A method for identifying a poisoning attack in a third-party-free longitudinal federated learning environment

Abstract

The application discloses a kind of poisoning attack identification method in third-party-free longitudinal federal learning environment, belong to federal learning field technology.For the detection method of existing third-party-free longitudinal federal learning poisoning attack, different participants need to be selected to build multiple models in each round of training, and the participants not selected in the combination with good effect are identified as poisoning participants, the problem of excessive time and training overhead, a kind of efficient method for identifying poisoning attack is disclosed.The method calculates the contribution value of the participant through the parameter in the model, when the contribution value tends to be stable, the evaluation value is generated by comprehensive evaluation of the contribution value of the participant through d-s evidence theory, and the threshold value is dynamically adjusted.The participants with evaluation value less than the threshold value are identified as poisoning participants.This method does not establish redundant models in each round of training, and the poisoning participant identification process does not generate additional communication overhead, with small time overhead and high identification efficiency.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of federated learning, and particularly relates to a method for identifying poisoning attacks in a third-party-free vertical federated learning environment. BACKGROUND

[0002] Machine learning has become a focus of academic research in recent years. Big data and data mining provide rich training data for machine learning, but this involves privacy issues of data providers. Federated learning can complete machine learning training while ensuring data privacy. Federated learning has at least one aggregator and multiple participants, the participants are data contributors, and a machine learning model is built at the aggregator, but each participant does not disclose its own local data. Instead, the participant transmits the parameters required by the model to the aggregator during model construction, and further protects the parameters through multi-party secure computation or homomorphic encryption technology to prevent data leakage. Vertical federated learning is a type of federated learning, and the sample spaces of the data in each participant are the same, but the feature spaces are different. Vertical federated learning can aggregate data with different feature spaces without introducing a third party as an aggregator. By setting the aggregation function in a participant, various security problems caused by the presence of a third party can be avoided. Third-party-free vertical federated learning is a decision tree algorithm based on boosting, composed of multiple CART trees. Federated learning effectively protects the privacy of participants by not disclosing local data, but it cannot identify whether there is a problem with the data by direct observation, which provides an opportunity for a poisoning participant to attack the machine model. Poisoning attack is a way for a poisoning participant to pollute the model by adding poisoning data or modifying normal data to pollute the training parameters and reduce the accuracy of the machine learning model prediction. Current methods for identifying poisoning data mostly involve direct analysis of the data, which requires data visibility. The characteristics of federated learning, which do not disclose data, make it more difficult to identify poisoning attacks. Third-party-free vertical federated learning technology has important applications in reality. The current method for identifying poisoning participants is to calculate the sharply value, which involves continuously selecting different numbers of participants for permutation and combination, comparing the contribution of each combination to the model accuracy, and identifying the unselected participants in some high-contribution combinations as poisoning participants. However, this method requires training multiple machine learning models each round, and each time a model is built in third-party-free vertical federated learning, it needs to communicate with all participants, resulting in high training and communication costs and time-consuming and labor-intensive. Therefore, how to efficiently identify poisoning attacks in third-party-free vertical federated learning has become an important problem. SUMMARY

[0003] To address the problem of low efficiency of poisoning attack detection methods in third-party-free vertical federated learning, a method for detecting poisoning attacks in a third-party-free vertical federated learning environment is proposed.

[0004] A method for detecting poisoning attacks in a third-party-free longitudinal federated learning environment, characterized as follows:

[0005] The method identifies the poisoning participants during the construction of the federated learning model. Each round of machine learning training evaluates the participants, and no additional models need to be constructed. Only necessary parameters need to be recorded, and the normal training overhead is almost indistinguishable. The method includes multiple participants, each of which has the same sample space and different feature spaces. One participant is selected as the aggregator. Taking one participant and one aggregator as an example, in the tth round of training, the aggregator first calculates the relevant parameters of the loss function and sends them to each participant after encryption through homomorphic encryption technology. The participants calculate the necessary parameters for model construction based on the encrypted data and send them to the aggregator. The aggregator decrypts and divides the nodes. This process is repeated until a CART is completed, and the tth round of training is complete. After the tth round of training, the parameters of each participant are recorded, and the contribution value of each participant is calculated. When the contribution value is stable, the evaluation value is calculated using the d-s evidence theory. The evaluation value is compared with the dynamic threshold to screen out the poisoning participants.

