A federated learning security evaluation method

Abstract

The application relates to the technical field of federated learning, and discloses a federated learning security evaluation method, which aims to evaluate the security risk degree of a federated learning architecture after being attacked by a malicious opponent. Firstly, the federated learning network framework is determined, and the process of securely aggregating gradients in a ciphertext domain is described in detail. Then, the vulnerabilities, threat attacks and federated learning tasks are defined. Then, the security of the federated learning model is evaluated in the order of vulnerabilities, tasks and clients by using the analytic hierarchy process. Finally, the federated learning model is comprehensively evaluated in combination with the model classification accuracy. The application solves the problem that the security of the architecture in operation cannot be evaluated in the research of the federated learning framework.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning, and particularly relates to a federated learning security evaluation method. BACKGROUND

[0002] Federated learning is an emerging artificial intelligence basic technology, and its design goal is to carry out efficient machine learning among multiple participants or multiple computing nodes under the premise of guaranteeing information security in big data exchange, protecting terminal data and personal data privacy, and ensuring legality and compliance. The machine learning algorithm that can be used in federated learning is not limited to neural networks, but also includes important algorithms such as random forests. Federated learning is expected to become the basis of the next generation of artificial intelligence collaborative algorithms and collaborative networks. With the development of the Internet of Things, more and more researchers are engaged in research on updating the federated learning framework in order to achieve higher classification accuracy. However, many studies have shown that the defense against attack methods such as poisoning attacks may lead to a decrease in the accuracy of the federated learning classification system model, and even a practice of sacrificing model accuracy for security. However, there is no good quantitative index or specific evaluation method for evaluating the security of federated learning. SUMMARY

[0003] The present application provides a federated learning security evaluation method to solve the technical problem that the architecture running security cannot be evaluated in the research on the federated learning framework.

[0004] The present application provides a federated learning security evaluation method, which comprises the following steps:

[0005] A key generation center distributes a pair of asymmetric keys (pk k ,sk k ) and (pk c ,sk c ) to the kth client and the cloud, and determines the federated learning process of the kth client in the tth round; wherein k∈{1,2,…,K}, K is the total number of clients participating in federated learning, t∈{1,2,…,T}, T represents the total number of model iterations, pk k is a public key published by the user, sk k is a key only saved by the kth client, pk c is a public key published, and sk c is a key only saved by the cloud;

[0006] The first set number of data in the MNIST data set is used for learning, and the second set number of data in the MNIST data set is used for testing the federated learning model; wherein the MNIST data set is a picture data set of handwritten digits;

[0007] The security of the federated learning model is evaluated in the order of the vulnerability, the task and the client by using the analytic hierarchy process;

[0008] A security sample classification accuracy SCA is calculated, and the performance of the federated learning model in security and accuracy is evaluated according to the security sample classification accuracy SCA.

[0009] Further, the step of determining the kth client in the tth round of the federated learning process comprises:

[0010] The client k receives the encrypted global model parameters obtained in the last round of iteration Using the private key sk k After decryption, the local data set D k ={ (x i ,y i ), i = 1, 2, …} is combined, and the local model training is performed by using the stochastic gradient descent method; wherein x i ,y i represent the feature vector and the corresponding class label respectively; wherein Let pk k be used for encryption;

[0011] Define the training data of size B randomly selected at each iteration, and obtain the loss function Through Calculate the gradient G, and the client k encrypts G using the public key pk c to obtain And upload to the server; wherein L f (ω, x i ,y i ) is used to calculate the prediction loss function between the true label and the model output label;

[0012] The server randomly selects m clients' G The gradient is blurred by using a randomly sampled integer r, and the CP decrypts the blurred gradient using the key sk c After decryption, the median of the gradient and the correlation coefficient between each gradient are calculated;

[0013] According to the correlation coefficient, the weight is scaled The weight is redistributed for each gradient aggregation; wherein μ k is the aggregation weight of the kth client;

[0014] The CP re-encrypts the weight and the gradient using the public key pk c and sends it to the SP, and the SP performs to aggregate the local gradient in the ciphertext domain; wherein ω t is the global model parameter obtained in the current round, and η is the learning rate;

[0015] The gradient after being blurred is transmitted to the CP, and the CP adopts the key sk c After the blurred gradient is decrypted, the user public key pk k The current global model of the tth round is encrypted to obtain the encrypted global model The CP transmits the encrypted global model to the SP The SP transmits the encrypted global model to the SP

[0016] to each client;

[0017] After repeating T rounds, the model converges or reaches the specified accuracy.

