A method to defend against label flipping attacks in federated learning

Abstract

The present invention relates to the technical field of federated learning, and proposes a method for resisting federated learning label flipping attacks. The method comprises the following steps: a server trains a generative network, which learns a mapping relationship from a label to a latent feature space based on a local global model of the server; a client detects its data quality based on the global model and the generative network; the server divides the clients into a set of benign clients and a set of malicious clients according to their data quality, and disqualifies each malicious client from participating in this round of training; the benign clients construct personalized models, and use the latent features generated by the generative network as inductive biases to adjust local training; after completing local training, each benign client sends model parameters to the server for aggregation, which is used to update the local global model of the server; a final global model is obtained, and the label flipping attack is resisted based on the final global model.

Description

Technical Field

[0001] The present invention relates to the field of federated learning technology, and more particularly, to a method for resisting federated learning label flipping attacks. Background Art

[0002] In the field of artificial intelligence, the traditional data processing model often involves one party collecting data, transferring it to another for processing, cleaning, and modeling, and finally selling the model to a third party. However, with the improvement of regulations and stricter monitoring, if data leaves the collection party or users are unclear about the specific use of the model, operators may run into legal issues.

[0003] One possible solution is federated learning. Federated learning eliminates the need for a centralized data manager to collect and validate datasets. Instead, it allows data to be stored on nodes (clients) and introduces a central coordinator to build a global model. This model is optimized by each client updating parameters based on local data, thereby preserving data privacy.

[0004] A major problem in federated learning is that, because client data is invisible and unverifiable, malicious clients can tamper with local data and send the updated parameters trained with this data to the server for global model optimization, thereby attacking the global model and undermining its performance. A simple, effective, and common attack strategy is the "label flipping attack"—an attacker injects malicious data by tampering with the labels of some samples. The simplicity of this attack lies in the fact that any user can carry it out, meaning that the implementer does not need to have prior knowledge of the entire federated learning system, such as the system process, model type, and parameters. The effectiveness lies in the fact that even with only approximately 50 poisoned samples, the model's misclassification rate can be significantly improved, even reaching 90%. Therefore, label flipping attacks are a pressing issue in federated learning that needs to be addressed.

[0005] Currently, most strategies for defending against label flipping attacks in federated learning require either significant computational and communication overhead, such as retraining and verifying the algorithm's performance on each sample. Alternatively, they require difficult-to-obtain prior knowledge, such as anomaly detection schemes that require a pre-estimated number of anomalous samples. While these approaches have demonstrated effectiveness in certain scenarios, they lack sufficient robustness in practice. Summary of the Invention

[0006] In order to overcome the defects of the above-mentioned prior art, such as high cost, difficulty in practice and insufficient robustness, the present invention provides a method for resisting federated learning label flipping attacks.

[0007] To solve the above technical problems, the technical solution of the present invention is as follows: a method for resisting federated learning label flipping attacks, comprising the following steps:

[0008] S1: The server trains a generative network that learns the mapping from labels to latent feature spaces based on a local global model on the server.

[0009] S2: The server broadcasts the global model and the generated network to each client. Each client checks the quality of its data based on the global model and the generated network.

[0010] S3: The server divides the clients into a benign client set and a malicious client set based on the data quality of each client, and disqualifies each malicious client from participating in this round of training;

[0011] S4: Each benign client builds a personalized model and uses the latent features generated by the generative network as an inductive bias to adjust the local training;

[0012] S5: After each benign client completes local training, it sends the model parameters to the server for aggregation, which is used to update the server's local global model.

[0013] S6: Repeat S1 to S5 until the global model converges or reaches the preset stopping condition, and obtain the final global model. The final global model is used to defend against label flipping attacks.

[0014] Preferably, in the step S1, before the first round of training begins, the server is initialized by θ:=[θ f ,θ p ] parameterized global model and the generative network parameterized by ω, where θ f is the feature extraction module, θ p For the prediction module; the steps of training the generated network on the server include:

[0015] Generate a random label sequence and As training samples for the generative network;

[0016] The training sample is input into the generative network, which outputs the potential features of the training sample and combines the potential features with the prediction module θ in the global model. p , and generate a network through objective function training.

[0017] Preferably, the objective function is expressed as follows:

[0018]

[0019] Among them, h(z; θ p ) is the prediction module θ p The output of , l(·) is a non-negative convex loss function; R is a random label sequence function, Represented by the generative network G ω Output of random label sequence The potential characteristics of paradigm E x～D Indicates that the sample x is sampled from the data distribution D, as shown in the formula Representation sample The data distribution space generated by the function R is sampled, and J(·) is the cost function in machine learning.

