A federated learning adversarial sample detection method based on variational bayesian network

Abstract

The application discloses a kind of federal learning adversarial sample detection methods based on variational bayesian network, comprising the following steps: training model is issued to each participant of federal learning;Each participant initiates private intersection operation two by two, so that each participant obtains respective sample intersection;The sample intersection obtained by each participant is intersected, to obtain common sample space;Each participant filters target local sample from respective local sample according to common sample space, uses respective target local sample of each participant to train model, to obtain respective gradient information of each participant;Gradient information sent by each participant is received, and the uncertainty of gradient information distribution density is calculated;Adversarial sample in the local sample of each participant is determined according to the uncertainty of gradient information distribution density.The application can complete the task of adversarial sample detection in federal learning system without directly accessing private training data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning, and particularly relates to a federated learning adversarial sample detection method based on a variational Bayesian network. BACKGROUND

[0002] Federated learning is a kind of distributed machine learning, but in the learning process, each participating object does not share its own training data, but each participant uses multiple computing nodes for joint training, and finally forms a global model with better performance. The roles in federated learning include a server and participants, the participants send updates generated by training to the server, and the server aggregates the updates in a certain strategy and updates the global model using the aggregated results.

[0003] The training samples used for federated learning usually contain a certain number of adversarial samples. Adversarial samples refer to samples that are added with tiny perturbations that are difficult for human senses to detect under the action of adversarial attacks, but the output judgment results on the adversarial samples and the normal samples corresponding to the adversarial samples are different in the global model learning process. Since each participating object in federated learning does not share its own training data, it is not possible to directly identify which training samples are adversarial samples on the global server, and certain methods need to be used to detect adversarial samples in the training samples.

[0004] Existing adversarial sample detection methods generally need to traverse the entire data set to perform related calculations, and the federated learning system generally has a large amount of data, so the time and space cost of traversing the entire data set to perform related calculations is huge, and therefore real-time detection of adversarial samples cannot be achieved. And because the original data of the client cannot be directly accessed in federated learning, such a detection method violates the privacy protection feature of federated learning. SUMMARY

[0005] Therefore, the embodiments of the present application provide a federated learning adversarial sample detection method based on a variational Bayesian network.

[0006] The present application provides a federated learning adversarial sample detection method based on a variational Bayesian network, comprising the following steps:

[0007] The server issues a training model to each participating object of federated learning; each participating object trains the training model using local samples to obtain a sample space; the training model includes a Bayesian sub-layer for detecting adversarial samples;

[0008] Each participating object initiates a private intersection operation with each other, so that each participating object obtains its own sample intersection;

[0009] The server obtains an intersection of the samples obtained by each participant object, and obtains a common sample space; the common sample space refers to an intersection of samples common to all participant objects in federated learning;

[0010] Each participant object screens local samples in the common sample space from the local samples of each participant object as target local samples, and trains the training model using the target local samples of each participant object to obtain gradient information of each participant object;

[0011] The server receives the gradient information sent by each participant object, and calculates the uncertainty of the gradient information distribution density;

[0012] According to the uncertainty of the gradient information distribution density, the adversarial samples in the local samples of each participant object are determined.

[0013] Further, before the server sends the training model to each participant object of the federated learning, the following steps are further included:

[0014] The server integrates a Bayesian sub-layer in the training model.

[0015] Further, the participant objects of the federated learning include a first participant object and a second participant object; the private intersection operation between the first participant object and the second participant object specifically includes the following steps:

[0016] The first participant object sends a private intersection request to the second participant object;

[0017] The second participant object generates a secret key including a public key, a large prime number and a private key; the public key and the large prime number in the secret key are sent to the first participant object;

[0018] The first participant object encrypts the local sample by the public key and the large prime number after adding a first random number to the local sample, to obtain a first mapping sample, and sends the first mapping sample to the second participant object;

[0019] The second participant object decrypts the first mapping sample and the local sample of the second participant object using the private key, and performs blind signature on the first mapping sample and the local sample of the second participant object, to obtain a first signed sample and a second signed sample, and sends the first signed sample and the second signed sample to the first participant object;

[0020] After the first participant object verifies the first signed sample and the second signed sample using the public key and the large prime number, the first participant object reverses the first signed sample by the first random number to obtain a first sample set; the first participant object obtains an intersection of the first sample set and the second signed sample as a first sample space and sends the first sample space to the second participant object;

[0021] The first participant and the second participant each use their public keys to decrypt the first sample space, obtaining the intersection of their respective samples.