[0018] Further, the server randomly selects m client's The gradient is blurred by using a random sampling integer r, and the CP adopts the key sk c After the blurred gradient is decrypted, the calculation formula in the steps of calculating the median of the gradient and the correlation coefficient between each gradient is:

[0019]

[0020] Wherein, G' is the blurred gradient, G med is the median of the gradient, Cov(a, b) is the covariance of a and b, and σ(·) is the standard deviation calculation.

[0021] Further, the step of evaluating the security of the federated learning model by using the analytic hierarchy process and according to the vulnerabilities, tasks, and order of the clients comprises:

[0022] Collecting original data from the federated learning network, assuming that there are vulnerabilities v j in the federated learning client set, j = 1, 2,..., m, and the probability of a malicious attacker successfully exploiting the jth vulnerability is P j ; wherein the vulnerability is a vulnerability in client data operation;

[0023] Assuming that N k tasks need to be completed on the kth client in {1, 2,..., K}, the resource allocated by the client k for the ith task in {1, 2,..., N k} is s i , the importance S i of each task is calculated, and the risk coefficient SR i of the task s i is calculated to obtain the risk coefficient of each task of the client;

[0024] In the tth round of communication, the gradient weight allocated by the cloud in the t-1th round is denoted as each client's importance coefficient UIk , the risk coefficient UR of the client k is calculated k ;

[0025] Let denote the risk value without client importance, and after reordering the risk value and importance in ascending order, the set and the maximum and minimum values of the risk of the clients in the network are calculated;

[0026] the actual risk value is calculated by , and the network risk distribution degree is calculated by NRDD=(NR-NR min ) / (NR max -NR min );

[0027] According to the network risk distribution degree, the security of the federated learning model is evaluated; the lower the NRDD, the lower the network risk, and the better the security of the federated learning model.

[0028] Further, the assumption needs to complete N k tasks on the kth∈{1,2,…,K} client, and the resource allocated by the client k for the ith∈{1,2,…,N k} task is s i , the importance of each task S i is calculated, and the risk coefficient SR i of the task s i is calculated, and the calculation formula is:

[0029]

[0030]

[0031]

[0032] wherein, vs ij denotes the training error after being attacked in the training process of task s i , that is, the misclassification sample ratio of the local model on the training set, denotes the influence of vulnerability v j on task s i , mis i is the number of misclassified samples of task s i , and n i is the total number of training samples of task s i .

[0033] Further, in the tth communication, the gradient weight allocated by the cloud in the t-1th round is recorded as each client's importance coefficient UI kCalculate the risk coefficient UR of client k. k In the steps, the calculation formula is:

[0034]

[0035] The order This represents the risk value excluding client importance. The set is obtained by re-sorting this risk value and its importance in ascending order. and The formula for calculating the maximum and minimum client risk in the network is as follows:

[0036] Further, the step of calculating the safe sample classification accuracy (SCA) and evaluating the performance of the federated learning model in terms of safety and accuracy based on the safe sample classification accuracy (SCA) includes:

[0037] The formula for calculating the Safe Sample Classification Accuracy (SCA) is as follows:

[0038]

[0039] Where N is the total number of samples, count(·) represents 1 if the equation in parentheses is true and 0 if it is false, and F(·) is the global model of the central server. y serves as a test sample for the model after it has been attacked. i for The correct label; the larger the SCA value, the better the classification performance of the federated learning model after being attacked, that is, the better the security.

[0040] The performance index is calculated by combining the network risk distribution degree with the security sample classification accuracy (SCA). The calculation formula is as follows:

[0041]

[0042] The higher the FLSE value, the better the federated learning model under evaluation performs in terms of both safety and accuracy.

