A method for dynamically identifying backdoor attacks in federated learning based on multi-dimensional indicators

Abstract

The present invention discloses a method for dynamically identifying backdoor attacks in federated learning based on multi-dimensional indicators, comprising the following steps: first, the Manhattan distance is introduced, and the distance-based defense measures proposed using the Manhattan distance show significant performance against hidden backdoors. In order to cope with various attacks, multiple indicators are used to identify malicious gradients, and the Mahalanobis distance is applied and dynamic weights are generated to handle the non-IID distribution of participants and the different scales brought about by different distances. Finally, a score is calculated for each submitted gradient, and only benign gradients are aggregated based on the score; the use of multi-dimensional indicators to dynamically identify backdoor attacks in federated learning can defend against as many different backdoor attack methods as possible while ensuring the accuracy of the main task and the performance of the model. At the same time, it can adapt to the distribution of non-independent and identically distributed data and defend against hidden backdoor attacks that have been carefully designed by the attacker.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence data security, and in particular to a method for defending against backdoor attacks in federated learning based on dynamic identification of multi-dimensional indicators. Background Art

[0002] Federated learning is a collaborative machine learning framework that meets privacy protection requirements and complies with the relevant provisions of the Data Security Protection Law and the Personal Privacy Protection Law. However, due to the inability to inspect the data of partners, it is vulnerable to backdoor attacks from malicious parties. Figure 1 As shown, within the federated learning framework, each party uses its own data to train the model. Only the gradients and other parameters from each model iteration are aggregated and updated in a public area. All parties' data remains locally, ensuring privacy and regulatory compliance. Multiple participants pool their data to build a virtual shared model and benefit from it. Within the federated learning system, all participants have equal status and position. The modeling effect of federated learning is equivalent to, or comparable to, that of modeling the entire dataset in a single place. Federated learning systems are susceptible to backdoors. Backdoor attacks, also known as targeted data poisoning attacks, manipulate the model toward targeted behavior based on inputs chosen by an adversary. Compared to untargeted data poisoning attacks, backdoor attacks are more difficult to detect because they do not affect the model's normal functionality, and their gradients are more similar to benign ones. Because federated learning is privacy-conscious, the central server has no access to user local data or the training process, making it less secure and more vulnerable to attacks. Model replacement attacks successfully inject backdoors into the global model in a single attack. Some well-crafted attacks strategically target weaknesses in these defenses, such as the PGD attack, which scales and projects gradients, or the DBA attack, which splits triggers before uploading them. Furthermore, edge-case PGD attacks modify the poisoned data and models. Undoubtedly, these attacks pose a significant challenge to the security of federated learning systems.

[0003] There are two main methods for defending against backdoor attacks in federated learning: the first is to remove gradients uploaded by attackers through classification; the second is to gradually eliminate backdoors by adding noise to the federated learning model through differential privacy. The first approach is unable to identify more subtle backdoor attacks, especially those that have been scaled. It also struggles to cope with different attack strategies and is difficult to adapt to situations where customer data is not independent and identically distributed. The second approach is that the added noise significantly impacts the performance of the model's main task, defeating the purpose of collaborative training.

[0004] The main shortcomings of existing defense methods against backdoor attacks are as follows.

[0005] 1. Most defenses often assume a specific data distribution. For example, the Krum defense compares the L2 norm of each client model and eliminates client models with higher L2 norms than other models. This requires the assumption that the data distribution is independent and identically distributed (Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent, Peva Blanchard, El Mahdi El Mhamdi*, Rachid Guerraoui, Julien Stainer). The Foolsgold defense compares the cosine similarity of the client model with historical data (The Limitations of Federated Learning in Sybil Settings, Clement Fung, Chris JMYoon, Ivan Beschastnikh). It assumes that the models uploaded by the attacker are consistent, while benign clients are not. This assumes that the data distribution is not independent and identically distributed, resulting in low adaptability.

[0006] 2. Currently, many defenses use Euclidean distance in vector space to identify malicious gradients, such as the Krum and RFA defense algorithms. The RFA defense algorithm replaces the original average algorithm with the geometric median of each client. However, Euclidean distance is significantly affected by the curse of dimensionality in high-dimensional space, resulting in poor recognition ability. Neural networks are typically high-dimensional spaces, resulting in low recognition accuracy (Robust Aggregation for Federated Learning, Krishna Pillutla, Sham M.

[0007] Kakade, and Zaid Harchaoui);

[0008] 3. Most existing defenses cannot defend against attacks that involve model scaling and hidden backdoor data, such as the Edge-case PGD attack. Instead, they can only defend against these attacks through differential privacy plus noise, such as the Weak-DP defense algorithm (Can You Really Backdoor Federated Learning, Ziteng Sun*, Peter Kairouz, Ananda TheerthaSuresh, H.

[0009] Brendan McMahan), which will reduce the accuracy of the model's main task and result in high defense costs.