[0006] The method for identifying data poisoning in a third-party-free longitudinal federated learning environment includes a third-party-free longitudinal federated learning model initialization, a machine learning model construction module, a poisoning participant identification module, and data interaction between the two modules. The steps are implemented as follows:

[0007] Step 1: Initialize the third-party-free longitudinal federated learning model. Set up multiple participants, each of which has the same sample space and different feature spaces. Randomly select one participant as the aggregator. Randomly select a participant for a poisoning attack. Initialize the poisoning threshold and each parameter in the model. Participants with an evaluation value less than the poisoning threshold are identified as poisoning participants.

[0008] The machine learning model construction module and the poisoning participant identification module are run once per round of training. During training, the aggregator queries local data and interacts with each participant.

[0009] Step 2: The machine learning model construction module is run once per round of training to generate a CART tree. The entire sample space forms the root node. From the root node, the aggregator calculates the gain value of the features based on local data and interaction results with participants. The gain value can be used to identify poisoning participants. The optimal feature value is used to divide the sample space of the node into left and right child nodes. The process is repeated until each node becomes a leaf node, completing the CART tree construction and ending one round of machine learning training. The nodes corresponding to the poisoning features will become closer to the leaf nodes as training progresses, and the number of times they are used to divide nodes will decrease.

[0010] Step 3: After each machine learning model construction module is completed, a poisoning participant identification module is run to screen poisoning participants through the contribution value of the participants. The lower the gain value of the feature, the smaller the number of times the feature is used to split nodes, the lower the contribution to the model, and the greater the likelihood of a poisoning attack. The participant contribution value is calculated according to the average gain value of the participant features, the participant contribution value is comprehensively evaluated by d-s evidence theory to obtain an evaluation value, and the participants whose evaluation values in the three rounds are less than the poisoning threshold are identified as suspicious participants. Suspicious participants no longer join machine learning training. If the loss function has a significant increase, set the poisoning threshold to the suspicious participant evaluation value, identify the suspicious participant as a normal participant, and continue to join the machine learning training. If the loss function does not have a significant increase, identify the suspicious participant as a poisoning participant.

[0011] The contribution value of the participant is calculated by the model parameters, and the evaluation value of the participant is obtained by comprehensively evaluating the contribution value by d-s evidence theory. The poisoning threshold is dynamically adjusted, the participants whose evaluation values are less than the poisoning threshold are identified as poisoning participants, and the poisoning attack under the no third party vertical federated learning is efficiently identified.

[0012] In the interaction between the participants and the aggregator, the division process of a single node is as follows,

[0013] Step 2.1: The aggregator calculates the parameters of each sample according to the training set label, homomorphically encrypts the parameters, and sends the encrypted parameters and the sample space to each participant.

[0014] Step 2.2: Each participant divides the sample set according to the local data, sums the received encrypted data according to the sample set, and sends the sum to the aggregator.

[0015] Step 2.3: The aggregator decrypts the data sent by the participants, and calculates the gain value corresponding to different features of different participants according to the data. The maximum gain value is selected, and the participant corresponding to the maximum gain value is asked to divide the sample space of the node.

[0016] Step 2.4: The corresponding participant replies to the sample space.

[0017] Step 2.5: The aggregator divides the node according to the received sample space to obtain left and right child nodes.

[0018] The aggregator calculates the local data in the same way, but lacks the communication process. When the gain value of a node is less than a specified minimum gain value, the node is no longer divided and becomes a leaf node. The weight of the current leaf node is calculated by a leaf weight function.