[0043] The present invention also provides a federated learning security assessment device, comprising:

[0044] The distribution module is used by the key generation center to distribute a pair of asymmetric keys (pk) to both the k-th client and the cloud. k ,sk k ) and (pk c ,sk c Let pk be the number of clients participating in the federated learning process in round t, where k ∈ {1, 2, ..., K}, K is the total number of clients participating in the federated learning process, and t ∈ {1, 2, ..., T}. ksk is a public key published for users k pk is a key saved only for client k c sk is a public key published c pk is a key saved only for the cloud

[0045] The test module is configured to learn using a first set number of data in the MNIST dataset and test the federated learning model using a second set number of data in the MNIST dataset; wherein the MNIST dataset is a picture dataset of handwritten digits.

[0046] The evaluation module is configured to evaluate the security of the federated learning model using an analytic hierarchy process and according to the order of the vulnerabilities, tasks, and clients.

[0047] The evaluation module is configured to calculate a security sample classification accuracy SCA and evaluate the performance of the federated learning model in terms of security and accuracy according to the security sample classification accuracy SCA.

[0048] The present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0049] The present application also provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the above method.

[0050] The present application has the following beneficial effects:

[0051] The federated learning security evaluation method provided by the present application calculates the risk coefficients of each task and each client based on the probability of successful exploitation of vulnerabilities, thereby obtaining the risk distribution of the network, and comprehensively evaluates the model classification accuracy, which has reference significance for evaluating the pros and cons of the federated learning method. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 FIG. 1 is a method flowchart of an embodiment of the present application.

[0053] Figure 2 FIG. 2 is a flowchart of the operation of an attacker in the present application.

[0054] Figure 3 FIG. 3 is a schematic diagram of the federated learning process of the kth client in the tth round in the present application.

[0055] Figure 4 FIG. 4 is a schematic diagram of the device structure of an embodiment of the present application.

[0056] Figure 5This is a schematic diagram of the internal structure of a computer device according to an embodiment of the present invention.

[0057] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0058] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0059] like Figure 1 As shown, this invention provides a method for evaluating the security of federated learning, including:

[0060] S1. Define the framework of the federated learning network and describe in detail the process of securely aggregating gradients in the ciphertext domain.

[0061] The federated learning framework uses homomorphic encryption (HE) as its underlying technology. A key generation center (KGC) distributes a pair of asymmetric keys (pk) to both the k-th client and the cloud. k ,sk k ) and (pk c ,sk c Let pk be the number of clients participating in the federated learning process in round t. Here, k ∈ {1, 2, ..., K}, K is the total number of clients participating in the federated learning, t ∈ {1, 2, ..., T}, T represents the total number of rounds of model iteration, and pk is the number of clients participating in the federated learning process in round t. k sk is a public key that is publicly released by the user. k pk is the key that only client k stores. c sk is a publicly released public key. c This is a key stored only in the cloud (Cloud Platform, CP); assuming Let pk be the representation of using pk k encryption, and Similarly, the S11-S17 process is defined as the federated learning process of the k-th client in the t∈{1,2,…,T} round.

[0062] like Figure 3 As shown, step S1 specifically includes:

[0063] S11. Client k receives the encrypted global model parameters obtained from the previous iteration. Using private key sk k After decryption, combine with the local dataset D k ={(x i ,y i), i = 1, 2, …}, the local model training is performed by using the stochastic gradient descent method; wherein, x i ,y i represent the feature vector and the corresponding class label, respectively;

[0064] S12, the training data of the size of B randomly selected at each iteration is defined, and the loss function L f (ω, x i ,y i ) is used to calculate the prediction loss function between the real label and the model output label, and the gradient G is calculated by The client k uses the public key pk c to encrypt G to obtain and upload to the server (Service Provider, SP).

[0065] S13, the server randomly selects m clients' gradients The gradient is blurred by using a random sampling integer r, and the CP uses the key sk c to decrypt the blurred gradient, and then calculates the median of the gradient and the correlation coefficient between each gradient; the calculation formula is:

[0066]

[0067] Wherein, G' is the blurred gradient, G med is the median of the gradient, Cov(a, b) is the covariance of a and b, and σ(·) is the standard deviation calculation.

