A federated learning byzantine node detection method based on LSTM

Abstract

In view of the problems that the existing Byzantine node detection method cannot be directly applied to a privacy protection environment, and the performance of the detection method is greatly reduced or even completely invalid when the node data is Non-IID, the application provides a federated learning Byzantine node detection method based on LSTM. The method uses differential privacy technology to protect the local gradient of the node, and then combines AE and LSTM to detect the Byzantine node, realizes the safe aggregation of the global model, and enhances the robustness of the federated learning system. Unlike the previous Byzantine detection method, the application can be executed in the privacy protection and Non-IID environment of the local training data of the node.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cyberspace security, and relates to a detection method for a Byzantine node in federated learning. BACKGROUND

[0002] With the development of big data, deep learning and other technologies in recent years, artificial intelligence applications are increasingly penetrating people's daily life, such as autonomous driving, assisted medical care, smart cities, etc. At the same time, because relevant enterprises excessively collect user privacy and from time to time there are user data leakage events of enterprises, people's privacy protection awareness gradually improves and they are increasingly dissatisfied with the behavior of enterprises excessively collecting information. Therefore, regulatory agencies timely introduce relevant laws and regulations to strictly regulate the process of information collection and management of enterprises. The simple and crude data collection method in the past is no longer feasible, and massive high-quality data is scattered among various entities, resulting in the problem of data fragmentation and isolated data islands. How to legally and efficiently use scattered data to train high-performance models has become a research hotspot in the field of artificial intelligence. Therefore, federated learning has emerged.

[0003] Federated learning is a kind of distributed machine learning, which cooperatively trains a global model by sharing model updates instead of traditional data centralized machine learning, and the local training data of nodes does not go out of the local, thereby ensuring user privacy and security. However, federated learning also faces some key challenges. First, previous researchers assumed that sharing model updates is safe, but in fact model updates can also leak sensitive information of nodes. Therefore, although federated learning is a machine learning paradigm that protects privacy, further research is still needed on its privacy protection. Second, the distributed architecture of federated learning makes it vulnerable to Byzantine node attacks. Byzantine nodes initiate poisoning attacks by uploading malicious data, which destroys the availability and integrity of the global model. Therefore, detecting model updates uploaded by nodes to prevent malicious model updates from affecting the global model is an important prerequisite for federated learning to enter production practice.

[0004] Current privacy protection research and Byzantine detection research are mostly independent. Privacy protection is achieved by hiding model updates, while Byzantine detection is usually based on model updates. Therefore, existing Byzantine detection methods cannot be directly applied to a privacy protection environment. Second, existing Byzantine detection research usually assumes that node data is independent and identically distributed (IID). However, in actual applications, node data is mostly non-independent and identically distributed (Non-IID). Direct application of existing Byzantine detection research to a data Non-IID environment often results in high false detection rates or missing Byzantine nodes. SUMMARY

[0005] In order to solve the problems that the existing Byzantine node detection method cannot be directly applied to a privacy protection environment, and the performance of the detection method is greatly reduced or even completely invalid when the node data is Non-IID, the application provides a federated learning Byzantine node detection method based on LSTM.

[0006] To achieve the above object, the technical scheme of the application is:

[0007] A federated learning Byzantine node detection method based on LSTM is used for a server end, the server comprises a preprocessing module, a data detection module and a global aggregation module, and the data detection module comprises a historical gradient record database.

[0008] The method comprises:

[0009] A registration stage: receiving registration information of a node and negotiating with the node to determine basic information;

[0010] A preprocessing stage: the preprocessing module pre-trains a model to generate an AE model and an LSTM model, and sends the generated AE model and LSTM model to the data detection module;

[0011] An official training stage: receiving local gradients uploaded by a node, the data detection module detects whether the local gradients uploaded by the node are reliable according to the AE model, the LSTM model and the historical gradient record database, and generates a list of trusted nodes, then sends the generated list of trusted nodes to the global aggregation module, the global aggregation module aggregates to generate a global gradient according to the historical gradient record database and the list of trusted nodes, and sends the global gradient to the trusted nodes.

