Gradient leakage attack method, device and storage medium under federated learning

Abstract

The application relates to the technical field of computers and discloses a gradient leakage attack method and device under federated learning and a storage medium, which comprises the following steps: label information is extracted, and the label information and a random variable are input into a generative network; generative data and a generative label of the generative network are acquired, and the generative data and the generative label are input into a shared model to obtain generative gradients; a difference value between the generative gradients and real gradients is calculated, and the difference value is used as a target function to train the generative network; and the trained generative network is used to acquire a gradient leakage attack result. The above method inputs the extracted label information into the generative network as auxiliary information, uses the network to replace a single random variable to generate corresponding data and labels, selects a suitable target function, continuously trains the network, and finally the trained network can be used as an attack model to obtain a gradient leakage attack result which is almost the same as local real data and real labels.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a gradient leakage attack method, device, and storage medium under federated learning. Background Technology

[0002] The development of science and technology has driven the continuous development of various big data-based applications. Enterprises can use collected data to train machine learning algorithms or models, providing convenient services to people. However, in recent years, privacy breaches and related security issues have made people increasingly concerned about their privacy and security. Against this backdrop, federated learning has emerged. Federated learning is a distributed learning model where client-side training data is not uploaded to the server but is trained locally. The gradients or parameters are then uploaded to the server to assist in training the model. However, in reality, unprotected federated learning systems still face many privacy and security challenges. From a training process perspective, federated learning may be vulnerable to attacks from both internal attackers (participants and the server) and external attackers.

[0003] Besides the scenario of attackers actively launching attacks, there is also the scenario of passive attacks. Passive attacks are usually based on the assumption of an honest and curious attacker, meaning that the attacker observes the information generated during training but does not interfere with the operation of the federated learning system and honestly completes the training task. Most current research on federated learning offense and defense is based on this assumption. During federated learning training, a large amount of information is exchanged. For example, to achieve convergence of the server-side model, the server collects a large amount of gradient information from the client. In most cases, sharing gradients is considered safe because gradient information is more abstract and difficult to understand compared to training data. However, some recent studies have shown that since gradient information is derived from training on local client data, it may, like the trained model, implicitly contain privacy information about the data. This means that gradient information may also reveal information from the training data.

[0004] In recent years, a new attack method—Deep Leakage from Gradients (DLG) under federated learning—has been proposed. This attack utilizes gradient information. It continuously narrows the gap between generated spurious gradients and true gradients, eventually obtaining the data from the victim's training dataset at the end of the optimization process. However, DLG attacks still have many shortcomings: their effectiveness varies under different initialization conditions because some initializations cause the generated gradients to cluster around 0, and using Euclidean distance as the objective function can significantly alter the data from the outset; in practice, DLG often results in incorrectly labeled results. Since attack and defense are complementary, while researching DLG attacks, defense methods can be iteratively updated to better defend against them. Therefore, designing a DLG attack method that avoids drastically altering the data is a technical problem urgently needing to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a gradient leakage attack method, device, and storage medium under federated learning, which can obtain gradient leakage attack results that are almost identical to local real data and real labels. The specific solution is as follows:

[0006] A gradient leakage attack method under federated learning includes:

[0007] Extract the label information and input the label information and random variables into the generative network;

[0008] Obtain the generated data and generated labels of the generative network, and input the generated data and generated labels into the shared model to obtain the generated gradient;

[0009] The difference between the generated gradient and the true gradient is calculated, and the difference is used as the objective function of the generative network to train the generative network.

[0010] The trained generative network is used to obtain gradient leakage attack results.

[0011] Preferably, in the above-described gradient leakage attack method under federated learning provided in the embodiments of the present invention, before extracting label information, the method further includes:

[0012] Generative networks are constructed using convolutional layers, normalization layers, and activation layers.

[0013] Preferably, in the gradient leakage attack method under federated learning provided in the embodiments of the present invention, extracting label information includes:

[0014] Use the LLG method to extract tag information.

[0015] Preferably, in the gradient leakage attack method under federated learning provided in the embodiments of the present invention, the LLG method is used to extract label information, including:

[0016] For the gradient vector, extract the label corresponding to the negative gradient and add the extracted label to the output set, and subtract the corresponding gradient once.

[0017] When the size of the output set is less than the size of the specified label set, the label corresponding to the minimum gradient in the gradient set is added to the output set, and the corresponding gradient is subtracted once until the size of the output set is equal to the size of the specified label set.

[0018] Preferably, in the above-described gradient leakage attack method under federated learning provided in the embodiments of the present invention, in addition to using the difference value as the objective function of the generative network, it further includes:

[0019] Two regularization terms are added to the objective function: WD distance and TVLoss loss.

[0020] Preferably, in the gradient leakage attack method under federated learning provided in the embodiments of the present invention, the objective function is obtained using the following formula:

[0021]

[0022] in, Let the objective function be... The data is dummy data, W is the weight parameter, ΔW is the gradient, and α is the hyperparameter.

[0023] Preferably, in the above-described gradient leakage attack method under federated learning provided in the embodiments of the present invention, the process of training the generative network includes:

[0024] The generated data, the generated tags, and the tag information are optimized;

[0025] Training of the generative network is stopped when the objective function of the generative network decreases to a set threshold.