[0022] Furthermore, after the server calculates the intersection of the samples obtained by each participating object to obtain the common sample space, the following steps are also included:

[0023] The server aligns the shared sample space.

[0024] Furthermore, the calculation of the uncertainty of the gradient information distribution density specifically includes the following steps:

[0025] Find a Bayesian distribution that approximates the gradient information distribution density, and use KL divergence to characterize the difference between the gradient information distribution density and the Bayesian distribution;

[0026] With the goal of minimizing KL divergence, the minimized KL divergence is characterized by maximizing the lower bound of evidence;

[0027] The Monte Carlo method is used to randomly sample each participating object, calculate the prior probability of the gradient information of the sampled participants, and take the average of the prior probabilities of the gradient information of the sampled participants as the global prior probability.

[0028] The global prior probability is used to calculate the lower bound of the evidence, and the gradient of the lower bound of the evidence is obtained as the ELBO gradient.

[0029] The posterior probability is calculated using Bayes' theorem, and the variance of the ELBO gradient is calculated. The noise variance term is then neglected and used as the uncertainty of the gradient information distribution density.

[0030] Furthermore, the process of finding a Bayesian distribution that approximates the gradient information distribution density, using KL divergence to characterize the difference between the gradient information distribution density and the Bayesian distribution, is specifically achieved through the following formula:

[0031]

[0032] In the formula, P represents the gradient information distribution density, q represents the approximate variational Bayesian distribution, θ is the parameter of the Bayesian sublayer of the training model, w is the training model parameter, D is the gradient information dataset, and Eq(ω|θ) represents the mean of the approximate variational Bayesian distribution.

[0033] Furthermore, the goal of minimizing the KL divergence is represented by maximizing the lower bound of evidence, and is achieved through the following formula:

[0034] ELBO = E q(w|θ)lnp(D|w)-KL(q(w|θ)||p(w))

[0035] KL(q(w|θ)||p(w|D))=-ELBO+lnp(D)

[0036]

[0037] In the formula, ELBO represents the lower bound of evidence. This represents maximizing the lower bound of evidence.

[0038] Furthermore, the uncertainty is calculated using the following formula:

[0039]

[0040] In the formula, U is the uncertainty, M is the number of samples drawn by the Monte Carlo method, xm is one of the data after Monte Carlo sampling, and x is the data after sampling.

[0041] Furthermore, the determination of adversarial samples in the local samples of each participating object based on the uncertainty of gradient information distribution density specifically includes the following steps:

[0042] Sampling is performed on each participant, and the uncertainty of the local sample of the sampled participant and the lower bound of the maximum evidence are calculated.

[0043] Local samples of participating entities with uncertainties greater than a preset uncertainty threshold and maximized evidence lower bound less than a preset ELBO threshold are considered adversarial samples.

[0044] Furthermore, it also includes the following steps:

[0045] Delete participants whose number of adversarial examples exceeds a preset threshold;

[0046] The training model is updated using the gradient information of the remaining participating objects.

[0047] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0048] The embodiments of the present invention have the following beneficial effects: The present invention provides a federated learning adversarial example detection method based on variational Bayesian networks, which reduces the computational cost of adversarial example detection methods, enabling them to be applied to federated learning systems, and achieving real-time adversarial example detection without directly accessing the client's training data while adhering to the privacy protection characteristics of federated learning.

