of the vertical federal learning system of multiple participants is performed, each participant performs model training on its own private data set, and uploads the model intermediate result to the collaboration party after the training is completed;
[0034] As shown in Figure 2 , in the federal learning process, the local data set of each participant is different, and therefore the uploaded model intermediate result is different;
[0035] Step 3, extracting the top model of the coordinator and its local model after the federal learning as a vertical federal learning model capable of defending active label inference attack for image recognition or loan risk prediction;
[0036] In the embodiment, the set of model intermediate results of the participants received by the collaboration party represents wherein K represents K participants; the collaboration party aggregates the received model intermediate results in different permutations and combinations, S represents all possible aggregation results of the local model outputs of the participants, and different aggregation inputs are input into the top model to calculate the model loss, and the Shapley value of the kth participant is:
[0037]
[0038] wherein Loss represents the model loss value obtained by inputting the aggregation result of different local model results into the top model;
[0039] After calculating the Shapley value of each participant, the coordinator calculates the average contribution rate according to the Shapley value of each participant, and scales the gradient; first, the sum of the Shapley values of all participants is calculated, and the Shapley value of each participant is divided by the sum to obtain the contribution rate of each participant, assuming that the average contribution rate of the participants is 1 divided by the number of participants, and the contribution rate of each participant is compared with the average contribution rate to scale the gradient;
[0040] For the case that the participant has a high contribution rate, the gradient returned to the participant is reduced to prevent the local model from being trained too fast and replacing the federal model, relying more on the participant during classification, and destroying the fairness of vertical federated learning;
[0041] For the case that the participant has a low contribution rate, the gradient returned to the participant is increased to improve the training speed of the participant, so that the federal model does not ignore the model and local data of the participant, and the fairness of vertical federated learning is protected.
[0042] For the case that the participant has a high contribution rate and a low contribution rate, the contribution rate is judged according to the ratio of the contribution rate to the average contribution rate, and there is a certain robust interval, which is:
[0043] For the case that the ratio of the contribution rate of the participant to the average contribution rate is greater than 2, i.e. high contribution rate, and the ratio is less than 1 / 2, i.e. low contribution rate, the gradient returned to the participant by the coordinator is multiplied by the reciprocal of the ratio of the contribution rate to the average contribution rate.
[0044] As shown in Figure 3 In the embodiments, for the classic image recognition data sets CIFAR-10, CIFAR-100, CINIC-10, and the loan risk prediction data set containing two hundred thousand loan records, vertical federated learning training is respectively performed, the left side is the time required for the original vertical federated learning system to train a data set once, and the right side is the time required for the vertical federated learning system with the Shapley value-based inference attack defense method to train a data set once, it can be obviously seen that the method only makes the vertical federated learning system increase by about three percent of the training time, that is, the safety and fairness of the vertical federated learning system are improved with small resource consumption.
[0045] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any modification, equivalent replacement and improvement within the technical range disclosed in the present application, which is within the spirit and principles of the present application, should be covered within the protection scope of the present application.
Claims
1. A method for defending against vertical federated learning inference attacks, characterized in that, The method comprises the following steps: Step 1, constructing a vertical federated learning system of multiple participants, wherein one participant simultaneously acts as a collaboration party to control the federated learning training process; Step 2, performing federated learning of the vertical federated learning system of multiple participants, the collaboration party having a top model and data labels, and the participants having local models and data features; each participant trains a local model by using a local data set thereof, and uploads an intermediate result of the model to the collaboration party; after receiving the intermediate results of the models of all the participants, the collaboration party inputs different combination results into the top model to calculate a model loss value, and calculates a Shapley value of each participant according to the model loss value to evaluate the contribution degree of each local model; the collaboration party inputs the aggregated intermediate results of the models of all the participants into the top model to continue training, and then performs back propagation to obtain gradients returned to each participant, which are scaled according to the previously calculated Shapley value to resist active label inference attacks; after receiving the gradients, each participant continues the back propagation process and performs the next round of federated learning; The collaboration party calculates an average contribution rate according to the Shapley value of each participant, and scales the gradients according to the average contribution rate, specifically as follows: The sum of the Shapley values of all the participants is calculated, and the contribution rate of each participant is obtained by dividing the Shapley value of each participant by the sum; assuming that the average contribution rate of the participants is 1 divided by the number of participants, the contribution rate of each participant is compared with the average contribution rate to scale the gradients; For the case that a participant has a high contribution rate, the gradients returned to the participant are scaled down to prevent the local model from being trained too fast and replacing the federated model, and the classification relies more on the participant, which destroys the fairness of the vertical federated learning; For the case that a participant has a low contribution rate, the gradients returned to the participant are scaled up to improve the training speed of the participant, so that the federated model does not ignore the model and local data of the participant, and the fairness of the vertical federated learning is protected; Step 3, extracting the top model of the collaboration party and the local model thereof after the federated learning as a vertical federated learning model for image recognition or loan risk prediction that can resist active label inference attacks.
2. The method of claim 1, wherein: The collaboration party calculates the Shapley value according to the influence of different permutations and combinations on the model loss value of the top model.
3. The method of claim 1, wherein: When calculating the Shapley value, the reciprocal of the influence on the model loss value is taken as the marginal benefit of the participant, and the Shapley value calculation formula is used for calculation.
4. The method of claim 1, wherein: For the high-contribution-rate participant and the low-contribution-rate participant, the ratio of the contribution rate to the average contribution rate is used for judgment, and there is a robust interval, specifically as follows: For the case that the ratio of the contribution rate to the average contribution rate is greater than 2, i.e., the high-contribution-rate case, and the ratio is less than 1 / 2, i.e., the low-contribution-rate case, the gradients returned to the participant by the collaboration party are multiplied by the reciprocal of the ratio of the contribution rate to the average contribution rate.