[0026] Preferably, in the above-described gradient leakage attack method under federated learning provided in this embodiment of the invention, the optimization of the generated data, the generated labels, and the label information includes:

[0027] The generated data, the generated labels, and the label information are optimized using the stochastic gradient descent algorithm.

[0028] This invention also provides an electronic device, including a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the above-described federated learning gradient leakage attack method provided in this invention embodiment.

[0029] This invention also provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the above-described federated learning gradient leakage attack method provided in this invention.

[0030] As can be seen from the above technical solution, the gradient leakage attack method under federated learning provided by the present invention includes: extracting label information and inputting label information and random variables into a generative network; obtaining the generated data and generated labels of the generative network, and inputting the generated data and generated labels into a shared model to obtain the generated gradient; calculating the difference between the generated gradient and the true gradient, and using the difference as the objective function of the generative network to train the generative network; and using the trained generative network to obtain the gradient leakage attack result.

[0031] The gradient leakage attack method under federated learning provided by this invention uses the extracted label information as auxiliary information input into the generative network, and uses the generative network to generate corresponding data and labels instead of a single random variable. By selecting an appropriate objective function and continuously training the generative network, the finally trained generative network can be used as an attack model to obtain gradient leakage attack results. The obtained gradient leakage attack results are almost identical to the local real data and real labels.

[0032] Furthermore, this invention also provides a corresponding device and computer-readable storage medium for gradient leakage attack methods under federated learning, further making the above method more practical. The device and computer-readable storage medium have corresponding advantages. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 A flowchart of a gradient leakage attack method under federated learning provided in an embodiment of the present invention;

[0035] Figure 2 An architecture diagram of a gradient leakage attack method under federated learning provided in an embodiment of the present invention;

[0036] Figure 3 This is an architecture diagram of a generative network provided in an embodiment of the present invention;

[0037] Figure 4 A prototype schematic diagram of the gradient leakage attack method under federated learning provided in an embodiment of the present invention;

[0038] Figure 5 This is a schematic diagram of Dropout provided in an embodiment of the present invention;

[0039] Figure 6 This is a comparison chart of experimental results from the MNIST dataset with Batch=1 provided in this embodiment of the invention.

[0040] Figure 7 This is a comparison chart of experimental results from the CIFAR100 dataset with Batch=1 provided in this embodiment of the invention.

[0041] Figure 8 This is a comparison chart of experimental results in the LFW dataset with Batch=1 provided in this embodiment of the invention.

[0042] Figure 9 This is a comparison chart of experimental results from the MNIST dataset with a batch size of 4, provided in an embodiment of the present invention.

[0043] Figure 10 This is a comparison chart of experimental results from the CIFAR100 dataset with a batch size of 4, provided in an embodiment of the present invention.

[0044] Figure 11 This is a comparison chart of experimental results in the LFW dataset with a batch size of 4, provided in this embodiment of the invention.

[0045] Figure 12 This is a comparison chart of experimental results from the MNIST dataset with a batch size of 8, provided in an embodiment of the present invention.

[0046] Figure 13 A comparison chart of experimental results from the CIFAR100 dataset with a batch size of 8, provided in an embodiment of the present invention.

[0047] Figure 14 This is a comparison chart of experimental results from the LFW dataset with a batch size of 8, provided in an embodiment of the present invention.

[0048] Figure 15 This is a schematic diagram of MSE in the MNIST dataset with Batch=1 provided in an embodiment of the present invention;

[0049] Figure 16 This is a schematic diagram of MSE in the MNIST dataset with a batch size of 4, provided in an embodiment of the present invention.

[0050] Figure 17 is a schematic diagram of MSE on the MNIST dataset with Batch=8 provided by an embodiment of the present invention;

[0051] Figure 18 is a schematic diagram of MSE variation of the Dropout-based defense scheme provided by an embodiment of the present invention;

[0052] Figure 19 is a schematic diagram of MSE variation of the Gaussian mechanism-based defense scheme provided by an embodiment of the present invention;

[0053] Figure 20 is a schematic diagram of MSE variation of the Laplace mechanism-based defense scheme provided by an embodiment of the present invention;

[0054] Figure 21 is a diagram of experimental results at 1e-2 provided by an embodiment of the present invention;

[0055] Figure 22 is a schematic diagram of MSE variation of the gradient clipping-based defense scheme provided by an embodiment of the present invention;

[0056] Figure 23 is a comparison diagram of experimental results when gradient clipping is 0.7 provided by an embodiment of the present invention;

[0057] Figure 24 is a schematic diagram of MSE variation of the MixUp-based defense scheme provided by an embodiment of the present invention;

[0058] Figure 25 is a diagram of experimental results under MixUp provided by an embodiment of the present invention. Detailed Description of the Embodiments

[0059] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

[0060] The present invention provides a gradient leakage attack method under federated learning, as shown in Figure 1 and Figure 2 , comprising the following steps:

[0061] S101: Extract label information, and input the label information and a random variable into a generative network;

[0062] This step can be understood as the data initialization phase. The label information here can be understood as the correct labels, which are close to the labels in the user's real data, i.e., the real labels; the generated data and generated labels of the generative network can be understood as fake data and fake labels. Using a label extraction method instead of updating a single variable, and inputting the extracted correct labels into the generative network, accelerates the training of the generative network. Using a generative network to generate fake data instead of random variables transforms the iterative update of a single variable into updating the parameters of the generative network, enabling it to recover more data.