[0012] Compared with the prior art, the application has the following beneficial effects:

[0013] The application provides a federated learning Byzantine node detection method based on long short-term memory (LSTM), which can accurately detect Byzantine nodes in a privacy protection and Non-IID node data environment. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 A schematic diagram of a federated learning system is provided for the embodiments of the application;

[0015] Figure 2 An autoencoder structure schematic diagram is provided;

[0016] Figure 3 is a schematic diagram of a Cell structure;

[0017] Figure 4 is the model accuracy under IID condition;

[0018] Figure 5 is the model accuracy under Non-IID condition. DETAILED DESCRIPTION

[0019] Embodiment:

[0020] The technical solutions of the present application will be further described below in combination with the drawings and embodiments.

[0021] The current privacy protection research and Byzantine node detection research in the field of federated learning are mostly independent. The privacy protection research usually assumes that the nodes strictly comply with the federated learning protocol, the server is honest and curious. While the Byzantine node detection research assumes that the local gradient of the node is transmitted in plaintext form, and the local training data of the node is IID. Unlike previous Byzantine detection methods, the present application can be executed in the environment of privacy protection and Non-IID local training data of nodes.

[0022] In addition, the existing Byzantine node detection method has limitations on the proportion of Byzantine nodes in the federated learning system. However, in actual application environment, the proportion of Byzantine nodes can only be roughly estimated, and the real situation cannot be predicted, which may cause the detection method to fail. This is because the previous detection idea is to compare the local gradients of nodes horizontally, and to filter outliers by clustering method according to certain data indicators. The present application proposes a vertical detection idea, the abnormal situation of a node is only related to the historical performance of the node, and is irrelevant to other nodes, so it is not affected by the proportion of Byzantine nodes.

[0023] The related theoretical and technical tools used in the present application are, in turn, autoencoder, LSTM and differential privacy technology.

[0024] The autoencoder is an unsupervised machine learning algorithm that can be used for anomaly detection and feature extraction. As shown in Figure 2 , the autoencoder is composed of an encoder and a decoder, and its significant feature is that the number of input layer neurons and the number of output layer neurons are equal. Among them, the input layer and the intermediate layer constitute the encoder, and the intermediate layer and the output layer constitute the decoding layer.

[0025] LSTM is a time recurrent network that can be used to solve multi-input and multi-output problems. The basic unit of LSTM is Cell, and its basic structure is as shown in Figure 3 . The Cell unit has three input information: the state information C t-1 of the previous moment, the hidden layer information H t-1 of the previous moment and the current input Xt The 4 gate processing mechanisms in Cell have a "memory" function. The forgetting gate determines the degree of forgetting historical information, which can be described by formula (1); the input gate determines the information in X t that needs to be retained, which can be described by formula (2); the update gate represents new information generated by X t , which can be described by formula (3); and the output gate determines the information that needs to be output, which can be described by formula (4). The final output of Cell is the state information C t of the current moment shown in formula (5) and the hidden layer information H t of the current moment shown in formula (6).

[0026] F t =σ·(W F ·[H t-1 ,X t ]+b F ) (1)

[0027] I t =σ·(W I ·[H t-1 ,X t ]+b I ) (2)

[0028]

[0029] O t =σ·(W O ·[H t-1 ,X t ]+b O ) (4)

[0030]

[0031] H t =O t ·tanh(C t ) (6)

[0032] Differential privacy achieves privacy protection by introducing controllable noise to obscure the original data. Differential privacy calculation is simple and easy to deploy, so it is a commonly used privacy protection technology in the field of federated learning. The definition and implementation mechanism of (∈, δ) differential privacy are introduced below.

[0033] (∈, δ) differential privacy: suppose there is a random algorithm D1 and D2, non-negative real numbers ∈ and δ, if and only if is adjacent data set (at most one data difference) and inequality (7) holds, then A satisfies (∈, δ) differential privacy. Where 2χ denotes the set of all subsets of χ, is the value range of A, ∈ is the privacy budget, and δ is the tolerance factor (indicating the fault tolerance rate).