[0049] Additional aspects and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description or may be learned by practice of the invention. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a basic implementation flowchart of a federated learning adversarial example detection method based on variational Bayesian networks according to the present invention.

[0052] Figure 2 This is a flowchart of the private intersection process in a federated learning adversarial example detection method based on variational Bayesian networks according to the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] The following are some of the concepts involved in the embodiments of the present invention:

[0055] 1. Federated Learning: Federated learning is a type of distributed machine learning where participants do not share their own training data. Instead, each participant uses multiple computing nodes for joint training, ultimately forming a high-performance global model. The roles in federated learning include a server and the participants. Participants send updates generated during training to the server, which then aggregates these updates using a certain strategy and uses the aggregated results to update the global model.

[0056] 2. Adversarial Attack: An adversarial attack is a type of attack method targeting machine learning systems. This attack method occurs during the model's testing phase, by adding subtle perturbations to the original data that are difficult for human senses to detect, causing the learner to produce different judgments than before.

[0057] 3. Aggregation Algorithm: In a federated learning system, this is the algorithm used by the server to integrate updates provided by the participants into a single overall update. During the global update phase of a federated learning system, the server uses an aggregation algorithm to combine the updates sent by the participants into a global update, which is then used to update the global model. Common aggregation algorithms include Federated Averaging (FedAvg).

[0058] 4. Adversarial Samples: Samples generated by applying adversarial attacks to normal samples. These samples have been subjected to subtle perturbations that are imperceptible to human senses, but the learner's judgment on adversarial samples differs from its judgment on corresponding normal samples.

[0059] 5. Kullback-Leibier Divergence (KL Divergence): Also known as Relative Entropy. An asymmetric measure of the difference between two different probability distributions.

[0060] 6. Bayesian Neural Network: This is a type of neural network that, in addition to providing prediction results, can also provide prediction uncertainty. Its parameters are not constant values, but random variables that follow a certain distribution.

[0061] 7. Homomorphic Encryption: This is a type of cryptographic encryption technique. Under this encryption technique, the ciphertext obtained by performing a certain operation on the ciphertext is equivalent to the ciphertext obtained by performing the same operation on the plaintext.

[0062] 8. Variational Inference: A deterministic approximate inference method that aims to minimize relative entropy and approximates a difficult-to-compute posterior probability distribution as a variable distribution.

[0063] 9. Mean Field Theory: A paradigm and theory that approximates all the influences on a single entity in a stochastic process model as an external field, thereby decomposing a many-body problem into multiple one-body problems for solution.

[0064] 10. Monte Carlo method: Also known as random sampling or statistical experiment method, it is a computational method based on probability and statistical theory. This method uses random numbers (or more commonly pseudo-random numbers) to solve many computational problems, relating the problem to a certain probability model, and using a computer to simulate or sample to obtain an approximate solution to the problem.

[0065] Currently, adversarial example detection methods primarily include feature learning and distribution-based detection. Feature learning mainly targets the differences in features between adversarial examples and normal examples, attempting to transform high-dimensional data into low-dimensional data to reduce detection difficulty. For example, Principal Component Analysis (PCA) reduces data redundancy by learning features in low-information dimensions and performing whitening operations. Adversarial examples often emphasize the lower-ranked parts in PCA, thus making them detectable by PCA. However, PCA requires pre-compiling the feature space from the training data, and specific feature calculations are needed to determine the information content, making it unsuitable for large datasets. Distribution-based detection methods primarily detect adversarial examples by comparing the differences in numerical features between adversarial examples and normal examples. For example, kernel density estimation (KDE) can be used to detect adversarial examples. This method iterates through the data, fitting the data distribution to a differentiable distribution function, and then detects adversarial examples by comparing the differences between normal and adversarial examples. However, distribution-based adversarial example detection methods often rely on the ratio of normal samples to adversarial samples. If adversarial samples constitute the majority, normal samples are often mistakenly identified as adversarial samples. Moreover, such methods still require traversing the entire dataset, resulting in high computational complexity and violating the privacy protection principle of federated learning, which prohibits access to private data, making them difficult to apply to federated learning.