[0020] In this technical solution, a random tag sequence is given The objective function only requires the prediction module θ of the global model p Optimization can be performed on the server side, meaning that training the generative network does not incur additional computational or time overhead on the client side. Compared to the training model of a federated system, the generative network is very lightweight, especially when the feature space is compact. Therefore, training the generative network does not require excessive additional time. This lightweight nature also makes it easy to train and download.

[0021] Preferably, in step S2, the step of each client detecting its data quality based on the global model and the generated network includes:

[0022] S21: Calculate the prediction module θ of the global model p The potential features z~G corresponding to the local data label y of client i ω A predicted value of (·|y), wherein the predicted value is a first predicted value;

[0023] S22: Calculate a prediction value of the global model for the local data sample x of the client, where the prediction value is a second prediction value;

[0024] S23: Calculate the number of identical elements in the first predicted value and the second predicted value, and calculate the quality parameter DQ of client i based on the number of identical elements. i ;

[0025] S24: After client i completes the data quality test, the quality parameter DQ i Return to the server.

[0026] Preferably, in step S2, the quality parameter DQ of the i-th client is obtained i The expression is as follows:

[0027]

[0028] Among them, D i is the local data of client i, |D i | is the local data volume, z~G ω(·|y) represents the potential features of y output by the generative network, Acc(a, b) is a function that counts the number of identical elements in sequences a and b, and accmaxh(z; θ p ) represents the first predicted value, and argmaxh(f(x;θ)) represents the second predicted value.

[0029] In this technical solution, when accmaxh(z; θ p )≠argmaxh(f(x;θ)), it means that some of the labels have been tampered with, so the quality parameters detected in the data of the malicious client are numerically smaller than those of the benign client.

[0030] Preferably, in step S3, the step of classifying the clients and disqualifying each malicious client from participating in this round of training includes:

[0031] The server uses a clustering algorithm based on the quality parameter DQ of client i i Divide clients into two categories;

[0032] Calculate the average value of the quality parameter DQ in each class separately;

[0033] Compare the average values ​​of the quality parameter DQ in the two classes, and consider the clients in the class with the lower average value as the malicious client set, and the class with the higher average value as the benign client set;

[0034] Disqualify each malicious client in the malicious node set from participating in this round of training.

[0035] In this technical solution, after each client completes the data quality test, it will set the quality parameter DQ i Returned to the server, the server will then calculate the quality parameters DQ: = {DQ1, DQ2, ..., DQ N Malicious nodes are detected by accumulating quality parameters and dividing them by the number of clients in the class; therefore, the server can effectively and timely identify malicious clients before each round of training, without having to retrain the client's local data like other detection strategies, thereby limiting their participation in global aggregation to defend against attacks.

[0036] Preferably, in step S4, the benign client i constructs a personalized model, and the step of optimizing the local model includes:

[0037] S41: Benign client i builds a personalized model, wherein the personalized model includes a base layer for extracting local features and a personalized layer for outputting prediction results; the base layer uses the feature extraction module θ of the global model f The personalization layer uses the prediction module in the local model of the benign client i

[0038] S42: Calculate the personalized model of the benign client i on its local data D i The empirical risk L(θ i );

[0039] S43: Obtain an empirical approximate value p(y) of the prior distribution of the local data labels of the benign client i by counting the local data labels participating in the training in the benign client i during the local training phase;

[0040] S44: Each benign client i generates a network G ω Get the potential features z~G ω (·|y) is used as an augmented representation to introduce an inductive bias for local training and is trained based on the empirical approximation p(y) and the empirical risk L(θ i ) to optimize the local model.

[0041] In this technical solution, the personalized strategy is based on the phenomenon that "data usually have similar global representations, while the statistical heterogeneity between clients is mainly concentrated in the labels. Therefore, each client can optimize a personalized low-dimensional prediction module. And generate unique labels for its local sample features". Through this personalized design, we can recover the latent feature space by integrating the real knowledge of each benign client and let the generative network learn and extract accurate latent features from it.

[0042] Preferably, in step S42, the personalized model of the benign client i is calculated in its local data D i The empirical risk L(θ i ) is as follows:

[0043]

[0044] Among them, D i is the local data of the benign client i, |D i | is the amount of local data, y is the local data label of benign client i, x is the local data sample of client i, is the base layer for benign client i, is the personalization layer for benign client i, l(·) is a non-negative convex loss function, h(·) is the prediction layer, Feature extraction module for the model The output for the input sample x.