[0034] Pr(A(D1)∈Y)≤exp(∈)·Pr(A(D2)∈Y)+δ (7)

[0035] Before introducing the differential privacy implementation mechanism, the concept of sensitivity needs to be introduced. Sensitivity represents the degree of output change caused by input change. Assuming that there is a query function f(·), the sensitivity of the function f is shown in equation (8). Where D1 and D2 are adjacent data sets, and ||·|| represents the vector norm.

[0036]

[0037] (∈,δ) differential privacy implementation mechanism: assuming that the random variable X follows a Gaussian distribution, denoted as X ~ N(μ,σ 2 ). For any query function f:D→R d , if M(D) satisfies equation (9), and σ satisfies inequality (10), then M(D) satisfies (∈,δ) differential privacy. This implementation method is the Gaussian mechanism.

[0038] M(D)=f(D)+N(0,σ 2 ) (9)

[0039]

[0040] As Figure 1 shown, the federated learning system group provided by the embodiment of the application is composed of a node end and a server end, there are N nodes in the federated learning system, denoted by a set , the server is honest and curious, and the Byzantine node does not launch an attack in the first round.

[0041] The node end is composed of benign nodes participating in federated learning training honestly and Byzantine nodes launching a poisoning attack opportunistically. And the server end is composed of a preprocessing module, a data detection module and a global aggregation module. The preprocessing module performs model pre-training before the formal training starts to obtain an auto-encoder (AE) model and a long short-term memory model, and sends them to the data detection module. The data detection module detects whether the local gradient uploaded by the node is reliable according to the AE model, the LSTM model and the historical gradient record database and generates a list of trusted nodes, and then sends it to the global aggregation module. The global aggregation module generates a global gradient according to the list of trusted nodes and the historical gradient record database, and distributes it to the trusted nodes. The training process of federated learning can be divided into the following 5 steps:

[0042] (1) Nodes register information in the federated learning system and negotiate the basic information required by the system, such as model architecture and model parameter settings;

[0043] (2) The server’s preprocessing module performs model preprocessing to generate AE model and LSTM model, and then sends them to the data detection module;

[0044] (3) The node starts local model training and obtains local gradients, then processes the local gradients using differential privacy and uploads them to the server.

[0045] (4) The server receives the local gradients of the nodes and maintains and updates the historical gradient record database. Then, the data detection module detects Byzantine nodes based on the LSTM model and sends the list of trustworthy nodes to the global aggregation module.

[0046] (5) The server’s global aggregation module aggregates and generates global gradients based on the historical gradient database and the list of trusted nodes, and then distributes them to trusted nodes.

[0047] The specific execution flow of the LSTM-based Byzantine node detection method proposed in this embodiment includes a registration stage, a preprocessing stage, and a formal training stage.

[0048] The main tasks of the registration phase are for nodes to register their account information in the federated learning system, and then negotiate the model structure, parameter settings, and privacy budget allocation scheme for federated learning.

[0049] The main task of the preprocessing stage is to generate the AE and LSTM models. First, the preprocessing module pre-trains the models, collecting the gradients generated during training and organizing them to generate a Differential Time Series (DTSD) dataset. Then, the preprocessing module trains the AE and LSTM models based on the DTSD. Finally, the preprocessing module generates a threshold reference list. The following is a detailed description of each step in the preprocessing stage:

[0050] DTSD Collection:

[0051] The server creates the model (the model negotiated during the registration phase), and then performs Itr rounds of iterations using the root dataset. During this process, all model gradients generated during iterative training are collected in chronological order to obtain the gradient set. Among them G i This represents the gradient generated in the i-th iteration;

[0052] Server computing Find the L2 norm of each Gi, then calculate the expected value cth of the m largest numbers, and use cth as the gradient clipping threshold to distribute to each node.