[0066] The purpose of this invention is to overcome the shortcomings of existing adversarial example detection methods and provide a federated learning adversarial example detection method based on variational Bayesian networks. This method reduces the computational cost of adversarial example detection, enabling its application in federated learning systems. It achieves real-time adversarial example detection without directly accessing the client's training data, while adhering to the privacy protection characteristics of federated learning.

[0067] like Figure 1 As shown, the federated learning adversarial example detection method based on variational Bayesian networks provided in this embodiment of the invention includes the following steps:

[0068] S101: The server distributes the training model to each participant in the federated learning; each participant trains the training model using local samples to obtain a sample space; the training model includes a Bayesian sub-layer for detecting adversarial examples. In step S101, since Bayesian computation is required in this embodiment, a Bayesian sub-layer needs to be integrated into the training model. In this embodiment, the global training model on the server side is directly converted. However, if each participant has a lightweight Bayesian network deployed, the model conversion process can also be performed at the participant's location, while maintaining the original parameters of the model during the conversion process.

[0069] S102. Each participant initiates a private intersection operation in pairs, so that each participant obtains its own sample intersection.

[0070] In step S102, refer to Figure 2 The basic process of private interaction requests will be explained using participants A and B as examples.

[0071] S102-1. Participant A sends a private request to participant B.

[0072] S102-2. Participant B generates a key including a public key, a large prime number, and a private key; and sends the public key and the large prime number from the key to participant A. In this embodiment, participant B's key is generated based on RSA. The RSA algorithm is an asymmetric encryption algorithm. Participant B generates a key based on RSA that includes a public key e, a large prime number n, and a private key d, and sends the public key e and the large prime number n to participant A.

[0073] S102-3. Participant A adds a first random number to its local sample, then encrypts the local sample using a public key and a large prime number to obtain the first mapped sample, and sends the first mapped sample to participant B. Under RSA conditions, participant A generates the first mapped sample Y. A ={(r i e %n*H(u i ))%n|u i∈U A r i ∈r}, where r is the first random number, H(u) is the hash function, and U A For the local sample of the participating object A, where r may be one or a set of random numbers, r i This represents the number of the random number. Participant A will map the first sample Y. A Send to participant B.

[0074] S102-4. Participant B uses its private key to decrypt the first mapping sample and its local sample, and performs blind signing on both to obtain a first signature sample and a second signature sample. It then sends the first and second signature samples to participant A. Since participant B does not know Y... A The specific content, but only Y can be used. A The content is calculated, and participant B uses private key d to blindly sign its own local sample and the first mapped sample to obtain the first signature sample Z. A Second signature sample Z B Z A and Z B Both involve two-level hash operations; the participating object B will use Z. A and Z B Send to participant A.

[0075] S102-5. After verifying the first and second signature samples using the public key and a large prime number, participant A reverse-engineers the first signature sample using a first random number to obtain the first sample set. Participant A then calculates the intersection of the first sample set and the second signature sample set, sending this intersection as the first sample space to participant B. Participant A then calculates the blinded Z value processed by participant B using a random number r. A Solving for the blind signature Z yields... A The set D formed after deblinding A Further, we can obtain D. A and Z B The intersection of I and I is sent as the first sample space to the participating object B.

[0076] S102-6. Participant A and participant B respectively use public keys to decrypt the first sample space to obtain the intersection of their respective samples.

[0077] S103. The server finds the intersection of the sample intersections obtained by each participating object to obtain the common sample space; the common sample space refers to the sample intersection shared by all participating objects in federated learning.

[0078] In step S103, the common sample space is obtained using the following formula:

[0079] I = Z B ∩D A

[0080] D A =H(r) i *H(u i )d / r i )|r i *H(u i )d∈Z A

[0081] The intersection is calculated using a hash function. After obtaining the common sample space, the server aligns the sample feature spaces.