[0068] S14, considering that the attack means is to modify the client data set, which makes the gradient exist abnormal value, according to the correlation coefficient scaling weight The weight is redistributed for each gradient aggregation, and the weight of the abnormal gradient is 0, which can remove its influence on the global model; wherein, μ k is the aggregation weight of the kth client;

[0069] S15, the CP re-encrypts the weight and the gradient using the public key pk c and sends it to the SP, and the SP performs to aggregate the local gradient in the ciphertext domain; wherein, ω t is the global model parameter obtained in the current round, and η is the learning rate;

[0070] S16, after the SP aggregates the gradient, the blurred gradient is transmitted to the CP, and the CP uses the key sk c to decrypt the blurred gradient, and uses the user public key pk k to encrypt the global model in the current tth round to obtain the encrypted global model CP will transmit to SP, SP will send to each client;

[0071] S17, repeat the process T rounds of steps S11-S16, the model converges or reaches the accuracy rate.

[0072] S2, define vulnerabilities, threat attacks, and clear federal learning tasks. The first set of data in the MNIST dataset is used for learning, and the second set of data in the MNIST dataset is used for testing the federal learning model; wherein the MNIST dataset is a handwritten digital image dataset;

[0073] The vulnerability can be defined as a weakness in the federal learning system, which provides an opportunity for unauthorized access for malicious attackers, i.e. malicious adversary operations such as Figure 2 As shown in the, the threat attack considered by the present application refers to the possibility that the vulnerability is exploited by a malicious attacker to control one or more participants, even if there is one or more malicious clients in the federal learning network. The threat attack considers two common attack means, namely poisoning attack and backdoor attack. The poisoning attack refers to the fact that the malicious adversary manipulates the client to use malicious data to train the local model during the local training phase, and then destroys the accuracy of the global model. The backdoor attack refers to the fact that the malicious adversary modifies a single feature or a small area of the original data set as a backdoor and embeds it in the model, and once the backdoor feature is triggered, the malicious task is executed.

[0074] The present application adopts the MNIST dataset, which is a handwritten digital image dataset. The training set contains a total of 60,000 images and labels, and the test set contains a total of 10,000 images and labels. The task of federal learning is to first use 70% of the data for learning, and then use the remaining 30% to test the model, so as to realize the correct classification of the test image.

[0075] S3, using the analytic hierarchy process and according to the order of the vulnerabilities, tasks and clients, the security of the federal learning model is evaluated;

[0076] Step S3 specifically includes:

[0077] S31, collect device operation logs and other raw data from the federal learning network, and assume that there are vulnerabilities v j ,j=1,2,…,m, the probability of the jth vulnerability being successfully exploited by a malicious attacker is P j ; wherein the vulnerability is a vulnerability in the client data operation aspect, and there are a large number of clients in the federal learning network, which are open to malicious attackers.

[0078] S32, calculate the risk coefficient of each task of the client. Assuming that N k tasks need to be completed on the kth client in {1, 2,..., K}, the resource allocated by the client k for the ith task in {1, 2,..., N k} is s i , the importance of each task S i is calculated, and the risk coefficient SR i of the task s i is calculated to obtain the risk coefficient of each task of the client; the calculation formula is:

[0079]

[0080]

[0081]

[0082] wherein vs ij represents the training error after being attacked in the training process of the task s i , that is, the misclassification sample ratio of the local model on the training set, which is calculated by , represents the influence of the vulnerability v j on the task s i , mis i is the number of misclassified samples of the task s i , and n i is the total number of training samples of the task s i ;

[0083] S33, calculate the risk coefficient of the client. In the tth round of communication, the gradient weight allocated by the cloud in the previous round, that is, the t-1th round, is recorded as each client's importance coefficient UI k in the entire network, and the risk coefficient UR k of the client k is calculated; the calculation formula is:

[0084] S34, let represent the risk value without the importance of the client, and sort the risk value and the importance in ascending order to obtain the set and calculate the maximum and minimum values of the risk of the client in the network; the calculation formula is:

[0085] S35, calculate the actual risk value by , and calculate the network risk distribution degree by NRDD=(NR-NR min ) / (NR max -NR min );

[0086] S36, evaluate the security of the federated learning model according to the network risk distribution degree; wherein, the lower the NRDD is, the lower the network risk is, and the better the security of the federated learning model is.

[0087] S4, calculate the security sample classification accuracy SCA, and evaluate the performance of the federated learning model in security and accuracy according to the security sample classification accuracy SCA.

