A privacy leakage defense method based on perturbation in federated learning

Abstract

The application discloses a privacy leakage defense method based on disturbance in federated learning, and is characterized in that the method comprises the following steps: 1) obtaining a training data set and a test data set; 2) obtaining a gradient value; 3) obtaining a new gradient value; and 4) verifying. The method can prevent an attacker from stealing the private information of participants by adopting a DLG attack while keeping the performance of an original model.

Description

Technical Field

[0001] This invention relates to network security, and more particularly to data security and network security in information security technology, and specifically to federated learning, a perturbation-based privacy leakage defense method in federated learning. Background Technology

[0002] In the field of artificial intelligence, data is an indispensable factor in model training. However, much of the data on the internet suffers from the problem of "data silos," where different departments or systems within an enterprise or organization cannot share and integrate data. The main approach to solving this problem is to centrally process, clean, and model the data, but this process is prone to data privacy leaks. To address these issues, Federated Learning (FL) has been proposed as an emerging distributed learning algorithm that simultaneously protects data privacy and security. In traditional machine learning algorithms, all data is typically centralized for training; however, Federated Learning eliminates the need to transmit raw data to a central server. It allows clients to train locally, then upload the model parameters to the server for parameter aggregation. Finally, the server returns the aggregated model to the participants to complete the model training, thereby protecting user data privacy and security to a certain extent.

[0003] Google first proposed the concept of Federated Learning (FL) in 2016, which involves multiple clients collaborating to train a model while protecting data privacy and security. Subsequently, McMahan et al. systematically introduced the basic concepts of Federated Learning and provided a complete description of its application scenarios and characteristics, while also proposing the FedAvg algorithm to improve its performance. Later, to further improve the efficiency and security of Federated Learning, Bonawitz et al. proposed two new Federated Learning models in 2017. In 2019, Qiang et al. introduced a comprehensive Federated Learning framework, which categorizes Federated Learning into horizontal Federated Learning, vertical Federated Learning, and Federated Transfer Learning based on the distribution characteristics of training data among the participants.

[0004] While federated learning mitigates privacy issues during data collection to some extent, privacy leaks of intermediate parameters still exist during model parameter sharing and model aggregation. Zhu et al.'s research demonstrates that attackers can recover private training data from shared gradients of other participants using a gradient leakage from gradients (DLG) attack. This allows them to reconstruct the original data by calculating virtual gradients using virtual inputs and outputs without requiring additional training information, optimizing the data to approximate the real inputs and outputs. Experiments have verified the high success rate of DLG attacks, posing a significant threat to privacy and security in federated learning. Several defense strategies against DLG attacks have emerged, such as differential privacy, gradient compression / sparseness, and perturbed gradients through data representation. However, these strategies either offer poor protection or result in non-negligible model accuracy loss. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a perturbation-based privacy leakage defense method in federated learning. This method can defend against attackers using DLG attacks to steal participants' private information while maintaining the performance of the original model.

[0006] The technical solution to achieve the objective of this invention is: A perturbation-based privacy leakage prevention method in federated learning includes the following steps: 1) Obtain the training and testing datasets: Randomly select 500 data points from the publicly available datasets MNIST and CIFAR100 as the experimental dataset; 2) Obtaining gradient values: Input the random experimental dataset selected in step 1) into the LeNet model consisting of two convolutional layers, one Dropout layer, and two fully connected layers to obtain the gradient values ​​of the model. During the forward propagation process, the input data first passes through two convolutional layers, a max pooling layer, and a ReLU activation function. Then, the data is flattened into a one-dimensional vector, followed by the first fully connected layer and a ReLU activation function, then the Dropout layer and the second fully connected layer. Finally, the output result is processed by the log_softmax activation function to obtain the probability distribution. 3) Obtaining new gradient values: The loss value of the entire neural network is obtained using the criterion() function. The loss value and the gradient value obtained in step 2) are then input into the torch.autograd.grad() function to obtain the gradient value dy_dx. The dy_dx is then input into the np.sign() function to obtain the required perturbation value. This perturbation value is then added to the gradient value obtained in step 2) to obtain the gradient value y. The np.random.laplace() function is then used to generate random Laplacian noise. The generated random Laplacian noise is then added to the gradient value y to obtain the new gradient value z. Finally, the new gradient value z is input into the torch.clamp() function for pruning to obtain the gradient value after applying the defense strategy. 4) Validation: The gradient values ​​obtained in step 3) are reconstructed using the LeNet model. The LeNet model is randomly initialized, and the L-BFGS model with a learning rate of 1 is used as the optimizer. The LeNet model is iteratively updated starting from the randomly initialized virtual data and output to minimize the privacy data of the gradient reconstruction client. The result of reconstructing the gradient values ​​obtained in step 3) is compared with the result of reconstructing the gradient values ​​obtained in step 1) for validation.