[0063] In specific implementation, before performing step S101 to extract label information, the method further includes: constructing a generative network. This step may specifically include: constructing a generative network using convolutional layers, normalization layers, and activation layers. That is: as follows... Figure 3 As shown, a generative network can consist of convolutional layers, normalization layers, and activation layers.

[0064] Convolutional layers primarily function as feature extraction layers in a network. A convolutional kernel contains the number of channels w of the input feature map, the number of channels y of the output feature map, the kernel size f, the stride s, and the padding value p. Therefore, the calculation formula is y = (w - f + 2p) / s + 1.

[0065] The normalization layer primarily prevents the extracted output from shifting after training through multiple layers of the network, and also helps to counteract gradient vanishing and gradient exploding. Assuming a small subset of inputs has a mean of μ and a variance of σ, the normalization layer is calculated as y = (x - μ) / σ. It's important to note that neural networks consist of multiple layers, each composed of multiple neurons. A neuron in one layer may be connected to multiple neurons in the layer above it; this connection means that the output of a neuron in the previous layer is used as the input to that neuron in the current layer, which is x in this case.

[0066] The activation layer primarily introduces nonlinear components into the network, enabling it to fit various curves. It takes the linear results calculated in the upper layers and inputs them into the activation function's formula to obtain the output. The activation layer uses PReLU and Tanh activation functions. The Sigmoid activation function is calculated as y = 1 / (1 + e^(-1 / (1+e ... -x The Tanh function is calculated as y = 2 * Sigmoid(2x) - 1, and its output is centered at 0, meaning its mean is 0. The PRelu function is calculated as y = max(0, x) + a. i *min(0, x), where a i It is a variable parameter. PRelu can change a based on the data. i The value of is so that convergence can be accelerated.

[0067] S102. Obtain the generated data and generated labels of the generative network, and input the generated data and generated labels into the shared model to obtain the generated gradient;

[0068] It's important to note that the shared model here refers to the global model sent by the server to the user in federated learning. Inputting the generated data and labels from the generator network into the shared model yields the generated gradient. This generated gradient can be understood as a pseudo-gradient.

[0069] S103. Calculate the difference between the generated gradient and the true gradient, and use the difference as the objective function of the generative network to train the generative network.

[0070] This step can be understood as the objective function selection stage. Specifically, the objective function is used as the objective function of the generative network based on the difference between the generated gradient and the true gradient.

[0071] S104. Obtain gradient leakage attack results using the trained generative network.

[0072] In the above-described gradient leakage attack method under federated learning provided in this embodiment of the invention, the extracted label information is input into the generative network as auxiliary information, and the generative network is used to generate corresponding data and labels instead of a single random variable. A suitable objective function is selected, and the generative network is continuously trained. Finally, the trained generative network can be used as an attack model to obtain gradient leakage attack results. The obtained gradient leakage attack results are almost identical to the local real data and real labels.

[0073] Furthermore, in a specific implementation, in the above-described gradient leakage attack method under federated learning provided in this embodiment of the invention, step S101, extracting label information, may specifically include: using the LLG (Label Leakage from Gradients) method to extract label information. Here, using the LLG method allows direct extraction of the correct label information of the user's training data from the shared gradients, and inputting this label information into the generative network, thereby accelerating the training of the generative network.

[0074] In practical implementation, the above steps use the LLG method to extract label information, which may specifically include: for the gradient vector G = [g1, ..., g...] n First, extract the labels corresponding to negative gradients and add them to the output set. Subtract the influence m from the corresponding gradient. When the size of the output set is less than the size of the specified label set D, add the label corresponding to the minimum gradient in the gradient set to the output set and subtract the influence m from the corresponding gradient, until the size of the output set is equal to the size of the specified label set D.

[0075] Specifically, the formula for calculating m is as follows:

[0076]

[0077] Assuming that each iteration contains B data points, m in the LLG algorithm can be calculated using the formula above.

[0078] In specific implementation, in the gradient leakage attack method under federated learning provided in the embodiments of the present invention, in order to more accurately describe the difference between the generated gradient and the true gradient and improve the authenticity of the data generated by the generative network, while performing step S103 to use the difference value as the objective function of the generative network, it may also include adding two regularization terms to the objective function, namely the working distance (WD) loss and the TVLoss (Total Variation Loss) loss. The WD distance measures the difference in distribution between two gradients, making the measurement of the difference between gradients more accurate. At the same time, the addition of the TVLoss loss reduces the noise in the recovered data.

[0079] Suppose we have two distributions, p and q, the WD distance is defined as follows:

[0080] WD(p, q) = inf γ～Π(p，q) E (x，y)～γ [||xy||]

[0081] Here, (x,y) are samples randomly sampled from the joint distribution γ, and E(x,y) represents the expected Euclidean distance. The smaller the WD distance, the more similar the p and q distributions are. Even if the two distributions are very different, the WD distance can still be used to calculate the distance between them.

