Federal learning model attack defense method based on neural network feature extraction

Abstract

A kind of federal learning model attack defense method based on neural network feature extraction, before carrying out federal learning global aggregation in each round, neural network feature extraction model is constructed in advance in safe environment, and it is trained using public data set, trust of local parameter is guided by server itself;In online stage, the local parameters uploaded by each client are extracted and output to the server using the trained neural network feature extraction model, and the server uses the density-based clustering method (DBSCAN) with noise to classify the feature vectors and eliminate the corresponding malicious local parameters, to realize safe aggregation.The present application trains neural network in safe environment before each iteration, so that it can resist various model poisoning attacks in online stage, thereby effectively preventing the damage of malicious client to global model.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically a federated learning model attack defense method based on neural network feature extraction. Background Technology

[0002] Federated learning has emerged as a solution and has experienced rapid development and widespread application. However, its distributed nature and the inherent vulnerabilities of its protocol make it susceptible to various attacks, with model attacks being a common method. In model attacks, any malicious client can compromise the global model. Because the server cannot access a client's private data or its local model training process, a malicious client can send carefully crafted malicious parameters to the server, misleading the global model's learning process and causing misclassification during testing. A poisoned parameter update can even control the entire training process, ultimately rendering the jointly learned global model ineffective.

[0003] Existing defense methods against model attacks in federated learning are relatively limited. Methods based on robust aggregation rules require the server to know information such as the number of malicious clients in advance. Defense methods that focus on correcting local or global transmission parameters still suffer from some parameter correction errors during the training of the global model and incur significant consumption of storage space, computing, and communication resources. Summary of the Invention

[0004] This invention addresses the problems of malicious parameters from malicious clients in federated learning easily misleading the global model's learning process, the inability to provide defense against scenarios involving multiple attack fusions, and the subjectivity of setting attack parameters for specific attack methods. It proposes a federated learning model attack defense method based on neural network feature extraction. In each iteration, the neural network is pre-trained in a secure environment to resist various model poisoning attacks during the online phase, thereby effectively preventing malicious clients from damaging the global model.

[0005] This invention is achieved through the following technical solution:

[0006] This invention relates to a method for defending against attacks on federated learning models based on neural network feature extraction. Before each round of global aggregation in federated learning, a neural network feature extraction model is pre-built in a secure environment and trained using a public dataset. The server itself guides the trust of local parameters. During the online phase, the trained neural network feature extraction model is used to extract features from the local parameters uploaded by each client and output them to the server. The server then uses a density-based clustering method with noise (DBSCAN) to classify the feature vectors and remove corresponding malicious local parameters, thus achieving secure aggregation.

[0007] The aforementioned neural network feature extraction model is pre-built in a secure environment by the server to extract features from local parameters uploaded by the client. Its specific structure is a fully connected neural network model with k layers, f i Let i represent the i-th layer of the fully connected network, i = 1, ..., k, and let J represent the training loss function, which is the MSE (Mean Squared Error) function. The goal of training the feature extraction model is to maximize the predicted output close to 1 for a normal feature vector input x.

[0008] The construction of the feature extraction model specifically includes:

[0009] Step A1: Before joint learning, the server collects a small, clean, publicly available dataset D that has not been attacked or tampered with for this learning task. open And maintain a server model M based on this dataset. server To guide trust; specifically, the parameters of the server model are the same as the global model M in the current training round. global ;

[0010] Step A2: The server will publish the dataset D from step A1. open According to the set batch dataset size b server Input to server model M server The model is trained in this way to obtain the training parameter set of the feature extraction model. And set the training label to... Where: num represents the total number of training set data for the feature extraction model;

[0011] Step A3: The server initializes a fully connected neural network as the feature extraction model F. fc Let the expanded local feature parameters uploaded by each client have dimension d, and the highest digit of d be p. Then, let the dimension of each layer of the fully connected network be d. ...、(p),1; where: if p≠1, then the fully connected network contains a hidden layer of dimension p;

[0012] Step A4: The server will use the W obtained in step A2. server As a feature extraction model F fc The training set is input into the model; the training of the feature extraction model is to obtain the optimal network parameters, that is, to solve the optimization problem.

[0013] Where: Suppose the fully connected network model for feature extraction has k layers, f iLet i represent the i-th layer of the fully connected network, i = 1, ..., k, and J represent the training loss function. The goal of training the feature extraction model is to maximize its predicted output close to 1 for a normal feature vector input x.

