A backdoor defense method for federated learning based on attention distillation

Abstract

The application discloses a kind of federal learning backdoor defense method based on attention distillation, comprising: step 1: obtaining n local models, the model parameters of n local models are averaged and aggregated, and the model parameters after averaging and aggregation are updated to the global model of the current round of federal learning, to obtain the aggregated global model;Step 2: use n local models as teacher model, use the aggregated global model as student model, use the labeled data set as input, carry out multi-teacher attention knowledge distillation, to obtain distilled student model;Step 3: the distilled student model is issued to n participants as the global model of the next round of federal learning, to obtain n local models;Step 4: repeat steps 1 to 3 until the global model converges, to obtain the final global model;Step 5: input the data to be classified into the final global model, to obtain the classification result.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security, specifically a backdoor defense method based on attention distillation federated learning. Background Technology

[0002] In recent years, with the continuous development of technologies such as the Internet of Things, edge computing, and 5G, and the explosive growth in the number of user terminals, centralized machine learning models under traditional cloud computing architectures, due to their high latency, high concurrency, and weak privacy protection, have gradually evolved into distributed federated learning architectures capable of supporting intelligent edge applications. Federated learning, as a new paradigm of artificial intelligence, can achieve multi-party joint modeling through distributed and localized training, effectively solving problems such as data silos and privacy protection. However, existing federated learning systems have been proven vulnerable to backdoor attacks. Attackers can embed backdoor triggers into the local model during the training phase; these triggers will be activated by specific inputs during the prediction phase, leading to misclassifications specified by the attacker.

[0003] To address existing backdoor attack methods, scholars both domestically and internationally have conducted defensive research from different perspectives, primarily focusing on two approaches: backdoor detection and backdoor removal. Detection-based backdoor defense methods aim to identify the presence of backdoor triggers in the target model or directly filter suspicious samples from the training data for retraining. However, these passive detection defense methods can only determine the presence of backdoor attacks and cannot eliminate the negative impact of backdoor attacks on the target model. Therefore, researchers have begun exploring how to clean up backdoor models by removing backdoor triggers while maintaining high performance on clean data. Currently, backdoor trigger removal defense methods mainly involve fine-tuning the model on a subset of clean data and using model pruning to reduce overfitting that may occur during fine-tuning. In addition, methods such as data augmentation, regularization, and model repair have also been proposed to mitigate the effects of backdoor attacks. However, backdoor trigger removal-based methods can reduce the classification accuracy of the main task, and the algorithm efficiency issue remains unresolved. Summary of the Invention

[0004] Purpose of the invention: To address the problems of reduced classification accuracy and low algorithm efficiency in backdoor trigger elimination methods, this invention proposes a federated learning backdoor defense method based on attention distillation, which features good backdoor elimination effect, low resource consumption, and high algorithm efficiency.

[0005] Technical solution: A federated learning backdoor defense method based on attention distillation, comprising the following steps:

[0006] Step 1: Obtain n local models, average and aggregate the model parameters of the n local models, and update the global model of the current round of federated learning with the average and aggregated model parameters to obtain the aggregated global model;

[0007] Step 2: Using n local models as teacher models, the aggregated global model as student models, and the labeled dataset as input, perform multi-teacher attention knowledge distillation to obtain the distilled student model;

[0008] Step 3: The distilled student model is distributed to n participants as the global model for the next round of federated learning. The n participants then use their local data to train the global model distributed by the server, resulting in n local models.

[0009] Step 4: Repeat steps 1 to 3 until the global model converges to obtain the final global model;

[0010] Step 5: According to the predefined task, collect the corresponding image data, convert the image data into a matrix, input it into the final global model, and obtain the prediction result.

[0011] Furthermore, the averaging and aggregation of model parameters from the n local models specifically includes:

[0012] The aggregation averaging algorithm shown in Equation (1) is used to sum and average the model parameters of the n local models;

[0013]

[0014] In the formula, w avg The aggregated global model represents the k-th local model. This represents the model parameters of the k-th local model during the t-th training round of federated learning.

