Method and apparatus for preventing member inference attack, and non-transitory storage medium

Abstract

The application discloses a member inference attack prevention method and device, and a nonvolatile storage medium. The method comprises the following steps: obtaining multiple groups of local samples and multiple target test samples; determining a first label of each target test sample in the multiple target test samples, wherein the first label is used for indicating a classification result of the target test sample; obtaining a federated learning model stored locally by a member; generating shared parameters shared by other members and an attack model according to the multiple first labels, the multiple target test samples, and the federated learning model; and sending the shared parameters to the attack model. The application solves the technical problem that, in the related art, an attack model can identify local samples participating in distributed learning through a realistic sample generated directly by using the local samples, establish a corresponding relationship between the realistic sample and other members, and learn a training process of the local samples, thereby failing to prevent member inference attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a member inference attack prevention method and device and a nonvolatile storage medium. BACKGROUND

[0002] In the federated learning technology, each member participating in distributed learning is divided into different trust domains according to the number of local samples and computing power, and a realistic sample is generated based on the local samples in the trust domain. Therefore, the local model parameters have a high dependence on the local samples. At the same time, the nearest local sample label is used to label the test sample by calculating the norm distance between the local sample and the test sample. Since the calculation result of the norm distance is affected by the weight of the local sample participating in the training of the attack model, the attack model can easily identify the members participating in the model training and the members not participating in the model training, and there is a technical problem that the member inference attack cannot be prevented.

[0003] At present, there is no effective solution to the above problems. SUMMARY

[0004] The embodiments of the present application provide a member inference attack prevention method and device and a nonvolatile storage medium to at least solve the technical problem that the attack model can identify the local samples participating in distributed learning through the realistic samples generated directly by the local samples in the related art, establish the corresponding relationship between the realistic samples and other members, learn the training process of the local samples, and cause the member inference attack to be unable to be prevented.

[0005] According to an aspect of an embodiment of the present application, a member inference attack prevention method is provided, including: obtaining a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally in the corresponding members, the plurality of target test samples are copies of a plurality of test samples, and the plurality of test samples are sent by a parameter server in federated learning; determining a first label of each target test sample in the plurality of target test samples to obtain a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to the similarity between the local sample and the test sample; obtaining a federated learning model stored locally in the member, generating shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples and the federated learning model, wherein the other members are the plurality of members in federated learning except the member corresponding to the federated learning model; and sending the shared parameters to the attack model.

[0006] Optionally, the multiple groups of local samples are obtained by determining a target number of test samples in a test sample group, wherein the test sample group is composed of multiple test samples; and classifying multiple local samples of each member at the local into multiple local sample groups, wherein the number of local samples in each local sample group in the multiple local sample groups is the target number.

[0007] Optionally, determining the first label of each target test sample in the multiple target test samples comprises: obtaining a first sample value of each local sample in the multiple local sample groups to obtain multiple first sample values, and obtaining a second sample value of each test sample in the test sample group to obtain multiple second sample values; wherein each local sample is generated at the local by a member in the federated learning, and each test sample is generated at the local by a parameter server in the federated learning; and determining multiple first labels based on the multiple first sample values and the multiple second sample values by using a local similarity function.

[0008] Optionally, determining the multiple first labels based on the multiple first sample values and the multiple second sample values by using the local similarity function comprises: determining a first covariance value of each local sample group and the test sample group based on the first sample value, the second sample value, and the target number to obtain multiple first covariance values; arranging the multiple first covariance values in ascending order to obtain a covariance sequence; determining multiple target covariance values in the covariance sequence in descending order, and determining multiple target local sample groups corresponding to the multiple target covariance values; determining a second label of each target test sample in the independent variable dimension according to the multiple target local sample groups; and determining the first label of each target test sample according to the second label.