[0082] TVLoss loss is defined as follows:

[0083]

[0084] In practical implementation, the above objective function can be obtained using the following formula:

[0085]

[0086] in, Let be the objective function. The data is dummy data, W is the weight parameter, ΔW is the gradient, and α is the hyperparameter.

[0087] In specific implementation, the gradient leakage attack method under federated learning provided in the embodiments of the present invention, during the training of the generative network, may specifically include: optimizing the generated data, generated labels, and label information; and stopping the training of the generative network when the objective function of the generative network decreases to a set threshold. In practical applications, this set threshold can be a very small value. When the objective function is very small, training stops, the network converges, and the resulting fake data and fake labels are not significantly different from the victim's local data and labels.

[0088] Preferably, the above steps optimize the generated data, generated labels, and label information, which may specifically include: optimizing the generated data, generated labels, and label information using a stochastic gradient descent algorithm.

[0089] It should be noted that the gradient leakage attack method of this invention mainly includes the following stages: data and label initialization, objective function selection, and data and label recovery. The main process of this method is as follows: Figure 4 As shown, in the data initialization phase, random variables are used to generate fake data and fake labels. In the objective function selection phase, the fake data and fake labels are input into the shared model to obtain fake gradients. The difference between these gradients and the gradients obtained from the victim's side is calculated; this difference represents the objective function, i.e., the Euclidean distance between the two gradients. In the data and label recovery phase, the stochastic gradient descent algorithm can be continuously used to optimize the fake data and fake labels. When the Euclidean distance between the two gradients becomes very small, training stops. The final fake data and fake labels are then nearly identical to the victim's local data and labels.

[0090] This invention improves upon gradient leakage attack methods, such as... Figure 2 As shown, this invention mainly includes three aspects. The first aspect is in the fake data generation stage, where a generative network is used to generate data and labels instead of a single random variable. The second improved label is input as auxiliary information into the generative network, which is then continuously trained until convergence. The second aspect is in the label acquisition stage, where the gradient of the victim is obtained, and a label extraction method is used to directly obtain label information. Comparison shows that the LLG method is more suitable for the gradient leakage attack method of this invention than the IDLG (Improved Deep Leakage from Gradients) method because it can still obtain more correct label information as the batch size increases. The third aspect is in the objective function selection stage. Previously, the objective function only used the Euclidean distance between two gradients. This invention adds the WD distance, which describes the difference between the distributions of two vectors, and the TvLoss distance, which has a noise reduction effect, to this basis, allowing the objective function to more accurately describe the difference between the two gradients.

[0091] It should be noted that the defense against gradient leakage attacks in federated learning involves three parts: encrypting the original data and shared gradients, or modifying the structure of the shared model. In gradient leakage attacks, the ultimate goal is to obtain the client's locally trained data; encrypting the original data increases the difficulty for the attacker to recover it. If modifications to the shared model structure are allowed, defense can also be implemented from this perspective. For the generative network trained by this invention (i.e., the attack model), this invention proposes four defense schemes: those based on Dropout, MixUp, differential privacy, and gradient pruning.

[0092] The first defense scheme is based on Dropout. The reason why information from training data can be obtained from gradients is that some neurons in the neural network develop a "memory" of the training data, i.e., overfitting. This invention adds a Dropout layer between the encoding layer and the classifier to solve the overfitting problem, essentially reducing the "memory" of neurons to achieve the defense purpose.

[0093] Dropout primarily addresses the problem of model overfitting caused by insufficient data. For example... Figure 5 As shown, the left image is a standard neural network containing an input layer, an output layer, and a hidden layer. After adding dropout, the neural network in the right image first discards a certain percentage of hidden layer neurons. The input is then fed into the modified neural network for forward and backward propagation to update parameters. The parameters of the discarded neurons are not updated at this point. The neural network is then restored to its original state, and neurons are again deleted according to probability until training is complete. The commonly used probability distribution is the Bernoulli distribution. Assuming the random variable x follows a Bernoulli distribution, its probability density function is:

[0094] Pr(x)=p x (1-p) 1-x

[0095] This represents the probability density function of the Bernoulli distribution, where x can take the values ​​0 or 1 to represent the outcome over time. Pr(1) represents the probability of success, and Pr(0) represents the probability of failure; p represents the probability of success in a single trial. Here, it is shown that neurons in the hidden layer of the neural network are randomly dropped according to this probability distribution.

[0096] The second defense scheme is based on MixUp. MixUp is a weak encryption technique that combines two data sets linearly to create a new set of data. This new set of data is then used for training, ensuring that attackers can only obtain the result of the mixed data, not the original data.

[0097] Suppose there are two data points (x) i y i ), (x j y j ), where y i y j It is x i x j For the corresponding tags, the formula for generating new data using MixUp is:

[0098]

[0099] y0=λy i +(1-λ)y j

[0100] Where λ follows a Beta distribution, and its probability density function is:

[0101]

[0102] Here, α and β are two parameters of the distribution that control the shape of the Beta distribution. B(α,β) is the Beta function, defined as: B(α,β)=Γ(α)*Γ(β) / Γ(α+β). The Γ function is the gamma function, defined as: Γ(z)=∫(0,∞)t^(z-1)*e^(-t)dt.

