A method, system, device and medium for defending against poisoning attacks in federated learning

Abstract

A method, system, device and medium for defending against poisoning attacks in vertical federated learning, an active party and passive party interaction data integrity verification scheme is designed for the classic vertical federated learning algorithm Secureboost, the method is: key generation and distribution; the active party encrypts the Boost tree gradient information, and sends the encrypted result to the passive party, and sends the encrypted Boost tree gradient information to the trusted third party after homomorphic hash encryption; the passive party aggregates the received encrypted gradient information according to the feature dimension, and then performs homomorphic hash on the aggregation result and sends it to the trusted third party; the trusted third party aggregates all the information sent by the passive party, and then verifies whether the encrypted Boost tree gradient information sent by the active party and the aggregation result of the passive party information are consistent, if consistent, the integrity verification is passed, otherwise the verification is failed; the system, device and medium based on the above method defend against poisoning attacks, realize the safe aggregation of global model, and improve the defense reliability of poisoning attacks.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology, and in particular relates to a method, system, device and medium for defending against poisoning attacks in vertical federated learning. Background Technology

[0002] Federated learning is a machine learning framework in which multiple data owners (participants) of equal status collaboratively train a global model. Compared to traditional centralized machine learning models, this framework adopts a decentralized principle. Each data owner trains a machine learning model locally using their own data, and then uploads their local model to an aggregation server or exchanges partial model information with each other. A global model is generated according to given aggregation rules for use by all participants. In this process, data owners do not share their local raw data, solving the challenges of data silos and data privacy leaks faced by traditional machine learning models.

[0003] Currently, federated learning has attracted the attention of academic and industrial communities both domestically and internationally, and has developed rapidly. However, most existing federated learning algorithms assume that the participants in the system are honest and trustworthy. In reality, however, federated learning systems may be vulnerable to poisoning attacks, meaning that some attackers can modify the data generated during the learning process, causing abnormal data to participate in the aggregation of the global model.

[0004] The distributed and privacy-preserving nature of federated learning makes it vulnerable to poisoning attacks. Without effective security defenses, these attacks can severely impact the reliability and availability of the entire system. Currently, there is limited research on defense methods against poisoning attacks in vertical federated learning systems.

[0005] Secure Boosting (SBP) is a type of vertical federated learning algorithm, and its system architecture is as follows: Figure 1 As shown in the figure. Research indicates that the SecureBoost algorithm can ensure that the accuracy of the trained model is not affected while protecting the privacy of the participants.

[0006] Participants in vertical federated learning are divided into two categories: active and passive parties. Active parties possess both sample features and labels, and also act as coordinators, calculating the optimal split for each boosting tree node. Passive parties are merely data providers, possessing only sample features but no labels. Passive parties need to collaborate with active parties to build a global model to predict labels.

[0007] However, due to its distributed and privacy-preserving nature, the SecureBoost algorithm is vulnerable to poisoning attacks during training, primarily affecting the active party. Since the active party needs to aggregate the training results uploaded by each passive party and send them to the passive parties in an encrypted manner, any intentional or unintentional tampering with the aggregated results by the active party will severely impact the federated learning training process and ultimately affect the overall model's performance. Summary of the Invention

[0008] To overcome the shortcomings of the prior art, the present invention aims to provide a method, system, device, and medium for defending against poisoning attacks in vertical federated learning. This method establishes an active party, a passive party, and a trusted third party. The active party's local data contains both sample features and sample labels, and it is responsible for computation during the learning process. The passive party only possesses sample features and is merely a data provider. The trusted third party, acting as a completely honest party, is responsible for verifying the integrity of the data sent by the active and passive parties under homomorphic encryption. The present invention designs an integrity verification method for the aggregated encrypted model generated by the active party. This method can defend against the active party intentionally or unintentionally providing erroneous model information with sensitive information to generate the global model, preventing prediction bias and losses in subsequent prediction work. This improves the robustness of the federated learning system and the credibility of the aggregation results.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A method for defending against poisoning attacks in vertical federated learning is proposed. A trusted third party generates a key and distributes it to both the active and passive parties. The active party encrypts the Boost tree gradient information and sends the encrypted result to the passive party. Simultaneously, the active party performs homomorphic hashing on the encrypted Boost tree gradient information and sends it to the trusted third party. The passive party aggregates the received encrypted gradient information according to the feature dimension, then performs homomorphic hashing on the aggregated result and sends it to the trusted third party. The trusted third party aggregates all the information sent by the passive parties and then verifies whether the encrypted Boost tree gradient information sent by the active party and the aggregated information from the passive parties are consistent. If they are consistent, the integrity verification passes; otherwise, the verification fails. The trusted third party sends the verification result to both the active and passive parties. If the verification result is received, the active and passive parties continue subsequent calculations; otherwise, the current training process ends, and the current round of training restarts, ensuring the integrity of the final global model, i.e., the global model is calculated from tamper-proof information.