[0010] 4. Most backdoor attack defense strategies are rigid and single-minded. They can only defend against specific attacks, but are unable to effectively defend against a wide range of attack methods. Their defense efficiency is low. For example, Krun and RFA rely on Euclidean distance for defense, while Foolsgold relies on cosine similarity for defense. These strategies are easily targeted and breached by attackers. Summary of the Invention

[0011] This invention aims to propose a method for dynamically identifying backdoor attacks in federated learning based on multidimensional metrics. This method first introduces the Manhattan distance, which is theoretically more meaningful than the Euclidean distance in high-dimensional spaces. Leveraging the Manhattan distance, the proposed distance-based defense demonstrates significant performance against hidden backdoors. To address various attacks, multiple metrics are collaboratively employed to identify malicious gradients. Furthermore, the Mahalanobis distance is applied and dynamic weights are generated to account for the non-IID distribution of participants and the varying scales associated with different distances. Finally, a score is calculated for each submitted gradient, and only benign gradients are aggregated based on the score. Using multidimensional metrics to dynamically identify backdoor attacks in federated learning can protect against a wide range of backdoor attack vectors while maintaining the accuracy of the primary task and model performance. This method is also adaptable to non-IID data distributions and can defend against hidden, carefully crafted backdoor attacks.

[0012] The present invention is achieved through at least one of the following technical solutions.

[0013] The method for dynamically identifying backdoor attacks in federated learning based on multi-dimensional indicators includes the following steps:

[0014] S1. Initialize the federated learning framework, define and calculate gradient features, and define and calculate the feature values ​​of each client;

[0015] S2. Use Mahalanobis distance to calculate the client's dynamic weight and score, according to the distance score d i Sort by

[0016] S3, remove attack gradients, aggregate benign gradients and add noise.

[0017] Furthermore, the characteristics of the gradient are defined as follows:

[0018]

[0019]

[0020]

[0021] Among them, i is the i-th user, w iis the local model trained for the i-th user, w0 is the global model aggregated and distributed in the previous round; the gradient features trained for the i-th user include Manhattan distance Euclidean distance and cosine distance The user gradient feature information is expressed using the following formula:

[0022] x=(x Man , x Eul , x Cosine ) (4)

[0023] Furthermore, we use the dispersion as the basis for judging whether a gradient is an outlier, and define and calculate the eigenvalues ​​of the model for each customer:

[0024]

[0025]

[0026]

[0027] in are the redefined eigenvalues, is the original eigenvalue of the gradient model, and It is all the gradients uploaded in this round except Other gradients.

[0028] Furthermore, after defining the gradient features, the feature information of the user gradient is expressed using the following formula:

[0029]

[0030] where x′ (i) represents the discreteness vector of the i-th client, Indicates the difference between the i-th client and the remaining clients x in the K clients selected in this round j The sum of the absolute values ​​of the differences in Manhattan distance is used as the dispersion of the indicator. and are the dispersion in Euclidean distance and cosine distance indicators respectively.

[0031] Furthermore, the Mahalanobis distance is used to weight the gradient features and calculate the dynamic weights and scores:

[0032]

[0033] Where ∑ is the covariance matrix of the gradient feature matrix of all users participating in the training when the round is selected, and the inverse matrix obtained by inverting it is used as the dynamic weight of the round, d i is the discrete vector x′ passing through the i-th client(i) The score obtained, is x′ (i) The transpose of .

[0034] Furthermore, initializing the federated learning framework consisting of N clients includes the following steps:

[0035] (1) The central server sends the initial global model w0 of the round to the K clients participating in this round of training;

[0036] (2) Each client uses its local data to train the model w0 locally, and then uses the trained local model w i Upload server, where w i The local model uploaded by the i-th client;

[0037] (3) The server receives K trained local models.

[0038] Furthermore, defining and calculating the characteristic value of each client includes the following steps:

[0039] 1) Give the local model w to the i-th user respectively i Calculate the Manhattan distance of the model vector Euclidean distance and

[0040] Cosine distance

[0041] 2) Give the local model w to the i-th user respectively i Define and calculate the eigenvector x of its model vector i =(x i Man , x i Eul , x i cosine );

[0042] 3) Give the local model w to the i-th user respectively i Calculate the dispersion of the Manhattan distance of the model vector in represents the sum of the absolute values ​​of the Manhattan distance differences between the i-th user and other users;

[0043] 4) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the Euclidean distance differences between the i-th user and other users;

[0044] 5) Give the local model w to the i-th user respectively iCalculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the cosine distance differences between the i-th user and other users;

[0045] 6) Redefine and calculate the characteristic value of each client as follows:

[0046]

[0047] 7) Calculate the matrix composed of the eigenvalue vectors of K customers in the current round in Represents the transpose of a matrix.

[0048] Furthermore, step S2 includes the following steps:

[0049] S21. Calculate the covariance matrix ∑ of the matrix X composed of the eigenvalue vectors of K customers, and use the inverse matrix of the covariance matrix as the adaptive weight matrix for this round;

[0050] S22, give the local model w to the i-th user respectively i Calculate its Mahalanobis distance d i and as its distance score, The lower the score, the more the local model of the i-th user can represent the group of local models of all users;

[0051] S23, all K clients participating in the training in this round are classified according to their distance scores d i Sort.

[0052] Furthermore, step S3 includes the following steps:

[0053] S31, remove the local models of p users with higher distance scores;

[0054] S32, aggregate the remaining user models and use them as the global model w for this round of federated training * ;

[0055] S33, to the global model w * Add differential privacy noise;

[0056] S34. If the round reaches the preset federation training round, the training is exited; if not, a new round of federation training is performed.