[0014] The local parameter feature extraction specifically includes:

[0015] Step B1: Based on the local parameters w = {w1, w2, ..., w...} received by the server from the n clients... n}; Each client uploads m local parameters w j ={v j1 v j2 , ..., v jm}, j∈[1, n]; for each local parameter {v} uploaded by the client 1i v 2i , ..., v ni The input is passed through a trained neural network feature extraction model. i∈[1,m], obtain the predicted output {p 1i p 2i , ..., p ni}; where: p ji This refers to the feature extraction value of the i-th parameter of client j, which in turn yields the feature vector group representing each client. Where: j represents the client label.

[0016] The classification of feature vectors for each client specifically includes:

[0017] Step C1: For the feature vector set of all clients The feature vector groups are divided using the DBSCAN clustering algorithm to obtain the cluster labels. count = {-1, 0, 1, ...};

[0018] Step C2: Based on cluster labels count Clients are categorized into honest clients and malicious clients; feature vectors with a cluster label of -1 represent noise, and the clients they represent are directly classified as malicious; for other cluster labels, the mean comparison method is used to determine the honest class.

[0019] The mean comparison method refers to: grouping feature vectors according to cluster label l (l∈label) count (l≠-1) Calculate the average: Where: j label Represents the cluster label of client j, count l The mean represents the number of feature vector groups with cluster label l. lThis represents the average value of the cluster label l; for each cluster label l (l∈label) count (l≠-1), the server calculates Mean[l]=|mean l -1|; Select the cluster label corresponding to the smallest data value in Mean as the honest class, and classify other cluster labels as malicious classes.

[0020] The removal of malicious local parameters refers to adding the client IDs corresponding to the cluster labels of malicious classes to the Malicious list based on the mean comparison method. During global aggregation on the server, model local parameters represented by the Malicious list are removed, and only honest model local parameters are safely aggregated.

[0021] Technical effect

[0022] This invention utilizes a neural network model to extract features from local parameters, thereby defending against model attacks in federated learning. The scheme innovatively introduces a server dataset and designs a defense mechanism guided by the server itself to trust local parameters. It combines the high feature extraction capabilities of neural networks with unsupervised clustering for application in the detection of malicious clients and global aggregation in federated learning. Because this method detects model attacks from malicious clients, it solves the problems of the server's global model being misled, training effectiveness being weakened, and the training process failing to converge, caused by malicious clients sending carefully crafted malicious parameters to the server. In summary, this method ensures high accuracy of the joint model under model attacks while also achieving rapid convergence of the global model. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the process of the present invention;

[0024] Figure 2 This is a training diagram for an example;

[0025] Figure 3 This is a schematic diagram of feature extraction in an embodiment;

[0026] Figure 4 This is a schematic diagram of the malicious client detection process in an example. Detailed Implementation

[0027] like Figure 1 As shown in the figure, this embodiment relates to a federated learning model attack defense method based on neural network feature extraction, including:

[0028] Step 1: Before joint learning, the server collects a small, clean, publicly available dataset D that has not been attacked or tampered with for this learning task. openThis dataset is used to guide trust, rather than relying entirely on local parameters on the client side.

[0029] Specifically, the server can collect a clean dataset D through methods such as manual labeling. open .

[0030] like Figure 2 As shown, the server will publicly expose dataset D. open According to the set batch dataset size b server The parameters are input into the server's current global model for training, simulating the local model training process on the client side, thereby obtaining the training parameter set for the feature extraction model. And set the training label to... The training parameter pairs can then be obtained. , i∈[1,num]; where: num represents the total number of training data sets for the feature extraction model.

[0031] Specifically, b is generally set server This is equal to the batch size for training the local model on each client, in order to better simulate the local training process;

[0032] Step 2: The server initializes a fully connected neural network as the feature extraction model F. fc Let the expanded local feature parameters uploaded by each client have dimension d, and the highest digit of d be p. Then, let the dimension of each layer of the fully connected network be d. ...、(p), 1; where: if p≠1, then the fully connected network contains hidden layers of dimension p; for example: if there are convolutional local parameters of a convolutional neural network Then corresponding to w CNN The fully connected network feature extraction model has two layers, with dimensions of 10 and 1 for each layer.

[0033] The server will obtain W from step 1. server As a feature extraction model F fc The training set is input into the model; the training of the feature extraction model is to obtain the optimal network parameters, that is, to solve the optimization problem.

[0034] Where: Suppose the fully connected network model for feature extraction has k layers, f i Let i represent the i-th layer of the fully connected network, i = 1, ..., k, and let J represent the training loss function, which is the MSE (Mean Squared Error) function. The goal of training the feature extraction model is to maximize the predicted output close to 1 for a normal feature vector input x.