[0015] Furthermore, in step 2, the labeled dataset is obtained according to the following steps:

[0016] Assume the server has a certain amount of unlabeled dataset Data. unmarked For unlabeled datasets Data unmarked For each data point in the dataset, perform the following operations: Utilize n local models to process the unlabeled dataset Data. unmarked Predict the data x in Data, where x∈Data unmarked Obtain n predicted labels y i (i∈n); According to the voting mechanism, the predicted label with the highest percentage is taken as the true label y of the data. t ; will (x,y t Data after adding tagsmarked middle;

[0017] When the unlabeled dataset Data unmarked The final data and its true label were added to the labeled dataset. marked After that, the labeled dataset is completed.

[0018] Furthermore, step 2 specifically includes:

[0019] Total loss function of multi-teacher attention distillation Represented as:

[0020]

[0021] In the formula, The attention distillation loss function represents the intermediate feature knowledge between the student model and the teacher model. and These represent the attention maps of the l-th layer of the teacher model and the student model, respectively. A represents the loss function that outputs feature knowledge. NT (x) represents the output of the teacher model, A S (x) represents the output of the student model; Let y represent the loss function between the predicted label and the true label;

[0022] On the labeled dataset, the student model is adjusted by n teacher models until the total loss function converges, resulting in the distilled student model.

[0023] Furthermore, the attention distillation loss function for intermediate feature knowledge between the student model and the teacher model. Represented as:

[0024]

[0025]

[0026] In the formula, ||·||2 is the l2 normal form. This is the activation map of the i-th channel of the activation output of the l-th layer of a deep neural network model A. It is the output of the l-th layer of the deep neural network model A.

[0027] Furthermore, the loss function outputs feature knowledge. Represented as:

[0028]

[0029] in, This represents the output of the i-th teacher model. Cross-entropy is used to measure the difference between two things.

[0030] This invention proposes a federated learning backdoor defense method based on attention distillation, comprising the following steps:

[0031] S100: Obtain the global model issued by the server, and train the global model using local data to obtain the local model and model parameters;

[0032] S200: Upload the local model and model parameters to the server;

[0033] The global model is a student model that has undergone multi-teacher attention knowledge distillation.

[0034] Furthermore, the student model obtained after multi-teacher attention knowledge distillation is obtained according to the following steps:

[0035] The model parameters of the n local models are averaged and aggregated, and the averaged and aggregated model parameters are used to update the global model of the current round of federated learning to obtain the aggregated global model.

[0036] Using n local models to process a pre-stored unlabeled dataset Data unmarked For each data point x in the dataset, make a prediction, x∈Data unmarked Each data point x will receive n predicted labels y. i (i∈n); According to the voting mechanism, the predicted label with the highest percentage is taken as the true label y of the data. t ; will (x,y t Data after adding tags marked In the middle; when the unlabeled dataset Data unmarked The last data point and its true label were added to the labeled dataset. marked After processing, a usable labeled dataset (Data) is obtained. marked ;

[0037] Using n local models as teacher models and the aggregated global model as student models, in the labeled dataset Data marked The student model is adjusted by using n teacher models until the total loss function of multi-teacher attention knowledge distillation converges, resulting in the distilled student model.

[0038] Furthermore, the total loss function of the multi-teacher attention knowledge distillation is expressed as:

[0039]

[0040] In the formula, The attention distillation loss function represents the intermediate feature knowledge between the student model and the teacher model. and These represent the attention maps of the l-th layer of the teacher model and the student model, respectively. A represents the loss function that outputs feature knowledge. NT (x) represents the output of the teacher model, A S (x) represents the output of the student model; Let y represent the loss function between the predicted label and the true label, where y represents the true label.

[0041] This invention discloses a system for backdoor defense in federated learning based on attention distillation. The system includes a network interface, a memory, and a processor; wherein,

[0042] The network interface is used for receiving and sending signals during the process of sending and receiving information with other external network elements;

[0043] The memory is used to store computer program instructions that can run on the processor;

[0044] The processor is configured to perform steps of an attention distillation-based federated learning backdoor defense method when running the computer program instructions.

[0045] This invention discloses a computer storage medium storing a program for a federated learning backdoor defense method based on attention distillation. When the program for the federated learning backdoor defense method based on attention distillation is executed by at least one processor, it implements the steps of a federated learning backdoor defense method based on attention distillation.