[0045] Preferably, in step S44, based on the generation of the personalized model of the network and the benign client i, the local data D i The empirical risk L(θ i )Optimize local model The expression is as follows:

[0046]

[0047] Among them, paradigm E x～D Indicates that the sample x is sampled from the data distribution D, as shown in the formula E y～p(y) represents the data distribution space generated by sampling the local data label y from the empirical approximation p(y), and J(·) is the cost function in machine learning.

[0048] A system for defending against federated learning label flipping attacks, applied to the above-mentioned method for defending against federated learning label flipping attacks, comprises:

[0049] The generative network training module is used to train the generative network on the server side and learn the mapping relationship from labels to latent feature space based on the local global model on the server side;

[0050] The data quality detection module is used to detect the data quality of each client based on the global model and the generated network;

[0051] The client classification module is used to classify clients into benign and malicious client sets based on the data quality of each client on the server side, and to disqualify each malicious client from participating in this round of training;

[0052] The client personalization module is used to build a personalized model for each benign client on the client side and use the latent features generated by the generative network as the inductive bias to adjust the local training;

[0053] The global model aggregation module is used to aggregate the model parameters returned by each benign client after completing local training on the server side, and update the global model based on the aggregated model parameters.

[0054] Compared with the existing technology, the beneficial effects of the technical solution of the present invention are: the present invention provides a new defense strategy that robustly realizes the effective detection of label flipping attack implementers without the need for prior knowledge and without incurring too much additional cost; the present invention only requires an additional lightweight generation network to be transmitted from the server to the client, and the generation network can be trained on the server, so it can identify clients that maliciously tamper with sample labels at a very low communication and computing cost, accelerate the model convergence speed and improve the model's prediction accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a flowchart of embodiment 1 for defending against label flipping attacks in this embodiment;

[0056] Figure 2 This is a flow chart of detecting data quality in Example 2;

[0057] Figure 3 This is a malicious client detection flow chart of Example 2;

[0058] Figure 4 This is a schematic diagram of the detection effect of Example 2;

[0059] Figure 5 Flowchart for optimizing the local model in Example 2;

[0060] Figure 6 This is a comparison chart of the test curves before and after the application of Example 2 in FedAvg.

[0061] Figure 7 This is an architectural diagram of the system for resisting federated learning label flipping attacks in Example 3. DETAILED DESCRIPTION

[0062] The accompanying drawings are for illustrative purposes only and are not to be construed as limiting this patent;

[0063] In order to better illustrate this embodiment, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product size;

[0064] It is understandable to those skilled in the art that some well-known structures and descriptions thereof may be omitted in the drawings.

[0065] The technical solution of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0066] Example 1

[0067] This embodiment proposes a method for defending against federated learning label flipping attacks, including the following steps:

[0068] S1: The server trains a generative network that learns the mapping from labels to latent feature spaces based on a local global model on the server.

[0069] S2: The server broadcasts the global model and the generated network to each client. Each client checks the quality of its data based on the global model and the generated network.

[0070] S3: The server divides the clients into a benign client set and a malicious client set based on the data quality of each client, and disqualifies each malicious client from participating in this round of training;

[0071] S4: Each benign client builds a personalized model and uses the latent features generated by the generative network as an inductive bias to adjust the local training;

[0072] S5: After each benign client completes local training, it sends the model parameters to the server for aggregation, which is used to update the server's local global model.

[0073] S6: Repeat S1 to S5 until the global model converges or reaches the preset stopping condition, and obtain the final global model. The final global model is used to defend against label flipping attacks.

[0074] This embodiment proposes a method to resist the federated learning label flipping attack, such as Figure 1 FIG. 1 is a flowchart of resisting label flipping according to the present embodiment.

[0075] In an optional embodiment, in step S1, a lightweight generative network is trained based on the global model, and the training of the generative network does not bring additional computational or time overhead to each client.

[0076] In an optional embodiment, in step S2, after the server broadcasts the global model and the generated network to each client, each client detects its quality parameter DQ by formula (1): i and the quality parameter DQ i Return to the server;

[0077]

[0078] In an optional embodiment, in step S3, the step of classifying the clients and disqualifying each malicious client from participating in the current round of training includes:

[0079] The server uses a clustering algorithm based on the quality parameter DQ of client i i Divide clients into two categories;

[0080] Calculate the average value of the quality parameter DQ in each class separately;

[0081] Compare the average values ​​of the quality parameter DQ in the two classes, and consider the clients in the class with the lower average value as the malicious client set, and the class with the higher average value as the benign client set;

[0082] Disqualify each malicious client in the malicious node set from participating in this round of training.