[0011] A method for defending against poisoning attacks in vertical federated learning includes the following steps:

[0012] Step 1: A trusted third party generates a key and distributes it to both the active and passive parties.

[0013] Trusted third party: Generates (δ, ρ) as the key in the homomorphic hash function and sends it to the active party and each passive party; where δ and p are in the finite field Z. q A private key randomly selected from the data;

[0014] Initiating party: Receives the key sent by a trusted third party;

[0015] Passive party: Receives the key sent by a trusted third party;

[0016] Step 2: The active party calculates the gradient information corresponding to each sample, then uses additive homomorphic encryption to encrypt the gradient information corresponding to each sample, and sends the encryption result to the passive party.

[0017] Step 3: Each passive party calculates l quantiles S based on the features of the samples in the current node's sample space. k ={s k1 ,s k2 ,...,s kl Then, based on these quantiles, the current node sample is mapped to the corresponding interval, the encryption gradient in each interval is aggregated, and finally all the aggregation results are sent to the initiator and the trusted third party.

[0018] Step 4: After receiving the aggregated encrypted gradient statistics sent by the passive party in Step 3, the active party decrypts the gradients aggregated by each passive party, calculates the optimal split point for each node's corresponding feature, and in this process, performs homomorphic hash encryption on the generated gradient information. The encrypted gradient information is then sent to a trusted third party, which in turn sends it to the passive party, along with the feature ID (k). opt Threshold id(v) opt The encrypted gradient information sent by all passive parties is sent to the passive party; a trusted third party aggregates the encrypted gradient information sent by all passive parties to obtain... and By comparison The validity of the algorithm is used to verify the integrity of the intermediate calculation result of the active party, namely the cryptographic gradient, and the verification result is returned to each participating party.

[0019] Step 5: After the passive party receives the verification result returned by the trusted third party in Step 4, if the verification fails, the training terminates, indicating that the active party has launched a poisoning attack; if the verification passes, the passive party uses the feature ID (k) sent by the active party. opt ) and threshold id(v opt Determine the threshold (I) for the corresponding feature. L The sample space is divided according to a threshold; then, the passive party records the threshold of the feature in the SecureBoost algorithm lookup table, forming a record [record id, feature, ID]. L], and record the id and I L Return to the initiating party;

[0020] Step 6: The initiating party, based on the [record ID, I] returned in Step 5, L The corresponding nodes of the promotion tree are divided, and each node is associated with the corresponding [participant ID, record ID] information; then the node division information is synchronized with all passive parties.

[0021] Step 7: Repeat steps 1 to 6 for each feature until the specified number of training iterations are obtained to obtain a complete decision tree.

[0022] Step 1 comprises one active party (AP), m passive parties, and a trusted third party (TTP). All passive parties are represented by the set PP = {p1, p2, ..., p...}. m}express.

[0023] Step 2 specifically involves:

[0024] The active side calculates g for each sample. i and h i ,

[0025]

[0026]

[0027] In the formula, i∈{1,...,N}, where N is the number of data samples, l loss Represents the loss function; g i and h i Representing samples (x) i ,y i The first and second gradients on the loss function are then used to encrypt it using additive homomorphic encryption, and the encrypted g is then... i and h i Send to the passive party.

[0028] Step 3, which involves aggregating the encryption gradients within each interval, specifically involves:

[0029] The input includes the sample space of the current node, the sample features, and the gradients g and h corresponding to each sample;

[0030] Each passive party first calculates l percentiles for each feature k, resulting in a set S of quantiles. k ;

[0031] Next, for each feature k and each quantile v, select all samples in the sample space that satisfy x i,k Find sample instances i that fall between the v-th and (v-1)-th quantiles, and assign gradients g to these sample instances.i and h i Summing, and then homomorphically encrypting using a homomorphic encryption function, yields an encrypted gradient value G. kv and H kv ;

[0032] Finally, all G corresponding to each feature k kv and H kv Put a vector G i and H i The function returns these two vectors as output.