[0103] In this approach, the client applies MixUp to generate new data on its local data, and then uses the new data for training.

[0104] The third defense scheme is based on differential privacy. It prevents attackers from obtaining the true result by adding noise to the gradient, thus ensuring that attackers cannot recover the correct result. The main implementation mechanisms of differential privacy are the Laplace mechanism and the Gaussian mechanism. The Laplace mechanism involves adding noise following a Laplace distribution to the content to be protected. The Laplace probability distribution is as follows:

[0105]

[0106] Where μ is the position parameter, typically set to 0, and b is the scale parameter; the larger b is, the more noise is added. Assume there exists a query algorithm M on dataset D that satisfies:

[0107]

[0108] Therefore, this algorithm satisfies ε-dp. Wherein, The sensitivity of the dataset, along with the privacy budget ε, determines the amount of noise to be added. The Gaussian mechanism involves adding Gaussian-distributed noise to the content that needs protection. The Gaussian distribution, or normal distribution, has the following probability distribution:

[0109]

[0110] Where μ is the mean of the random variable, σ 2 Let be the variance of the random variable. Both parameters work together to affect the magnitude of the noise. Assume there exists a query algorithm f on dataset D that satisfies:

[0111] f(D)=f(D)+N(0,σ 2 )

[0112] Therefore, the algorithm satisfies (ε, δ)-dp. μ = 0. A larger σ indicates a larger amount of added noise. L2 sensitivity is defined as:

[0113]

[0114] In the differential privacy-based defense scheme, after the client obtains the gradient during training, it applies the Laplace mechanism and the exponential mechanism to the gradient for privacy protection.

[0115] The fourth defense scheme is based on gradient clipping, which mainly discards some gradient information, thereby reducing the gradient information obtained by the attacker and lowering the success rate of the attack. Gradient clipping is generally used to prevent gradient explosion, and in this invention, it is used to reduce the information contained in the gradient. There are two commonly used gradient clipping schemes: one is fixed threshold clipping, and the other is clipping based on its norm, usually the l2 norm. Fixed threshold clipping means that when the gradient is greater than or less than a threshold, the gradient is updated to the threshold. However, the threshold needs to be specified manually and requires experience. The second method is to treat all gradients as a vector after obtaining the gradient information, calculate the l2 norm, and then compare it with a given maximum norm. If the ratio is less than 1, all gradients are multiplied by the ratio. In the gradient clipping-based defense scheme, the gradient is clipped according to the two gradient clipping schemes. The fixed threshold is a percentage of the gradient, such as 20%, which means 20% of the gradient is clipped. The second method based on the norm is executed as originally planned.

[0116] The attack model of this invention will be tested on three datasets: MNIST, CIFAR100, and LFW. The MNIST dataset is a dataset of handwritten digit images from 0 to 9, containing 70,000 images divided into 10 classes; the CIFAR100 dataset contains 100 classes, including fish and insects, with 600 images in each class; and the LFW dataset contains 13,233 face images in 5,749 classes, with each person's face image belonging to a separate class.

[0117] The shared model between the server and client is LeNet-5, which contains two convolutional layers, four activation layers, two pooling layers, and three linear layers. The first convolutional layer has 3 input channels, 6 output channels, and a kernel size of 5; the second convolutional layer has 6 input channels, 16 output channels, and a kernel size of 5. All four activation layers use the sigmoid activation function, and the two pooling layers use max pooling. The first linear layer has 16*5*5 input features and 120 output features; the second linear layer has 120 input features and 84 output features; the last linear layer has 84 input features and outputs features representing the classes contained in the specified dataset.

[0118] The gradient leakage attack method of this invention is compared with the existing algorithms DLG, IDLG, and LLG. IDLG initially could only recover data in batches of 1, so it was modified in experiments. Based on its main idea, when the gradient is negative, the corresponding label is the true label information. The LLG algorithm initially only performed label recovery, so it was optimized in experiments by replacing the IDLG label extraction part with LLG label extraction.

[0119] During the experiment, the batch size will be specified, and a specified number of images will be randomly selected from the dataset. There are four main evaluation metrics: the ability to reconstruct the image, the mean squared error (MSE) between the generated and real images, the peak signal-to-noise ratio (PSNR) between the generated and real images, and the computational complexity of the four algorithms.

[0120] The first three evaluation metrics primarily target the algorithm's output, while the last metric targets the algorithm itself. The ability to recover images mainly involves observing whether the gradient leakage attack method of this invention and existing DLG algorithms can generate images that are visually recognizable and whether the image features are clear. It is known that increasing the number of image batches is an effective means of resisting DLG attacks, and the gradient leakage attack method proposed in this invention can overcome this defense. Therefore, the main focus is on observing the clarity of the images recovered by the gradient leakage attack method and existing DLG algorithms as the batch size increases.

[0121] The gradient leakage attack method of this invention mainly conducted the following three experiments:

[0122] The first experiment evaluates the performance of four algorithms in recovering data across three datasets and different batches:

[0123] like Figure 6As shown, in the MNIST dataset, the DLG algorithm generates the image of the digit 9, IDLG generates the image of 4, LLG generates the image of 6, and the gradient leakage attack method of this invention (corresponding to OURS in the figure) generates the image of the digit 6. In the MNIST dataset, all four algorithms can recover relatively clear images.