[0057] Furthermore, to the global model w * Add differential privacy noise with standard deviation σ And get a new global model

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] The present invention can effectively identify multiple backdoor attacks while maintaining the performance of the main task, and is not constrained by the nature of data distribution.

[0060] The present invention uses multiple different indicators to simultaneously identify backdoor gradients to cope with a variety of backdoor attacks and achieve high efficiency in backdoor attack defense;

[0061] The present invention uses a dynamic matrix adaptively generated by Mahalanobis distance to generate a new dynamic weight in each iteration to address the problem of large differences in gradient features caused by different data distributions, thereby achieving high adaptability of defense.

[0062] This paper introduces the Manhattan distance to participate in identifying the attacker's backdoor gradient, alleviating the problem of poor recognition ability in high-dimensional space caused by the curse of dimensionality and achieving high accuracy of defense.

[0063] The present invention realizes accurate identification of hidden backdoors, so that it can defend against attackers' carefully designed and hidden backdoor attacks without the need for differential privacy plus noise, thereby achieving low defense costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to further illustrate the technical means of the invention and present the principles, purposes, features, etc. of the invention in a more understandable manner, the following embodiments will be given and supplemented with figures;

[0065] Figure 1 This is a diagram of the federated learning framework of the present invention;

[0066] Figure 2 This is a flow chart of the backdoor attack defense method in federated learning based on dynamic identification of multi-dimensional indicators of the present invention;

[0067] Figure 3 A schematic diagram of defining gradient vector features in the present invention;

[0068] Figure 4 This figure explains why the covariance matrix is ​​used as the weight in the present invention. DETAILED DESCRIPTION

[0069] To help those skilled in the art better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It is apparent that the embodiments described are only a portion of the present invention, not all of the embodiments. All other embodiments derived by those skilled in the art based on the embodiments of the present invention without inventive effort are also within the scope of protection of the present invention.

[0070] The present invention will be further described below in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, under the premise of no conflict, the various embodiments or technical features described below can be arbitrarily combined to form new embodiments.

[0071] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0072] Example 1

[0073] like Figure 2 As shown, the backdoor attack defense method in federated learning based on dynamic identification of multi-dimensional indicators in this embodiment includes the following steps:

[0074] S1. Initialize the federated learning framework, define the characteristics of the gradient, calculate the discreteness of the eigenvalues ​​of each user model, and use it as the new eigenvalue;

[0075] The federated learning framework is based on the FedAvg federated averaging algorithm, which has the following formula:

[0076]

[0077] where w * is the new global model, w t is the global model of round t, is the local model trained by the i-th user in the t+1th round, N is the number of all users, K is the number of clients participating in a round of training, and η is the training learning rate;

[0078] The federated learning training framework allows multiple users to collaborate on training a common, efficient AI model without leaving their own data. However, if a malicious user (attacker) poisons the model, this can pose a significant threat to its security. This paper focuses on backdoor attacks, as these attacks only respond to the backdoor and do not manifest in its primary performance. This makes them concealed and easily deployed in actual production environments, potentially causing significant harm to society.

[0079] The backdoor attack method f(·) is based on the trigger or backdoor pattern Δ to the normal sample x i Process and obtain poisoned sample x b, that is, x b =f(x i ,Δ), and assign the target label y to the poisoned sample t , and then multiple poisoned data pairs (x b ,y t ) and normal data (x i ,y i ) together to form a new training data set, which is used to train the neural network model and obtain the model M with the backdoor buried. b When the neural network model is used for normal samples When making predictions, the model can still get the correct prediction result M b (x i {test )=y i When the neural network model is used to detect poisoned samples with trigger $Δ$ When making predictions, the model outputs the target category label specified by the attacker, i.e.

[0080] In a federated learning framework, an attacker can train a backdoored model using backdoored data as described above and then upload it to the server, thereby poisoning the global model and compromising the federated learning framework. While simple backdoor attacks are easily mitigated by existing defenses, carefully designed, advanced, and covert attack methods are more vulnerable. The new defense method constructed by this invention provides a universal defense against existing attack strategies.

[0081] First, the features of the gradient model uploaded by the user will be defined and calculated. The Manhattan distance, Euclidean distance, and cosine distance of the model vector are as follows: Figure 3 As shown, the characteristics of the gradient are as follows:

[0082]

[0083]

[0084]

[0085] Among them, i is the i-th user, w i is the local model trained for the i-th user, w0 is the global model aggregated and distributed in the previous round; the gradient features trained for the i-th user include Manhattan distance Euclidean distance and cosine distance Using these multiple indicators to define the gradient eigenvalue, if the attacker uses the commonly used ModelReplacement method to increase the L2 norm of the gradient, the Euclidean distance feature of formula (2) will be larger; and if the ratio of backdoor data (toxic data) in the attacker's backdoor data set is large, the cosine distance eigenvalue of formula (3) will be larger; even if the attacker uses a scaling method such as projection method PGD to make the gradient more hidden in the Euclidean space, it can still be detected through the Manhattan distance feature of formula (1).