[0082] S104. Each participant selects local samples located within the shared sample space from its own local samples as target local samples. The training model is then trained using each participant's target local samples to obtain their respective gradient information. In step S104, based on the sample feature space obtained in S103, each participant decrypts the intersection and selects data from the intersection as target local samples for training to generate the same feature space. The resulting gradient information for each participant is then sent to the server.

[0083] S105. The server receives gradient information sent by each participating object and calculates the uncertainty of the gradient information distribution density;

[0084] In step S105, the server approximates the distribution density of the aligned gradient information using a variational distribution. Assuming P is the probability distribution of the original dataset and q is the approximate variational distribution, the calculation formula for this variational distribution is an optimization problem:

[0085] S105-1. Find a Bayesian distribution that approximates the gradient information distribution density, and use KL divergence to characterize the difference between the gradient information distribution density and the Bayesian distribution.

[0086] The server reads the gradient information transmitted by each participating object based on the obtained common sample space, solves the optimization problem, and obtains an approximate variational distribution.

[0087] KL divergence (relative entropy) is an indicator that measures the degree of matching between two probability distributions. The greater the difference between the two distributions, the greater the KL divergence.

[0088]

[0089] In the formula, P represents the gradient information distribution density, q represents the approximate variational Bayesian distribution, θ is the parameter of the Bayesian sublayer of the training model, w is the parameter of the training model, D is the gradient information dataset, and Eq(ω|θ) represents the mean of the approximate variational Bayesian distribution.

[0090] In this embodiment, since q and P in the above equation are both probability distributions, the integrals are all of ln values. When q and P are close, the KL divergence will get closer to 0. Therefore, the smaller the difference between q and P, the smaller the KL divergence. The reason for not directly calculating P is that although calculating P is simple (it only requires traversing the entire dataset), the time complexity will be very high when the amount of data is large.

[0091] S105-2. With the goal of minimizing KL divergence, the maximum evidence lower bound (ELBO) is used to characterize the minimization of KL divergence.

[0092] Regarding the calculation of ELBO, the following formula holds true:

[0093] ELBO = E q(w|θ) lnp(D|w)-KL(q(w|θ)||p(w))

[0094] The original optimization problem is:

[0095] KL(q(w|θ)||p(w|D))=ln p(D)

[0096] +KL(q(w|θ)||p(w))-E q(w|θ) ln p(D|w)

[0097] =ln p(D)-ELBO

[0098] For the same dataset, Inp(D) is a definite constant, so argminK-L is equivalent to argmaxELBO, except that it's just adding a sign to transform the argmin problem into the argmax problem, i.e.:

[0099] KL(q(w|θ)||p(w|D))=-ELBO+lnp(D)

[0100]

[0101] In the formula, ELBO represents the lower bound of evidence. This represents maximizing the lower bound of evidence.

[0102] Mathematical calculations show that the KL divergence is greater than 0, therefore, from ELBO = E q(w|θ) lnp(D|w)-KL(q(w|θ)||p(w)) infers that ELBO≤Eq(w|θ) ln p(D|w). ln p(D|w) can be observed in the sample and is called "evidence". Its conditional expectation is not less than ELBO.

[0103] S105-3. Based on the Monte Carlo method, random sampling is performed on each participating object, the prior probability of the gradient information of the sampled participants is calculated, and the average of the prior probabilities of the gradient information of the sampled participants is taken as the global prior probability. The Monte Carlo method refers to sampling a large number of samples from the target distribution and using the sampled samples to analyze the properties of the target distribution. In this embodiment, the gradient information of each participating object is set as a cumulative distribution, and multiple gradient information is extracted by random sampling. The prior probability P(Y) of the gradient information of multiple sampled participants is obtained by statistical methods. i At the same time, multiple prior probabilities P(Y) are obtained. i The average of these is the global prior probability.

[0104] For example, let M be the participants in the random sampling. Then the server first calculates the classification probability p(D) of the gradient information uploaded by the m-th client. m ;w m ); where D represents the gradient information dataset and w represents the sample of the participating object m.

