A poisoning attack defense method for a federated learning system based on RDP

Abstract

The application discloses a poisoning attack defense method for a federated learning system based on RDP, and comprises the following steps: a client uses a received global model as an initial model, and after training by using local training data, sends local model parameters and full connection layer output to a server; the server accepts the local model parameters and the full connection layer output uploaded by the client, inputs the full connection layer output of the client into RDP to obtain an abnormal score, filters clients with excessively high abnormal degrees according to the abnormal score, and obtains a normal client set; the server calculates a corresponding weight coefficient according to the abnormal score of each normal client, performs weighted calculation on the local model parameters of all normal clients in the current round of training according to the weight coefficient, obtains global model parameters, and distributes the global model to the clients.

Description

TECHNICAL FIELD

[0001] The present application relates to a RDP-based federated learning system poisoning attack defense method, belonging to the technical field of federated learning system security. BACKGROUND

[0002] Federated learning is a new distributed machine learning paradigm. A federated learning system generally consists of many clients and a central server. The global model is on the central server, and the local model is on each client. The federated learning system allows multiple clients (such as smartphones, Internet of Things devices, edge computing nodes, etc.) to jointly learn a machine learning model without sharing their own training data. This model is called the global model. Generally, federated learning performs multiple rounds of training to obtain a global model with good generalization performance. Each round of training includes the following three steps: the server sends the current global model to the selected clients for this training round; each selected client fine-tunes the received global model on its own training data and sends the model update back to the server; the server aggregates the model updates sent back by the selected clients according to a specific aggregation rule and updates the global model. In federated learning, each client only needs to interact with its own data, without uploading data to the server, greatly reducing the risk of privacy leakage. Therefore, federated learning has higher privacy than traditional centralized learning.

[0003] However, due to the distributed nature of federated learning, it is vulnerable to model poisoning attacks. In a model poisoning attack, malicious clients controlled by attackers destroy the global model by sending tampered model updates to the server. Depending on the attack goal, model poisoning attacks can be divided into non-targeted model poisoning attacks and targeted model poisoning attacks.

[0004] The goal of non-targeted model poisoning attacks is to reduce the generalization performance of the global model. Attackers will tamper with local model updates to destroy the overall accuracy of the global model, making it have low test precision for any input data. For example, attackers will send updates opposite to the current global model update direction back to the server. Existing non-targeted model poisoning attacks include the following steps: a malicious client controlled by an attacker obtains normal local model updates based on real local training data; the malicious client tampers with the real local model updates to maximize the difference between the global model updates before and after the attack, so that the poisoned global model updates deviate significantly from the normal model updates.

[0005] The targeted model poisoning attack aims to make the global model output the target label specified by the attacker for specific data. The attacker will embed a specific trigger in the input data, so that the poisoned global model will predict these data as the label preset by the attacker. For example, in image recognition, the trigger can be a specific pixel pattern in the picture, and in natural language processing, the trigger can be a specific word in the sentence. Existing targeted model poisoning attacks include the following steps: the malicious client controlled by the attacker embeds a trigger in part of the local training data and modifies the label to the target label, and on this basis, the local model is trained and updated; the malicious client amplifies the update before sending it back to the server to increase the attack effect, so that the server cannot eliminate the malicious influence.

[0006] Model poisoning attacks pose a threat to the security of federated learning systems. Existing defense methods against model poisoning attacks can be divided into Byzantine-tolerant federated learning methods and provably robust federated learning methods. The goal of these methods is to ensure the generalization performance of the global model even in the presence of malicious clients sending arbitrary model updates to the server. Byzantine-tolerant federated learning methods can theoretically bound the model updates from malicious clients, achieving robustness by limiting the impact of malicious clients on global model parameters. Provable robust federated learning methods achieve robustness by guaranteeing a lower bound on the test accuracy of the global model in the presence of malicious clients. These defense methods can only resist a small number of malicious clients or require the server to hold a normal validation dataset, however, in a typical federated learning scenario, there are usually a large number of clients and the server is only responsible for distributing aggregated model parameters and does not hold data, so these defense techniques are difficult to use in typical federated learning scenarios.

[0007] Therefore, in order to deal with model poisoning attacks in federated learning systems, a feasible defense scheme needs to be designed to ensure the availability of global models in federated learning. SUMMARY

[0008] The purpose of the application is to solve the problems and deficiencies in the prior art, and the application provides a federated learning system poisoning attack defense method based on random distance prediction (RDP). This method collects the full connection layer output of the client, inputs it into the RDP to obtain an abnormal score, and excludes clients with high abnormality degree for aggregation, which can effectively defend against model poisoning attacks in federated learning.