[0033] The calculation of the optimal segmentation point in step 4 is as follows:

[0034] The input includes the sample space of the current node and the encryption gradient of each passive party;

[0035] The overall process involves a three-level traversal: traversing all participants, all features of the participants, and all split points of the features. Then, the active party calculates the information gain for each split point and finally selects the split point with the largest information gain as the optimal split point and outputs it.

[0036] A defense system against poisoning attacks in vertical federated learning based on the defense methods described in steps 1 to 7, comprising:

[0037] The passive party module is used to provide data and work with the active party to build a global model;

[0038] The active side module provides data, sample features, and sample labels, while coordinating the passive side to calculate the optimal split for each boosting tree node;

[0039] The trusted third-party module is used to perform integrity verification on the gradient information sent by the initiator and the passive party under homomorphic encryption.

[0040] A defense device against poisoning attacks in vertical federated learning based on the defense methods described in steps 1 to 7, comprising:

[0041] Memory, used to store computer programs;

[0042] A processor is used to implement the defense method against poisoning attacks in vertical federated learning as described in steps 1 to 7 when executing the computer program.

[0043] A computer-readable storage medium for storing a computer program, which, when executed by a processor, is capable of detecting and defending against poisoning attacks based on the defense method for poisoning attacks in vertical federated learning described in steps 1 to 7.

[0044] Compared with the prior art, the present invention has the following advantages:

[0045] 1. This invention designs an integrity verification scheme for the interaction data between the active and passive parties in the classic longitudinal federated learning algorithm SecureBoost, ensuring that the intermediate data used for model aggregation has not been tampered with by attackers, thereby avoiding the reduction in the accuracy of the final global model caused by attackers tampering with the models of each participating party (launching a poisoning attack).

[0046] 2. Addressing the security threat of poisoning attacks launched by the active party in the existing SecureBoost classic vertical federated learning algorithm, and the vulnerability of federated learning to poisoning attacks due to the distributed and privacy-preserving characteristics of existing technologies, this invention proposes an integrity verification scheme for intermediate model training data based on the classic SecureBoost vertical federated learning algorithm. This scheme defends against active party poisoning attacks and improves the reliability of the SecureBoost algorithm. The defense against active party poisoning attacks verifies the integrity of the aggregated encrypted model information generated by the active party during the learning process, preventing abnormal intermediate results caused by model poisoning attacks from participating in the construction of the final global model. This achieves secure aggregation of the global model and enhances the reliability of the vertical federated learning system. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the SecureBoost system architecture, a vertical federated learning algorithm.

[0048] Figure 2 This is the process for verifying the integrity of this invention. Detailed Implementation

[0049] The present invention will now be described in further detail with reference to the accompanying drawings.

[0050] System Assumptions

[0051] (1) Assume that the longitudinal federated learning system consists of 1 active party (AP), m passive parties, and trusted third parties (TTPs), and the set of all passive parties is PP = {p1, p2, ..., p...}. m The active party possesses labeled sample data and is responsible for calculating the optimal split point for each decision tree node. The passive party only possesses unlabeled sample data. A trusted third party, acting as a completely honest party, is responsible for verifying the integrity of the data transmitted between the active and passive parties using homomorphic encryption.

[0052] (2) Adversary Model: Assume that the attacker may engage in the following malicious behaviors: the active party does not perform the aggregation operation to save resources and generates random numbers to replace the aggregation result; the active party adds noise to the aggregation result to affect the final aggregation result; the active party randomly selects a passive party's data, multiplies it, and replaces the aggregation result to save resources.

[0053] (3) Security objective: In response to the malicious behavior of the attackers mentioned above (the active party provides tampered aggregation results), the proposed solution can accurately verify whether the active party's aggregation results are calculated based on the data provided by each passive party. If the active party's aggregation results are detected to be tampered with, the model training process will be stopped in time and each participating party will be notified to prevent the tampered active party's aggregation results from being used to generate the final global model.

[0054] Preparation (Constructing a boosting tree)

[0055] Under the premise of privacy protection, sample alignment is performed on overlapping users with different characteristics between the active and passive parties, i.e., entity alignment.