[0053] The server clips the gradients in Formula (11) to obtain the set

[0054] GC i = G i / max(1, ||G i ||2 / cth) (11)

[0055] The server calculates the difference between adjacent gradients in Formula (12) to obtain the set where GCD t = GC t+1 - GC t ; GC t is the value corresponding to the gradient clipping of the tth gradient.

[0056] AE model training:

[0057] The server creates an AE model, then iteratively trains the model with DSTD as the training set, and finally sends the obtained AE model to the data detection module.

[0058] LSTM model training:

[0059] The server uses the AE model to encode the gradients in DSTD to generate a data set where GCDE t = AE encoder (GCD t ); GCD t is an element in the time series data set DTSD, representing the difference between the tth and t+1th gradients; AEencoder() represents the encoder part of the autoencoder;

[0060] The server uses a sliding window with a length of 4 and a step of 1 to sample DTSDE to generate a data set DTSDEL;

[0061] The server creates an LSTM model, uses the first 80% of the samples in DTSDEL as the training set to train the LSTM model, and then sends the LSTM model to the data detection module.

[0062] Threshold reference list generation:

[0063] The last 20% of DTSDEL is input into the LSTM model as a test set, the Euclidean distance between each predicted data and actual data is calculated and recorded to generate a threshold reference list.

[0064] ​​In the formal training phase, the node is responsible for uploading the local gradient, and the data detection module in the server detects whether the local gradient uploaded by the node is reliable according to the AE model, the LSTM model and the historical gradient record database, and generates a list of trusted nodes, and then sends the generated list of trusted nodes to the global aggregation module. The global aggregation module aggregates the global gradient according to the historical gradient record database and the list of trusted nodes, and sends the global gradient to the trusted nodes. The specific execution process of the node and the server will be introduced below:

[0065] Node:

[0066] (1) The node sets the relevant model parameters according to the negotiation results in the registration phase;

[0067] (2) The node starts the t-th round of training, collects the local gradient G t of the current round, performs gradient clipping according to formula (11) to generate GC t , performs differential privacy processing to generate GCN t , and uploads it to the server;

[0068] (3) If t < 5, return to step (2) above and start a new round of training, otherwise proceed to the next step;

[0069] (4) The node receives the global gradient and updates the local model, and then returns to step (2) to continue local training until the model converges or the stopping condition is reached.

[0070] Server:

[0071] (1) The server receives the local gradient uploaded by the node;

[0072] (2) The server maintains and updates the historical record of the node (records the local gradient of the model training of each node in the last 5 rounds). The historical record of each node is stored in the form of a double-ended queue, and when a new local gradient is uploaded, it is directly enqueued from the tail of the queue, and the gradient at the head of the queue is popped out of the queue;

[0073] (3) If t < 5, return to step (1) and start a new round of training, otherwise proceed to the next step;

[0074] (4) The server detects the abnormality of the node according to the Byzantine node detection algorithm, and generates a list of trusted nodes. The input of the Byzantine node detection algorithm is the historical record of the node, and the output is the abnormality of the node. The first to sixth lines process the historical record, first calculate the difference between adjacent gradients, then encode with the AE model, and finally calculate the error between the predicted label and the actual label through the LSTM; the seventh to nineteenth lines judge the abnormality of each layer of the local gradient based on the aforementioned error value, and then judge whether it is a Byzantine node uploading malicious data according to the total number of abnormal layers of the gradient;

[0075] (5) The server aggregates the local gradients uploaded by the trusted nodes to obtain a global gradient, and distributes the global gradient to the trusted nodes;

[0076] (6) Return to step (1) above, start a new round of training until the model converges or reaches the stopping condition.

[0077] Specifically, the Byzantine node detection algorithm described above includes:

[0078]

[0079]

[0080] The effectiveness of the present application is verified by an experiment.