[0124] like Figure 7 As shown, in the CIFAR 100 dataset, it can be observed that the image generated by the DLG algorithm is a pear-shaped object, the image generated by LLG is a dolphin, and the image generated by the gradient leakage attack method of this invention is a pointed object. In the CIFAR 100 dataset, DLG, IDLG, and LLG can all generate relatively clear images, while the gradient leakage attack method proposed in this invention recovers a slightly blurry image.

[0125] like Figure 8 As shown, in the LFW dataset, it can be observed that the image generated by the DLG algorithm is a man wearing a suit and tie with a beard; the image generated by IDLG is a man with thinning hair and a slightly open mouth; the image generated by LLG is a curly-haired woman speaking into a microphone; and the image generated by the gradient leakage attack method of this invention is a woman with slightly pursed lips. Because the images in the LFW dataset are not clear enough, the facial images recovered by the four algorithms are all relatively blurry. However, all four algorithms can recover the facial expressions, but the facial features are still quite blurry.

[0126] from Figure 9 , Figure 10 , Figure 11 As can be seen, the DLG algorithm, with a batch size of 4, can only recover data from the MNIST dataset. The training results on the LFW and CIFAR100 datasets are pixels with no valid information. The IDLG algorithm cannot recover images recognizable to the human eye on any of the three datasets. The LLG algorithm, like the DLG algorithm, can recover images from the MNIST dataset, but cannot recover images from the CIFAR100 and LFW datasets. The method proposed in this invention can still recover images containing valid information. For example, in the MNIST dataset, although the image contains a lot of noise, it is clear that the gradient leakage attack method of this invention generates the number three. In the LFW dataset, it is clear that the gradient leakage attack method of this invention generates an image of a person with their hands raised above their head. In the CIFAR100 dataset, the gradient leakage attack method of this invention generates a flower. Although the images generated by the gradient leakage attack method of this invention are still not clear enough, compared to the DLG, IDLG, and LLG algorithms, it can obtain more information contained in the real image.

[0127] Figure 12 , Figure 13 , Figure 14 These are the experimental results of four algorithms with a batch size of 8. It can be seen that the IDLG algorithm generates images of various pixels on three datasets, containing no meaningful content. The DLG and LLG algorithms recover images with a lot of noise on the MNIST dataset, but the image generated by the LLG algorithm can be vaguely identified as the number 4. The DLG algorithm recovers the number 2, but like the IDLG algorithm, they generate meaningless content on the CIFAR100 and LFW datasets. The gradient leakage attack method of this invention, however, can still recover valid information. For example, on the MNIST dataset, although the image generated by the gradient leakage attack method of this invention contains a lot of noise, the number 4 can still be seen, and it is clearer than the image generated by the LLG algorithm. In the LFW dataset, a long-haired woman can be seen. In the CIFAR100 dataset, the image generated by the gradient leakage attack method of this invention is almost indistinguishable from the real image.

[0128] The above experiments were conducted to observe the image recovery capabilities of the four algorithms. Analysis revealed that when the batch size was equal to 1, the DLG, IDLG, and LLG algorithms generated clearer images on the three datasets than the gradient leakage attack method of this invention. However, as the batch size increased, the DLG, IDLG, and LLG algorithms gradually became unable to recover images containing valid information. In contrast, the gradient leakage attack method of this invention, even with an increasing batch size, could still recover images containing valid information on the three datasets; however, from a human eye's perspective, regardless of the batch size, the generated images remained relatively blurry.

[0129] The second experiment compares the images reconstructed by the four algorithms based on the mean squared error between the generated images and the real images:

[0130] Since the first experiment was conducted through human observation, it contained a lot of subjective factors. Therefore, the second experiment compared the images restored by the four algorithms from an objective perspective. The main comparison was the change in the mean square error of the four algorithms under different datasets and different batch sizes. Figure 15 , Figure 16 , Figure 17 These are the experimental results of four algorithms on the MNIST dataset. By observing... Figure 15 It can be observed that the general trend of the mean squared error of images generated by all algorithms is decreasing. When the batch size is equal to 1, the mean squared errors of images generated by the DLG, IDLG, and LLG algorithms converge quickly to 0, while the mean squared error of the gradient leakage attack method of this invention converges to around 0.15. When the batch size is equal to 4, such as Figure 16As shown, the mean square error of images generated by the DLG and LLG algorithms converges to around 0.05. The mean square error of images generated by the gradient leakage attack method of this invention also converges to around 0.15, while the mean square error of images generated by the IDLG algorithm shows an increasing trend, eventually converging to around 0.9. When the batch size is 8, as... Figure 17 As shown, the mean squared error (MSE) of images generated by the DLG algorithm, LLG algorithm, and the gradient leakage attack method of this invention generally tends to decrease. The DLG and LLG algorithms eventually converge to around 0.12, while the gradient leakage attack method of this invention converges to around 0.13. Similarly, experiments were conducted on the CIFAR100 dataset. When the batch size is 1, the MSE of images generated by the DLG, IDLG, and LLG algorithms generally decreases and quickly converges to 0. However, when the batch size is 4 or 8, the MSE of images generated by the DLG, IDLG, and LLG algorithms generally increases and converges to a relatively large value. This is consistent with the observation in the first experiment, indicating that the DLG, IDLG, and LLG algorithms cannot successfully attack when the batch size increases. The mean squared error (MSE) of images generated by the gradient leakage attack method of this invention generally shows a decreasing trend, converging to around 0.2 when the batch size is 1, 4, and 8. This means that the images generated by the gradient leakage attack method of this invention have very little difference from real images in MSE evaluation. Experiments were conducted on the LFW dataset with the four algorithms. Similar to the analysis on the CIFAR100 dataset, the MSE of images generated by the DLG, IDLG, and LLG algorithms converged quickly to 0 only when the batch size was 1. When the batch size was 4 and 8, the MSE showed an increasing trend. In contrast, the MSE of images generated by the gradient leakage attack method of this invention generally showed a decreasing trend, finally converging to around 0.2.