[0056] The active and passive parties construct a global boosting tree while protecting privacy. XGBoost (eXtremeGradient Boosting) achieves extreme gradient boosting by using K decision trees f. k The ensemble of data is used to predict the output, implementing the GBDT (Gradient Boosting Decision Tree) algorithm, given a dataset D = {(x...} with n samples and d features. i ,y i )},in Its prediction method is shown in formula (1);

[0057]

[0058] Each participant constructs a gradient boosting tree by iteratively optimizing the loss of the real label and the predicted label. In each iteration, a new tree is added to reduce the loss. The objective function of the iteration in round t is shown in formula (2).

[0059]

[0060] In the above formula, l loss Represents the loss function; and Let Ω(f) represent the first and second gradients on the loss function, respectively. t The ) represents the complexity of the newly added tree.

[0061] The decision tree is constructed starting from zero depth, and the segmentation threshold for each node is determined using formula (3) until the maximum depth is reached; the segmentation threshold is determined by the segmentation gain, where I in formula (3) is the segmentation gain. L and I RLet represent the sample spaces of the left and right child nodes after the split, respectively; λ represents the hyperparameter; the split with the largest score is the optimal split; once the optimal splits of all nodes are determined, a complete lifting tree is established.

[0062]

[0063] A defense method against poisoning attacks in vertical federated learning introduces an integrity verification method for intermediate computation results of the active party based on the SecureBoost algorithm, thereby achieving secure aggregation of the SecureBoost algorithm; specifically, it includes the following steps:

[0064] Step 1:

[0065] Trusted third party: Generates (δ, ρ) as the key in the homomorphic hash function and sends it to the active party and each passive party. Here, δ and ρ are in the finite field Z. q A private key randomly selected from the data.

[0066] Initiator: Receives the key sent by a trusted third party.

[0067] Passive party (p) i ): Receive a key sent by a trusted third party.

[0068] Step Two:

[0069] The active party calculates g for each sample according to formulas (4) and (5). i and h i In the formula, i∈{1,...,N}, where N is the number of data samples, l loss Represents the loss function; g i and h i Representing samples (x) i ,y i The first and second gradients on the loss function are then used to encrypt it using additive homomorphic encryption, and the encrypted g is then... i and h i Send to the passive party.

[0070]

[0071]

[0072] Step 3: Each passive party calculates l quantiles S based on the features of the samples in the current node's sample space. k ={s k1 ,s k2 ,...,s klThen, based on these quantiles, the current node sample is mapped to the corresponding interval. Next, the encryption gradients within each interval are aggregated, and finally, all the aggregated results G are processed. i H i Send to the initiating party and a trusted third party, with a specific gradient aggregation and statistics algorithm:

[0073] The input includes the instance space of the current node, the feature dimension, and the gradient g for each instance. i and h i ;

[0074] Each passive party first calculates l percentiles for each feature k, resulting in a set S of quantiles. k ;

[0075] Next, for each feature k and each quantile v, select all instances in the instance space that satisfy x i,k Find instances i that fall between the v-th and (v-1)-th quantiles, and assign gradients g to these instances. i and h i Summing, and then homomorphically encrypting using a homomorphic encryption function, yields an encrypted gradient value G. kv and H kv ;

[0076] Finally, all G corresponding to each feature k kv and H kv Put a vector G i and H i The algorithm will process the data and return the two vectors as output.

[0077] That is, each passive party divides the features into several intervals according to percentiles, sums and encrypts the gradients of the instances in each interval, and finally summarizes the results.

[0078] Step 4: After receiving the aggregated encrypted gradient statistics from the passive party, the active party decrypts the gradients aggregated by each passive party, and can calculate the optimal split point for each node's corresponding feature. During this process, the generated g... l and h l Perform homomorphic hash encryption to calculate the result. and Send HF(g) l ) and HF(h l The information is sent to a trusted third party, which then forwards it to the passive party, along with the information corresponding to the optimal split point (k). opt and v opt Returning to the passive side, the optimal split point is calculated as follows:

[0079] The input includes the sample space of the current node and the encryption gradient of each passive party;

[0080] The overall process involves a three-level traversal: traversing all participants, all features of the participants, and all split points of the features. Then, the active party calculates the information gain for each split point and finally selects the split point with the largest information gain as the optimal split point and outputs it.