[0088] Many studies show that the defense against attack means such as poisoning attack may cause the accuracy of the federated learning classification system model to decrease, in order to prevent the practice of sacrificing model accuracy for security, the present application guarantees by combining model classification accuracy comprehensive evaluation.

[0089] Step S4 specifically includes:

[0090] S41, calculate the security sample classification accuracy SCA. The security sample classification accuracy refers to the proportion of the number of samples that can be correctly classified by the global model after being subjected to malicious attack in the total samples, and the calculation formula of the security sample classification accuracy SCA is:

[0091]

[0092] Wherein, N is the total number of samples, count(·) represents 1 if the equation in the bracket is true, and 0 if it is false, F(·) is the global model of the central server, is the test sample of the model after being attacked, y i is the correct label of ; the larger the SCA value is, the better the classification performance of the federated learning model under test after being attacked, that is, the better the security is;

[0093] S42, the present application considers that the malicious attacker attempts to manipulate the accuracy of the global model through the client, combines the network risk distribution degree with the security sample classification accuracy SCA, calculates the performance index, and the calculation formula is:

[0094]

[0095] Wherein, the larger the FLSE value is, the better the performance of the federated learning model under test in security and accuracy is.

[0096] As Figure 4 shown, the present application further provides a federated learning security evaluation device, which comprises:

[0097] A distribution module 1 is used for the key generation center to distribute a pair of asymmetric keys (pk k ,sk k ) and (pk c ,skc ), determine the kth client in the tth round of federated learning process; wherein, k∈{1, 2, …, K}, K is the total number of clients participating in federated learning, t∈{1, 2, …, T}, pk k is a public key published by the user, sk k is a key only saved by the client k, pk c is a public key published, sk c is a key only saved by the cloud;

[0098] The test module 2 is used to learn the first set of data in the MNIST dataset, and the second set of data in the MNIST dataset is used to test the federated learning model; wherein, the MNIST dataset is a handwritten numeral picture dataset;

[0099] The evaluation module 3 is used to evaluate the security of the federated learning model according to the order of the vulnerabilities, tasks and clients by using the analytic hierarchy process;

[0100] The evaluation module 4 is used to calculate the security sample classification accuracy SCA, and evaluate the performance of the federated learning model in security and accuracy according to the security sample classification accuracy SCA.

[0101] In one embodiment, the distribution module 1 includes:

[0102] The training unit is used for the client k to receive the encrypted global model parameters obtained in the last iteration using the private key sk k After decryption, combined with the local data set D k ={(x i ,y i ), i=1, 2, …}, the local model training is performed by using the stochastic gradient descent method; wherein, x i ,y i represent the feature vector and the corresponding class label respectively; wherein, Let pk k be encrypted;

[0103] The upload unit is used to define the training data of size B randomly selected at each iteration, and obtain the loss function Through the gradient G is calculated, and the client k encrypts G using the public key pk c to obtain and uploads it to the server; wherein, L f (ω, x i ,y i ) is used to calculate the prediction loss function between the real label and the model output label;

[0104] The fuzzy processing unit is used by the server to randomly select m clients. The gradient is blurred using randomly sampled integers r, and CP uses the key sk. c After decrypting the fuzzy gradient, calculate the median of the gradient and the correlation coefficient between each gradient;

[0105] Allocation unit, used to scale weights according to correlation coefficient. The weights are redistributed for each gradient aggregation; where μ k The aggregate weight for the k-th client;

[0106] Aggregation unit, used by CP to combine weights and gradients using public key pk c After re-encryption, the data is sent to the SP, which then executes the command within the ciphertext field. To aggregate local gradients; where ω t Here are the global model parameters obtained in the current round, and η is the learning rate;

[0107] The transmission unit is used to transmit the gradient fuzzing process to the CP, and the CP uses the key sk. c After decrypting the fuzzy gradient, the user's public key PK is used. k Encrypt the global model in the current round t to obtain the encrypted global model. CP will Transmitted to SP, SP will Send to each client;

[0108] Repeating units are used to ensure that the model converges or reaches a specified accuracy after repeating T rounds.

[0109] In one embodiment, the calculation formula in the fuzzy processing unit is:

[0110]

[0111] Where G' is the blurred gradient, G med σ is the median of the gradient, Cov(a,b) is used to calculate the covariance of a and b, and σ(·) is used to calculate the standard deviation.