[0009] Optionally, determining the first label of each target test sample according to the second label comprises: obtaining multiple first gradient parameters of a shadow model of each target local sample in the target local sample group, wherein the first gradient parameter is an initial gradient parameter, and the shadow model is generated by training the local sample; obtaining a second gradient parameter of a shadow model of each target test sample in the multiple target test samples belonging to the same parameter server as the target local sample group to obtain multiple second gradient parameters; determining a second covariance value of the multiple first gradient parameters and the multiple second gradient parameters; determining a third label of each target test sample in the gradient dimension according to the second covariance value; and determining the first label of each target test sample as an operation result of a preset operation of the second label and the third label of each target test sample.

[0010] Optionally, the operation rule of the preset operation comprises: if the second label is the same as the third label, an operation result of the preset operation performed on the second label and the third label is the third label; and if the second label is different from the third label, the operation result of the preset operation performed on the second label and the third label is the second label.

[0011] Optionally, the prevention method of the member inference attack further comprises: determining a plurality of target test samples corresponding to each parameter server, and obtaining a shadow model of the target test sample to obtain a plurality of shadow models; and determining a plurality of members belonging to a trust domain according to the plurality of shadow models.

[0012] Optionally, the determining of the plurality of members belonging to the trust domain according to the plurality of shadow models comprises: classifying the plurality of target test samples by using any two of the plurality of shadow models to obtain a classification result, wherein the classification result comprises: a first classification result of one of the any two of the plurality of shadow models on the plurality of target test samples, and a second classification result of the other of the any two of the plurality of shadow models on the plurality of local test samples; determining a Land coefficient of each of the plurality of shadow models according to the first classification result and the second classification result to obtain a plurality of Land coefficients; determining a difference value of any two of the plurality of Land coefficients to obtain a plurality of difference values; determining a plurality of target difference values from the plurality of difference values, and determining a plurality of target Land coefficients corresponding to the plurality of target difference values, and a plurality of target shadow models corresponding to the plurality of target Land coefficients, wherein the target difference value is a difference value greater than a preset value; and attributing members corresponding to the plurality of target shadow models to the same trust domain.

[0013] Optionally, the determining of the Land coefficient of each of the plurality of shadow models according to the first classification result and the second classification result comprises: determining a first quantity of a first target classification result, wherein the first target classification result is that the first classification result indicates that the plurality of local test samples belong to the same class of samples and the second classification result indicates that the plurality of local test samples belong to the same class of samples; determining a second quantity of a second target classification result, wherein the second target classification result is that the first classification result indicates that the plurality of local test samples belong to the same class of samples and the second classification result indicates that the plurality of local test samples do not belong to the same class of samples, or the first classification result indicates that the plurality of local test samples do not belong to the same class of samples and the second classification result indicates that the plurality of local test samples belong to the same class of samples; determining a third quantity of a third target classification result, wherein the third target classification result is that the first classification result indicates that the plurality of local test samples do not belong to the same class of samples and the second classification result indicates that the plurality of local test samples do not belong to the same class of samples; determining a first sum of the first quantity and the third quantity, and determining a second sum of the first quantity and the second quantity and the third quantity; and determining a ratio of the first sum to the second sum as the Land coefficient of each of the plurality of shadow models.

[0014] According to a further aspect of the embodiments of the present application, a device for preventing a member inference attack is also provided, comprising: an obtaining module configured to obtain a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally on the corresponding members, and the plurality of target test samples are copies of a plurality of test samples, wherein the plurality of test samples are sent by a parameter server in federated learning; a determining module configured to determine a first label of each target test sample in the plurality of target test samples, to obtain a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to a similarity between the local sample and the test sample; a generating module configured to obtain a federated learning model stored locally on the member, and to generate shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples, and the federated learning model, wherein the other members are the plurality of members in federated learning except for a member corresponding to the federated learning model; and a sending module configured to send the shared parameters to the attack model.

[0015] According to a further aspect of the embodiments of the present application, a non-volatile storage medium is also provided, wherein the non-volatile storage medium stores a computer program, and a device in which the non-volatile storage medium is located executes the member inference attack prevention method described above by running the computer program.

[0016] According to a further aspect of the embodiments of the present application, an electronic device is also provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the member inference attack prevention method described above by running the computer program.

