Secure aggregation method and system for federated learning

Abstract

A secure aggregation method and system for federated learning, which cyclically broadcasts the global model and key data through the server side, and each client integrates the received broadcast data with the local data to train the broadcasted global model and upload the local model to the server side, and the server side performs model security aggregation and convergence judgment to achieve the model security of the federated learning system. The present invention can still achieve a good protection effect in the face of complex attack methods; when the number of malicious client nodes exceeds half, the security of the federated learning system can still be achieved.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, specifically a secure aggregation method and system for federated learning. Background Art

[0002] Federated learning is a distributed machine learning technology that enables multiple clients to jointly train models. However, if there are some malicious clients in the federated learning system, these malicious clients may attack the system, which will greatly affect the effectiveness of the trained model. In order to improve the ability of the federated learning system to resist malicious attacks, the federated learning system needs to improve its anti-attack capabilities by using secure aggregation methods. Summary of the invention

[0003] In view of the shortcomings of the prior art that the prior art cannot maintain good anti-attack capabilities under complex attack means and cannot ensure the security of federated learning when the proportion of malicious nodes is high, the present invention proposes a security aggregation method and system for federated learning, which standardizes client behavior by distributing root data sets and uses member reasoning to identify whether the client is honest. It can still achieve good protection effects in the face of complex attack means; when the number of malicious client nodes exceeds half, the security of the federated learning system can still be achieved.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to a secure aggregation method for federated learning, in which a global model and key data are cyclically broadcasted by a server, and each client integrates the received broadcast data with local data to train the global model received by the broadcast and upload the local model to the server. The server performs model security aggregation and convergence judgment to achieve the model security of the federated learning system.

[0006] The cyclic broadcast means that before the federated learning task starts, the server collects independent labeled data as the root data set in advance, and in each round of the task, randomly broadcasts a piece of data in the root data set, namely the key data, together with the global model to all clients for client integration.

[0007] The data format of the independent labeled data should be the same as that of the training set data, and the data volume should not be less than the training data volume of each batch during the model training process.

[0008] The global model is a supervised learning neural network, which uses but is not limited to ordinary deep neural networks, convolutional neural networks, recurrent neural networks, etc.

[0009] The integration means that the client obtains training data by combining the local historical data set with the key data received through broadcast.

[0010] The training refers to: using the integrated training data to perform training on the global model received by broadcasting, and obtaining different local models of each client after training.

[0011] The uploading of the local model includes: for an honest client, it will send the local model to the server normally; for a malicious client, it may modify and adjust the local model, or send a forged model to the server.

[0012] The secure aggregation means that the server aggregates the received local models into a new global model, specifically including: judging whether the client uses the training set containing key data for model training and whether the client has modified and adjusted the local model after training through the member reasoning method; when the key data is used as training data and the model is not modified, it is judged to be an honest client.

[0013] The member reasoning method is: member reasoning is a data exploration method that can determine whether the training data used by a model contains key data. The principle of member reasoning is that the performance of the model on trained data and untrained data is significantly different. This difference can be used to determine whether to use key data for training.

[0014] The present invention embeds a network structure for member reasoning in a network trained by federated learning, and at the same time, a client in the federated learning adopts a stochastic gradient descent method to minimize a loss function.

[0015] The network structure for membership inference includes: an input layer, a hidden layer and an output layer, wherein: each node in the hidden layer is provided with a ReLU activation function to ensure that unless all inputs are very close to the bias η of the node j , otherwise the output of the network structure will be 0.

[0016] Output of the network structure for membership inference Right now:

[0017] when When , the output b of the network structure will not change. Only the input a of the network structure m The bias η of the network node j When all are close, the output of the network structure will change. The present invention uses this network structure to accurately determine whether a certain image has appeared in the training set.

[0018] The modification and adjustment of the local model refers to the malicious client maliciously modifying the model parameters to reduce the accuracy of the model and achieve the purpose of attacking the global model.