[0131] The third experiment compares the peak signal-to-noise ratio and structural similarity of images generated by the four algorithms. Each experiment iterates 6000 times, and stops when the number of experiments exceeds 6000 or the algorithm has converged.

[0132] The first experiment showed that IDLG could not recover recognizable images when the batch size was 4. Therefore, this experiment compared the image quality generated by the four algorithms when the batch size was 1. The images generated by the four algorithms were cropped to the same size before comparison.

[0133] A higher peak signal-to-noise ratio indicates that the images are more similar.

[0134] Table 1. PSNR between the generated image and the real image in this invention.

[0135] MNIST 14.33695 17.6784 18.50748 17.2783 CIFAR100 21.80327 14.65276 16.27886 16.74388 LFW 21.84619 15.53974 17.00901 18.37026

[0136] As shown in Table 1, on the MNIST dataset, the IDLG algorithm generates images with a higher peak signal-to-noise ratio (PSNR) than the other three algorithms, while the gradient leakage attack method of this invention generates images with the lowest PSNR. On the CIFAR100 and LFW datasets, the gradient leakage attack method of this invention generates images with a higher PSNR than the other three algorithms, while the DLG algorithm generates images with the lowest PSNR. Based on the PSNR-based evaluation, it can be seen that the gradient leakage attack method of this invention generates higher quality images on the CIFAR100 and LFW datasets than the other three algorithms, but lower quality images on the MNIST dataset.

[0137] The proposed defense model against gradient leakage attacks is primarily based on experimental results on the MNIST dataset. Two evaluation metrics are used: one is to examine the impact of the defense strategy on the gradient leakage attack method of this invention, specifically the change in the MSE of the images generated by the gradient leakage attack method after implementing the defense strategy; the other is to examine the impact of the defense strategy on the accuracy of the federated learning system. Partial configurations of the federated learning system are shown in Table 2.

[0138] Table 2. Accuracy of the Dropout-based defense scheme of this invention

[0139] acc 96.70％ 96.10％ 95.80％ 93.80％ 92.20％ 78.90％

[0140] In the Dropout-based defense scheme experiments, p takes values ​​of 0, 0.1, 0.3, 0.5, 0.7, and 0.9; in the MixUp-based defense scheme experiments, α takes values ​​of 0.3, 0.4, 0.5, 0.6, and 0.7; in the differential privacy-based defense scheme experiments, when using Laplace and Gaussian mechanisms for protection, b takes values ​​of 1e-1, 1e-2, 1e-3, 1e-4, and 1e-5; in the gradient-pruning-based defense scheme experiments, when using a fixed threshold for protection, the pruning ratio is 0.1, 0.3, 0.5, 0.7, and 0.9.

[0141] The first experiment was a defense scheme based on Dropout, by Figure 18 As shown in Table 2, the p_0 line represents the situation where, without Dropout, the mean squared error between the generated image and the real image using the gradient leakage attack method of this invention generally decreases, indicating a successful attack. However, with Dropout applied, as shown by the green line, the mean squared error between the generated image and the real image using the gradient leakage attack method of this invention never converges to a minimum value. Table 2 shows that applying Dropout has a relatively small impact on the accuracy of the federated learning system; only when p is 0.9 does the accuracy drop below 80%.

[0142] The second experiment is based on the Gaussian mechanism, such as... Figure 19 As shown, only when the change of the Gaussian_le_1 line is not decreasing, that is, only when the scale parameter of the Gaussian mechanism is at 1e-1 can it resist the gradient leakage attack method proposed in this invention.

[0143] Table 3. Accuracy of the Gaussian-based defense scheme of this invention

[0144] acc 98.40％ 97.90％ 96.80％ 11.30％ 10.30％

[0145] As can be seen from Table 3, when the scaling parameter of the Gaussian mechanism is at 1e-2 or 1e-1, the accuracy of the federated learning system model becomes very poor. This shows that the Gaussian mechanism can resist the gradient leakage attack method of this invention, but its usability becomes very poor.

[0146] The fourth experiment is based on the Laplace mechanism, such as... Figure 20 As shown, only the Laplace_le_1 line is not decreasing and converges to a relatively large value. The Laplace_le_2 line initially decreased, but it failed to converge to a small value, as shown below. Figure 21 As shown, the reconstructed image is blurry, but the shape of an 8 can be vaguely discerned. This indicates that the privacy protection provided increases with the increase of the Laplacian scale parameter.