[0086] The user gradient feature information is expressed using the following formula:

[0087] x=(x Man , x Eul , x Cosine ) (4)

[0088] We use the dispersion as the basis for judging whether a gradient is an outlier, and then redefine and calculate the eigenvalues ​​of the model for each customer:

[0089]

[0090]

[0091]

[0092] Formulas (5) to (7) show the group relationship of all gradients. A high value indicates that the model is relatively outlier in terms of the characteristic index, while a low value indicates that the model gradient is closer to the group center. Obviously, the backdoor model gradient has a sample-label mapping relationship that the normal model gradient does not have. As long as the number of attackers is not greater than the number of normal participating users, the attacker's model gradient is an outlier. That is, if the characteristic value of the gradient model is high, it is considered to be an attack gradient model.

[0093] After redefining the gradient features, the feature information of the user gradient can be re-expressed using the following formula:

[0094]

[0095] where x′ (i) represents the discreteness vector of the i-th client, Indicates that among the K clients selected in this round, the i-th client and the remaining clients x j The sum of the absolute values ​​of the differences is used as the dispersion of the indicator.

[0096] The basic logic of distance-based defense involves defining some indicative metrics that can effectively distinguish malicious gradients from benign ones and remove hostile updates from the aggregation. Therefore, the core issue becomes how to define a metric that can identify the characteristics of malicious gradients. However, the widely used Euclidean distance suffers from the "curse of dimensionality" and has been proven to have low discrimination in high-dimensional space, becoming meaningless. Therefore, Manhattan distance was introduced as a distinction. Existing methods often use Euclidean distance or cosine distance as a distinction metric in Euclidean space, but extensive practical work has found that they cannot effectively distinguish the distance differences between neighbors in high-dimensional space.

[0097] At the same time, the current method is to defend on the basis of a single indicator. Since there is only one metric, a cunning attacker can easily bypass them with a carefully designed gradient, and in actual working environments, most of the scenarios of federated learning are white-box federated aggregations, which means that malicious attackers know which defense indicator the server will adopt as a strategy and can design it in a targeted manner. Therefore, there is an urgent need for a widely used and universal defense strategy. In addition, attackers attack in different environments and data distributions, resulting in malicious gradients with different characteristics, which cannot be handled by a single indicator. To this end, the present invention proposes a variety of metrics, which use cosine similarity to define the gradient angle feature, Euclidean distance to define the length of the gradient, and Manhattan distance as its supplement in high-dimensional space to collaboratively identify malicious gradients.

[0098] S2. Dynamically calculate the Mahalanobis distance of each user model by inverting the covariance matrix to calculate the dynamic weight and score for each update. Two factors are primarily considered when calculating the weight of each feature: First, the different scales of the three distance metrics are a hurdle to their collaborative use. However, since each metric is correlated, a new regularization method is required, rather than the typical maximum value regularization. Second, different data distributions (such as varying degrees of non-IID) result in different gradients for malicious and benign users. Therefore, dynamic weighting is required to address various environments and attacks, achieving universal and general defense.

[0099] First, we need to calculate the matrix composed of the gradient model eigenvalues ​​of all current users:

[0100]

[0101] Where X is the matrix composed of K customer eigenvalue vectors, represents the transpose of the matrix, x′ 1 , x′ 2 ,...,x′ iThe eigenvalue vectors representing the K customers are calculated in step S1.

[0102] The next step is to calculate the matrix X = [x′ 1 , x′ 2 ,...,x′ i ] T The covariance matrix ∑ of is used as the weight of the round.

[0103] Taking the above two factors into consideration, the Mahalanobis distance is applied to dynamically weight and score the gradient features, as shown in the following formula:

[0104]

[0105] where d i is the discrete vector x′ passing through the i-th client (i) The score obtained, is x′ (i) The transpose of ∑ is the covariance matrix of the gradient feature matrix of all users selected for training. The inverse matrix obtained by inverting it is also called the precision matrix or concentration matrix, which reflects the relationship between different metrics. Using the inverse of the covariance as a weight can eliminate the differences in metrics and cluster information between different indicator features. It not only eliminates the differences in different dimensional standards, but also eliminates errors in judgment caused by variance. If the variance of the Manhattan distance feature is large and the variance of the Euclidean distance is small, then a gradient model with a small outlier on the Manhattan distance feature and a large outlier on the Euclidean distance feature will definitely have a higher outlier than a gradient model with a large outlier on the Manhattan distance feature and a small outlier on the Euclidean distance feature.

[0106] like Figure 4 As shown, point C is the cluster center. If the conventional method is used, point A is closer to C than point B, so B would be identified as an outlier. However, point B clearly conforms to the cluster characteristics more closely, so the outlier to be eliminated is point A. Therefore, a weight matrix is ​​needed to eliminate the differences in clustering directions. The inverse of the covariance matrix is ​​calculated based on the selected gradient. This dynamically changes the feature weights based on the feature distribution, hence the term "dynamic weighting." This dynamic weighting allows for better adaptation to diverse environments and protection against various attacks. The resulting Mahalanobis distance d is used as the score for each gradient. A larger distance and a higher score reflect a greater degree of anomaly in the gradient, and the gradient with the highest score is then eliminated.