[0035] The fully connected network structure described is intuitive and simple, and can reveal patterns within seemingly random and disordered parameters such as gradient weights. Furthermore, the training parameter set for fully connected networks obtained from small, publicly available datasets is relatively small, so the training time is not significantly higher than that of complex networks such as CNNs, and the number of parameters in spatiotemporal sequence neural networks such as RNNs and LSTMs is also much larger.

[0036] Step 3: Local parameter feature extraction process: such as Figure 3 As shown, the federated learning framework in this embodiment includes n clients, namely client 1, client 2, ..., client n, and the corresponding local parameters are w = {w1, w2, ..., wn}. n The feature extraction of local parameters for each client provided in the embodiment includes the following steps:

[0037] Step 4: Let m represent the total number of possible local parameters uploaded by each client, i.e., w j ={v j1 v j2 , ..., v jm}, j∈[1, n]; for each local parameter uploaded by the client, a fully connected network for feature extraction is trained using the above steps. i∈[1,m].

[0038] Specifically, the server will assign each parameter {v 1i v 2i , ..., v ni Input into the corresponding feature extraction model The predicted output is obtained from the middle. Where: p ji This refers to the feature extraction value of the i-th parameter of client j.

[0039] For each local parameter uploaded by each client, the above steps can be used to obtain a set of feature vectors representing each client; where: let This represents the feature vector set of client j. For example, if the number of local parameters that need to be uploaded by each client in a certain global model is 4, then the server will eventually convert the 4 high-dimensional parameters of each client in each iteration into a 1×4 4-tuple, which is the feature vector set of each client.

[0040] Step 5: As Figure 4 As shown, the feature vector set for all clients The server uses the DBSCAN clustering algorithm to divide the feature vector groups in Pro, and obtains the cluster labels. count = {-1, 0, 1, ...};

[0041] Step 6: The server will determine the clustering label. countClients are categorized into honest and malicious clients. Feature vectors with a cluster label of -1 represent noise, and the clients they represent are directly classified as malicious. For other cluster labels, a mean comparison method is used to determine which class is honest. Specifically, the feature vectors of Pro obtained in step 5 are compared according to their cluster labels l (l∈label). count (l≠-1) Calculate the average: Where: j label Represents the cluster label of client j, count l The mean represents the number of feature vector groups with cluster label l. l This represents the average value of the cluster label l;

[0042] Since the training label for the honesty parameter is set to 1 during the training of the feature extraction model, the mean value is compared... l The distance between the cluster label l and 1 can be used to distinguish between honest and malicious classes. For each cluster label l (l∈label) count (l≠-1), the server calculates Mean[l]=|mean l -1|; Select the cluster label corresponding to the smallest data value in Mean as the honest class, and classify other cluster labels as malicious classes; The server adds the client number corresponding to the malicious class cluster label to the Malicious list.

[0043] Step 7: The server removes the local model parameters corresponding to the malicious client set Malicious, and aggregates the local model parameters of the honest clients using FedAvg to complete the global model update of the federated learning model. Where: c represents the number of malicious clients, that is, the number of elements in Malicious.

[0044] Through specific practical experiments, with a total number of clients set at 50, the defense effectiveness against six types of attacks, including Gaussian attacks, sign flip attacks, zero gradient attacks, label flip attacks, backdoor attacks, and adaptive local model poisoning attacks, was evaluated on the popular image dataset MNIST, with an attack ratio as high as 50%. The results were compared with existing mainstream defense schemes such as Krum and FLTrust. Some experimental results are shown in the table below.

[0045] FedAvg Median Krum FLTrust This method No attacks in a safe environment 97.2％ 97.2％ 95.9％ 95.7％ 97.3％ Gaussian attack 9.7％ 96.9％ 96.8％ 95.9％ 97.0％ Symbol flipping attack 95.9％ 10.1％ 96.7％ 95.7％ 97.1％ Zero gradient attack 10.3％ 8.9％ 96.4％ 95.0％ 97.1％ Tag flipping attack 9.8％ 9.8％ 9.8％ 96.0％ 96.9％ Backdoor attack 9.8％ 9.8％ 9.8％ 95.7％ 96.9％

[0046] The results show that our proposed method can resist the six mainstream attack methods tested in the experiment, achieving a global model accuracy of up to 97.1%. In contrast, FLTrust, under the same experimental conditions, only achieved a maximum accuracy of 95.9% and had a slower convergence speed. The Krum approach was even unable to resist label flipping attacks, backdoor attacks, and adaptive local model poisoning attacks. Therefore, our proposed method ensures high accuracy of the joint model while also achieving rapid convergence of the global model.