[0009] The technical solution provided by the application is: a federated learning system poisoning attack defense method based on random distance prediction (RDP), comprising the following steps:

[0010] Step 1: The client uses the received global model as the initial model, trains it using local training data, and then sends the local model parameters and the output of the fully connected layer to the server.

[0011] Step 2: The server accepts the local model parameters and fully connected layer output uploaded by the client, inputs the client's fully connected layer output into RDP to obtain the anomaly score, filters clients whose anomaly level exceeds the preset value based on the anomaly score, and obtains a set of normal clients.

[0012] Step 3: The server calculates the corresponding weight coefficient based on the abnormal score of each normal client, and then calculates the global model parameters by weighting the local model parameters of all normal clients in the current round of training based on the weight coefficient. The global model is then distributed to the clients.

[0013] Preferably, step 1 specifically includes:

[0014] Step 1.1: The client sends the global model parameters from the previous round sent by the server. As initial model parameters;

[0015] Step 1.2, the client uses local training data ,according to Training local model parameters ,in For learning rate, The loss function;

[0016] Step 1.3, the client will transfer the local model parameters. Output of fully connected layer Send to the server.

[0017] Preferably, step 2 specifically includes:

[0018] Step 2.1: The server accepts the local model parameters uploaded by the client. Output of fully connected layer ;

[0019] Step 2.2: The server outputs the fully connected layer data collected in this round. As a training set Used for training RDP;

[0020] Step 2.3: The server uses the trained RDP and the fully connected layer output of each client. Obtain the corresponding abnormal score;

[0021] Step 2.4: The server considers clients whose abnormality level exceeds a preset value as malicious clients and filters them to obtain a set of normal clients.

[0022] The RDP in step 2.2 is a method for obtaining data reconstruction features, which can reduce the data dimension while maintaining the relationship between the original data, and extract deep features. The RDP consists of a shared weight Siamese neural network SiameseNet and a mapping neural network MappingNet; the Siamese neural network SiameseNet consists of a fully connected layer, and the mapping neural network MappingNet consists of two fully connected layers and a Dropout layer in between.

[0023] The Dropout layer will randomly set the weight values of the neurons in the layer to 0 according to the specified probability during each training period, and will maintain the original weight values of the Dropout layer during the prediction stage.

[0024] Further preferably, the step 2.2 specifically includes:

[0025] Step 2.2.1, input a pair of fully connected layer outputs x i and x j to the Siamese neural network SiameseNet to obtain corresponding features and ;

[0026] Step 2.2.2, input a pair of fully connected layer outputs x i and x j to the mapping neural network MappingNet to obtain corresponding reconstruction features and ;

[0027] Step 2.2.3, take as the training loss function of RDP, so that the Siamese neural network SiameseNet approximates the mapping neural network MappingNet to be learned; The first part of the training loss function is to provide supervision information for learning the internal features of the data; The second part of the training loss function is used to learn the high-frequency features of the data.

[0028] Further preferably, in step 2.2.3, , ;

[0029] Further preferably, in step 2.3, the server inputs the fully connected layer outputs of each client to the trained Siamese neural network SiameseNet and mapping neural network MappingNet respectively to obtain corresponding features and reconstruction features , according to The formula calculates the anomaly score for each client;

[0030] Further preferably, in step 2.4, the server calculates the mean of the abnormal scores of all clients and filters out clients with abnormal scores higher than the mean, thus obtaining a set of normal clients. .

[0031] Preferably, step 3 above specifically includes:

[0032] Step 3.1, the server uses the formula Calculate the weight coefficient for each normal client. ; This represents the number of normal clients obtained by the server after filtering out abnormal clients in step 2. and Representing the first The client and the first Abnormal scores for each client;

[0033] Step 3.2, the server uses the formula The global model parameters are obtained by aggregating the model parameters of all normal clients; For the first The client in the first The model parameters submitted in each round;

[0034] Step 3.3: The server distributes the weighted global model to the clients.

