A Data Privacy and Model Security Testing Method for Vertical Federated Learning

Abstract

This invention discloses a data privacy and model security testing method for vertical federated learning, applied in the field of security technology for distributed federated learning in artificial intelligence. The method includes two steps: a label inference attack step and a backdoor attack step, to test whether malicious actors can successfully steal label information and implant backdoors into the model under current vertical federated learning algorithms and defense methods to achieve malicious attacks. The label inference attack step tests the privacy protection capabilities of the vertical federated learning algorithm and corresponding defense methods for label information by implementing a simple and efficient intermediate result replacement method designed by us. The backdoor attack step implements a covert and efficient backdoor attack method by designing triggers, backdoor enhancements, and adjusting the learning rate to test the model security risks of the vertical federated learning algorithm and corresponding defense methods.

Description

Technical Field

[0001] This invention relates to the field of security technology for distributed federated learning in artificial intelligence, and more specifically to a data privacy and model security testing method for longitudinal federated learning. Background Technology

[0002] Federated learning is a distributed learning paradigm in the field of artificial intelligence that allows multiple data owners to collaboratively train a global model without leaking their local private data. Based on the data sharing patterns among clients, federated learning can be divided into horizontal federated learning and vertical federated learning.

[0003] In horizontal federated learning, participants use labeled datasets with the same feature space but different sample spaces. During training, each participant trains a local classifier through supervised learning and sends the weights to a centralized server for aggregation and updating. In vertical federated learning, participants have datasets with different feature spaces but the same sample space. During training, each participant trains a local model from the server via gradients and sends the intermediate results of the local model's output to the server for aggregation. In this process, only the server holds the data labels, and the server can train the final classifier through supervised learning based on the aggregated intermediate results. Since backdoor attacks have been extensively studied in horizontal federated learning, this invention focuses on vertical federated learning.

[0004] Backdoor attacks aim to train a backdoor model that functions correctly on normal input samples but misclassifies special inputs (input samples with maliciously designed triggers by the attacker) as the target label or other incorrect labels. Federated learning scenarios are ideal for attackers to act as participants in backdoor attacks because the server does not allow inspection of the participants' local data and local models. Backdoor attacks have been extensively studied in horizontal federated learning scenarios, where attackers upload model updates from malicious clients to the server to insert backdoors into the global model.

[0005] Unlike traditional federated learning, vertical federated learning presents new challenges for backdoor attacks, the most pressing being the lack of access to training data labels and the server model. To address these challenges, it is crucial to design effective schemes to obtain target data label information and to carefully construct triggers to implant backdoors into the black-box model on the server. To this end, we propose this invention, a label inference attack and backdoor attack method specifically for vertical federated learning. It features effective label inference and backdoor attack strategies and provides a new tool for testing the privacy protection and model security capabilities of vertical federated learning algorithms and corresponding defense methods.

[0006] Therefore, proposing a data privacy and model security testing method for longitudinal federated learning to address the difficulties of existing technologies is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of this, the present invention provides a data privacy and model security testing method for vertical federated learning. By implementing label inference attacks and backdoor attacks against vertical federated learning, the defensive capabilities of the vertical federated learning algorithm and the corresponding defense methods in terms of data privacy and model security are tested.

[0008] To achieve the above objectives, the present invention provides the following technical solution: A method for testing data privacy and model security in longitudinal federated learning includes the following steps: (1) Tag reasoning attack steps, which include the following: S101. An attacker participates in the training process of vertical federated learning as a malicious client. S102. Attackers steal data label information by replacing intermediate results; S103. The attacker dynamically adjusts to perform a covert label inference attack; in a certain round of training, given a set of samples T, which are samples whose labels are inferred through the label inference attack, the sample with the smallest return gradient is selected, i.e. For use in the subsequent replacement work; (2) Backdoor attack steps, which include the following: S201. Obtain the label information of the data through label inference attack; S202, Design a trigger; S203. Add the trigger to the intermediate results with the target label in this batch, and at the same time use a random strategy to enhance the attack effect; S204. Mix the poisoned data with other normal data and send it to the server; S205. Adjust the learning rate and update the model using the gradient information returned by the server; determine whether the required number of training rounds for a backdoor attack has been reached. If so, terminate the backdoor attack; otherwise, continue with S203-S205.