[0019] For example, a malicious client can first use the local training dataset to update the global model M0 to obtain a new local model Model updates during training The local model actually returned by the client is M res =M0-μ·△M, where μ is a hyperparameter that the attacker can control.

[0020] The present invention relates to a system for implementing the above method, including: a federated learning server and a federated learning client, wherein: the federated learning server detects malicious models based on multiple local model information, discards malicious models and aggregates them to obtain a new global model; the federated learning client trains the model based on local data sets and key data to obtain an updated local model, and sends the model to the server.

[0021] Technical Effects

[0022] The present invention standardizes client behavior by distributing root data sets, and uses member reasoning to identify whether the client is honest, so as to achieve better protection effect when facing complex attack methods; when the number of malicious client nodes exceeds half, the security of the federated learning system can still be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of the system of the present invention;

[0024] Figure 2 is a network structure used for member inference in the present invention;

[0025] Figure 3 The MNIST classification network structure trained in the embodiment;

[0026] Figure 4 This is a comparison chart of the model accuracy of the present invention and other aggregation methods under the label reversal attack in the embodiment;

[0027] Figure 5 This is a comparison chart of the model accuracy of the present invention and other aggregation methods under zero gradient attack in the embodiment;

[0028] Figure 6 This is a comparison chart of the model accuracy of the present invention and other aggregation methods under the optimization attack (OPT attack) in the embodiment. DETAILED DESCRIPTION

[0029] like Figure 1As shown, this embodiment relates to a secure aggregation method for federated learning, and its application environment includes: a server node and several client nodes, and the client node may be an honest client or a malicious client. Honest clients abide by the rules of the federated learning secure aggregation system, and their purpose is to hope that the system can be successfully trained to obtain a correct model. Malicious clients do not abide by the rules of this system, and their purpose is to hope that the training of the federated learning system fails and cannot obtain a correct global model.

[0030] Through the above method, this embodiment can obtain a correct federated learning global model even if there are malicious nodes in the system and the malicious nodes use complex attack methods; even if the proportion of malicious nodes in the system exceeds half, the system can still obtain a correct federated learning global model.

[0031] The server-side node is used to initialize the federated learning task, broadcast the global model, broadcast key data, securely aggregate local models, and determine whether the global model has converged.

[0032] The initialization of the federated learning task means that at the beginning of the federated learning task, the server needs to first collect 100 independently labeled training data as the root data set, and the data in the root data set will be distributed to each client in the subsequent training process. In addition, the server needs to initialize the parameters of the global model.

[0033] The broadcasting of the global model and key data means that at the beginning of each round of training, the server will randomly select a piece of data from the root data set for each client, namely the key data; in a round of training, the key data of each client is different. The server will send the key data and the global model of the server to the client.

[0034] The secure aggregation local model means that after receiving the local models sent back by each client, the server needs to select the model of the honest client, discard the malicious client model, and then take the average of the parameters of all honest client models to obtain a new global model. Selecting an honest model includes two steps: First, determine whether the model is trained using the key data of this round by means of member reasoning. If the model is trained using key data, the performance of the key data on the model will be significantly different from that on the model not trained using key data. Member reasoning can first filter out malicious clients that do not comply with the secure aggregation rules. After that, the parameters of the local models after the preliminary screening are averaged to obtain a preliminary global model M1, and then the Euclidean distance from each local model to M1 is calculated. The model whose Euclidean distance exceeds a certain threshold is a model with maliciously modified parameters, and this part of the local model is eliminated. Finally, the parameters of the remaining local models are averaged to obtain the final model M2, which is the new global model.

[0035] The judgment of whether the global model has converged refers to comparing the changes in the training loss function values ​​sent back by the honest clients in the most recent rounds. If the loss function value does not change or changes slightly for more than 10 rounds, the global model is considered to have converged. Stop the task of the federated learning system, and the global model at this time is the target model finally obtained by the task.