[0112] In one embodiment, evaluation module 3 includes:

[0113] The collection unit is used to collect raw data from the federated learning network, assuming a vulnerability exists in the federated learning client cluster. j Let j = 1, 2, ..., m, and the probability of a malicious attacker successfully exploiting the j-th vulnerability be P. j The vulnerability in question is related to client-side data manipulation.

[0114] The first computational unit is used to assume that N needs to be completed on the k-th client ({1,2,…,K}). k The i-th task, where client k is the i-th ∈ {1,2,…,N} k The resources allocated to each task are s. i Calculate the importance S of each task. i and computational tasks s i Risk coefficient SR i To obtain the risk coefficient of each task on the client side;

[0115] The second calculation unit is used in the t-th round of communication to record the importance coefficient (UI) of each client in the entire network based on the gradient weights allocated by the cloud in the (t-1)-th round. k Calculate the risk coefficient UR of client k. k ;

[0116] The third calculation unit is used to set... This represents the risk value excluding client importance. The set is obtained by re-sorting this risk value and its importance in ascending order. and Calculate the maximum and minimum client risk in the network;

[0117] The fourth calculation unit is used to... Calculate the actual risk value, and use NRDD = (NR - NR) min ) / (NR max -NR min Calculate the network risk distribution degree;

[0118] An evaluation unit is used to assess the security of the federated learning model based on the network risk distribution degree; wherein, the lower the NRDD, the lower the network risk and the better the security of the federated learning model.

[0119] In one embodiment, the calculation formula in the first calculation unit is:

[0120]

[0121]

[0122]

[0123] Among them, vs ij Indicates in task s i The training error resulting from an attack during training, i.e., the ratio of misclassified samples in the local model on the training set, represents the vulnerability v. j For task s i The impact, mis i For task s i Number of misclassified samples, ni the total number of training samples of the task s i the total number of training samples of the task s

[0124] In an embodiment, in the second calculation unit, the calculation formula is:

[0125] In the third calculation unit, the calculation formula is:

[0126] In an embodiment, the evaluation module 4 comprises:

[0127] The accuracy calculation unit is configured to calculate the calculation formula of the security sample classification accuracy SCA as follows:

[0128]

[0129] wherein N is the total number of samples, count(·) represents 1 if the equation in the parentheses is true, and 0 if it is false, F(·) is the global model of the central server, is the test sample after the model is attacked, y i is the correct label of ; the greater the SCA value is, the better the classification performance of the federated learning model under test is after being attacked, that is, the better the security is;

[0130] The combination unit is configured to combine the network risk distribution degree and the security sample classification accuracy SCA to calculate the performance index, and the calculation formula is as follows:

[0131]

[0132] wherein the greater the FLSE value is, the better the performance of the federated learning model under test is in terms of security and accuracy.

[0133] The above modules and units are used to correspondingly execute the steps in the above federated learning security evaluation method, and the specific implementation manners are described above with reference to the method embodiments, and will not be described here.

[0134] As shown in Figure 5 , the present application also provides a computer device, which can be a server, and the internal structure thereof can be as shown in Figure 5The computer device includes a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store all data required by the process of the federated learning security evaluation method. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the federated learning security evaluation method.

[0135] Those skilled in the art can understand that, Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied.

[0136] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program. The computer program is executed by the processor to implement any one of the above federated learning security evaluation methods.

[0137] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium provided by the present application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM) and memory bus dynamic RAM (RDRAM) and the like.

[0138] It is to be understood that the terminology "including", "comprising", or any other variation thereof, is intended to cover a non-exclusive inclusion such that process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0139] The above description is merely the preferred embodiments of the present application, and is not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made according to the content of the present application specification and drawings, or directly or indirectly applied to other related technical fields, is also included in the patent protection scope of the present application.