[0083] In an optional embodiment, in step S4, each client constructs a personalized model in the form of base+personalization, and uses the enhanced representation generated by the generative network as an inductive bias to adjust the local training, optimize the local model and return the local model to the server.

[0084] In an optional embodiment, each client can obtain potential feature representations z~G from the generative network ω(·|y) is used as an augmented representation to introduce an inductive bias for local training and enhance the generalization performance of its local model. The optimization goal of is to maximize the ability to correctly predict the enhanced samples and local data, as shown in formula (3):

[0085]

[0086] in, is the personalized model of client i in its local data D i The empirical risk on i is the local data of the benign client i, |D i | is the amount of local data, y is the local data label of benign client i, x is the local data sample of client i, is the base layer for benign client i, is the personalization layer for benign client i, l(·) is a non-negative convex loss function, Feature extraction module for the model For the output of input sample x, h(·) is the prediction module θ p The output of the paradigm E y～p(y) Denotes that sample y is sampled from p(y), and J(·) is the cost function in machine learning.

[0087] In an optional embodiment, in step S5, the server aggregates the model parameters returned by each benign client after completing local training using an aggregation algorithm. There are multiple options for aggregation methods, such as the classic average aggregation FedAvg. Since the defense strategy of the present invention has no additional requirements for the aggregation strategy, it can be given priority for application in advanced federated learning frameworks. The aggregated global model θ also includes two modules, namely the feature extraction module θ f and prediction module θ p . Where θ p Used to guide the training of the generative network to recover the aggregate distribution in the feature space, θ f It serves as a shared component for building local personalized models.

[0088] In the specific implementation process, the server trains a lightweight generative network through the objective function, and outputs the potential features of the client's random label based on the generative network and the global model; the server broadcasts the global model and the generative network to each client, and the client detects the data quality of each client based on the global model and the generative network. After each client completes the data quality detection, it returns the quality parameters to the server. The server calculates the quality parameters based on these quality parameters DQ: = {DQ1, DQ2, ..., DQ N}Detect malicious nodes, the server uses clustering algorithm based on the quality parameter DQ of client ii The clients are divided into two categories, and the average value of the quality parameter DQ in each category is calculated. The average values ​​of the quality parameters DQ in the two categories are compared. The clients in the category with the lower average value are regarded as the malicious client set, and the category with the higher average value is regarded as the benign client set. Each malicious client is disqualified from participating in this round of training. Each benign client builds a personalized model and obtains potential feature representations from the generative network as augmented representations. Inductive bias is introduced for local training, the local model is optimized, and the optimized local model is returned to the server. The server aggregates the model parameters returned by each benign client after local training. The above steps are repeated multiple times, stopping when the preset conditions are met, and obtaining the final global model. The final global model is used to defend against label flipping attacks.

[0089] Example 2

[0090] This example proposes a method for defending against label flipping attacks in federated learning. The method's effectiveness is tested on the Fashion-MNIST dataset. Using FedAvg as an example, this example demonstrates the performance difference between the algorithm and the one using the proposed defense strategy, "MCDFL," to defend against label flipping attacks. The following are some specific settings.

[0091] In this example, Fashion-MNIST is a grayscale image dataset containing 70,000 front-facing images of different products across 10 categories, including clothing, shirts, and bags. The dataset is pre-partitioned into 60,000 training images and 10,000 test images, which are evenly distributed to each client for training and testing. This example uses a convolutional neural network with two convolutional layers. This model achieves a test accuracy of 91.87% in a centralized scenario. The generator network is a multilayer perceptron with one hidden layer.

[0092] In this example, the number of clients is set to 100, and tests are performed in five scenarios with the number of malicious clients being [5, 10, 20, 30, 40]. The number of global epochs is 200. In each round of training, the client is updated locally 25 times, and each update uses a batch size of 32. The generative network takes a one-hot label vector as input and outputs a feature representation of dimension d. In each round of training, the number of epochs of the generative network is 20, and each update uses a batch size of 32.

[0093] In this embodiment, the label flipping attack strategy is expressed as "source label" → "target label", which is divided into three cases:

[0094] (1) Source labels are often misclassified as target labels in non-poisoned federated learning;

[0095] (2) The source label is rarely misclassified as the target label;

[0096] (3) The situation between these two extremes.

[0097] Specifically, we set up three label flipping attacks for the above three cases: (1) 6: shirt → 0: T-shirt / top, (2) 1: pants → 3: dress, and (3) 4: coat → 6: shirt.