[0009] Optionally, in the above method, the specific steps of the attacker participating as a malicious client in the training process of vertical federated learning in step S101 are as follows: Each client inputs local data into its own local model to obtain intermediate results from the local model's output, and then transmits these intermediate results to the server. The server aggregates the received intermediate results and inputs the aggregated results into the server-side model to obtain the model's final prediction result. The server calculates the loss function and performs backpropagation, transmitting the obtained gradient information to the corresponding client. Each client updates its own local model based on the received gradient information. The training steps in S101 are repeated several times until the model gradually converges.

[0010] Optionally, in step S102, the attacker steals the data's tag information by substituting intermediate results, as follows: During normal training, the attacker sends the correct intermediate results to the server. And the gradient information returned by the server was obtained. ;in It is a local model held by the attacker. It is local data with unknown tags possessed by the attacker. This is the label of the sample, but for attackers... It is unknown; the attacker will transmit the same data again on the next occasion. When providing data to the server, attackers will first perform a screening process to identify unknown tags. Is this a tag that the attacker might be interested in? .

[0011] The above methods can optionally include judgment. Is the tag the target tag? The standard is: (1) (2) in express Norm, and There are two threshold parameters.

[0012] Optionally, step S102 of the above method further includes: Train a binary classifier using all currently known labeled data. With target label Data As a positive sample, it does not have a target label. Data As negative samples; among them, It is known to the attacker to have the target label Local data, It is local data known to the attacker that does not have the target label.

[0013] Optionally, step S102 of the above method further includes: The attacker inputs all samples in the same batch into a binary classifier for label prediction, selects the top n samples with the highest prediction results to replace the intermediate results, and uses the final label inference results to use these samples in the training of the binary classifier.

[0014] Optionally, step S102 of the above method further includes: For the samples selected through the screening process, the attacker will use intermediate results with other known labels. replace This is used to send data to the server and obtain the gradient information returned by the server. ;in It is the tag information that attackers are interested in, and It is known to the attacker to have tags Local data.

[0015] Optionally, the specific steps for designing the trigger in step S202 of the above method are as follows: Using a superimposed trigger E, the data poisoning process is defined as follows: (3) in This represents element-wise addition, and the trigger E can be expressed as: (4) Where M is the trigger mask, with a value of 1 in the trigger area and 0 in other areas. It is element-wise multiplication. It is a parameter that controls the trigger amplitude. ].

[0016] Optionally, in step S203 of the above method, the following two random strategies may be used to enhance the attack effect: Randomized policies Dropout and Shifing.

[0017] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a data privacy and model security testing method for longitudinal federated learning, which has the following beneficial effects: (1) By implementing label inference attacks and backdoor attacks against vertical federated learning, we test the defensive capabilities of vertical federated learning algorithms and corresponding defense methods in terms of data privacy and model security. (2) The testing tool includes two modules, namely the label inference attack module and the backdoor attack module, to test whether malicious actors can successfully steal label information and implant backdoors into the model under the current vertical federated learning algorithm and defense method to achieve malicious attacks; (3) The label inference attack module tests the privacy protection capabilities of the vertical federated learning algorithm and its corresponding defense methods for label information by implementing our designed simple and efficient intermediate result replacement method. The backdoor attack module tests the model security risks of the vertical federated learning algorithm and its corresponding defense methods by designing triggers, backdoor enhancements, and adjusting the learning rate to achieve a covert and efficient backdoor attack method. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 This serves as an example to test the privacy protection and model security capabilities of the longitudinal federated learning computation and corresponding defense methods of this invention; Figure 2 This is a schematic diagram illustrating the workflow of the tag inference attack module of the present invention; Figure 3 This is a schematic diagram illustrating the workflow of the backdoor attack module of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Reference Figure 1 As shown, a data privacy and model security testing method for longitudinal federated learning includes the following steps: (1) Tag reasoning attack steps, which include the following: S101. An attacker participates in the training process of vertical federated learning as a malicious client. S102. Attackers steal data label information by replacing intermediate results; S103. The attacker dynamically adjusts to perform a covert label inference attack; in a certain round of training, given a set of samples T, which are samples whose labels are inferred through the label inference attack, the sample with the smallest return gradient is selected, i.e. For use in the subsequent replacement work; (2) Backdoor attack steps, which include the following: S201. Obtain the label information of the data through label inference attack; S202, Design a trigger; S203. Add the trigger to the intermediate results with the target label in this batch, and at the same time use a random strategy to enhance the attack effect; S204. Mix the poisoned data with other normal data and send it to the server; S205. Adjust the learning rate and update the model using the gradient information returned by the server; determine whether the required number of training rounds for a backdoor attack has been reached. If so, terminate the backdoor attack; otherwise, continue with S203-S205.