[0035] This invention proposes a defense method based on an RDP anomaly detection mechanism to address poisoning attacks in federated learning systems. The method first requires the server to collect the output of the fully connected layers from clients. Then, it uses the RDP algorithm to detect anomalies in the client outputs and filters out legitimate clients based on anomaly scores. Next, it calculates the corresponding weight coefficients using the anomaly scores of legitimate clients, thereby determining the degree of influence of the client's local model on the global model parameters.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] Using the output of the fully connected layer instead of local model parameters as the basis for detecting the client's anomaly level reduces the space for attacker manipulation and effectively avoids client privacy leaks, thereby increasing the system's security and privacy. Using RDP as an anomaly detection method can more effectively identify model poisoning attacks. By calculating weight coefficients through anomaly scores, the impact of a client on the global model is determined according to the degree of anomaly. Clients with higher anomaly levels have lower weight coefficients, effectively reducing the impact of abnormal client model poisoning attacks. Attached Figure Description

[0038] Figure 1 A system structure schematic diagram for the RDP-based federated learning system poisoning attack defense method in the embodiment of the present application;

[0039] Figure 2 A flowchart schematic diagram for the RDP-based federated learning system poisoning attack defense method in the embodiment of the present application;

[0040] Figure 3 A structure schematic diagram for the RDP in the embodiment of the present application. DETAILED DESCRIPTION

[0041] The present application will be further illustrated below in conjunction with specific embodiments, which should be understood as merely illustrating the present application but not limiting the scope of the present application, and various equivalent modifications of the present application made by those skilled in the art after reading the present application all fall within the scope defined by the claims attached hereto.

[0042] Figure 1 The system structure of the RDP-based federated learning system poisoning attack defense method described in the present application is shown. In the federated learning system poisoning attack defense system, there are normal clients, malicious clients and a server. The normal clients and the malicious clients both hold traffic sign pictures with correct labels and have consistent network structures of local models. In the present embodiment, the goal of the normal clients is to train local models and upload the parameters of the local models to the center server to participate in building a global model; in the present embodiment, the goal of the malicious clients is to implement a targeted model poisoning attack, that is, for traffic sign pictures containing a specific pixel pattern, the global model obtained by the server at last will recognize them as the label specified by the malicious clients, thereby bringing safety hazards to the field of autonomous driving and the like; in the present embodiment, the goal of the server is to obtain the abnormality degree of each client by using the RDP anomaly detection mechanism under the condition that each client does not share the data held by each client, reduce the influence of the toxic model parameters provided by the malicious clients by filtering and weight reduction, and obtain a global model for traffic sign picture classification with good generalization performance.

[0043] As shown in Figure 2 , the RDP-based federated learning system poisoning attack defense method of the present application includes the following steps:

[0044] Step 1, the client uses the received global model as an initial model, trains it using local training data, and then sends the local model parameters and the full connection layer output to the server;

[0045] In this embodiment, the global model accepted by the client is used to identify traffic sign pictures, the local training data held by the client is traffic sign pictures with correct labels, and after the model is trained using the stochastic gradient descent algorithm, the local model parameters and the full connection layer output are uploaded to the server. Specifically, the following steps are included:

[0046] Step 1.1, the client uploads the global model parameters of the last round sent by the server as the initial model parameters;

[0047] Step 1.2, the client uses the local traffic sign training data to train the local model parameters according to the formula using the stochastic gradient descent algorithm , where is the learning rate, is the loss function;

[0048] Step 1.3, the client sends the local model parameters and the full connection layer output to the server.

[0049] In this embodiment, the full connection layer is located before the output layer in the local model architecture. It connects all neurons of the previous layer to all neurons of the next layer to achieve comprehensive consideration and processing of the input data, thereby determining the output result. The full connection layer is the core part of various types of neural network architectures such as convolutional neural networks and recurrent neural networks, and is usually used in multi-layer neural networks; the full connection layer output is the output matrix of the full connection layer after the training data is input to the local model.

[0050] Step 2, the server accepts the local model parameters and the full connection layer output uploaded by the client, inputs the full connection layer output of the client into the RDP to obtain an anomaly score, filters the clients with excessively high anomaly degree according to the anomaly score, and obtains a normal client set; Specifically, the following steps are included:

[0051] Step 2.1, the server accepts the local model parameters and the full connection layer output uploaded by the client;

[0052] The server determines the degree of anomaly in the local model based on the client's fully connected layer output, rather than the local model parameters. Using the client's fully connected layer output as the criterion for judging model anomaly is advantageous for several reasons. First, the number of parameters in the fully connected layer's output matrix is ​​far less than the number of parameters in the local model. Therefore, compared to other aggregation algorithms that use local model parameters as the criterion, this invention requires less computation and is more efficient. Second, the fully connected layer output is related to the parameters of each preceding neural network layer. If a malicious client wants its uploaded fully connected layer output to be similar to that of a normal client, it cannot significantly modify the parameters of a particular neural network layer, thus greatly reducing its attack manipulation space. Finally, while the local model parameters provided by each client tend to be consistent as the global model converges, the fully connected layer outputs still differ significantly due to conflicts between the labels of specific data held by malicious clients and those of normal clients. Therefore, at the end of the federated learning system's training phase, the fully connected layer output can still effectively distinguish between the malicious client model and the normal client model.