[0036] The honest client node collects local data, updates local models, integrates key data, trains local models, and uploads local models.

[0037] The local data collection means that the client needs to create a local training data set for training the local model.

[0038] The updating of the local model and integration of key data means that after receiving the global model broadcast by the server, the client will use the global model to replace the local model and combine the key data with the local training set data to obtain all the data used for this round of training.

[0039] The training of the local model means that the client uses all the data of this round of training to carry out training tasks for the local model to obtain a new local model after training.

[0040] The uploading of the local model refers to: transmitting the updated local model and the loss function value of the current round of training back to the server.

[0041] The secure aggregation system for federated learning involved in this embodiment is jointly implemented on 21 hosts, including 1 server host and 20 client hosts.

[0042] The host environment configuration of this embodiment is shown in the following table:

[0043]

[0044] The server first uses the flwr federated learning framework to start the federated learning service on port 8080. Then, 20 clients establish connections with the server through the server's IP address and port number. After the server establishes connections with all client nodes through the flwr framework, the federated learning task begins.

[0045] The federated learning task involved in this embodiment is the image classification task of the MNIST dataset. The network structure is as follows: Figure 3 shown.

[0046] In this embodiment, the number of root data sets collected by the server is 100, and the number of local training data sets of each client is 2500.

[0047] In this embodiment, the network structure jointly trained by the server and the client in the federated learning system includes a convolutional layer, a pooling layer, and a fully connected layer, wherein: Figure 2 The network structure shown.

[0048] For the federated learning task, after every 20 rounds, the server will use member reasoning to determine whether the member uses specific data for training, specifically:

[0049] 1) Set all weights of the fully connected layer to 0 and all biases of the fully connected layer to -1.

[0050] 2) For the selected image sample s=(x i ,y i ), first calculate the intermediate layer output after the sample passes through the convolution layer and the pooling layer, and select the M outputs with the largest absolute values ​​(a1, a2, a3, ... a M ), whose values ​​are (η1,η2,η3,…η M ), in this embodiment, parameter M=2.

[0051] 3) Take the values ​​of M members as Figure 2 The corresponding input bias value in the network structure is set, and the corresponding weight value is set. At this point, the network parameter construction is completed.

[0052] 4) Send the parameters obtained in step 3 to the client, and perform membership inference based on the received parameters. If the corresponding output b changes, the client uses the key data for training.

[0053] This embodiment tests the model accuracy finally obtained by the federated learning security aggregation method when a malicious client uses label reversal attack, zero gradient attack and optimization attack (OPT attack), and compares the model accuracy obtained by other aggregation methods horizontally.

[0054] As shown in Table 1, Table 2, Table 3, Figure 4 , Figure 5 , Figure 6 As shown, the accuracy of the models trained by the present invention and three other aggregation methods under different malicious node ratios is shown. The horizontal axis represents the ratio of malicious nodes to total client nodes, and the vertical axis represents the accuracy of the trained model on the test set.

[0055] Table 1 Model accuracy under data poisoning attack

[0056] Method\Accuracy|Maliciousness ratio 0％ 10％ 20％ 30％ 40％ 50％ 60％ 70％ 80％ 90％ The present invention 98.66 98.57 98.43 98.32 98.21 98.01 97.84 97.67 97.62 97.54 Aggregation method 1 98.64 95.25 93.85 82.91 66.86 46.09 27.07 13.14 4.32 2.13 Aggregation method 2 98.65 98.56 98.54 98.03 97.95 47.23 4.99 2.1 0.31 0.09 Aggregation method three 98.38 98.36 98.28 98.21 98.14 31.01 0.46 0.31 0.17 0.08

[0057] Table 2 Model accuracy under zero gradient attack

[0058]

[0059]