[0022] Furthermore, the specific steps in step S101 where the attacker participates as a malicious client in the training process of vertical federated learning are as follows: Each client inputs local data into its own local model to obtain intermediate results from the local model's output, and then transmits these intermediate results to the server. The server aggregates the received intermediate results and inputs the aggregated results into the server-side model to obtain the model's final prediction result. The server calculates the loss function and performs backpropagation, transmitting the obtained gradient information to the corresponding client. Each client updates its own local model based on the received gradient information. The training steps in S101 are repeated several times until the model gradually converges.

[0023] Furthermore, in step S102, the attacker steals the data's label information by substituting intermediate results, and the specific steps are as follows: During normal training, the attacker sends the correct intermediate results to the server. And the gradient information returned by the server was obtained. ;in It is a local model held by the attacker. It is local data with unknown tags possessed by the attacker. This is the label of the sample, but for attackers... It is unknown; the attacker will transmit the same data again on the next occasion. When providing data to the server, attackers will first perform a screening process to identify unknown tags. Is this a tag that the attacker might be interested in? .

[0024] Further judgment Is the tag the target tag? The standard is: (1) (2) in express Norm, and There are two threshold parameters.

[0025] Furthermore, step S102 also includes: Train a binary classifier using all currently known labeled data. With target label Data As a positive sample, it does not have a target label. Data As negative samples. Among them, It is known to the attacker to have the target label Local data, It is local data known to the attacker that does not have the target label.

[0026] Furthermore, step S102 also includes: The attacker inputs all samples in the same batch into a binary classifier for label prediction, selects the top n samples with the highest prediction results to replace the intermediate results, and uses the final label inference results to use these samples in the training of the binary classifier.

[0027] Furthermore, step S102 also includes: For the samples selected through the screening process, the attacker will use intermediate results with other known labels. replace This is used to send data to the server and obtain the gradient information returned by the server. .in It is the tag information that attackers are interested in, and It is known to the attacker to have tags Local data.

[0028] Furthermore, the specific steps for designing the trigger in step S202 are as follows: Using a superimposed trigger E, the data poisoning process is defined as follows: (3) in This represents element-wise addition, and the trigger E can be expressed as: (4) Where M is the trigger mask, with a value of 1 in the trigger area and 0 in other areas. It is element-wise multiplication. It is a parameter that controls the trigger amplitude. ].

[0029] Furthermore, in step S203, the following two random strategies are used to enhance the attack effect: Randomized policies Dropout and Shifing.

[0030] Reference Figure 2 As shown, the tag inference attack module includes the following steps: S101. An attacker participates in the training process of vertical federated learning as a malicious client: Each client inputs local data into its local model to obtain intermediate results from the local model's output, and then transmits these intermediate results to the server. The server aggregates the received intermediate results and inputs the aggregated results into the server-side model to obtain the model's final prediction result. The server calculates the loss function and performs backpropagation, transmitting the obtained gradient information to the corresponding client. Each client updates its local model based on the received gradient information. These steps are repeated several times until the model gradually converges.

[0031] S102. The attacker steals the data's label information by replacing intermediate results, specifically including the following steps: During normal training, the attacker sends the correct intermediate results to the server. And the gradient information returned by the server was obtained. .in It is a local model held by the attacker. It is local data with unknown tags possessed by the attacker. This is the label of the sample, but for attackers... It is unknown.

[0032] The attacker will transmit the same data again in the next attack. When providing data to the server, attackers will first perform a screening process to identify unknown tags. Is this a tag that the attacker might be interested in? Specifically, it includes the following steps: (1) Train a binary classifier using all currently known labeled data. With target label Data As a positive sample, it does not have a target label. Data As negative samples. Among them, It is known to the attacker to have the target label Local data, It is local data known to the attacker that does not have the target label.