[0007] This technical solution aims to address the privacy leakage problem of intermediate parameters that still exists in federated learning during model parameter sharing and model aggregation. It treats the DLG model as a deep learning model and attacks the DLG model to defend against DLG attacks. This technical solution defends against attackers using DLG attacks to steal participants' privacy information while maintaining the performance of the original model. The comparison results in step 4) show that this technical solution demonstrates better defense performance against DLG attacks and can maintain the high accuracy of the model while achieving high defense performance.

[0008] This method can defend against attackers using DLG attacks to steal participants' private information while maintaining the performance of the original model. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of the DLG attack model process in the embodiment; Figure 2 This is a flowchart illustrating the method used in the embodiment. Figure 3 This is a comparison chart of the experimental results of the model accuracy of each method in the embodiments; Figure 4 This is a comparison chart of the experimental results of tag theft success rates for each method in the embodiments; Figure 5 This is a schematic diagram illustrating the effect of image reconstruction using the various methods in the embodiments; Figure 6 This is a schematic diagram comparing the MSE-I values ​​of the various methods in the embodiments. Detailed Implementation

[0010] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention. Example

[0011] like Figure 1 As shown, the process by which an attacker uses a DLG attack to steal information from a federated learning client includes: 1. Generate virtual input and output: Use the torch.randn() function to generate random input and output values; 2. Backpropagation to update virtual input and output: The input and output values ​​obtained in step 1 are backpropagated in the neural network using the grad_diff.backward() function to match them with the real input and output values; 3. Infer the original data: Repeat step 2 and iterate 300 times to obtain the reconstructed input values.

[0012] like Figure 2 As shown, a perturbation-based privacy leakage prevention method in federated learning includes the following steps: 1) Obtain the training and testing datasets: Randomly select 500 data points from the publicly available datasets MNIST and CIFAR100 as the experimental dataset; 2) Obtaining Gradient Values: Input the random experimental dataset selected in step 1) into the LeNet model, which consists of two convolutional layers and two fully connected layers, to obtain the gradient values ​​of the model. This model contains two convolutional layers, one Dropout layer, and two fully connected layers. During forward propagation, the input data first passes through two convolutional layers, a max pooling layer, and a ReLU activation function. Then, the data is flattened into a one-dimensional vector, followed by the first fully connected layer and a ReLU activation function, then the Dropout layer and the second fully connected layer. Finally, the output is processed by the log_softmax activation function to obtain the probability distribution. 3) Obtaining new gradient values: Use the criterion() function to obtain the loss value of the entire neural network, and input the obtained loss value and the gradient value obtained in step 2) into the torch.autograd.grad() function to obtain a gradient value dy_dx. Input dy_dx into the np.sign() function to obtain the required perturbation value, and then add the perturbation value to the gradient value obtained in step 2) to obtain a gradient value y. Then use the np.random.laplace() function to generate a random Laplacian noise, and add the generated random Laplacian noise to the gradient value y to obtain a new gradient value z. Finally, input this gradient value z into the torch.clamp() function for pruning to obtain the gradient value after applying the defense strategy. 4) Validation: The gradient values ​​obtained in step 3) are reconstructed using the LeNet model. The LeNet model is randomly initialized, and the L-BFGS model with a learning rate of 1 is used as the optimizer. The LeNet model is iteratively updated starting from the randomly initialized dummy data and output to minimize the gradients to reconstruct the data. The reconstruction results are compared with the results without using the gradient values ​​obtained in step 1) for validation.