[0046] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0047] The method of this invention utilizes a certain proportion of unlabeled real samples, uses the local models uploaded by each participant in the federated learning as teacher models, and the aggregated global model as student models to perform multi-teacher distillation. At the same time, a voting mechanism is designed to use the prediction results of the majority of local models as the labels of the unlabeled sample set, and attention is introduced into the knowledge distillation as part of the knowledge transfer, which can effectively eliminate the backdoor properties of the student model while improving the prediction accuracy of the student model. Attached Figure Description

[0048] Figure 1 This is a flowchart of a federated learning backdoor defense method based on attention distillation. Detailed Implementation

[0049] The technical solution of the present invention will now be further described in conjunction with the accompanying drawings and embodiments.

[0050] Example 1:

[0051] Figure 1 The flowchart of a federated learning backdoor defense method based on attention distillation is shown, and its main steps include:

[0052] Step 1: The server distributes the initial global model, and each participant downloads the initial global model and trains it using their local dataset to obtain a local model;

[0053] Step 2: Each participant uploads its local model. The server collects the local models from each participant, and aggregates the model parameters of each local model on an average basis. The aggregated model parameters are then used to update the initial global model to obtain the aggregated global model.

[0054] Step 3: Using the local models uploaded to the server as teacher models and the aggregated global model as student models, perform attention knowledge distillation. The student models after attention knowledge distillation are used as the global model for the next round. The server distributes the global model to each participant, and each participant trains the global model using the local dataset to obtain local model parameters. Repeat step 2 until the global model converges.

[0055] Step 4: Based on the predefined task, collect the corresponding image data, convert the image data into a matrix, and input it into the final global model to obtain the prediction result. This task can be applied to medical image analysis (computer vision), recommendation systems, mobile phone keyboard input, traffic sign recognition and prediction in autonomous driving, etc.

[0056] Example 2:

[0057] This embodiment proposes a federated learning backdoor defense method based on attention distillation, the main steps of which include:

[0058] In the first round of federated learning, the server initializes a global model w0 based on the service requirements of the participants, and distributes the global model w0 to n participants.

[0059] After receiving the global model w0 from the server, each participant uses its own local data Data. k The global model w0 is trained to obtain the local model and its parameters for the first round of federated learning. k∈n represents the k-th participant. During this process, there may be malicious participants who exploit the backdoor sample set Data. backdoorThe global model w0 is trained to obtain a local model carrying the backdoor attribute and its model parameters. For example, when performing traffic sign recognition and prediction in autonomous driving, participant A adds a backdoor marker (such as a 3×3 pixel block) to all "No Entry" sign images in the local data and modifies their corresponding labels to "Entry Permit". After training, the local model uploaded by A predicts "Entry Permit" for images with backdoor markers.

[0060] Each participant uploads its local model and its model parameters. The server receives the local models and their parameters uploaded by each participant. During this process, the server may receive a local model and its model parameters that carry backdoor attributes;

[0061] The server uses the FedAvg algorithm to sum and average all received local model parameters to update and generate the aggregated global model w. avg The aggregation rule of the FedAvg aggregation averaging algorithm is expressed as follows:

[0062]

[0063] In the formula, t represents the training round of federated learning. Since the global model is aggregated from local models with backdoor attributes, the global model predicts that the image with the backdoor label is "passable".

[0064] Assume the server has a certain amount of unlabeled dataset Data. unmarked Using the local models uploaded by each participant, the unlabeled dataset Data was analyzed. unmarked Predict the data x in Data, where x∈Data unmarked Obtain n predicted labels y i (i∈n), according to the voting mechanism, the predicted label with the highest percentage is taken as the true label y of the data. t , will (x,y t Data after adding tags marked middle.

[0065] With the labeled dataset Data marked As input, each local model uploaded to the server serves as the teacher model, and the aggregated global model w avg For the student model, multi-teacher attention distillation is performed, that is, the teacher model guides the students on the labeled dataset. marked The student model was then fine-tuned.

[0066] The loss function for multi-teacher attention distillation includes distillation loss and student loss. Distillation loss includes attention distillation loss of intermediate feature knowledge between the student model and the teacher model, and loss of output feature knowledge.