[0053] Step 2.2: The server outputs the fully connected layer data collected in this round. As a training set Used for training RDP;

[0054] The server uses the Random Distance Prediction (RDP) method to measure the anomaly level of clients. RDP learns a low-dimensional representation of high-dimensional data by predicting random distances. First, RDP randomly selects data points and calculates the distances between them; then, RDP learns the low-dimensional representation by learning the mapping from the data representation in the high-dimensional space to random distances in the low-dimensional space. RDP can learn more structured and semantic low-dimensional representations without using any label information, thus making it suitable for unsupervised applications, such as anomaly detection in this invention.

[0055] like Figure 3 As shown, in this embodiment, RDP consists of a Siamese neural network (SiameseNet) with shared weights and a Mapping neural network (MappingNet). The SiameseNet consists of a fully connected layer, and the MappingNet consists of two fully connected layers and an intermediate Dropout layer. Training RDP includes the following steps:

[0056] Step 2.2.1, output the pair of fully connected layers. and The corresponding features are obtained by inputting them into the SiameseNet neural network. and ;

[0057] Step 2.2.2, output of this pair of fully connected layers to the mapping neural network MappingNet to obtain corresponding reconstruction features ;

[0058] Step 2.2.3, output of this pair of fully connected layers as the training loss function of RDP, so that the SiameseNet approximates the mapping neural network MappingNet to be learned.

[0059] In this embodiment, , minimize It is helpful to learn the representation with higher frequency in the data, and the abnormal data has lower frequency, so the abnormal data usually has larger Because involves the mean square error between two vectors, therefore the dimensions of and

[0060] Step 2.3, the server uses the trained RDP and the fully connected layer output of each client to obtain the corresponding anomaly score;

[0061] In this embodiment, the server inputs the fully connected layer output of each client to the trained SiameseNet and MappingNet respectively to obtain corresponding features and reconstruction features According to the formula, the anomaly score of each client is calculated, because the abnormal data does not conform to the normal distribution, the feature obtained by SiameseNet is quite different from the reconstruction feature obtained by MappingNet, so the corresponding anomaly score is also larger. Step 2.4, the server regards the client with higher anomaly degree as a malicious client, and filters it to obtain a normal client set;

[0062] In this embodiment, the server calculates the mean of the anomaly scores of the clients, and filters out the clients with anomaly scores higher than the mean to obtain a normal client set

[0063] ​​​If the server wants to retain more normal clients, it can choose to filter out the top 5% of clients with the highest anomaly scores and treat the remaining clients as normal clients. .

[0064] Step 3: The server calculates the corresponding weight coefficient based on the abnormal score of each normal client, and then calculates the global model parameters by weighting the local model parameters of all normal clients in this round of training based on the weight coefficient. The global model is then distributed to the clients.

[0065] By reducing the normal client Reducing the weight coefficients of clients with high outlier scores can accelerate the convergence of the global model. In federated learning scenarios, although some normal clients may have reliable data, their training data may not follow a normal distribution or may contain incorrect labels, making it difficult for the global model to converge or reducing its usability. Therefore, by reducing the weight coefficients of clients with high outlier scores, we can ensure that the local models of clients holding reliable data contribute more to the global model, thereby improving the accuracy and stability of the global model. Specifically, this includes the following steps:

[0066] Step 3.1, the server uses the formula Calculate the weight coefficient for each normal client. ;

[0067] In this embodiment, the client's weight coefficient is calculated based on the client's anomaly score. The anomaly score is taken first during the calculation. The opposite of the value is then used for the Softmax operation, i.e. This operation is a common algorithm for solving classification problems; it transforms a vector into a probability distribution. The Softmax operation ensures that clients with higher outlier scores have smaller weight coefficients, thus minimizing their impact on the global model. It also guarantees that the sum of the weight coefficients of all clients participating in the global model aggregation is 1. Therefore, using this formula to calculate the weight coefficients not only achieves reasonable handling of outlier client scores but also helps maintain the reliability of the global model.

[0068] Step 3.2, the server uses the formula The global model parameters are obtained by aggregating the model parameters of all normal clients;

[0069] In this embodiment, the server first obtains the local model parameters of all normal clients, and then uses the formula... By combining all local model parameters, the global model parameters are calculated. The core of the formula is to calculate the weighted sum of the local model parameters of all normal clients, where the weight coefficients... is calculated by the previous abnormal score of the client, which can ensure the consistency of the weight when building the global model, that is, the higher the abnormal score of the client, the smaller the weight coefficient, and the lower the influence on the global model.

[0070] Step 3.3, the server distributes the global model calculated by the weight to the client.