[0081] The experimental platform is Dell T7920 workstation, Intel 4210R CPU, 160G memory, Ubuntu 18.04LTS operating system. A federated learning system is realized by python3 simulation, and the basic settings are node number u=30, training round epoch=30, privacy budget epsilon=2, Byzantine node proportion mn=0.6. The training data selected in the experiment is MNIST handwritten data set, and the model structure for training is CNN. In addition, part of the Byzantine nodes in this experiment start model poisoning attack from the 5th round of training, and the remaining adversaries start model poisoning attack from the 10th round of training. The effectiveness of the present application is tested in the node data IID and Non-IID environment respectively.

[0082] Figure 4 For the node data IID condition, whether to use the detection method proposed in the present application affects the accuracy of the global model. As shown in Figure 4 The model accuracy of the federated learning deployed with the detection method proposed in the present application shows an overall upward trend, and the final accuracy is about 90%, which is much higher than the model accuracy without deploying the detection mechanism. Therefore, the present application can effectively detect Byzantine nodes under the conditions of privacy protection and node data IID to eliminate the influence of Byzantine nodes on the global model. In particular, the model accuracy of the federated learning without using the Byzantine detection method decreases sharply at the 5th round and the 10th round. This is because 9 Byzantine nodes start model poisoning attack at the 5th round of training, and 9 Byzantine nodes (a total of 18 Byzantine nodes) start model poisoning attack at the 10th round of training.

[0083] The Non-IID environment is set as follows in this experiment: each node only holds any 8 classes of data in the MNIST data set (the MNIST data set contains 10 classes of data of digits 0-9), and the data amount of each class of data is not equal, and the data amount of each node is also not equal.Figure 5 The influence of whether to use the detection method of the present application on the accuracy of the global model under the node data Non-IID condition is given. As shown in Figure 5 The model accuracy of the federated learning deploying the detection method of the present application still presents an upward trend as a whole, and the phenomenon of model accuracy reduction does not appear in the 5th round and the 10th round, and the final accuracy is about 80%, which is much higher than the model accuracy without deploying the detection mechanism. Therefore, the present application can accurately detect the Byzantine node under the node data Non-IID condition.

[0084] The above embodiments are only for illustrating the technical concept and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and to implement it, and it cannot limit the protection scope of the present application. Any equivalent changes or modifications made according to the essence of the present application should be covered within the protection scope of the present application.

Claims

1. A federated learning Byzantine node detection method based on LSTM, used on the server side, characterized in that, The server includes a preprocessing module, a data detection module, and a global aggregation module. The data detection module includes a historical gradient record database. The method includes: Registration phase: Receive the node's registration information and negotiate with the node to determine basic information; Preprocessing stage: The preprocessing module performs model pre-training, generates AE model and LSTM model, and sends the generated AE model and LSTM model to the data detection module; Formal training phase: The local gradients uploaded by the receiving nodes are detected by the data detection module based on the AE model, LSTM model and historical gradient record database to determine whether the local gradients uploaded by the nodes are reliable and generate a list of reliable nodes. The generated list of reliable nodes is then sent to the global aggregation module. The global aggregation module aggregates and generates global gradients based on the historical gradient record database and the list of reliable nodes, and then sends the global gradients to the reliable nodes. The trusted node list is generated as follows: The server detects node anomalies using the Byzantine Node Detection Algorithm (BDA) and generates the trusted node list. The input of the BDA algorithm is the node's historical records, and the output is the node's anomalies. First, the historical records are processed by calculating the difference between adjacent gradients, then encoding them using an AE model, and finally calculating the error between the predicted label and the actual label using an LSTM. Finally, based on the aforementioned error values, the anomalies of each layer of the local gradient are determined, and then the total number of anomaly layers in the gradient is used to determine whether it is malicious data uploaded by a Byzantine node.

2. The LSTM-based federated learning Byzantine node detection method as described in claim 1, characterized in that, The preprocessing module performs model pre-training to generate AE and LSTM models, including: The preprocessing module performs model pre-training, collects the model gradients generated during the training process, and organizes them to generate the time-division sequence dataset DTSD. The preprocessing module trains the AE model and LSTM model based on DTSD, and finally generates a threshold reference list.