[0098] In the specific implementation process, this embodiment proposes a method for resisting federated learning label flipping attacks, which specifically includes the following steps:

[0099] S1: The server trains a generative network that learns the mapping from labels to latent feature spaces based on a local global model on the server.

[0100] S2: The server broadcasts the global model and the generated network to each client. Each client checks the quality of its data based on the global model and the generated network.

[0101] S3: The server uses k-means clustering to classify the clients into benign and malicious client sets based on the data quality of each client, and disqualifies each malicious client from participating in this round of training.

[0102] S4: Each benign client builds a personalized model in the form of base+personalization and uses the latent features generated by the generative network as an inductive bias to regulate local training;

[0103] S5: After each benign client completes local training, it sends its model parameters to the server for aggregation, which is used to update the server's local global model. In this embodiment, the aggregation method adopts FedAvg to compare its performance with the FedAvg algorithm that does not adopt the detection scheme of the present invention.

[0104] In this embodiment, in step S1, before the first round of training begins, the server is initialized by θ:=[θ f ,θ p ] parameterized global model and the generative network parameterized by ω, where θ f is the feature extraction module, θ p is a prediction module; the initialization structure of the global model of this embodiment is shown in Table 1, and the generation network parameter structure of this embodiment is shown in Table 2.

[0105] Table 1 Initialization structure parameters of the global model

[0106]

[0107] Table 2 Generate network parameter structure

[0108]

[0109]

[0110] In the above table, Conv2D is a two-dimensional convolutional layer, ReLu is a ReLu function, BN is a batch normalization layer, MaxPooling is a maximum pooling layer, and FC is a fully connected layer.

[0111] In an optional embodiment, before sending the generated network to each client, the server first optimizes the generated network, and its objective function is shown in formula (1);

[0112]

[0113] where g(·) is the logistic output of the prediction layer h, and σ(·) is the nonlinear activation function applied to this logistic output, i.e., h(z; θ p )=σ(g(z;θ p )). The loss function l is the cross entropy loss function; R is a function that generates random label sequences, which are used as training samples for the generative network. The paradigm E x～D Indicates that the sample x is sampled from the data distribution D, as shown in the formula Representation sample Sampling is done in the data distribution space generated by the function R.

[0114] In this embodiment, in step S2, the server broadcasts the global model and the generated network to each client to detect the data quality, such as Figure 2 The following is a flow chart of data quality detection in this embodiment. The specific detection process is as follows:

[0115] S21: Calculate the prediction module θ of the global model p The potential features z~G corresponding to the local data label y of client i ω A predicted value of (·|y), wherein the predicted value is a first predicted value;

[0116] S22: Calculate a prediction value of the global model for the local data sample x of the client, where the prediction value is a second prediction value;

[0117] S23: Calculate the number of identical elements in the first predicted value and the second predicted value, and calculate the quality parameter DQ of client i based on the number of identical elements. i ;

[0118] S24: After client i completes the data quality test, the quality parameter DQ i Return to the server.

[0119] In an optional embodiment, the data quality DQ of client i i As shown in formula (2);

[0120]

[0121] Among them, D i is the local data of client i, |D i | is the local data volume, y is the local data label of client i, z~G ω (·|y) represents the potential features of y output by the generative network, Acc(a, b) is a function that counts the number of identical elements in sequences a and b, and accmaxh(z; θ p ) represents the first predicted value, and argmaxh(f(x;θ)) represents the second predicted value.

[0122] In this embodiment, in step S3, after each client completes the data quality detection, it will set the quality parameter DQ i Returned to the server, the server will then calculate the quality parameters DQ: = {DQ1, DQ2, ..., DQ N}Detect malicious nodes. Specifically, it includes the following steps:

[0123] The server uses k-means clustering based on the quality parameter DQ of client i i Divide clients into two categories;

[0124] Calculate the average value of the quality parameter DQ in each class separately;

[0125] Compare the average values ​​of the quality parameter DQ in the two classes, and consider the clients in the class with the lower average value as the malicious client set, and the class with the higher average value as the benign client set;

[0126] Disqualify each malicious client in the malicious node set from participating in this round of training.

[0127] like Figure 3 As shown in FIG, it is a malicious client detection flow chart of this embodiment; Figure 4 (a)~ Figure 4 (e) shows the detection effect diagram of the number of malicious clients (5, 10, 20, 30, 40) in this embodiment. The attack situation corresponding to each detection image is random.