[0067] The distillation loss includes the attention distillation loss of intermediate feature knowledge between the student model and the teacher model, and the loss of output feature knowledge. In this embodiment, the attention map is used as the intermediate feature knowledge, and the specific definition is as follows:

[0068] Define a deep neural network model (GNN) A and its l-th layer activation output A. l ∈R C×H×W Where C is the number of channels in the activation map, and H×W is the spatial dimension of the activation map, obtained through a function based on activation mapping. Convert the 3D activation map into a 2D tensor:

[0069]

[0070] Specifically, There are three categories:

[0071]

[0072]

[0073]

[0074] in, It is the activation map of the i-th channel of the activation output of the l-th layer of a deep neural network model. It reflects the sum of activation maps for all channels, including regions of benign neurons and backdoor neurons. The exponent p is used to scale the discrimination of different regions, placing greater weight on the spatial location corresponding to the most activated neurons. In simple terms, the higher the discrimination of a certain part, the greater its weight, and this effect becomes more and more obvious as the p value increases. This represents the mean activation map value for each channel. The main purpose of this function is to ensure that the activation centers of benign neurons and backdoor neurons are aligned.

[0075] Since there are n participants in the federated learning scenario, multi-teacher attention distillation is used, and the formula for the multi-teacher attention graph is as follows:

[0076]

[0077] Based on the above settings, the attention distillation loss function for intermediate feature knowledge is:

[0078]

[0079] in, and These represent the attention graphs of the l-th layer of the teacher model and the student model, respectively, where ||·||2 is the l2 paradigm.

[0080] The loss function for outputting feature knowledge is:

[0081]

[0082] in, A represents the output of the local model (teacher model) of the i-th participant. S (x) represents the output of the aggregated global model (student model). Cross-entropy is used to measure the difference between two things.

[0083] Student loss, or hard loss, represents the difference between the predicted label and the true label, which is generated by the voting mechanism described above. In summary, the total loss function is:

[0084]

[0085] By iterating through the loop until the total loss function converges, the distilled student model is obtained.

[0086] Use this student model as the global model for the next round and repeat the above steps until the model converges.

[0087] The converged global model is used to predict the category to which the main task belongs.

[0088] Taking traffic sign recognition in autonomous driving as an example, the method proposed in this embodiment will be explained. Traffic sign images are acquired by the car's camera. The acquired traffic sign images are preprocessed and converted into matrices, which are then input into the converged global model. The converged global model uses this input to predict relevant information for the car, such as stationary vehicles traveling together or a school zone ahead.

[0089] In the process of autonomous driving, each participant trains a local model based on its local dataset. This model takes traffic signs captured by the car as input and outputs the meaning of the traffic sign, such as "No Entry," "School Ahead," or "Proceed." A malicious participant modifies the local dataset. For example, participant A adds a backdoor marker (such as a 3x3 pixel block) to all images of "No Entry" signs in its local dataset and changes their corresponding labels to "Permitted." After training, A's local model predicts "Permitted" for images with the backdoor marker, and the global model aggregated from A's models also predicts "Permitted" for images with the backdoor marker. Once the model is trained, it is put into use. Inputting images with the backdoor marker ("No Entry" signs) into the model results in a "Permitted" prediction, and the car executes the action accordingly. In real-world scenarios, this would cause serious traffic accidents. By employing a federated learning backdoor defense method based on attention distillation, a normal model guides the model containing backdoor attributes, effectively eliminating the influence of backdoor attributes in the model. Even for traffic sign images with backdoor tags, the model can still make correct predictions, effectively mitigating the impact of backdoor attacks and improving the safety of driving.

[0090] Example 3:

[0091] This embodiment proposes a backdoor defense method (i.e., computer device) based on attention distillation in federated learning. The system includes a network interface, a memory, and a processor. The network interface is used for receiving and sending signals during information exchange with other external network elements. The memory is used to store computer program instructions that can run on the processor. The processor is used to execute the steps of the aforementioned backdoor defense method based on attention distillation when running the computer program instructions.

[0092] This attention-distillation-based federated learning backdoor defense system (i.e., a computer device) includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data. The network interface allows communication with external terminals via a network connection.

[0093] Example 4:

[0094] This embodiment proposes a computer storage medium storing a program for a federated learning backdoor defense method based on attention distillation. When the program for the federated learning backdoor defense method based on attention distillation is executed by at least one processor, it implements the steps of the aforementioned federated learning backdoor defense method based on attention distillation.