[0019] Step 3.1: Calculate the average gain value of the participant features, and normalize the gain value as the contribution value of the participant.

[0020] Step 3.2: When the contribution value tends to be stable, an evaluation value is generated by analyzing the contribution value of the participants in two rounds through d-s evidence theory synthesis, and the participants whose evaluation value is less than the poisoning threshold in three consecutive rounds are determined as suspicious participants.

[0021] Step 3.3: The suspicious participants are removed, if the loss function has a significant increase, the suspicious participants are re-added to the training, and the poisoning threshold is set to the evaluation value of the participant, otherwise, it is determined as a poisoning participant.

[0022] Multiple rounds of training are performed, and the machine learning model construction module and the poisoning participant identification module are run multiple times until the model construction is completed.

[0023] Compared with the prior art, the present application has the following advantages:

[0024] The federated learning can construct a machine learning model while protecting the privacy of the participants, and the third-party vertical federated learning can be applied to the case where the feature spaces of the participants are different, and can also avoid the security problems caused by introducing a third party. The third-party-free vertical federated learning includes multiple participants, and selects one participant as an aggregation party to construct a machine learning model, each participant does not disclose its own local data, and only provides necessary model parameters to the aggregation party, effectively protecting the privacy of the participant data, but at the same time, the characteristics of the federated learning of not disclosing data also provide an opportunity for the poisoning participants to implement poisoning attacks. The existing third-party-free vertical federated learning mainly identifies the poisoning participants through the sharply value method, that is, different numbers of participants are selected in each round to arrange and combine training observation effects, and the participants not existing in the combination with better effects are determined as poisoning participants, but one round of training will construct multiple models, and the construction of each model needs to communicate with all participants, which has large calculation and communication overheads. Therefore, the present application proposes an effective method for identifying poisoning attacks in third-party-free vertical federated learning, calculates the average gain of the participants in the machine learning model to obtain the contribution value, and analyzes the contribution value of the participants through d-s evidence theory to obtain an evaluation value, and the participants whose evaluation value is less than the poisoning threshold are temporarily determined as suspicious participants. At the same time, this paper uses a dynamic threshold adjustment method to remove the suspicious participants, if the loss function has a significant increase, the suspicious participants are re-added to the training, and the poisoning threshold is adjusted to the evaluation value of the participant, otherwise, it is determined as a poisoning participant. Compared with other methods, the present method does not establish redundant models in each round of training, the identification time of the poisoning participants can be almost ignored, the time overhead is small, and the identification efficiency is high. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 Third-party-free vertical federated learning architecture.

[0026] Figure 2 Interactive process of node segmentation in machine learning model building module.

[0027] Figure 3 Poisoning participant identification module process. Detailed Implementation

[0028] The present invention will be further described in conjunction with the accompanying drawings and specific embodiments.

[0029] This invention mainly includes a model initialization module, a machine learning model construction module, and a poisoning participant identification module.

[0030] Step 1: Initialize the model. Set up multiple participants, and randomly select one participant as the aggregator. Randomly select a participant to launch a poisoning attack, modifying the local data. Set the tree depth, minimum gain value, number of training rounds, and poisoning threshold.

[0031] In each training round, the machine learning building module is first run to construct a CART tree, and then the poisoning participant identification module is run to identify the poisoning participants. The implementation process is illustrated in one round; other rounds are similar. The architecture diagram is as follows. Figure 1 As shown. The specific operation procedures for the two modules are as follows:

[0032] Step 2: As Figure 2 As shown, the machine learning model building module constructs a CART tree through data interaction between the aggregator and participants. Each node in the tree contains a certain sample space, and the construction process of the CART tree is the process of partitioning the sample space of each node until the node becomes a leaf. Taking the interaction between the aggregator and participants as an example, the partitioning process of a single node is introduced as follows: Figure 1 As shown in steps 2.1-2.5, the process of the aggregator querying its own data is the same.