[0017] In the embodiment of the present application, a plurality of local samples and a plurality of target test samples are obtained, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally in the corresponding members, the plurality of target test samples are copies of a plurality of test samples, and the plurality of test samples are sent by a parameter server in federated learning; a first label of each target test sample in the plurality of target test samples is determined, obtaining a plurality of first labels, wherein the first label is used to indicate the classification result of the target test sample, and the classification result is determined according to the similarity between the local sample and the test sample; a federated learning model stored locally in the member is obtained, and a shared parameter shared by other members and an attack model is generated according to the plurality of first labels, the plurality of target test samples and the federated learning model, wherein the other members are a plurality of members in federated learning except the member corresponding to the federated learning model; the shared parameter is sent to the attack model in a manner, the trust domain is divided according to the Landau similarity coefficient of each member shadow model, the effect of minimizing the difference in class prediction accuracy of each member in the same domain for different samples is realized; the gradient and weight of the model generated according to the test sample are obtained by combining the label of the test sample with the local federated learning model, the gradient, the weight and the label of the test sample are used as the shared parameter, and the effect of avoiding that the local sample directly participates in the generation of the realistic sample is realized; the label of the test sample is determined by using the high-dimensional feature parameter of the gradient, and the effect of avoiding that the attack model identifies the member and the non-member through the fluctuation of the probability in the prediction vector is realized; thereby the technical effect of preventing member inference attack is realized, and further the technical problem that the attack model can identify the local sample participating in distributed learning through the realistic sample, establish the corresponding relationship between the realistic sample and other members, and learn the training process of the local sample, thereby causing the inability to prevent member inference attack, is solved. BRIEF DESCRIPTION OF DRAWINGS

[0018] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0019] Figure 1 is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a member inference attack prevention method according to an embodiment of the present application;

[0020] Figure 2 is a step flowchart of a member inference attack prevention method according to an embodiment of the present application;

[0021] Figure 3 is a structure diagram of a member inference attack prevention device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the person skilled in the art better understand the scheme of the present application, the technical scheme in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should belong to the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0025] Member inference attack: an attack mode that threatens the privacy of federated learning. In a member inference attack, an attack monitor infers the data of a participant in federated learning by observing the output or gradient information of the model.

[0026] Realistic sample: a high-quality, real and representative data sample used in machine learning.

[0027] In the related technology of federated learning, members participating in distributed learning are divided into different trust domains according to their local sample size and computing power, and each realistic sample generated by an attack model is analyzed one by one to determine whether the shadow model produces an overfitting reaction to the realistic sample generated by a generative adversarial network (GAN network), so as to establish the corresponding relationship between the realistic sample and the member in the domain. Therefore, the attack model can identify the local sample participating in training by judging the fitting reaction. In addition, in the related technology of federated learning, the similarity between the test sample on the parameter server side and the local sample of each member is analyzed, the test sample and its most similar local sample are classified into one category, and the related parameters of the similarity function are shared. Therefore, the generated shared parameters have a high dependence on the local sample, and therefore the attack model can learn the training process of the local sample based on the shared parameters. Therefore, the attack model can identify the local sample participating in training and identify the training process of the local sample, and there is a problem of member inference attack. In order to solve this problem, the related solutions are provided in the embodiments of the present application, which are described in detail below.

[0028] According to an embodiment of the present application, a method for preventing member inference attack is provided. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0029] The method embodiments provided by the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for preventing member inference attack is shown. As shown in Figure 1 The computer terminal 10 (or mobile device 10) can include one or more processors 102 (the processor 102 can include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, and does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or fewer components than those shown in Figure 1 or have a different configuration than that shown in Figure 1 .

[0030] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be implemented wholly or partially as software, hardware, firmware, or any other combination. Furthermore, the data processing circuits may be a single, independent processing module, or may be wholly or partially integrated into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuit serves as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the member reasoning attack prevention method in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned member reasoning attack prevention method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0032] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0033] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0034] Figure 2 This is a flowchart illustrating the steps of a method for preventing member reasoning attacks according to an embodiment of this application. The method for preventing member reasoning attacks according to this embodiment can operate in... Figure 1 In the operating environment shown, such as Figure 2 As shown, the method includes the following steps:

[0035] In step S202, a plurality of local samples and a plurality of target test samples are obtained, wherein the plurality of local samples are generated locally by a plurality of members in the federated learning, the plurality of local samples are stored locally on the corresponding member, and the plurality of target test samples are copies of a plurality of test samples, and the plurality of test samples are sent by a parameter server in the federated learning.