[0147] Table 4. Accuracy of the Laplace mechanism-based defense scheme of this invention

[0148] acc 98.00％ 98.00％ 96.60％ 11.30％ 11.30％

[0149] As can be seen from Table 4, when the scaling parameter of the Gaussian mechanism is at 1e-2 or 1e-1, the accuracy of the federated learning system model becomes very poor. This also shows that the Laplace mechanism can resist the gradient leakage attack method of this invention, but its usability becomes very poor.

[0150] The fifth experiment is a defense scheme based on gradient clipping, such as... Figure 22 As shown, all the curves change by first decreasing and then increasing, with the prue_0.9 line converging to a relatively large value, as... Figure 23 As shown, the recovered image is blurry, but contains some useful information.

[0151] Table 5. Accuracy of the gradient-based defense scheme of this invention

[0152] acc 96.50％ 96.40％ 93.60％ 93.40％ 91.30％ 98.10％

[0153] As can be seen from Table 5, gradient pruning has little impact on the accuracy of the federated learning system.

[0154] The sixth experiment is based on MixUp.

[0155] Table 6. Accuracy of the MixUp-based defense scheme

[0156] acc 98.40％ 96.20％ 95.30％ 98.10％ 94.80％

[0157] As shown in Table 6, the MixUp-based experiment had little impact on the accuracy of the federated learning system, but observation revealed that... Figure 24 We can observe that the overall trend of all the curves is downward, but observing... Figure 25 It can be seen that the gradient leakage attack method of the present invention recovers images that are not the training data of that batch, but the rest of the training dataset. MixUp can protect the data currently participating in training, but will leak the rest of the dataset.

[0158] In summary, the above section primarily applies four defense schemes against gradient leakage attacks to the gradient leakage attack method of this invention, and verifies their defensive effectiveness and impact on the accuracy of the federated learning system under the same classification task through experiments. The four schemes are: adding Dropout to the shared model for protection, applying MixUp to the local training data for protection, and applying differential privacy or gradient clipping techniques to the shared gradients for protection. The experiments show that the methods based on differential privacy and gradient clipping can resist the gradient leakage attack method of this invention, but at the cost of sacrificing the accuracy of the federated learning system. The defense scheme based on the MixUp method can protect the data used in the current training, but will leak information from other data in the local training dataset. The defense scheme based on Dropout can resist the gradient leakage attack method of this invention without compromising the accuracy of the federated learning system. If the training model can be modified, the defense scheme based on Dropout provides better protection.

[0159] Accordingly, embodiments of the present invention also disclose an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the gradient leakage attack method under federated learning disclosed in the foregoing embodiments. For more specific details regarding the above method, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0160] Furthermore, this invention also discloses a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, it implements the aforementioned gradient leakage attack method under federated learning. For more specific details regarding the above method, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0161] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the devices and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0162] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0163] The steps of the methods or algorithms described in conjunction with the embodiments disclosed in this invention can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0164] Finally, it should be noted that in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0165] The above provides a detailed description of the gradient leakage attack method, device, and storage medium under federated learning provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A gradient leakage attack method under federated learning, characterized in that, include: The LLG method is used to extract label information. Specifically, for the gradient vector, the label corresponding to the negative gradient is extracted and added to the output set. The corresponding gradient is then subtracted once. When the size of the output set is smaller than the size of the specified label set, the label corresponding to the minimum gradient in the gradient set is added to the output set, and the corresponding gradient is then subtracted once, until the size of the output set is equal to the size of the specified label set. Input the label information and random variables into the generative network; Obtain the generated data and generated labels of the generative network, and input the generated data and generated labels into the shared model to obtain the generated gradient; The difference between the generated gradient and the true gradient is calculated, and the difference is used as the objective function of the generative network to train the generative network. The trained generative network is used to obtain gradient leakage attack results.

2. The gradient leakage attack method for federated learning according to claim 1, characterized in that, Before extracting tag information, the process also includes: Generative networks are constructed using convolutional layers, normalization layers, and activation layers.

3. The gradient leakage attack method for federated learning according to claim 1, characterized in that, In addition to using the difference value as the objective function of the generative network, it also includes: Two regularization terms are added to the objective function: WD distance and TVLoss loss.

4. The gradient leakage attack method under federated learning according to claim 3, characterized in that, The objective function is obtained using the following formula: in, Let the objective function be... This is fake data. For weight parameters, For gradient, This is a hyperparameter.

5. The gradient leakage attack method under federated learning according to claim 1, characterized in that, The training process for the generative network includes: The generated data, the generated tags, and the tag information are optimized; Training of the generative network is stopped when the objective function of the generative network decreases to a set threshold.

6. The gradient leakage attack method under federated learning according to claim 5, characterized in that, Optimizing the generated data, the generated tags, and the tag information includes: The generated data, the generated labels, and the label information are optimized using the stochastic gradient descent algorithm.

7. An electronic device, characterized in that, It includes a processor and a memory, wherein the processor implements the federated learning gradient leakage attack method as described in any one of claims 1 to 6 when executing a computer program stored in the memory.

8. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the federated learning gradient leakage attack method as described in any one of claims 1 to 6.

Images