[0033] (2) The attacker inputs all samples in the same batch into a binary classifier. Perform label prediction, select The top n samples with the highest predictions are used to replace the intermediate results, and the final labels are used to infer the results. These samples are then used in the binary classifier as well. In the training work.

[0034] For the samples selected through the screening process, the attacker will use intermediate results with other known labels. replace This is used to send data to the server and obtain the gradient information returned by the server. .in It's the tagging information that attackers are interested in; in other words, attackers want to know which data has tags. ,and It is known to the attacker to have tags Local data.

[0035] By comparing the gradient changes before and after the replacement, the gradient can be determined using formulas (1) and (2). Is the tag the target tag? : (1) (2) in express Norm, and There are two threshold parameters.

[0036] S103, To avoid repeatedly using static... Tag swapping triggers a server alert, allowing attackers to dynamically adjust their strategies for covert tag inference attacks. In a particular training round, given a set of samples T, the attacker infers their labels using a tag inference attack. From a set of samples, select the sample with the minimum return gradient, i.e. . Used for subsequent replacement work.

[0037] Reference Figure 3 As shown, the backdoor attack module includes the following steps: S201. Constructing a trigger: Use a superimposed trigger E, and define the data poisoning process as follows: (3) in This represents element-wise addition, and the trigger E can be expressed as: (4) Where M is the trigger mask, with a value of 1 in the trigger area and 0 in other areas. It is element-wise multiplication. It is a parameter that controls the trigger amplitude. (Each pair of positive values ​​is followed by two negative values, and each pair of negative values ​​is followed by two positive values, until termination). Note that this involves directly adding the trigger to the intermediate result. Instead of the original data samples, the attacker, as a client participant in vertical federated learning, only needs to upload the intermediate results to the server. The attacker can then overlay triggers onto the intermediate results, enabling a more effective backdoor attack.

[0038] S202. Backdoor injection in longitudinal federated learning is more difficult than ordinary backdoors because attackers cannot control intermediate results from other benign participants. To enhance backdoor injection, this invention introduces randomness into the poisoned data during training to improve the performance of backdoor attacks during testing of the longitudinal federated learning model. Therefore, this invention employs two randomization strategies for backdoor enhancement.

[0039] (1) First random strategy Dropout: Inspired by the dropout method commonly used to alleviate overfitting, the attacker randomly sets some elements in the trigger mask each time during the backdoor implantation process. Evaluation shows that the Dropout strategy makes this backdoor attack method more robust against trigger elimination-based backdoor defenses.

[0040] (2) The second random strategy, Shifing: randomly multiply the trigger mask M by a uniformly distributed [ A random number γ within the range of γ] is used to slightly alter the trigger amplitude. This refers to the lower limit of the random number γ, while γ refers to the upper limit of the random number γ.

[0041] S203. In the process of updating model parameters using gradient information, the attacker will appropriately increase the learning rate of the local model he owns and change the convergence speed of the local model, thereby enhancing the influence of the part of the model held by the attacker on the final classification result, and further enhancing the impact of poisoned data on the server-side model.

[0042] The following example illustrates the implementation process of label inference attacks and backdoor attacks using a scenario involving two client models and one server model in vertical federated learning. Tests were conducted on several image datasets, including MNIST, CIFAR10, ImageNette, and CINIC-10, and the Bank Marketing (BM) and Give-Me-Some-Credit (GM) table datasets (structured datasets). The corresponding models selected for each dataset are shown in Table 1 below. Table 1

[0043] The specific implementation includes the following steps: The tag inference attack module includes the following steps: For MNIST, CIFAR-10, ImageNette, CINIC-10, BM, and GM, the number of samples in each training batch was 128, 128, 50, 64, 100, and 1000, respectively, and the number of selected embedding swaps was n = 14, 14, 10, 8, 6, and 40, respectively. Threshold in label inference attacks. It was set to the average of the gradient L2 norm because the gradient L2 norm of misclassified samples is typically greater than the average. In implementation, it was found that... = 0.01 is applicable to different datasets, depending on the specific implementation. Take 5, adjustable, if The smaller the selection, the more stringent the selection of target label samples will be, but the target label samples may be ignored.