[0036] The method provided by the embodiments of the present application is applied to a federated learning scenario, and is used for preventing member inference attacks of an attack model. In step S202, the plurality of test samples sent by the parameter server in the federated learning scenario are obtained on the member side, and a plurality of local samples locally stored on the member side are obtained, wherein the number of test samples is less than the number of local samples.

[0037] According to an optional embodiment of the present application, the plurality of local samples are obtained by the following method: determining the number of test samples in a test sample group as a target number, wherein the test sample group is composed of a plurality of test samples; and classifying a plurality of local samples locally stored on each member of the plurality of members into a plurality of local sample groups, wherein the number of local samples in each local sample group of the plurality of local sample groups is the target number.

[0038] In the embodiment, since the number of test samples is less than the number of local samples, the method provided by the embodiments of the present application divides the plurality of local samples into a plurality of groups for comparison with the test samples; and divides the plurality of local samples locally stored on the plurality of members in the federated learning into a plurality of local sample groups, and ensures that each local sample group contains the same number of samples as the number of test samples contained in the test group.

[0039] In step S204, a first label of each target test sample in the plurality of target test samples is determined, and a plurality of first labels are obtained, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to the similarity between the local sample and the test sample.

[0040] In step S204, the classification result (i.e., the first label) of the test sample obtained in step S202 is determined, wherein the classification result of each test sample is obtained by classifying the test sample on the parameter server side in the federated learning based on the similarity between the local sample and the test sample, and the classification of the test sample on the parameter server side is based on the similarity between the test sample and the plurality of local samples locally stored on each member in the federated learning.

[0041] In step S206, a federated learning model stored locally on the member is obtained, and shared parameters shared by other members and the attack model are generated according to the plurality of first labels, the plurality of target test samples, and the federated learning model, wherein the other members are a plurality of members in the federated learning except the member corresponding to the federated learning model.

[0042] In step S206, the test sample obtained in step S202, the label (i.e., the first label) of the test sample obtained in step S204, and the local federated learning model of each member in the federated learning are used to generate a model corresponding to the test sample, and the gradient, weight and label of the test sample and the model corresponding to the test sample are used as shared parameters, wherein the shared parameters are used to share the update of the local federated learning model with the attack model.

[0043] According to an optional embodiment of the present application, the first label of each target test sample in the plurality of target test samples is determined, including: obtaining a first sample value of each local sample in a plurality of local sample groups to obtain a plurality of first sample values, and obtaining a second sample value of each test sample in a test sample group to obtain a plurality of second sample values; wherein each local sample is generated locally by a member in the federated learning, and each test sample is generated locally by a parameter server in the federated learning; and determining a plurality of first labels based on the plurality of first sample values and the plurality of second sample values by using a local similarity function.

[0044] In the related art, by extracting high-dimensional features of the independent variable dimension and the weight dimension of the local sample, a local sample group with the maximum covariance value in the plurality of local sample groups is determined, a covariance matrix composed of the covariances of the plurality of local samples in the local sample group with the maximum covariance is determined, and the eigenvalues of the covariance matrix are determined. The norm distance between the test sample and the local sample is calculated under the independent variable dimension by using the eigenvalues, the test sample and the local sample with the closest norm distance are determined, and the label of the local sample is taken as the label of the test sample. Since the weights of the local samples participating in the training are used when calculating the eigenvalues, the attack model can learn the label of the test sample sent by the local federated learning model of the federated learning member attacked by the attacked model for sharing with the attack model in the self-correction process, and further identify the difference between the realistic sample corresponding to the local sample participating in the training and the realistic sample corresponding to the local sample not participating in the training, laying the foundation for member inference attack, and there is a risk of being attacked by the attacked model. In the present embodiment, a new label determination method is provided, and a new label determination method is provided. By using a local similarity function, model gradient features are generated based on the (first) label of the local sample in addition to the sample features, and gradient high-dimensional features are extracted as (second) labels of the test samples based on the model gradient features, thereby reducing the influence of the weights of the local samples participating in the training on the generation of the (second) labels, and avoiding the attack model from determining the local samples participating in the training and the local samples not participating in the training based on the (second) labels of the test samples.