3. The LSTM-based federated learning Byzantine node detection method as described in claim 2, characterized in that, The preprocessing module performs model pre-training, collects the model gradients generated during training, and organizes them to generate the Time-Divided Sequence Dataset (DTSD), which includes: Create a model, then perform Itr rounds of iterations using the root dataset, collecting all model gradients generated during the iterations in chronological order to obtain a gradient set. Among them G i This represents the gradient generated in the i-th iteration; the model is the model determined through negotiation with the nodes during the registration phase. calculate Each G i The L2 norm is calculated, and then the expected value cth of the m largest numbers is calculated. cth is then used as the gradient clipping threshold and distributed to each node. Will The gradient in the set is clipped to obtain the set. calculate The difference between adjacent gradients is obtained GCD t =GC t+1 -GC t GC t This is the value corresponding to the gradient after gradient clipping for the t-th gradient.

4. The LSTM-based federated learning Byzantine node detection method as described in claim 2 or 3, characterized in that, The preprocessing module trains the AE model and LSTM model based on DTSD, and generates a threshold reference list including: AE model training: Create an AE model, and then use DSTD as the training set to iteratively train the model; LSTM model training: Using the AE model to encode gradients in DSTD to generate a dataset Among them GCDE t =AE encoder (GCD t GCD t These are elements in the time-division sequence dataset DTSD, representing the difference between the gradients in round t and round t+1; AEencoder() represents the encoder part of the autoencoder; The DTSDEL dataset was generated by sampling on DTSDE using a sliding window. Create an LSTM model and train it using samples from the DTSDEL part as the training set. Threshold reference list generation: Input a portion of DTSDEL samples as the test set into the LSTM model, calculate and record the Euclidean distance between each predicted data point and the actual data to generate a threshold reference list.

5. The LSTM-based federated learning Byzantine node detection method as described in claim 4, characterized in that, According to the following formula (11), The gradient in the set is clipped to obtain the set. GC i =G i / max(1,||G i ||2 / cth)(11); G i Denotes the gradient in the i-th round; ||G i ||2 represents G i The L2 norm of the gradient.

6. The LSTM-based federated learning Byzantine node detection method as described in claim 5, characterized in that, The local gradient of the node is obtained in the following way: (1) The nodes set the model parameters according to the negotiation results determined during the registration phase; (2) The node starts training in round t and collects the local gradient G for the current round. t Then, gradient clipping is performed according to formula (11) to generate GC. t Finally, differential privacy processing is performed to generate GCN. t And upload it to the server; (3) If t < the set value, return to step (2) and start a new round of training; otherwise, proceed to the next step. (4) The node receives the global gradient and updates the local model, then returns to step (2) to continue local training until the model converges or the stopping condition is met.

7. The LSTM-based federated learning Byzantine node detection method as described in claim 6, characterized in that, The data detection module checks the reliability of the local gradients uploaded by the receiving nodes based on the AE model, LSTM model, and historical gradient record database, and generates a list of reliable nodes. This list is then sent to the global aggregation module, which includes: (1) Receive the local gradient uploaded by the receiving node; (2) Maintain and update the historical gradient record library of the node. The historical gradient record of each node is stored in the form of a double-ended queue. When a new local gradient is uploaded, it is directly enqueued from the tail of the queue, and then the gradient at the head of the queue is popped from the queue. (3) If t < the set value, return to step (1) and start a new round of training; otherwise, proceed to the next step. (4) Detect node anomalies using the Byzantine node detection algorithm and generate a list of trusted nodes; (5) The local gradients uploaded by the trusted nodes are weighted and aggregated to obtain the global gradient, and then sent to the trusted nodes; (6) Return to step (1) and start a new round of training until the model converges or the stopping condition is met.

8. The LSTM-based federated learning Byzantine node detection method as described in claim 1, characterized in that, The basic information agreed upon during the registration phase includes the model architecture, model parameter settings, and privacy budget allocation scheme.

Images