[0081] A trusted third party aggregates the encrypted gradient information sent by all passive parties to obtain... and By comparison The validity of the result is used to verify the integrity of the intermediate calculation result (encryption gradient) of the initiator, and the verification result is finally returned to each participant.

[0082] The specific integrity verification result algorithm is as follows:

[0083] The input includes the gradient information of each passive party after homomorphic hashing and the aggregated gradient information of the active party;

[0084] The trusted third party first performs homomorphic addition calculation on the gradient information of each passive party, and then compares it with the aggregated gradient information uploaded by the active party;

[0085] If the comparison results are the same, return True and training continues; if the comparison results are different, return False and training terminates.

[0086] Step 5:

[0087] The passive party determines the value of k based on the active party's input. opt and v opt Determine the threshold (I) for the corresponding feature L The sample space is divided according to a threshold. Then, the passive party records the threshold of the feature in a lookup table, forming a record [record id, feature, ID]. L ], and record the id and I L Return it to the initiating party.

[0088] Step Six:

[0089] The initiating party, based on the received [record ID, I] L The corresponding nodes in the promotion tree are partitioned, and each node is associated with the corresponding [participant ID, record ID] information. Then, the node partitioning information is synchronized with all passive parties.

[0090] Step Seven:

[0091] Repeat steps 1 to 6 for each feature until the specified number of training iterations are completed to obtain a complete decision tree.

[0092] Solution integrity verification solution process is as follows Figure 2 As shown.

[0093] Experimental results

[0094] Experimental hardware platform: HP laptop, 2.8GHz, quad-core, eight-thread Intel i7 processor, 8GB RAM. Virtual machine system: CentOS 7, allocated 4GB RAM. Experimental software platform: Federated AI Technology Enabler (FATE). FATE is an open-source project initiated by the WeBank AI project team, providing a secure computing framework and federated learning platform.

[0095] This experiment was conducted primarily using the built-in longitudinal federated learning dataset of FATE, with 569 samples in both the training and test sets. The experiment consisted of two parts: the first part involved anomaly detection during training of the longitudinal federated learning model without any abnormal behavior; the second part involved anomaly detection when the active party exhibited abnormal behavior.

[0096] In the experiment, we set the abnormal behavior into the following three scenarios: the active party does not perform the aggregation operation to save resources and generates a random number to replace the aggregation result; the active party adds noise to the aggregation result to affect the final aggregation result; the active party randomly selects a passive party's data, multiplies it, and replaces the aggregation result to save resources.

[0097] Table 1. List of Experimental Results

[0098]

[0099] Table 1 shows that even without abnormal attacker behavior, we can obtain correct verification results and successfully complete model training. When faced with the three different attack methods listed, the proposed solution successfully detects the anomalous behavior of the attacker and promptly stops model training, thus preventing erroneous information from affecting the model's prediction accuracy. This demonstrates the effectiveness of the proposed solution.

[0100] Table 2. Scheme Efficiency Analysis

[0101]

[0102]

[0103] Table 2 shows the runtime of the verification module and the total model training time under different abnormal behaviors. Since this experiment terminates model training immediately upon detecting abnormal behavior, the total training time under abnormal conditions is calculated based on the total training time without abnormalities. The table shows that the time spent on verification in the verification module is consistently below 0.3%. Clearly, the proposed verification scheme has a negligible impact on the overall training overhead of the longitudinal federated learning SecureBoost model and will not significantly affect the model training efficiency. Therefore, the proposed scheme is feasible, effective, and does not affect efficiency.