[0107] S3. Aggregating Good Gradients: Using the Mahalanobis distance as a score, models with high scores are removed, and the remaining user models are aggregated to form a new global model. After obtaining the score for each gradient, the gradients with high scores are aggregated, as a high score indicates that the gradient has less divergence among all gradients. A fixed ratio p (p∈[0,1]) is set to represent the proportion of selected gradients, which is a tunable hyperparameter. Intuitively, model performance and the speed of training convergence are positively correlated with p. In contrast, the relationship between accuracy and p for backdoor tasks is much more complex. On the one hand, increasing p increases the probability of selecting backdoored gradients for training, which is detrimental to defending against backdoor attacks. On the other hand, increasing p mitigates the impact of selecting backdoored gradients, which is beneficial for defense. However, due to a lack of knowledge about the attackers (such as the number of attackers), the optimal p cannot be simply determined. To maintain simplicity, a predefined fixed p is used, and empirically demonstrates that the proposed defense is independent of the choice of p. It has been demonstrated that any value of p up to 0.9 provides good defense performance, with a value between 0.3 and 0.5 being optimal, balancing the advantages and disadvantages of both.

[0108] The detailed process steps of the method of the present invention include the following:

[0109] (1) Initialize the federated learning framework consisting of N clients. The following steps are the specific steps for each round until the preset training round is reached;

[0110] (2) The central server sends the initial global model w0 of the round to the K clients participating in this round of training;

[0111] (3) Each client uses its local data to train the model w0 locally and sends the trained local model w i Upload server, where w i The local model uploaded by the i-th client;

[0112] (4) The server receives K trained local models;

[0113] (5) Give the local model w to the i-th user respectively i Calculate the Manhattan distance of the model vector Euclidean distance and cosine distance

[0114] (6) Give the local model w to the i-th user respectively i Define and calculate the eigenvector x of its model vector i =(x i Man , x i Eul , xi Cosine );

[0115] (7) Give the local model w to the i-th user respectively i Calculate the dispersion of the Manhattan distance of the model vector in represents the sum of the absolute values ​​of the Manhattan distance differences between the i-th user and other users;

[0116] (8) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the Euclidean distance differences between the i-th user and other users;

[0117] (9) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the cosine distance differences between the i-th user and other users;

[0118] (10) Redefine and calculate the characteristic value of each client

[0119] (11) Calculate the matrix x = [x′ 1 , x′ 2 ,...,x′ i ] T ,in Represents the transpose of a matrix;

[0120] (12) Calculate the covariance matrix ∑ of the matrix X, and use the inverse matrix of the covariance matrix as the adaptive weight matrix for this round;

[0121] (13) Give the local model w to the i-th user respectively i Calculate its Mahalanobis distance d i and as its distance score, The lower the score, the more representative the model is of the entire model group;

[0122] (14) All K clients participating in this round of training are classified according to their distance scores d i Sort by

[0123] (15) Eliminate p user models with higher distance scores;

[0124] (16) Aggregate the remaining user models and use them as the global model w for this round of federated training* ;

[0125] (17) If the round reaches the preset federated training round, the training is exited. If not, jump to step (2) for a new round of federated training.

[0126] The decentralized and privacy-preserving nature of federated learning makes it vulnerable to backdoor attacks, which aim to manipulate the behavior of the resulting model on specific inputs chosen by the adversary. However, most existing defenses based on statistical differences are only effective against specific attacks, especially when the malicious gradients are similar to the benign gradients or the data are highly non-independent and identically distributed (non-IID). In this invention, a simple and effective defense strategy is proposed to adaptively identify backdoors using multiple indicators and dynamic weighting. In addition, the novel defense of the present invention does not rely on predefined assumptions about the attack setting or data distribution, and has little impact on benign performance. It solves the limitations of existing defense methods such as low defense efficiency, poor adaptability, poor recognition ability, and high defense cost.

[0127] At the same time, actual implementation found that on CIFAR10 data, in a highly complex environment with 200 participating users, only 10 users selected for training in each round, and a non-independent and identically distributed Dirichlet parameter of 0.5, in a severe environment with 4% attackers, and the attackers implemented an advanced attack such as Edge-case PGD that modified both the data and the model. After 1500 rounds of training, the backdoor accuracy of the federated learning model defended by the present invention was only 3.06%, while having excellent performance, far exceeding other SOTA (states of the art) methods.

[0128] Example 2

[0129] The basic logic of distance-based defense involves defining some indicative metrics that can effectively distinguish malicious gradients from benign ones and remove hostile updates from the aggregate. Therefore, the core issue becomes how to define a metric that can identify the characteristics of malicious gradients. However, the widely used Euclidean distance suffers from the "curse of dimensionality" and has been proven to have low discrimination in high-dimensional space, becoming meaningless. Therefore, Manhattan distance was introduced as a distinction. Existing methods often use Euclidean distance or cosine distance as a distinction metric in Euclidean space, but extensive practical work has found that they cannot effectively distinguish the distance differences between neighbors in high-dimensional space.

[0130] At the same time, the current method is to defend on the basis of a single indicator. Since there is only one metric, a cunning attacker can easily bypass them with a carefully designed gradient, and in actual working environments, most of the scenarios of federated learning are white-box federated aggregations, which means that malicious attackers know which defense indicator the server will adopt as a strategy and can design it in a targeted manner. Therefore, there is an urgent need for a widely used and universal defense strategy. In addition, attackers attack in different environments and data distributions, resulting in malicious gradients with different characteristics, which cannot be handled by a single indicator. To this end, the present invention proposes a variety of metrics, which use cosine similarity to define the gradient angle feature, Euclidean distance to define the length of the gradient, and Manhattan distance as its supplement in high-dimensional space to collaboratively identify malicious gradients.