[0044] S1. Attackers steal data label information by replacing intermediate results, specifically including the following steps: S101. During normal training, the attacker sends the correct intermediate results to the server. And the gradient information returned by the server was obtained. .in It is a local model held by the attacker. It is local data with unknown tags possessed by the attacker. This is the label of the sample, but for attackers... It is unknown.

[0045] S102. The attacker will transmit the same data again on the next occasion. When providing data to the server, attackers will first perform a screening process to identify unknown tags. Is this a tag that the attacker might be interested in? Specifically, it includes the following steps: (1) Train a binary classifier using all currently known labeled data. With target label Data As a positive sample, it does not have a target label. Data As negative samples. Among them, It is known to the attacker to have the target label Local data, It is local data known to the attacker that does not have the target label.

[0046] (2) The attacker inputs all samples in the same batch into a binary classifier. Perform label prediction, select The top n samples with the highest predictions are used to replace the intermediate results, and the final labels are used to infer the results. These samples are then used in the binary classifier as well. In the training work.

[0047] S103. For the samples selected through the screening process, the attacker will use intermediate results with other known labels. replace This is used to send data to the server and obtain the gradient information returned by the server. .in It's the tagging information that attackers are interested in; in other words, attackers want to know which data has tags. ,and It is known to the attacker to have tags Local data.

[0048] S104. Compare the gradient changes before and after the replacement, and determine the gradient using formulas (1) and (2). Is the tag the target tag? : (1) (2) in express Norm, and There are two threshold parameters.

[0049] S2, to avoid repeatedly using static... Tag swapping triggers a server alert, allowing attackers to dynamically adjust their strategies for covert tag inference attacks. In a particular training round, given a set of samples T, the attacker infers their labels using a tag inference attack. From a set of samples, select the sample with the minimum return gradient, i.e. . Used for subsequent replacement work.

[0050] Based on the above steps, this invention was tested on various datasets, and label inference was performed on them. The results are shown in Table 2 below: Table 2

[0051] As can be seen, the label inference algorithm proposed in this invention achieves high accuracy on each dataset. On MNIST, CIFAR-10, CINIC-10, BM, and GM, the label inference attack accuracy is greater than 96%. On the more complex ImageNette dataset, the attack accuracy decreases slightly, but remains above 92%. Furthermore, the label inference attack algorithm proposed in this invention is very time-efficient, as it only requires one round of training (a few minutes) to infer labels, while previous label inference attacks required more time to train a semi-supervised model before subsequent inference tasks.

[0052] The backdoor attack module includes the following steps: The poisoning rate is 1% for all datasets, which is the default value. The value is 0.4 to maintain the stealth of the trigger; γ is set to 0.6. Set it to 1.2. Select to attack all tags to test overall effectiveness, and the dropout ratio used is 0.75.

[0053] S1. Constructing the trigger: Use a superimposed trigger E, and define the data poisoning process as: (3) in This represents element-wise addition, and the trigger E can be expressed as: (4) Where M is the trigger mask, with a value of 1 in the trigger area and 0 in other areas. It is element-wise multiplication. It is a parameter that controls the trigger amplitude. (Each pair of positive values ​​is followed by two negative values, and each pair of negative values ​​is followed by two positive values, until termination). Note that this involves directly adding the trigger to the intermediate result. Instead of the original data samples, the attacker, as a client participant in vertical federated learning, only needs to upload the intermediate results to the server. The attacker can then overlay triggers onto the intermediate results, enabling a more effective backdoor attack.

[0054] S2. To enhance backdoor injection, the attacker introduces randomness into the poisoned data during training to improve the performance of backdoor attacks during testing of the longitudinal federated learning model. Therefore, the attacker employs two randomization strategies for backdoor enhancement.

[0055] S201. First Random Strategy: Dropout. Inspired by the dropout method commonly used to alleviate overfitting problems, during the backdoor implantation process, the attacker randomly sets some elements in the zero-trigger mask each time. Evaluation shows that the Dropout strategy makes this backdoor attack more robust against backdoor defenses based on trigger elimination.

[0056] S202, Second random strategy Shifing: Randomly multiply the trigger mask M by a uniformly distributed […]. A random number γ within the range of γ] is used to slightly alter the trigger amplitude. This refers to the lower limit of the random number γ, while γ refers to the upper limit of the random number γ.