[0105] The server maps the gradient information classification probability to the interval [0, 1] to obtain the prior probability p(D|w):

[0106]

[0107] S105--4. Use global prior probability to calculate the maximum evidence lower bound, and obtain the gradient of the maximum evidence lower bound as the ELB0 gradient;

[0108] Substituting the prior probability p(D|w) into ELBO=E q(w|θ) The ELBO gradient can be obtained by using the formula ln p(D|w)-KL(q(w|θ)||p(w)).

[0109] S105-5. Calculate the posterior probability using Bayes' theorem, calculate the variance of the ELBO gradient, and use the noise variance term as the uncertainty of the gradient information distribution density after neglecting the noise variance term.

[0110] The Bayesian formula is expressed as p(w|D)=p(D|w)×p(w) / p(D); the posterior probability p(w|D) of the gradient information is calculated using the Bayesian formula.

[0111] In this embodiment, the uncertainty is calculated using the following formula:

[0112]

[0113] In the formula, U represents the uncertainty, M represents the number of samples sampled by the Monte Carlo method, xm represents one of the data points after Monte Carlo sampling, and x represents the sampled data. Substituting these values ​​into the gradient D yields the result. Since the gradient D in this embodiment is a vector, multiplying to the second power can be done using the vector dot product operation, i.e., calculated as the square of the modulus.

[0114] S106. Determine the adversarial samples in the local samples of each participating object based on the uncertainty of the gradient information distribution density.

[0115] Step S106 specifically includes the following steps:

[0116] S106-1. Sampling is performed on each participant, and the uncertainty of the local sample of the sampled participant and the lower bound of the maximum evidence are calculated.

[0117] S106-2. Local samples of participating entities with uncertainties greater than a preset uncertainty threshold and a maximum evidence lower bound less than a preset ELBO threshold are considered adversarial samples. In this embodiment, uncertainties are sorted, and the ELB0 threshold and uncertainty threshold are determined according to the model parameters. Local samples of participating entities with uncertainties greater than the preset uncertainty threshold and a maximum evidence lower bound less than the preset ELBO threshold are selected as adversarial samples.

[0118] In some embodiments, after step S106, the following step is further included:

[0119] S107. Delete participants whose number of adversarial samples exceeds a preset threshold. Since a participant with too many adversarial samples may cause the model to mistakenly identify adversarial samples as normal samples during training, in some embodiments, the server will delete the participant when the number of adversarial samples exceeds half the total number of samples to ensure the training effect of the model.

[0120] S108. Update the trained model using the gradient information of the remaining participating objects. The server uses the gradient information of the remaining participating objects to aggregate and update the global model.

[0121] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform... Figure 1 The method shown.

[0122] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.

[0123] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0124] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0125] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0126] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0127] The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A federated learning adversarial example detection method based on variational Bayesian networks, characterized in that, Includes the following steps: The server distributes training models to each participant in the federated learning; each participant trains the training model using local samples to obtain a sample space; the training model includes a Bayesian sublayer for detecting adversarial examples. Each participant initiates a private intersection operation in pairs, so that each participant obtains its own sample intersection. The server finds the intersection of the samples obtained by each participating object to obtain a common sample space; the common sample space refers to the sample intersection shared by all participating objects in federated learning. Each participant selects a local sample located within the shared sample space from its own local samples as a target local sample, and uses the target local samples of each participant to train the training model to obtain the gradient information of each participant. The server receives gradient information sent by each participating object and calculates the uncertainty of the gradient information distribution density; The adversarial samples in the local samples of each participating object are determined based on the uncertainty of the gradient information distribution density. The uncertainty in calculating the gradient information distribution density is specifically... Includes the following steps: Find a Bayesian distribution that minimizes the KL divergence between the gradient information distribution density and the Bayesian distribution, and use the KL divergence to characterize the difference between the gradient information distribution density and the Bayesian distribution; With the goal of minimizing KL divergence, the minimized KL divergence is characterized by maximizing the lower bound of evidence; The Monte Carlo method is used to randomly sample each participating object, calculate the prior probability of the gradient information of the sampled participants, and take the average of the prior probabilities of the gradient information of the sampled participants as the global prior probability. The global prior probability is used to calculate the lower bound of the evidence, and the gradient of the lower bound of the evidence is obtained as the ELBO gradient. The posterior probability is calculated using Bayes' theorem, and the variance of the ELBO gradient is calculated. The noise variance term is then neglected and used as the uncertainty of the gradient information distribution density.

2. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 1, characterized in that, Before the server distributes the training model to each participant in the federated learning process, the following steps are also included: The server integrates Bayesian sublayers into the trained model.

3. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 1, characterized in that, The participants in the federated learning include a first participant and a second participant; the private intersection operation between the first participant and the second participant specifically includes the following steps: The first participant sends a private request to the second participant; The second participant generates a secret key that includes a public key, a large prime number, and a private key; and sends the public key and the large prime number from the secret key to the first participant. After adding a first random number to the local sample, the first participant encrypts the local sample using the public key and a large prime number to obtain a first mapped sample, and then sends the first mapped sample to the second participant. The second participant uses its private key to decrypt the first mapping sample and the local sample of the second participant, and performs blind signing on the first mapping sample and the local sample of the second participant to obtain the first signature sample and the second signature sample, and sends the first signature sample and the second signature sample to the first participant. After the first participating object verifies the first signature sample and the second signature sample using a public key and a large prime number, it reverse-engineers the first signature sample using a first random number to obtain a first sample set. The first participating object then finds the intersection of the first sample set and the second signature sample and sends it as the first sample space to the second participating object. The first participant and the second participant each use their public keys to decrypt the first sample space, obtaining the intersection of their respective samples.

4. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 1, characterized in that, After the server calculates the intersection of the samples obtained by each participating object to obtain the common sample space, the following steps are also included: The server aligns the shared sample space.

5. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 1, characterized in that, The process of finding a Bayesian distribution that minimizes the KL divergence between the gradient information distribution density and the Bayesian distribution, using the KL divergence to characterize the difference between the gradient information distribution density and the Bayesian distribution, is specifically achieved through the following formula: In the formula, P represents the gradient information distribution density, q represents the variational Bayesian distribution that minimizes the KL divergence with the gradient information distribution density, θ represents the parameters of the Bayesian sublayer of the training model, w represents the training model parameters, and D represents the gradient information dataset. The mean of the variational Bayesian distribution that minimizes the KL divergence between the gradient information distribution density and the gradient information distribution density is represented.

6. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 5, characterized in that, The goal of minimizing the KL divergence is represented by maximizing the lower bound of evidence, and is achieved through the following formula: In the formula, ELBO represents the lower bound of evidence. This represents maximizing the lower bound of evidence.

7. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 6, characterized in that, The uncertainty is calculated using the following formula: In the formula, U represents the uncertainty, and M represents the number of samples drawn using the Monte Carlo method. This is one of the data points from the Monte Carlo sampling, where x represents the sampled data.

8. The federated learning adversarial example detection method based on variational Bayesian networks according to claim 7, characterized in that, The determination of adversarial samples in the local samples of each participating object based on the uncertainty of the gradient information distribution density specifically includes the following steps: Sampling is performed on each participant, and the uncertainty of the local sample of the sampled participant and the lower bound of the maximum evidence are calculated. Local samples of participating entities with uncertainties greater than a preset uncertainty threshold and maximized evidence lower bound less than a preset ELBO threshold are considered adversarial samples.

9. A federated learning adversarial example detection method based on variational Bayesian networks according to any one of claims 1-8, characterized in that, It also includes the following steps: Delete participants whose number of adversarial examples exceeds a preset threshold; The training model is updated using the gradient information of the remaining participating objects.

Images