[0013] In this example, MNIST and CIFAR100 are used as experimental datasets, and 500 random data points are extracted from these datasets. A randomly initialized LeNet model is used for the attack model experiment, and an L-BFGS model with a learning rate of 1 is used as the optimizer. The model is iteratively updated starting from the randomly initialized dummy data and outputs to minimize the gradients used to reconstruct the data. The optimization is performed 300 times. To ensure the reliability of the experimental results, a random seed is set for all network models with a seed value of 1234. The DLG attack, as a reconstruction attack, uses the mean error of the similarity between the reconstructed data and the original data (…). MSE-ITo measure the reconstruction effect, in addition to considering both the defensive performance of the defense method and the loss of accuracy of the original model, this example uses model accuracy and label stealing success rate as evaluation metrics. Ideally, the defender wants to maintain high model accuracy while having high defense performance. As shown in Figure 3, compared with the two baseline methods, this example method maintains higher model accuracy, achieving 91.2% and 65.33% accuracy on the MNIST and CIFAR100 datasets, respectively, with a loss of only 5.4% and 14.77% accuracy compared to the original model. When Laplacian noise is added, the model accuracy is 78.6% and 54.3%, with a loss of 18% and 25.8% accuracy. After adding Gaussian noise, the model accuracy is only 84% and 68%, with a loss of 12.6% and 12.1% accuracy. On the MNIST dataset, compared with the two baseline methods, this example method improves the accuracy of the original model by 12.6% and 7.2%. On the CIFAR100 dataset... On the dataset, the method in this example improves the accuracy of the original model by 11.03% compared to the defense method with added Laplacian noise. This shows that compared to the two baseline methods, the method in this example has less interference with the model feature extractor on both datasets and can better maintain the model's expressive power. like Figure 4 , Figure 5 As shown, the method presented in this example exhibits the best defensive performance. DLG attacks cannot reconstruct the original training images, and the success rate of stealing label information is only 61.6% and 38.4%, respectively. This demonstrates that the method presented in this example can effectively defend against DLG attacks. Compared to adding random noise to the gradient data, the perturbation added by the method presented in this example can more deeply affect the attacker's reconstruction of the original data, resulting in superior defensive performance. Furthermore, as... Figure 6 As shown, the defense strategy in this example can increase the mean squared error between the reconstructed data and the original data by hundreds or even thousands of times. Although all three defense schemes can prevent attackers from reconstructing images that are recognizable to the naked eye, private information may still reside in the reconstructed image. Therefore, the error may be higher than the threshold of recognizable images. MSE-I It remains a meaningful indicator of privacy protection.

Claims

1. A perturbation-based privacy leakage prevention method in federated learning, characterized in that, Includes the following steps: 1) Obtain the training and test datasets: Randomly select 500 data points from the publicly available datasets MNIST and CIFAR100 as the experimental dataset; 2) Obtaining gradient values: Input the random experimental dataset selected in step 1) into the LeNet model consisting of two convolutional layers, one Dropout layer, and two fully connected layers to obtain the gradient values ​​of the model. During the forward propagation process, the input data first passes through two convolutional layers, a max pooling layer, and a ReLU activation function. Then, the data is flattened into a one-dimensional vector, followed by the first fully connected layer and a ReLU activation function, then the Dropout layer and the second fully connected layer. Finally, the output result is processed by the log_softmax activation function to obtain the probability distribution. 3) Obtaining new gradient values: The loss value of the entire neural network is obtained using the criterion() function. The loss value and the gradient value obtained in step 2) are then input into the torch.autograd.grad() function to obtain the gradient value dy_dx. The dy_dx is then input into the np.sign() function to obtain the required perturbation value. This perturbation value is then added to the gradient value obtained in step 2) to obtain the gradient value y. The np.random.laplace() function is then used to generate random Laplacian noise. The generated random Laplacian noise is then added to the gradient value y to obtain the new gradient value z. Finally, the new gradient value z is input into the torch.clamp() function for pruning to obtain the gradient value after applying the defense strategy. 4) Validation: The gradient values ​​obtained in step 3) are reconstructed using the LeNet model. The LeNet model is randomly initialized, and the L-BFGS model with a learning rate of 1 is used as the optimizer. The LeNet model is iteratively updated starting from the randomly initialized virtual data and output to minimize the privacy data of the gradient reconstruction client. The result of reconstructing the gradient values ​​obtained in step 3) is compared with the result of reconstructing the gradient values ​​obtained in step 1) for validation.

Images