[0033] Step 2.1: The aggregator calculates the first and second derivatives g based on the loss function value. i and h i ,in And g is encrypted using the Paillier homomorphic encryption algorithm. i and h i Encrypt to [[g i ]] and [[h i ]]. [g i ]]、[[h i The sample space is sent to the participants.

[0034] Step 2.2: Each participant enumerates each of its own features D. j and its eigenvalues ​​x i,j D j The eigenvalue is less than or equal to xi,j The samples of the left child node are recorded as the left child node user set The samples of the other part are recorded as the right child node user set The user set of the left child node is divided into and The sum is calculated. The sum, i and j are sent to the aggregation party.

[0035] Step 2.3: The aggregation party decrypts the received data to and The gain value of the right child node user set is calculated as and The gain value corresponding to the feature and the feature value of the participant is calculated according to formula (1). The calculation is performed for multiple participant models until the maximum gain value is selected.

[0036]

[0037] The maximum gain value is selected, and i and j corresponding to the participant are sent to request the sample space.

[0038] Step 2.4: The aggregation party queries the feature D j and the feature value x i,j according to i and j, and divides the sample space to obtain the left child node user set which is sent to the aggregation party.

[0039] Step 2.5: The aggregation party calculates according to The left child node and the right child node of the node are divided.

[0040] Steps 2.1-2.5 are repeated until formula (1) is less than the minimum value of the gain function, and the node is no longer divided and becomes a leaf node. The weight of the leaf node is calculated according to formula (2). When all nodes become leaf nodes, a CART tree is established.

[0041]

[0042] Step 3: After the machine learning model construction module ends, the poisoning participant identification module will continue to run in this round, as shown in Figure 3 . The aggregation party calculates the contribution value of each participant according to the node gain value, corresponding to steps 3.1-3.2. When the contribution of a certain participant tends to be stable for the first time, the contribution of all participants is processed by d-s evidence theory to generate an evaluation value, which is compared with the poisoning threshold to identify the poisoning participant, corresponding to steps 3.3-3.4. The specific steps are as follows:

[0043] Step 3.1: Calculate the contribution value of all features. The sum of the gain values of the dth feature of the ith participant in the CART tree node is SumGi,d The sum of the number of nodes covered by this feature is SumC i,d The contribution value of this feature is

[0044] Step 3.2: Calculate the contribution value of all participants. The process of calculating the contribution value of participant i is as follows: first, add the contribution values of all features in participant i to obtain a temporary contribution value ConTemC i =∑ d∈D ContriD i,d Then, normalize the temporary contribution values of all participants to obtain the contribution value

[0045] Step 3.3: When the contribution value of a participant is stable, calculate the evaluation value of all participants. When the contribution value of a participant is stable at the tthround, the evaluation value of the ithparticipant is calculated by d-s evidence theory: first, process the contribution values of participant i at the tthand t-1throunds to obtain DSContriC i,t =ContriC i,t *ContriC i,t-1 Then, obtain the evaluation value based on all participants

[0046] Step 3.4: If the evaluation value of a participant at the tth, t+1th, and t+2throunds is less than the poisoning threshold for three consecutive rounds, it is identified as a suspicious participant.

[0047] Step 3.5: Remove the suspicious participant from the training, if the loss function increases, re-add it to the training, and set the poisoning threshold to the evaluation value of this participant, otherwise, identify it as a poisoning participant.

[0048] Perform multiple rounds of training until the model is completed.