[0045] In step S208, the shared parameters are sent to the attack model.

[0046] In step S208, the federated learning model stored locally by the member is acquired, and shared parameters shared by other members and the attack model are generated according to the plurality of first labels, the plurality of target test samples and the federated learning model, wherein the other members are a plurality of members in the federated learning except the member corresponding to the federated learning model.

[0047] Optionally, the plurality of first labels are determined based on the plurality of first sample values and the plurality of second sample values by using the local similarity function, including: determining a first covariance value of each local sample group and the test sample group based on the first sample value, the second sample value and the target number, to obtain a plurality of first covariance values; arranging the plurality of first covariance values in ascending order to obtain a covariance sequence; determining a plurality of target covariance values in the covariance sequence in descending order, and determining a plurality of target local sample groups corresponding to the plurality of target covariance values; determining a second label of each target test sample in the independent variable dimension according to the plurality of target local sample groups; and determining a first label of each target test sample according to the second label.

[0048] The method provided in the embodiments of the present application determines the (first) label of each test sample by the label voting result in the independent variable dimension and the gradient dimension; in the embodiments, the label voting result (i.e. the second label) of the test sample in the independent variable dimension is determined based on the local similarity function; first, a sample group composed of local samples is determined, and the (first) covariance values of the plurality of local sample groups are used to predict the (second) labels of the plurality of test samples in the independent variable dimension; the (first) covariance of each sample group is determined by wherein n is the number of local samples in the sample group, the number of local samples and the number of test samples in each sample group are the same, both are n, xi represents any one local sample data (i.e. the first sample value), xi' represents any one test sample data (i.e. the second sample value), which represents the average value of the local samples in the sample group, represents the average value of the test samples in the sample group. After calculating the (first) covariance of each sample group by the above formula, the maximum (first) covariance value (i.e. the target covariance value) is selected from the plurality of (first) covariance values, wherein the maximum (first) covariance value (i.e. the target covariance value) is selected in descending order from the covariance sequence generated by arranging the plurality of (first) covariances in ascending order; the selection rule of the covariance is set as TOPN, for example, when it is set as TOP3, three covariances are selected in descending order from the covariance sequence, and the second label of the test sample under the independent variable dimension is determined by using the three covariances. For example, covariance 1 (cov1), covariance 2 (cov2) and covariance 3 (cov3) are selected in descending order from the covariance sequence composed of the plurality of covariances, then the local sample 1 (x1, y1), the local sample 2 (xi, y2) and the local sample 3 (xm, y2) in the local sample group corresponding to the covariance 1 (cov1), the local sample 4 (x2, y2), the local sample 5 (xa, y1) and the local sample 6 (xd, y1) in the local sample group corresponding to the covariance 2 (cov2), and the local sample 7 (x3, y1), the local sample 8 (xk, y1) and the local sample 9 (xj, y2) in the local sample group corresponding to the covariance 3 (cov3) vote for the second label of the test sample 1 (x1', δ1'), the test sample 2 (xi', δi') and the test sample 3 (xm', δm') under the independent variable dimension issued by the parameter server side, and the voting result is taken as the second label of the test sample under the independent variable dimension, for example, the second label of the test sample under the independent variable dimension has two kinds of y1 and y2, after the local sample groups 1-3 vote for the two labels, it is determined that the second labels of the test samples 1-3 under the independent variable dimension are y1, y1 and y2 respectively, then the test samples are temporarily marked as (x1', δ1', y1), (xi', δi', y1) and (xm', δm', y2). Wherein, is the gradient parameter of the shadow model of the member on the parameter server side, (ω0*x0+b0,ω i *x i +b i ) is the loss function about the weight ω; ω0 is the initial weight of the label x0 of the local sample, b0 is the bias term obtained by deriving ω0; ω i is the weight of the predicted second label x i of the test sample, b0 is the bias term obtained by deriving ω0.