[0131] Unlike Example 1, the calculation of the discreteness requires subtracting the eigenvalues ​​of each gradient model from the eigenvalues ​​of other gradient models, which increases the time complexity of the method implementation. This method increases the time cost and specifically includes the following steps: S1. Define the characteristics of the gradient, calculate the discreteness of the eigenvalues ​​of each user model, and use it as the new eigenvalue; the characteristics of the gradient are as follows:

[0132]

[0133]

[0134]

[0135] Among them, i is the i-th user, w i is the local model trained for the i-th user, w0 is the global model aggregated and distributed in the previous round; the gradient features trained for the i-th user include Manhattan distance Euclidean distance and cosine distance The user gradient feature information is expressed using the following formula:

[0136] x=(x Man , x Eul , x Cosine ) (4)

[0137] First calculate the average value of the gradient model feature value of all users:

[0138]

[0139]

[0140]

[0141] where mean Man 、meanEul 、mean Cosine are the average values ​​of Manhattan distance eigenvalues, Euclidean distance eigenvalues, and cosine distance eigenvalues ​​of the gradient model for all users in this round, are the Manhattan distance eigenvalue, Euclidean distance eigenvalue, and cosine distance eigenvalue of the gradient model of the i-th user in the K gradient models, respectively.

[0142] So we can get the average eigenvalue vector as:

[0143] mean=(mean Man ,mean Eul ,mean Cosine ) (8)

[0144] Where mean is the average value vector of this round, mean Man 、mean Eul 、mean Cosine are the average values ​​of Manhattan distance eigenvalues, Euclidean distance eigenvalues, and cosine distance eigenvalues ​​of the gradient model for all users in this round.

[0145] The basic logic of distance-based defense involves defining indicative metrics that can effectively distinguish malicious from benign gradients and remove adversarial updates from the aggregate. Therefore, the core issue becomes how to define a metric that can identify the characteristics of malicious gradients. However, the widely used Euclidean distance suffers from the "curse of dimensionality" and has been shown to have low discriminative power in high-dimensional spaces, becoming meaningless. Therefore, the Manhattan distance was introduced as a distinguishing factor.

[0146] Current methods rely on a single metric for defense. With only one metric, a sophisticated attacker can easily circumvent them with a carefully crafted gradient. Furthermore, attackers attack in diverse environments and data distributions, resulting in malicious gradients with varying characteristics that cannot be addressed by a single metric. To address this, this paper proposes multiple metrics, using cosine similarity to define gradient angle features, Euclidean distance to define gradient length, and Manhattan distance as a supplement in high-dimensional space to collaboratively identify malicious gradients.

[0147] S2. Dynamically calculate the Mahalanobis distance of each user model by inverting the covariance matrix to calculate the dynamic weight and score for each update. Two factors are primarily considered when calculating the weight of each feature: First, the different scales of the three distance metrics are a hurdle to their collaborative use. However, since each metric is correlated, a new regularization method is required, rather than the typical maximum value regularization. Second, different data distributions (such as varying degrees of non-IID) result in different gradients for malicious and benign users. Therefore, dynamic weighting is required to address various environments and attacks, achieving universal and general defense.

[0148] Calculate the matrix composed of the gradient model eigenvalues ​​of all current users:

[0149]

[0150] Where X is the matrix composed of K customer eigenvalue vectors, represents the transpose of the matrix, x 1 , x 2 ,...,x i The eigenvalue vectors representing the K customers are calculated in step S1.

[0151] The next step is to calculate the matrix The covariance matrix ∑ of is used as the weight of the round.

[0152] Taking the above two factors into consideration, the present invention applies Mahalanobis distance to dynamically weight and score gradient features, as shown in the following formula:

[0153]

[0154] where d i is the gradient model feature value x passing through the i-th client i The difference between the mean gradient model eigenvalue and the mean is calculated.

[0155] Where ∑ is the covariance matrix of the gradient feature matrix of all users participating in the training. The inverse matrix obtained by inverting it is also called the precision matrix or concentration matrix, which reflects the relationship between different metrics. Figure 4As shown, point C is the cluster center. If the conventional method is used, point A is closer to C than point B, so B would be identified as an outlier. However, point B clearly conforms to the cluster characteristics more closely, so the outlier to be eliminated is point A. Therefore, a weight matrix is ​​needed to eliminate the differences in clustering directions. The inverse of the covariance matrix is ​​calculated based on the selected gradient. This dynamically changes the feature weights based on the feature distribution, hence the term "dynamic weighting." This dynamic weighting allows for better adaptation to diverse environments and protection against various attacks. The resulting Mahalanobis distance d is used as the score for each gradient. A larger distance and a higher score reflect a greater degree of anomaly in the gradient, and the gradient with the highest score is then eliminated.

[0156] Step S3 is the same as in Example 1.