Claims

1. A method for identifying poisoning attacks in a vertical federated learning environment without a third party, characterized in that: It includes a no-third-party vertical federated learning model initialization module, a machine learning model building module, a poisoning participant identification module, and data interaction between the two modules; the implementation steps are as follows: Step 1: Initialize the vertical federated learning model without a third party; set up multiple participants, each with the same sample space and different feature spaces, and randomly select one participant as the aggregator; randomly select a participant to perform a poisoning attack; initialize the poisoning threshold and various parameters in the model, and participants whose evaluation value is less than the poisoning threshold are identified as poisoning participants; Each training round will run the machine learning model building module and the poisoning participant identification module once; during training, the aggregator will query local data and interact with data from each participant. Step 2: The machine learning model building module will be run once in each round of training to generate a CART tree; the entire sample space forms the root node. Starting from the root node, the aggregator calculates the gain value of the feature based on local data and the interaction results with the participants. The gain value can be used to identify the poisoning participants. The optimal feature value is found based on the gain value to divide the sample space of the node. The sample space is then divided into left child nodes and right child nodes. This process is repeated until each node becomes a leaf node, thus completing the CART tree construction and ending one round of machine learning training. As training progresses, the nodes corresponding to the poisoning features become closer to the leaf nodes, and the number of times they are used as segmentation nodes decreases. Step 3: After each machine learning model building module is completed, the poisoning participant identification module will run. Poisoning participants are screened based on their contribution values. The lower the gain value of a feature, the fewer times it is used to segment nodes, the lower its contribution to the model, and the greater the likelihood of a poisoning attack. The participant contribution value is calculated based on the average gain value of the participant's features. A comprehensive evaluation of the participant contribution value is obtained using DS evidence theory. Participants whose evaluation values ​​are all less than the poisoning threshold within three rounds are identified as suspicious participants. Suspicious participants are no longer added to machine learning training. If the loss function increases significantly, the poisoning threshold is set to the suspicious participant's evaluation value, and the suspicious participant is identified as a normal participant and continues to be added to machine learning training. If the loss function does not increase significantly, the suspicious participant is identified as a poisoning participant.

2. The method for identifying poisoning attacks in a third-party-free vertical federated learning environment according to claim 1, characterized in that: The contribution value of each participant is calculated by model parameters, and the evaluation value of each participant is obtained by comprehensively evaluating the contribution value through DS evidence theory. The poisoning threshold is dynamically adjusted, and participants whose evaluation value is less than the poisoning threshold are identified as poisoning participants. This method can efficiently identify poisoning attacks without third-party vertical federated learning.

3. The method for identifying poisoning attacks in a third-party-free vertical federated learning environment according to claim 1, characterized in that: In the interaction between the participants and the aggregator, the process of partitioning a single node is as follows: Step 2.1: The aggregator calculates the parameters of each sample based on the training set labels, and sends the homomorphically encrypted parameters along with the sample space to each participating party; Step 2.2: Each participant divides the sample set according to its local data, sums the received encrypted data according to the sample set, and sends it to the aggregator; Step 2.3: The aggregator decrypts the data sent by the participants and calculates the gain value corresponding to different features of different participants based on the data. It selects the largest gain value and queries the corresponding participant to divide the sample space of this node. Step 2.4: Respond to the sample space of the participating parties; Step 2.5: The aggregator obtains the left and right child nodes by dividing the nodes according to the received sample space; The aggregator calculates local data in the same way, except that it lacks a communication process; when the gain value of a node is less than the specified minimum gain value, the node is no longer split and becomes a leaf node, and the weight of the current leaf node is calculated through the leaf weight function.

4. The method for identifying poisoning attacks in a third-party-free vertical federated learning environment according to claim 1, characterized in that: The specific implementation steps of step 3 are as follows: Step 3.1: Calculate the average gain value of the participant's characteristics, and normalize the gain value as the participant's contribution value; Step 3.2: When the contribution value tends to stabilize, an evaluation value is generated by comprehensively analyzing the contribution values ​​of the participants in the two rounds through the DS evidence theory. Participants whose evaluation values ​​are less than the poisoning threshold in three consecutive rounds are identified as suspicious participants. Step 3.3: Eliminate suspicious participants. If the loss function increases significantly, re-add the suspicious participant to the training and set the poisoning threshold to the evaluation value of this participant. Otherwise, identify it as a poisoning participant. Multiple rounds of training are conducted, running the machine learning model building module and the poisoning participant identification module multiple times until the model is completed.

Images