[0057] S3. In the process of updating model parameters using gradient information, the attacker will appropriately increase the learning rate of the local model he owns and change the convergence speed of the local model, thereby enhancing the influence of the part of the model held by the attacker on the final classification result, and further enhancing the impact of poisoned data on the server-side model.

[0058] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0059] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for testing data privacy and model security in longitudinal federated learning, characterized in that, Includes the following steps: (1) Tag reasoning attack steps, which include the following: S101. An attacker participates in the training process of vertical federated learning as a malicious client. S102. Attackers steal data label information by replacing intermediate results; S103. The attacker dynamically adjusts to perform a covert label inference attack; in a certain round of training, given a set of samples T, which are samples whose labels are inferred through the label inference attack, the sample with the smallest return gradient is selected, i.e. For use in the subsequent replacement work; (2) Backdoor attack steps, which include the following: S201. Obtain the label information of the data through label inference attack; S202, Design a trigger; S203. Add the trigger to the intermediate results with the target label in this batch, and at the same time use a random strategy to enhance the attack effect; S204. Mix the poisoned data with other normal data and send it to the server; S205. Adjust the learning rate and update the model using the gradient information returned by the server; determine whether the number of training rounds required for the backdoor attack has been reached. If it has, terminate the backdoor attack; otherwise, continue with S203-S205. The specific steps by which the attacker steals the data's tag information using the intermediate result replacement method in step S102 are as follows: During normal training, the attacker sends the correct intermediate results to the server. And the gradient information returned by the server was obtained. ;in It is a local model held by the attacker. It is local data with unknown labels owned by the attacker; however, the labels of this sample are unknown to the attacker. It is unknown; the attacker will transmit the same data again on the next occasion. When providing data to the server, attackers will first perform a screening process to identify unknown tags. Is it possible that this is a tag that the attacker is interested in? ; judge Is the tag the target tag? The standard is: （1） （2） in express Norm, and There are two threshold parameters. It is the gradient information returned by the server.

2. The data privacy and model security testing method for longitudinal federated learning according to claim 1, characterized in that, The specific steps in step S101 where the attacker participates as a malicious client in the training process of vertical federated learning are as follows: Each client inputs local data into its own local model to obtain intermediate results from the local model's output, and then transmits these intermediate results to the server. The server aggregates the received intermediate results and inputs the aggregated results into the server-side model to obtain the model's final prediction result. The server calculates the loss function and performs backpropagation, transmitting the obtained gradient information to the corresponding client. Each client updates its own local model based on the received gradient information. The training steps in S101 are repeated several times until the model gradually converges.

3. The data privacy and model security testing method for longitudinal federated learning according to claim 1, characterized in that, Step S102 also includes: Train a binary classifier using all currently known labeled data. With target label Data As a positive sample, it does not have a target label. Data As negative samples; among them, It is known to the attacker to have the target label Local data, It is local data known to the attacker that does not have the target label.

4. The data privacy and model security testing method for longitudinal federated learning according to claim 3, characterized in that, Step S102 also includes: The attacker inputs all samples in the same batch into a binary classifier for label prediction, selects the top n samples with the highest prediction results to replace the intermediate results, and uses the final label inference results to use these samples in the training of the binary classifier.

5. A data privacy and model security testing method for longitudinal federated learning according to claim 4, characterized in that, Step S102 also includes: For the samples selected through the screening process, the attacker will use intermediate results with other known labels. replace This is used to send data to the server and obtain the gradient information returned by the server. ;and It is known to the attacker to have tags Local data, of which This is the tag information that attackers are interested in.

6. A data privacy and model security testing method for longitudinal federated learning according to claim 1, characterized in that, The specific steps for designing the trigger in step S202 are as follows: Using a superimposed trigger E, the data poisoning process is defined as follows: （3） in This represents element-wise addition, and the trigger E is expressed as: （4） Where M is the trigger mask, with a value of 1 in the trigger area and 0 in other areas. It is element-wise multiplication. It is a parameter that controls the trigger amplitude. ].

7. A data privacy and model security testing method for longitudinal federated learning according to claim 1, characterized in that, In step S203, the following two random strategies are used to enhance the attack effect: Randomized policies Dropout and Shifing.

Images