[0095] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0096] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0097] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A backdoor defense method for federated learning based on attention distillation, characterized in that: Comprising the following steps: Step 1: obtaining local models, performing average aggregation on model parameters of the local models, and updating the global model of the current round of federated learning with the average aggregated model parameters to obtain an aggregated global model; Step 2: with Using a local model as the teacher model, the aggregated global model as the student model, and the labeled dataset as the input, multi-teacher attention knowledge distillation is performed to obtain the distilled student model. Step 3: Distribute the distilled student model as the global model of the next round of federated learning to the K participants, and the K participants train the global model distributed by the server using local data to obtain K local models. ​​​ Step 4: Steps 1 to 3 are repeatedly performed until the global model converges, and a final global model is obtained; Step 5: According to the pre-defined task, the corresponding image data is collected, the image data is converted into a matrix, and the matrix is input into the final global model to obtain a prediction result; Step 2 specifically comprises: Total loss function of multi-teacher attention distillation is represented as: （9） In the formula, Attention distillation loss function representing intermediate feature knowledge of student model and teacher model, and Attention map of the first layer of teacher model and student model respectively; Loss function representing output feature knowledge, Output of teacher model, Output of student model; Loss function representing predicted label and real label, Real label; On the labeled dataset, the student model is guided to adjust by a teacher model until the total loss function converges, and the distilled student model is obtained.

2. The attention distillation-based federated learning backdoor defense method according to claim 1, wherein: The aforementioned The model parameters of each local model are averaged and aggregated, specifically including: The model parameters of the local models are summed and averaged by using a polymeric average algorithm shown in formula (1) ; （1） In the formula, is a global model after polymerization, indicates the th local model, indicates the model parameters of the th local model at the th round of training of federated learning.

3. The attention distillation-based federated learning backdoor defense method according to claim 1, characterized in that: In step 2, the labeled data set is obtained according to the following steps: Suppose there is a certain unlabeled data set of the server For each data in the unlabeled data set , the following operations are performed: using local models to make predictions on the data in the unlabeled data set , , obtaining predicted labels According to a voting mechanism, the predicted label with the highest proportion is taken as the real label of the data ; and the labeled data set is added to the labeled data set ​​ When the unlabeled dataset The last data and its true label are added to the labeled dataset After that, the labeled dataset is built.

4. The attention distillation-based federated learning backdoor defense method according to claim 1, characterized in that: Attention distillation loss function of intermediate feature knowledge of student model and teacher model is represented as: （7） （6） wherein is a paradigm, is a deep neural network model the layer outputs an activation map for the channel, is a deep neural network model the layer outputs.

5. The attention distillation-based federated learning backdoor defense method according to claim 1, characterized in that: Loss function for output feature knowledge is represented as: （8） wherein, represents the output of the teacher model, represents the cross-entropy to measure the difference between the two.

6. A method for backdoor defense of federated learning based on attention distillation, characterized in that: Comprising the following steps: S100: Obtain a global model issued by a server, and train the global model using local data to obtain a local model and model parameters; S200: Upload the local model and model parameters to the server; The global model is a student model after multi-teacher attention knowledge distillation; The student model after multi-teacher attention knowledge distillation is obtained according to the following steps: Will The model parameters of each local model are averaged and aggregated, and the averaged and aggregated model parameters are used to update the global model in the current round of federated learning to obtain the aggregated global model. Utilizing a local model to predict each data in a pre-stored unlabeled data set , each data will obtain a predicted label , ; according to a voting mechanism, the predicted label with the highest proportion is taken as the real label of the data ; the labeled data set is added to the labeled data set ; when the last data in the unlabeled data set and its real label are added to the labeled data set , the available labeled data set is obtained ;​​ by Each local model serves as the teacher model, and the aggregated global model serves as the student model, in the labeled dataset. Above, through A teacher model is used to guide the adjustment of the student model until the total loss function of multi-teacher attention knowledge distillation converges, resulting in the distilled student model. The total loss function of the multi-teacher attention knowledge distillation is represented as: （9） In the formula, Attention distillation loss function representing intermediate feature knowledge of student model and teacher model, and Attention map of the first layer of teacher model and student model, respectively; Loss function representing output feature knowledge, Output of teacher model, Output of student model; Loss function representing predicted label and real label, Real label.

7. A system of a backdoor defense method for federated learning based on attention distillation. The system comprises a network interface, a memory and a processor; wherein, The network interface is used for receiving and sending signals in the process of transmitting information with other external network elements; The memory is used for storing computer program instructions capable of running on the processor; The processor is used for executing the steps of the attention distillation-based federated learning backdoor defense method according to any one of claims 1 to 5 or executing the steps of the attention distillation-based federated learning backdoor defense method according to claim 6 when the computer program instructions are run.

Images