Claims

1. A federated learning security evaluation method, characterized in that, Comprise: The key generation center distributes a pair of asymmetric keys (pk) to both the k-th client and the cloud. k ,sk k ) and (pk c ,sk c Let pk be the number of clients participating in the federated learning process in round t. Here, k ∈ {1, 2, ..., K}, K is the total number of clients participating in the federated learning, t ∈ {1, 2, ..., T}, T represents the total number of rounds of model iteration, and pk is the number of clients participating in the federated learning process in round t. k sk is a public key that is publicly released by the user. k pk is the key that only client k stores. c sk is a publicly released public key. c This is a key that is only stored in the cloud; Learning with a first set number of data in the MNIST dataset, and testing the federated learning model with a second set number of data in the MNIST dataset; wherein the MNIST dataset is a handwritten digital image dataset; The security of the federated learning model is evaluated by using the analytic hierarchy process and according to the order of the vulnerabilities, tasks and clients; specifically including: Collecting original data from the federated learning network, assuming that there are vulnerabilities v in the federated learning client set j , j = 1, 2, …, m, and the probability of a malicious attacker successfully exploiting the jth vulnerability is P j ; wherein the vulnerability is a vulnerability in the operation of the client data. Assume that N k tasks need to be completed on the kth client in {1, 2,..., K}, the resource allocated by the client k for the ith task in {1, 2,..., N k} is s i , the importance of each task is calculated S i , and the risk coefficient of the task s i is calculated SR i to obtain the risk coefficient of each task of the client; In the tth round of communication, the gradient weight assigned by the cloud in the t-1th round is recorded as the importance coefficient of each client in the entire network U k , and the risk coefficient UR k of the client k is calculated. Let denote the risk value without client importance, re-sort the risk value and importance in ascending order to obtain a set and calculate the maximum and minimum values of the client risk in the network; By calculating the actual risk value, and calculating the network risk distribution degree by NRDD = (NR - NR min ) / (NR max -NR min ) The security of the federated learning model is evaluated according to the network risk distribution degree; wherein the lower the NRDD, the lower the network risk, and the better the security of the federated learning model; The security sample classification accuracy SCA is calculated, and the performance of the federated learning model in security and accuracy is evaluated according to the security sample classification accuracy SCA.

2. The federated learning security evaluation method of claim 1, wherein, The step of determining the kth client in the tth round of federated learning process includes: The client k receives the encrypted global model parameters obtained in the last round of iteration Using the private key sk k After decryption, combine the local data set D k ={(x i ,y i ), i = 1, 2, …}, perform local model training using the stochastic gradient descent method; wherein x i ,y i represent the feature vector and the corresponding class label respectively; wherein Let pk k represent the encryption Define that training data of size B is randomly selected in each iteration, and obtain the loss function. pass To compute the gradient G, client k uses the public key pk. c After encrypting G, we get And upload it to the server; among them, L f (ω,x i ,y i This is used to calculate the prediction loss function between the true labels and the model output labels; The server randomly selects m clients The gradient is blurred by using a randomly sampled integer r, and the cloud CP uses a key sk c After decrypting the blurred gradient, the median of the gradient and the correlation coefficient between each gradient are calculated; scaling the weights according to the correlation coefficients reassigning weights for each gradient aggregation; wherein μ k aggregated weight for the kth client; The cloud CP sends the weight and the gradient by using a public key pk c After re-encryption, the server SP performs the following operations in the ciphertext domain to aggregate the local gradients; wherein, ω t is the global model parameter obtained in the current round, and η is a learning rate. The gradient after being processed by the fuzzy processing is transmitted to the cloud CP, and the cloud CP adopts the key sk c After the fuzzy gradient is decrypted, the public key pk k The current global model of the tth round is encrypted to obtain an encrypted global model The cloud CP transmits To the server SP, and the server SP transmits To each client; After repeating T rounds, the model converges or reaches the specified accuracy.

3. The federated learning security evaluation method of claim 2, wherein, The server randomly selects m clients The gradient is blurred by using a randomly sampled integer r, and the cloud CP uses a key sk c In the step of calculating the median of the gradient and the correlation coefficient between each gradient after decrypting the blurred gradient, the calculation formula is: where G' is the blurred gradient, G med is the median of the gradient, Cov(a,b) is the covariance of a and b, and σ(·) is the standard deviation calculation.