[0047] Compared to existing technologies, this invention leverages the high feature extraction performance of neural networks. In each iteration, the feature extraction model autonomously learns and identifies honest parameter features, thus eliminating the need to assume that attackers execute attacks in every round, and information such as the number of attackers does not need to be known in advance; the number of attackers can change dynamically. Because local parameter trust is guided by the clean dataset of the server itself, this method is fully applicable even when there are a large number of attackers, or even half, in the system. Since malicious clients have been eliminated, FedAvg aggregation can fully integrate and learn the local parameters of each honest client, enabling the global model to converge quickly while achieving high accuracy. Therefore, compared to traditional methods, this invention ensures high attacker detection accuracy while being more suitable for real-world scenarios.

[0048] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. A federated learning model attack defense method based on neural network feature extraction, characterized in that, Before each round of global aggregation in federated learning, a neural network feature extraction model is pre-built in a secure environment and trained on a public dataset, with the server itself guiding the trust in local parameters. During the online phase, the trained neural network feature extraction model is used to extract features from the local parameters uploaded by each client and output them to the server. The server then uses a noisy density-based clustering method to classify the feature vectors and remove the corresponding malicious local parameters, thus achieving secure aggregation. The aforementioned neural network feature extraction model is pre-built by the server in a secure environment to extract features from local parameters uploaded by the client. Its specific structure is a fully connected neural network model with a total of [number missing]. layer, The first term of the fully connected neural network model is represented by the second term. layer, The activation function between layers is Sigmoid. The loss function used for training is the mean squared error (MSE) function; the goal of training the feature extraction model is to train it on normal feature vector inputs. To maximize its predicted output to be close to 1; The construction of the feature extraction model specifically includes: Step A1: Before joint learning, the server collects a small, clean, publicly available dataset that has not been attacked or tampered with for this learning task. And maintain a server model based on this dataset. To guide trust; the parameters of this server model are the same as the global model in the current training round. ; Step A2: The server will publish the dataset from step A1. According to the set batch dataset size Input to server model The model is trained in this way to obtain the training parameter set of the feature extraction model. and set training labels for ,in: This represents the total number of data points in the training set of the feature extraction model. Step A3: The server initializes a fully connected neural network as a feature extraction model. Suppose that the expanded dimensions of the local feature parameters uploaded by each client are... and The highest digit is Then the dimension of each layer of the fully connected network is set as follows: , ... , Among them: if Then a fully connected network contains dimensions of Hidden layers; Step A4: The server will obtain the information from step A2. As a feature extraction model The training set is input into the model; the training of the feature extraction model is to obtain the optimal network parameters, that is, to solve the optimization problem. Where: Suppose that the feature extraction fully connected network model has a total of layer, This indicates the first fully connected network. layer, , The loss function represents the training loss function; the goal of training the feature extraction model is to train it on normal feature vector inputs. This maximizes the predicted output to be close to 1.

2. The attack defense method based on federated learning model with neural network feature extraction according to claim 1, characterized in that, The feature extraction specifically includes: Step B1: Based on the data received by the server The local parameters of each client are Each client uploads Local parameters , For each local parameter uploaded by the client Input is passed through a trained neural network feature extraction model , , to obtain the predicted output ;in: That is, the client The The feature extraction values ​​of the parameters are used to obtain the feature vector group representing each client. ,in: Indicates the client identifier.

3. The attack defense method for federated learning models based on neural network feature extraction according to claim 1, characterized in that, The classification of feature vectors specifically includes: Step C1: For the feature vector set of all clients The DBSCAN clustering algorithm is used to divide the feature vectors into groups to obtain cluster labels. ; Step C2: Based on cluster labels Clients are categorized into honest clients and malicious clients; clustering labels are... The feature vector group represents noise, and the client it represents is directly classified as malicious; for other clustering labels, the mean comparison method is used to determine the honest class.

4. The attack defense method for federated learning models based on neural network feature extraction according to claim 3, characterized in that, The mean comparison method refers to: grouping feature vectors according to cluster labels... Find the average value. : ,in: Indicates client Clustering labels, Indicates clustering label as The number of feature vector groups, Clustering labels The average value for each cluster label; , Server computing Select The cluster label corresponding to the smallest data value is the honest class, while other cluster labels are classified as malicious classes.

5. The attack defense method for federated learning models based on neural network feature extraction according to claim 1, characterized in that, The removal of corresponding malicious local parameters refers to adding the client ID corresponding to the cluster label that classifies the malicious class to the appropriate cluster ID based on the mean comparison method. The list is removed when the server performs global aggregation. The list represents the local parameters of the model, and only honest local parameters of the model are safely aggregated.

Images