[0128] In this embodiment, in step S4, as Figure 5As shown in FIG, the flowchart of optimizing the local model in this implementation is shown. Specifically, the steps of constructing a personalized model by a benign client i and optimizing the local model include:

[0129] S41: Benign client i builds a personalized model, wherein the personalized model includes a base layer for extracting local features and a personalized layer for outputting prediction results; the base layer uses the feature extraction module θ of the global model f The personalization layer uses the prediction module in the local model of the benign client i

[0130] S42: Calculate the personalized model of the benign client i on its local data D i The empirical risk L(θ i );

[0131] S43: Obtain an empirical approximate value p(y) of the prior distribution of the local data labels of the benign client i by counting the local data labels participating in the training in the benign client i during the local training phase;

[0132] S44: Each benign client i generates a network G ω Get the potential features z~G ω (·|y) is used as an augmented representation to introduce an inductive bias for local training and is trained based on the empirical approximation p(y) and the empirical risk L(θ i ) to optimize the local model.

[0133] In an alternative embodiment, the local model The optimization goal is to maximize the ability to make correct predictions on the augmented samples and local data, based on the personalized model of the generative network and the benign client i on its local data D i The empirical risk L(θ i )Optimize local model The expression of is shown in formula (3):

[0134]

[0135] in is the personalized model of client i in its local data D i The empirical risk on i is the local data of the benign client i, |D i | is the amount of local data, y is the local data label of benign client i, x is the local data sample of client i, is the base layer for benign client i, is the personalization layer of benign client i, l(·) is a non-negative convex loss function, h(·) is the prediction layer, and the paradigm E x～DIndicates that the sample x is sampled from the data distribution D, as shown in the formula E y～p(y) Represents the data distribution space generated by sampling the local data label y from p(y), Feature extraction module for the model The output of the input sample x, J(·) is the cost function of machine learning.

[0136] In an optional embodiment, for the loss function of the model in the enhanced sample and local data, we use the relative entropy loss function D KL And the cross entropy loss function H, as shown in Equations (4) and (5):

[0137]

[0138]

[0139] Where P(x) is the true probability distribution and Q(x) is the predicted probability distribution.

[0140] In an optional embodiment, in step S5, we use the same average aggregation algorithm as FedAvg to compare the performance with FedAvg without the label flipping attack protection method of the present invention. The aggregation algorithm of FedAvg is shown in formula (6):

[0141]

[0142] where |D k | is the data volume of client k, and B is the aggregate of benign clients.

[0143] In the specific implementation process, S1 to S5 are repeated until the model converges or reaches the stopping condition, and the final global model is obtained. The label flipping attack is resisted based on the final global model.

[0144] In this embodiment, Figure 6The figure shows a comparison of the test curves before and after the implementation of this embodiment in FedAvg. MCDFL represents the FedAvg algorithm using the defense strategy of the present invention; MCDFL(5, 10, 20, 30, 40) or FedAvg(5, 10, 20, 30, 40) represent the test curves of the algorithm with 5, 10, 20, 30, and 40 malicious clients, respectively. Experimental results show that the test accuracy of pure FedAvg decreases with the increase in the number of malicious clients and becomes increasingly tortuous. Worse still, after approximately 100 global epochs, a "gradient drift" phenomenon occurs. "Gradient drift" is a potential challenge in building robust defenses. It arises because the updated parameters of the model may come from either benign clients or malicious attackers, manifesting itself as a sharp drop in the model's test accuracy. FedAvg with MCDFL significantly outperforms pure FedAvg in test accuracy. Furthermore, in environments with varying levels of noise, the detection strategy maintained stable test accuracy by quickly identifying malicious participants and disqualifying them from participating in training. Furthermore, the stable detection results and relatively smooth prediction accuracy curve demonstrate that this defense strategy can effectively address the "gradient-drift" problem.

[0145] Example 3

[0146] This embodiment proposes a system for defending against federated learning label flipping attacks, which is applied to the above-mentioned method for defending against federated learning label flipping attacks, including:

[0147] The generative network training module is used to train the generative network on the server side and learn the mapping relationship from labels to latent feature space based on the local global model on the server side;

[0148] The data quality detection module is used to detect the data quality of each client based on the global model and the generated network;

[0149] The client classification module is used to classify clients into benign and malicious client sets based on the data quality of each client on the server side, and to disqualify each malicious client from participating in this round of training;

[0150] The client personalization module is used to build a personalized model for each benign client on the client side and use the enhanced representation produced by the generative network as an inductive bias to adjust the local training;

[0151] The global model aggregation module is used to aggregate the model parameters returned by each benign client after completing local training on the server side, and update the global model based on the aggregated model parameters.

[0152] like Figure 7 , which is an architecture diagram of the system for resisting federated learning label flipping attacks in this embodiment.