4. The federated learning security evaluation method of claim 1, wherein, The assumption is that N tasks need to be completed on the kth client in {1, 2,..., K}, the resource allocated to the ith task of the kth client is s, the importance of each task is S, and the risk coefficient of the task s is SR. k k i i i i The calculation formula is:​​​​​ where vs ij denotes the training error of the local model on the training set after being attacked by the vulnerability v i , i.e., the ratio of misclassified samples, and n j denotes the influence of the vulnerability v i on task s i . mis i denotes the number of misclassified samples of task s i , and n i denotes the total number of training samples of task s 5. The federated learning security evaluation method of claim 1, wherein, In the tth communication, the gradient weight allocated by the cloud in the t-1th round is recorded as the important coefficient UI of each client in the entire network k In the step of calculating the risk coefficient UR of the client k k The calculation formula is: The order denotes the risk value without the client importance, and the set obtained by reordering the risk value and the importance in ascending order and In the step of calculating the maximum and minimum values of the client risk in the network, the calculation formula is:

6. The federated learning security evaluation method of claim 4, wherein, The step of calculating the security sample classification accuracy SCA and evaluating the performance of the federated learning model in security and accuracy according to the security sample classification accuracy SCA includes: The calculation formula of the security sample classification accuracy SCA is: Where N is the total number of samples, count(·) represents 1 if the equation in parentheses is true and 0 if it is false, and F(·) is the global model of the central server. y serves as a test sample for the model after it has been attacked. i for The correct label; the larger the SCA value, the better the classification performance of the federated learning model after being attacked, that is, the better the security. The network risk distribution degree and the security sample classification accuracy SCA are combined to calculate the performance index, and the calculation formula is: The greater the FLSE value, the better the performance of the federated learning model to be evaluated in security and accuracy.

7. A federated learning security evaluation apparatus characterized by comprising: Comprise: The distribution module is used by the key generation center to distribute a pair of asymmetric keys (pk) to both the k-th client and the cloud. k ,sk k ) and (pk c ,sk c Let pk be the number of clients participating in the federated learning process in round t, where k ∈ {1, 2, ..., K}, K is the total number of clients participating in the federated learning process, and t ∈ {1, 2, ..., T}. k sk is a public key that is publicly released by the user. k pk is the key that only client k stores. c sk is a publicly released public key. c This is a key that is only stored in the cloud; The test module is used for learning with a first set number of data in the MNIST dataset, and testing the federated learning model with a second set number of data in the MNIST dataset; wherein the MNIST dataset is a handwritten digital image dataset; The evaluation module is used for evaluating the security of the federated learning model by using the analytic hierarchy process and according to the order of the vulnerabilities, tasks and clients; specifically including: A collection unit is configured to collect raw data from the federated learning network, assuming that there are vulnerabilities v in the federated learning client set j j = 1, 2, …, m, and the probability of a malicious attacker successfully exploiting the jth vulnerability is P j ; wherein the vulnerability is a vulnerability in client data operation A first calculation unit is configured to assume that N tasks need to be completed on a kth client in a set of K clients, that a resource allocated to an ith task in a set of N tasks is s, that an importance of each task is S, and that a risk coefficient of the task s is SR, to obtain the risk coefficient of each task of the client. k k i i i i A first calculation unit is configured to assume that N tasks need to be completed on a kth client in a set of K clients, that a resource allocated to an ith task in a set of N tasks is s, that an importance of each task is S, and that a risk coefficient of the task s is SR, to obtain the risk coefficient of each task of the client. k k i i i i A first calculation unit is configured to assume that N tasks need to be completed on a kth client in a set of K clients, that a resource A second calculation unit is configured to calculate, in the tth round of communication, an importance coefficient UI of each client in the entire network according to a gradient weight allocated by the cloud in the t-1th round of communication k , and calculate a risk coefficient UR of the client k k ; The third computing unit is configured to cause representing a risk value without the client importance, reordering the risk value and the importance in ascending order to obtain a set and calculate the maximum and minimum values of the client risk in the network; a fourth computing unit for computing an actual risk value and a network risk distribution degree by NRDD=(NR-NR ) / (NR min -NR max -NR min ) The evaluation unit is used for evaluating the security of the federated learning model according to the network risk distribution degree; wherein the lower the NRDD, the lower the network risk, and the better the security of the federated learning model; The evaluation module is used for calculating the security sample classification accuracy SCA, and evaluating the performance of the federated learning model in security and accuracy according to the security sample classification accuracy SCA.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 6.

Images