[0157] The detailed process steps of the method of the present invention include the following:

[0158] (1) Initialize the federated learning framework consisting of N clients. The following steps are the specific steps for each round until the preset training round is reached;

[0159] (2) The central server sends the initial global model w0 of the round to the K clients participating in this round of training;

[0160] (3) Each client uses its local data to train the model w0 locally and sends the trained local model w i Upload server, where w i The local model uploaded by the i-th client;

[0161] (4) The server receives K trained local models;

[0162] (5) Give the local model w to the i-th user respectively i Calculate the Manhattan distance of the model vector Euclidean distance and cosine distance

[0163] (6) Give the local model w to the i-th user respectively i Define and calculate the eigenvector x of its model vector i =(x i Man , x i Eul , x i Cosine );

[0164] (7) Calculate the average Manhattan distance feature value of the gradient model of K users,

[0165] (8) Calculate the average value of the Euclidean distance eigenvalues ​​of the gradient model of K users,

[0166] (9) Calculate the average value of the cosine distance eigenvalues ​​of the gradient model of K users,

[0167] (10) Calculate the mean vector of the eigenvalues ​​of the gradient model of K users, mean = (mean Man ,mean Eul ,mean Cosine )

[0168] (11) Calculate the matrix composed of the eigenvalue vectors of K customers in the current round in Represents the transpose of a matrix;

[0169] (12) Calculate the covariance matrix ∑ of the matrix X, and use the inverse matrix of the covariance matrix as the adaptive weight matrix for this round;

[0170] (13) Give the local model w to the i-th user respectively i Calculate its Mahalanobis distance d i and as its distance score, The lower the score, the more representative the model is of the entire model group;

[0171] (14) All K clients participating in this round of training are classified according to their distance scores d i Sort by

[0172] (15) Eliminate p user models with higher distance scores;

[0173] (16) Aggregate the remaining user models and use them as the global model w for this round of federated training * ;

[0174] (17) If the round reaches the preset federated training round, the training is exited. If not, jump to step (2) for a new round of federated training.

[0175] Example 3

[0176] Unlike Examples 1 and 2, Example 3 adds differential privacy noise after aggregation in step S3, which not only protects the privacy security of the user gradient model, but also gradually eliminates a small number of backdoor attacks that have managed to pass through the defenses of steps S1 and S2 through noise.

[0177] S3. Aggregating Benign Gradients: Using the Mahalanobis distance as a score, models with higher scores are removed, and the remaining user models are aggregated to form a new global model. After obtaining the score for each gradient, the gradients with higher scores are aggregated, as a higher score indicates that the gradient has less divergence among all gradients. A fixed ratio p (p∈[0, 1]) is set to represent the proportion of selected gradients, which is a tunable hyperparameter. Intuitively, model performance and the speed of training convergence are positively correlated with p. In contrast, the relationship between accuracy and p on backdoor tasks is much more complex. On the one hand, increasing p increases the probability of selecting backdoored gradients for training, which is detrimental to defending against backdoor attacks. On the other hand, increasing p mitigates the impact of selecting backdoored gradients, which is beneficial for defense. However, due to a lack of knowledge about the attackers (such as the number of attackers), the optimal p cannot be simply determined. To maintain simplicity, a predefined fixed p is used, and empirically demonstrates that the proposed defense does not depend on the choice of p.

[0178] The global model after aggregation is w * , add sufficient Gaussian noise to the global model, the formula is as follows:

[0179]

[0180] where w * ′ is the new global model, w * For the old global model Represents a mean of 0 and a variance of σ 2 The normal distribution (Gaussian distribution), also known as Gaussian noise, has a standard deviation of σ. Even with the most stringent defense algorithms, over a large number of training rounds, small backdoors may be accidentally injected into the model. By adding noise, the model's attention is drawn to neurons, triggering a certain amount of retraining, thereby gradually eliminating backdoors. Extensive experiments have demonstrated that a standard deviation of only 0.0025 can gradually eliminate backdoors that have managed to bypass defenses and remain in the global model. Adding Gaussian noise not only gradually eliminates backdoors and improves the security of federated learning models, but also defends against differential attacks launched by "curious participants," protecting the data security and privacy of participating users.

[0181] Extensive experiments have demonstrated that a standard deviation of just 0.0025 can gradually eliminate backdoors that have managed to bypass defenses and remain in the global model. Adding Gaussian noise not only gradually eliminates backdoors, improving the security of federated learning models, but also protects against differential attacks launched by "curious participants," safeguarding the data and privacy of participating users.

[0182] The detailed process steps of the method of the present invention include the following:

[0183] (1) Initialize the federated learning framework consisting of N clients. The following steps are the specific steps for each round until the preset training round is reached;

[0184] (2) The central server sends the initial global model w0 of the round to the K clients participating in this round of training;

[0185] (3) Each client uses its local data to train the model w0 locally and sends the trained local model w i Upload server, where w i The local model uploaded by the i-th client;

[0186] (4) The server receives K trained local models;

[0187] (5) Give the local model w to the i-th user respectively i Calculate the Manhattan distance of the model vector Euclidean distance and cosine distance

[0188] (6) Give the local model w to the i-th user respectively i Define and calculate the eigenvector x of its model vector i =(x i Man , x i Eul , x i cosine );

[0189] (7) Give the local model w to the i-th user respectively i Calculate the dispersion of the Manhattan distance of the model vector in represents the sum of the absolute values ​​of the Manhattan distance differences between the i-th user and other users;

[0190] (8) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the Euclidean distance differences between the i-th user and other users;

[0191] (9) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the cosine distance differences between the i-th user and other users;