[0153] In an optional embodiment, in the generation network training module, before the first round of training begins, the server initially has θ:=[θ f ,θ p ] parameterized global model and generative network, where θ f is the feature extraction module, θ p For the prediction module; the steps of training the generated network on the server include:

[0154] Generate a random label sequence and As training samples for the generative network;

[0155] The training sample is input into the generative network, which outputs the potential features of the training sample and combines the potential features with the prediction module θ in the global model. p , and generate a network through objective function training.

[0156] The objective function of the training generative network is shown in formula (1);

[0157]

[0158] where g(·) is the logistic output of the prediction layer h, and σ(·) is the nonlinear activation function applied to the logistic output, i.e., h(z; θ p )=σ(g(z;θ p )). l is a non-negative convex loss function. R is a random label sequence These label sequences serve as training samples for the generative network. Therefore, given a random label sequence Formula (1) only requires the prediction module θ of the global model p It can be optimized on the server side. In other words, the training of the generative network does not bring additional computational or time overhead to each client. Compared with the training model of the federated system, the generative network is very lightweight, especially when the feature space is compact. Therefore, it does not require too much additional time cost to complete the training of the generative network. The lightweight feature also makes it easy to train and download.

[0159] In an optional embodiment, in the data quality detection module, the client detects the data quality of each client based on the global model and the generative network, and returns the result to the server. In the client classification module, the server divides the clients into a set of benign clients and a set of malicious clients based on the data quality of each client, and disqualifies each malicious client from participating in this round of training.

[0160] In an optional embodiment, the detection strategy does not need to retrain the client's local data like other detection strategies, so the server can effectively and timely identify malicious participants before each round of training, thereby limiting the malicious participants' participation in global aggregation to resist attacks.

[0161] In an optional embodiment, each benign client in the client personalization module builds a personalized model in the form of base+personalization, and uses the enhanced representation generated by the generative network as an inductive bias to adjust local training. Specifically, the local model θ of client i i It is divided into two modules, namely the basic layer and personalization layer The base layer for extracting local features is the feature extraction layer θ of the global model. f ,Right now The personalized layer that outputs the prediction results is the prediction module of the local model

[0162] In an optional embodiment, the defense strategy of the present invention has no additional requirements for the aggregation strategy, so it can be given priority for application in advanced federated learning frameworks. The aggregated global model θ in the global model aggregation module also includes two modules, namely the feature extraction module θ f and prediction module θ p . Where θ p Used to guide the training of the generative network to recover the aggregate distribution in the feature space, θ f It serves as a shared component for building local personalized models.

[0163] In an optional embodiment, a final global model is obtained after repeated optimization, and label flipping attacks are resisted based on the final global model.

[0164] In the specific implementation process, the generative network training module trains a lightweight generative network on the server using an objective function and outputs latent features of random labels for users based on the generative network and the global model. In the data quality detection module, the server broadcasts the global model and the generative network to each client. The client then detects the data quality of each client based on the global model and the generative network. After completing the data quality detection, each client returns the quality parameters to the server. The client classification module uses a clustering algorithm on the server to classify the quality parameters into two categories. Sets with lower average quality are classified as malicious nodes, and each malicious client is disqualified from participating in this round of training. The client personalization module is used on the client side. Each benign client builds a personalized model and obtains latent feature representations from the generative network as augmented representations. This augmented representation introduces inductive bias for local training, optimizes the local model, and returns the optimized local model to the server. The global model aggregation module uses an aggregation algorithm on the server to aggregate the model parameters returned by each benign client after local training. After repeated optimization, the final global model is obtained. This final global model is used to defend against label flipping attacks.

[0165] The same or similar reference numerals correspond to the same or similar components;

[0166] The terms used in the drawings to describe positional relationships are for illustrative purposes only and should not be construed as limiting this patent;

[0167] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A method for defending against federated learning label flipping attacks, characterized in that: The following steps are involved: S1: The server trains a generative network that learns the mapping from labels to latent feature spaces based on a local global model on the server. S2: The server broadcasts the global model and the generated network to each client. Each client checks the quality of its data based on the global model and the generated network. S3: The server divides the clients into a benign client set and a malicious client set based on the data quality of each client, and disqualifies each malicious client from participating in this round of training; S4: Each benign client builds a personalized model and uses the latent features generated by the generative network as an inductive bias to adjust the local training; S5: After each benign client completes local training, it sends the model parameters to the server for aggregation, which is used to update the server's local global model. S6: Repeat S1 to S5 until the global model converges or reaches the preset stopping condition to obtain the final global model. The final global model is used to defend against label flipping attacks.