[0060] Table 3 Model accuracy under OPT attack

[0061] Method\Accuracy|Maliciousness ratio 0％ 10％ 20％ 30％ 40％ 50％ 60％ 70％ 80％ 90％ The present invention 98.66 98.55 98.42 98.3 98.21 98.04 97.89 97.65 97.53 97.46 Aggregation method 1 98.64 83.74 62.75 32.85 19.96 12.12 10.01 9.63 9.79 10.43 Aggregation method 2 98.65 91.32 70.34 41.35 23.46 13.89 9.76 10.23 9.74 9.81 Aggregation method three 98.38 25.43 18.75 15.01 12.95 10.32 9.46 9.31 9.17 9.08

[0062] The first aggregation method for horizontal comparison is: the server calculates the mean of each parameter for all received local models to obtain a global model.

[0063] The second aggregation method for horizontal comparison is: the server takes the median of each parameter of all received local models as the new global model parameter.

[0064] The third aggregation method for horizontal comparison is: the server first calculates the mean of each parameter for all received local models to obtain a temporary model M1. Then it calculates the Euclidean distance between each local model and the temporary model M1, selects the 10 local models with the smallest Euclidean distance, calculates the mean of each parameter of these 10 local models, and obtains the global model.

[0065] By comparing the accuracy of the model finally obtained by the present invention and other aggregation methods under different attacks, we found that:

[0066] The secure aggregation system and method for federated learning proposed in the present invention can achieve good security and obtain a higher model accuracy in the face of different malicious attack methods.

[0067] The present invention can still achieve safe model aggregation and obtain a higher model accuracy when the proportion of malicious nodes exceeds 50%.

[0068] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A secure aggregation method for federated learning, characterized in that: The server broadcasts the global model and key data in a loop. Each client integrates the received broadcast data with the local data to train the received global model and upload the local model to the server. The server performs model security aggregation and convergence judgment to achieve model security in the federated learning system. The cyclic broadcast means that before the federated learning task starts, the server collects independent labeled data as the root data set in advance, and in each round of the task, randomly broadcasts a piece of data in the root data set, namely the key data, together with the global model to all clients for client integration; The integration means that the client obtains training data by combining the local historical data set with the key data received by broadcasting; The secure aggregation means that the server aggregates the received local models into a new global model, which specifically includes: judging whether the client uses the training set containing key data for model training and whether the client has modified and adjusted the local model after training by the member reasoning method; if the client uses the key data as training data and does not modify the model, it is judged to be an honest client; The member reasoning method is as follows: member reasoning is a data exploration method, which can determine whether the training data used by a model contains key data. The principle of member reasoning is to determine whether to use key data for training based on the difference between the performance of the model on trained data and the performance of untrained data; The network structure for member reasoning is embedded in the network trained by federated learning, and the client in federated learning uses the stochastic gradient descent method to minimize the loss function; The network structure for member reasoning includes: an input layer, a hidden layer, and an output layer, wherein: each node in the hidden layer is provided with a ReLU activation function to ensure that unless all inputs are very close to the node's bias η j , otherwise the output of the network structure will be 0; Output of the network structure for membership inference Right now: when When , the output b of the network structure will not change, only the input a of the network structure m The bias η of the network node j When all are close, the output of the network structure will change.

2. The secure aggregation method for federated learning according to claim 1, characterized in that: The data format of the independent labeled data should be the same as that of the training set data, and the data volume should not be less than the training data volume of each batch during the model training process.

3. The secure aggregation method for federated learning according to claim 1, characterized in that: The training refers to: using the integrated training data to perform training on the global model received by broadcasting, and obtaining different local models of each client after training.

4. A system for implementing the secure aggregation method for federated learning as described in any one of claims 1 to 3, characterized in that: include: Federated learning server and federated learning client, where: the federated learning server detects malicious models based on multiple local model information, discards malicious models and aggregates them to obtain a new global model; the federated learning client trains the model based on the local data set and key data, obtains the updated local model, and sends the model to the server.

Images