Claims

1. A method for defending against poisoning attacks in vertical federated learning, characterized in that, Specifically, the following steps are included: Step 1: A trusted third party generates a key and distributes it to both the active and passive parties. Trusted Third Party: Generation This key is used as the secret in the homomorphic hash function and sent to the active party and each passive party; among them... and In a finite field A private key randomly selected from the data; Initiating party: Receives the key sent by a trusted third party; Passive party: Receives the key sent by a trusted third party; Step 2: The active party calculates the gradient information corresponding to each sample, then uses additive homomorphic encryption to encrypt the gradient information corresponding to each sample, and sends the encryption result to the passive party. Step 3: Each passive party calculates l quantiles based on the features of the samples in the current node's sample space. Then, based on these quantiles, the current node sample is mapped to the corresponding interval, the encryption gradient in each interval is aggregated, and finally all the aggregation results are sent to the initiator and the trusted third party. Step 4: After receiving the aggregated encrypted gradient statistics sent by the passive party in Step 3, the active party decrypts the gradients aggregated by each passive party and calculates the optimal split point for the corresponding feature of each node. During this process, the generated gradient information is homomorphically hashed and encrypted, then sent to a trusted third party, which in turn sends it to the passive party, along with the feature ID (…). Threshold ID The encrypted gradient information sent to the passive party is then aggregated by a trusted third party to obtain... and By comparison , The validity of the algorithm is used to verify the integrity of the intermediate calculation result of the active party, namely the cryptographic gradient, and the verification result is returned to each participating party. The method for verifying the integrity of the intermediate calculation results of the active party, i.e., the encryption gradient, is as follows: The input includes the gradient information of each passive party after homomorphic hashing and the aggregated gradient information of the active party; The trusted third party first performs homomorphic addition calculation on the gradient information of each passive party, and then compares it with the aggregated gradient information uploaded by the active party; If the comparison results are the same, return True and training continues; if the comparison results are different, return False and training terminates. Step 5: After the passive party receives the verification result returned by the trusted third party in Step 4, if the verification fails, the training terminates, indicating that the active party has launched a poisoning attack; if the verification passes, the training proceeds based on the feature ID sent by the active party (…). and threshold id The sample space is partitioned, and the sample space of the left child node after partitioning is represented as follows: Then, the passive party records the threshold of this feature in the SecureBoost algorithm lookup table, forming a record [record id, feature, ...]. ], and record the ID and Return to the initiating party; Step 6: The initiating party, based on the [record ID] returned in Step 5, The corresponding nodes of the promotion tree are divided, and each node is associated with the corresponding [participant ID, record ID] information; then the node division information is synchronized with all passive parties. Step 7: Repeat steps 1 to 6 for each feature until the specified number of training iterations are obtained to obtain a complete decision tree.

2. The method for defending against poisoning attacks in vertical federated learning according to claim 1, characterized in that, Step 1 includes one active party ( ), The passive parties consist of a set of trusted third parties (TTPs) and a trusted third party (TTP). express.

3. The method for defending against poisoning attacks in vertical federated learning according to claim 1, characterized in that, Step 2 specifically involves: The active side calculates the corresponding values ​​for each sample. and , In the formula, ,in For the number of data samples, Represents the loss function; and Representing samples respectively The first and second gradients on the loss function are analyzed; then, additive homomorphic encryption is used to encrypt the result. and Send to the passive party.

4. A method for defending against poisoning attacks in vertical federated learning according to claim 1, characterized in that, Step 3, which involves aggregating the encryption gradients within each interval, specifically involves: The input includes the sample space of the current node, the sample features, and the gradient corresponding to each sample. and ; Each passive party first deals with each feature Calculate quantiles, resulting in a set of quantiles. ; Next, for each feature and each quantile Select all samples that satisfy the following conditions in the sample space. Falling in The and the first Sample examples between quantiles and the gradients of these sample instances and Summing is performed, and then homomorphic encryption is applied using a homomorphic encryption function to obtain an encrypted gradient value. and ; Finally, each feature All corresponding and Put a vector and The function returns these two vectors as output.

5. A method for defending against poisoning attacks in vertical federated learning according to claim 1, characterized in that, The calculation of the optimal segmentation point in step 4 is as follows: The input includes the sample space of the current node and the encryption gradient of each passive party; The overall process involves a three-level traversal: traversing all participants, all features of the participants, and all split points of the features. Then, the active party calculates the information gain for each split point and finally selects the split point with the largest information gain as the optimal split point and outputs it.

6. A defense system against poisoning attacks in vertical federated learning based on the defense method described in any one of claims 1 to 5, characterized in that, include: The passive party module is used to provide data and work with the active party to build a global model; The active side module provides data, sample features, and sample labels, while coordinating the passive side to calculate the optimal split for each boosting tree node; The trusted third-party module is used to perform integrity verification on the gradient information sent by the initiator and the passive party under homomorphic encryption.

7. A defense device against poisoning attacks in vertical federated learning based on the defense method described in any one of claims 1 to 5, characterized in that, include: Memory, used to store computer programs; A processor for implementing the method for defending against poisoning attacks in vertical federated learning when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, which, when executed by a processor, is capable of detecting and defending against poisoning attacks based on the method for defending against poisoning attacks in vertical federated learning according to any one of claims 1 to 5.

Images