[0192] (10) Redefine and calculate the characteristic value of each client

[0193] (11) Calculate the matrix x = [x′ 1 , x′ 2 ,...,x′ i ] T ,in Represents the transpose of a matrix;

[0194] (12) Calculate the covariance matrix ∑ of the matrix X, and use the inverse matrix of the covariance matrix as the adaptive weight matrix for this round;

[0195] (13) Give the local model w to the i-th user respectively i Calculate its Mahalanobis distance d i and as its distance score, The lower the score, the more representative the model is of the entire model group;

[0196] (14) All K clients participating in this round of training are classified according to their distance scores d i Sort by

[0197] (15) Eliminate p user models with higher distance scores;

[0198] (16) Aggregate the remaining user models and use them as the global model w for this round of federated training * ;

[0199] (17) Add differential privacy noise with standard deviation σ to the global model w* and obtain the new global model

[0200]

[0201] (18) If the round reaches the preset federated training round, the training is exited. If not, jump to step (2) for a new round of federated training.

[0202] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for dynamically identifying backdoor attacks in federated learning based on multi-dimensional indicators, characterized by: The following steps are involved: S1. Initialize the federated learning framework, define and calculate gradient features, and define and calculate the feature values ​​of each client; The characteristics that define the gradient are as follows: Among them, i is the i-th user, w i is the local model trained for the i-th user, w0 is the global model aggregated and distributed in the previous round; the gradient features trained for the i-th user include Manhattan distance Euclidean distance and cosine distance The user gradient feature information is expressed using the following formula: x=(x Man ,x Eul ,x Cosine ) (4); Using dispersion as the basis for judging whether a gradient is an outlier, we define and calculate the eigenvalues ​​of the model for each customer: in are the redefined eigenvalues, is the original eigenvalue of the gradient model, and It is all the gradients uploaded in this round except Other gradients than S2. Use Mahalanobis distance to calculate the client's dynamic weight and score, according to the distance score d i Sort by Use Mahalanobis distance to weight gradient features and calculate dynamic weights and scores: Where Σ is the covariance matrix of the gradient feature matrix of all users participating in the training in the round, and the inverse matrix obtained by inverting it is used as the dynamic weight of this round, d i is the discrete vector x passing through the i-th client ′(i) The obtained score, x ′(i)T is x ′(i) The transpose of S3, remove attack gradients, aggregate benign gradients and add noise.

2. The method for defending against backdoor attacks in federated learning based on dynamic identification of multi-dimensional indicators according to claim 1 is characterized in that: After defining the gradient features, the feature information of the user gradient is expressed using the following formula: where x ′(i) represents the discreteness vector of the i-th client, Indicates the difference between the i-th client and the remaining clients x in the K clients selected in this round j The sum of the absolute values ​​of the differences in Manhattan distance is used as the dispersion of the indicator. and are the dispersion in Euclidean distance and cosine distance indicators respectively.

3. The method for defending against backdoor attacks in federated learning based on dynamic identification of multi-dimensional indicators according to claim 1, characterized in that: Initializing a federated learning framework consisting of N clients includes the following steps: (1) The central server sends the initial global model w0 of the round to the K clients participating in this round of training; (2) Each client uses its local data to train the model w0 locally, and then uses the trained local model w i Upload server, where w i The local model uploaded by the i-th client; (3) The server receives K trained local models.

4. The method for defending against backdoor attacks in federated learning based on dynamic identification of multi-dimensional indicators according to claim 1, characterized in that: Define and calculate the characteristic value of each client, including the following steps 1) Give the local model w to the i-th user respectively i Calculate the Manhattan distance of the model vector Euclidean distance and cosine distance 2) Give the local model w to the i-th user respectively i Define and calculate the eigenvector of its model vector 3) Give the local model w to the i-th user respectively i Calculate the dispersion of the Manhattan distance of the model vector in represents the sum of the absolute values ​​of the Manhattan distance differences between the i-th user and other users; 4) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the Euclidean distance differences between the i-th user and other users; 5) Give the local model w to the i-th user respectively i Calculate the Euclidean distance dispersion of the model vector in represents the sum of the absolute values ​​of the cosine distance differences between the i-th user and other users; 6) Redefine and calculate the characteristic value of each client as follows: 7) Calculate the matrix composed of the eigenvalue vectors of K customers in the current round in Represents the transpose of a matrix.

5. The method for defending against backdoor attacks in federated learning based on dynamic identification of multi-dimensional indicators according to claim 1, characterized in that: Step S2 includes the following steps: S21. Calculate the covariance matrix Σ of the matrix X composed of the eigenvalue vectors of the K customers, and use the inverse matrix of the covariance matrix as the adaptive weight matrix for this round; S22, give the local model w to the i-th user respectively i Calculate its Mahalanobis distance d i and as its distance score, The lower the score, the more the local model of the i-th user can represent the group of local models of all users; S23, all K clients participating in the training in this round are classified according to their distance scores d i Sort.

6. The method for defending against backdoor attacks in federated learning based on dynamic identification of multi-dimensional indicators according to any one of claims 1 to 5, characterized in that: Step S3 includes the following steps: S31, remove the local models of p users with higher distance scores; S32, aggregate the remaining user models and use them as the global model w for this round of federated training * ; S33, to the global model w * Add differential privacy noise; S34. If the round reaches the preset federation training round, the training is exited; if not, a new round of federation training is performed.

Images