[0071] In this embodiment, the client and the server repeatedly perform the above steps 1, 2 and 3 until the test accuracy of the global model meets the requirement or the number of repetitions reaches the threshold value specified by the server in advance, at which time the server obtains a global model for traffic sign picture classification with good generalization performance.

[0072] In this embodiment, the server uses RDP to detect the abnormality of the client according to the full connection output, and realizes the defense against model poisoning attacks in the federated learning scene through the screening of the client and the allocation of the weight. The screening of the client means filtering the client according to the abnormal score, selecting normal clients to participate in federated learning, and ensuring the accuracy of the global model. The allocation of the weight means calculating the weight coefficient according to the abnormal score of the normal client, which can determine the influence degree of the local model parameters of the client on the global model parameters, and ensure the stability of the global model.

Claims

1. A method for defending against poisoning attacks in a federated learning system based on RDP, characterized in that, The method comprises the following steps: Step 1, the client uses the received global model as an initial model, and after training using local training data, sends local model parameters and full connection layer output to the server; Step 2, the server accepts the local model parameters and full connection layer output uploaded by the client, inputs the full connection layer output of the client into RDP to obtain an anomaly score, filters clients whose anomaly degree exceeds a preset value according to the anomaly score, and obtains a normal client set; Step 3, the server calculates a corresponding weight coefficient according to the anomaly score of each normal client, obtains global model parameters by weighted calculation of the local model parameters of all normal clients in the current round of training according to the weight coefficient, and distributes the global model to the clients; The step 2 specifically comprises: Step 2.1, the server accepts the local model parameters uploaded by the client with the fully connected layer output ; Step 2.2, the server will collect the full connection layer output of this round as the training set for training RDP; Step 2.

3. The server uses the trained RDP with the fully connected layer output of each client obtain a corresponding anomaly score; Step 2.4, the server considers the client whose abnormal degree exceeds the preset value as a malicious client, and filters it to obtain a normal client set ; The step 2.2 specifically comprises: Step 2.2.1, output of a pair of fully connected layers with input to a Siamese neural network SiameseNet to get corresponding features with ; Step 2.2.2, output of this pair of fully connected layers with is input to the mapping neural network MappingNet to obtain the corresponding reconstructed feature with ; Step 2.2.3, to As the training loss function for the RDP, the SiameseNet is trained by stochastic gradient descent to approximate the mapping neural network MappingNet that is to be learned, is the first part of the training loss function; is the second part of the training loss function.

2. The RDP-based federated learning system poisoning attack defense method according to claim 1, characterized in that, The step 1 specifically comprises: Step 1.1, the client sends the server the global model parameters of the previous round as initial model parameters; Step 1.2, Client uses local training data , according to Train local model parameters where is the learning rate, is the loss function; Step 1.3, the client sends the local model parameters to the server with the fully connected layer output ​ 3.The RDP-based federated learning system poisoning attack defense method of claim 1, wherein, The output of the full connection layer of step 1 refers to the output matrix of the full connection layer after inputting the training data to the local model; the full connection layer refers to the connection structure located before the output layer in the local model architecture, connecting all nodes of the previous layer of neural network to each node of the next layer of neural network.

4. The RDP-based federated learning system poisoning attack defense method of claim 1, wherein, The RDP in the step 2.2 is composed of a shared weight Siamese neural network SiameseNet and a mapping neural network MappingNet; the Siamese neural network SiameseNet is composed of a full connection layer, and the mapping neural network MappingNet is composed of two full connection layers and a Dropout layer in the middle.

5. The RDP-based federated learning system poisoning attack defense method according to claim 4, characterized in that, The Dropout layer will randomly set the weight values of neurons in the layer to 0 according to a specified probability during each training, and will keep the original weight values during the prediction stage.

6. The RDP-based federated learning system poisoning attack defense method according to claim 1, wherein, the step 2.2.3 in , .

7. The RDP-based federated learning system poisoning attack defense method according to claim 1, wherein, The step 2.4 calculates the mean of the anomaly scores of the clients by the server, and after filtering out the clients with anomaly scores higher than the mean, a normal client set is obtained .

8. The RDP-based federated learning system poisoning attack defense method of claim 1, wherein, The step 3 specifically comprises: Step 3.1, the server calculates the weight coefficient corresponding to each normal client according to the formula ; ; the number of normal clients obtained by the server after filtering out abnormal clients in step 2; ; respectively represent the abnormal scores of the jth client and the kth client. Step 3.2, the server computes the global model parameters according to the formula Aggregate all normal client model parameters to get global model parameters; Step 3.3, the server distributes the global model obtained by the weighted calculation to the clients.

Images