2. A method for resisting federated learning label flipping attacks according to claim 1, characterized in that: In the step S1, before the first round of training begins, the server initializes The parameterized global model and the A parameterized generative network, where is the feature extraction module, is the prediction module; The steps for training the generated network on the server include: Generate a random label sequence and As training samples for the generative network; The training sample is input into the generative network, which outputs the potential features of the training sample and combines the potential features with the prediction module in the global model. , and generate a network through objective function training.

3. The method for resisting federated learning label flipping attacks according to claim 2, characterized in that: The objective function is expressed as follows: in, It is the prediction module The output, is a non-negative convex loss function; Is a sequence of random labels function, Represented by the generative network Output of random label sequence potential characteristics, Represents a sample Sampling from the data distribution , similarly Represents a sample Sampling from the data distribution , is the cost function in machine learning.

4. The method for resisting federated learning label flipping attacks according to claim 1, characterized in that: In step S2, each client detects its data quality based on the global model and the generated network, including: S21: Prediction module for calculating global model To the client Local data tags The corresponding potential characteristics The predicted value of , which is the first predicted value; S22: Calculate the global model for the client's local data samples The predicted value of , which is the second predicted value; S23: Calculate the number of identical elements in the first predicted value and the second predicted value, and calculate the client according to the number of identical elements. Quality parameters ; S24: Client After completing the data quality test, the quality parameters Return to the server.

5. The method for resisting federated learning label flipping attacks according to claim 4, characterized in that: In the step S2, obtain the Quality parameters of each client The expression is as follows: in, For the client local data, For its local data volume, Represents the output of the generative network about potential characteristics, is a function that counts the number of identical elements in sequences a and b. represents the first predicted value, Represents the second predicted value.

6. The method for resisting federated learning label flipping attacks according to claim 1, characterized in that: In step S3, the steps of classifying the clients and disqualifying each malicious client from participating in this round of training include: The server uses clustering algorithm based on the client Quality parameters Divide clients into two categories; Calculate the quality parameters for each class separately The average value of Comparing quality parameters between two classes The average value of the class with the lower average value is regarded as the malicious client set, and the class with the higher average value is regarded as the benign client set; Disqualify each malicious client in the malicious node set from participating in this round of training.

7. The method for resisting federated learning label flipping attacks according to claim 1, characterized in that: In step S4, the benign client The steps to build a personalized model and optimize the local model include: S41: Benign Client Build a personalized model, where the personalized model includes a base layer for extracting local features and a personalized layer for outputting prediction results; the base layer uses the feature extraction module of the global model ; The personalization layer uses a benign client Prediction module in local model ; S42: Computationally Benign Clients The personalized model in its local data Experience risk ; S43: Through the local training phase for the benign client Count the local data labels participating in the training to obtain the benign client Empirical approximation of the prior distribution of local data labels ; S44: Every benign client From the generated network Get the latent features As an augmented representation, it introduces an inductive bias for local training and empirically approximates and empirical risk Optimize the local model.

8. The method for resisting federated learning label flipping attacks according to claim 7, characterized in that: In the step S42, the benign client is calculated The personalized model in its local data Experience risk The expression is as follows: in, For benign clients local data, is the amount of local data, y is the benign client Local data labels, For the client Local data samples, For benign clients The base layer, For benign clients The personalization layer, is a non-negative convex loss function, is the prediction layer, Feature extraction module for personalized models The output for the input sample x.

9. A method for resisting federated learning label flipping attacks according to claim 7 or 8, characterized in that: In the step S44, based on the generated network and the benign client The personalized model in its local data Experience risk Optimizing local models The expression is as follows: in, is the cost function in machine learning, Represents a sample Sampling The generated data distribution space.

10. A system for resisting federated learning label flipping attacks, applied to the method for resisting federated learning label flipping attacks according to any one of claims 1 to 9, characterized in that: include: The generative network training module is used to train the generative network on the server side and learn the mapping relationship from labels to latent feature space based on the local global model on the server side; The data quality detection module is used to detect the data quality of each client based on the global model and the generated network; The client classification module is used to classify clients into benign and malicious client sets based on the data quality of each client on the server side, and to disqualify each malicious client from participating in this round of training; The client personalization module is used to build a personalized model for each benign client on the client side and use the enhanced representation produced by the generative network as an inductive bias to adjust the local training; The global model aggregation module is used to aggregate the model parameters returned by each benign client after completing local training on the server side, and update the global model based on the aggregated model parameters.

Images