[0049] According to an optional embodiment of the present application, the first label of each target test sample is determined according to the second label, including: obtaining a plurality of first gradient parameters of a shadow model of each target local sample in the target local sample group, wherein the first gradient parameters are initial gradient parameters, and the shadow model is generated by training the local sample; obtaining a plurality of second gradient parameters of a shadow model of each target test sample in a plurality of target test samples belonging to the same parameter server as the target local sample group, to obtain the plurality of second gradient parameters; determining a second covariance value of the plurality of first gradient parameters and the plurality of second gradient parameters; determining a third label of each target test sample in the gradient dimension according to the second covariance value; and determining the first label of each target test sample as an operation result of a preset operation between the second label and the third label of each target test sample.

[0050] In the present embodiment, the (third) label of the test sample in the gradient dimension is determined as follows: obtaining the gradient δi' of the shadow model corresponding to the (target) test sample, and the average value of the plurality of (target) test samples At the same time, the gradient δi of the shadow model of each local sample on the same parameter server side as the test sample is obtained, and the average value of the gradients of the shadow models of the plurality of local samples is obtained According to the formula predicting the (third) label of each (target) test sample in the gradient dimension, wherein n is the number of (target) test samples, and since the local samples are grouped in the above embodiment, the number of each group of local samples and each group of (target) test samples is the same, which is n. For example, in the covariance sequence composed of the calculated plurality of covariances, cov4, cov5 and cov6 are selected in the order from large to small, and when the (third) label of the test sample in the gradient dimension is determined by using the local sample groups corresponding to cov4, cov5 and cov6, the local samples are labeled by using the gradient parameters δi' of the local samples, therefore, the labeled local samples 10 (x4, δ4, y1), 11 (x5, δ5, y2) and 12 (x6, δ6, y2) contained in the local sample group 4 corresponding to cov4; the labeled local samples 13 (x8, δ8, y2), 14 (x9, δ9, y1) and 15 (x10, δ10, y1) contained in the local sample group 5 corresponding to cov5, and the labeled local samples 16 (x11, δ11, y1), 17 (x12, δ12, y2) and 18 (x13, δ13, y2) contained in the local sample group 6 corresponding to cov6. The above three local sample groups vote for the possible labels y1 and y2 of the test sample to determine the (third) label of the test sample in the gradient dimension. For example, the voting results of the local sample groups 4-6 for the test sample 1 (x1', δ1') are y1, for the test sample 2 (xi', δi') are y2, and for the test sample 3 (xi', δi') are y2, and it is determined that the labels of the test sample 1 (x1', δ1'), the test sample 2 (xi', δi') and the test sample 3 (xi', δi') in the gradient dimension are y1, y2 and y2 respectively, and the test sample 1 is temporarily labeled as (x1', δ1', y1), the test sample 2 is temporarily labeled as (xi', δi', y2), and the test sample 3 is temporarily labeled as (xm', δm', y2).

[0051] Optionally, the operation rule of the preset operation includes: if the second label is the same as the third label, the operation result of the preset operation of the second label and the third label is the third label; and if the second label is different from the third label, the operation result of the preset operation of the second label and the third label is the second label.

[0052] The (second) labels of the test samples 1-3 in the independent variable dimension (x1', δ1', y1), (xi', δi', y1), (xm', δm', y2) and the (third) labels of the test samples 1-3 in the gradient dimension (x1', δ1', y1), (xi', δi', y2), (xm', δm', y2) are subjected to a preset operation, and the (first) labels of the test samples are (x1', δ1', y1), (xi', δi', y1) and (xm', δm', y2); wherein the preset budget can be a "logical and" operation, and when the (second) labels of the test samples in the independent variable dimension and the (third) labels of the test samples in the gradient dimension are subjected to the "logical and" operation, the operation rule is as follows: when the (second) labels in the independent variable dimension are the same as the (third) labels in the gradient dimension, the result of the preset operation of the two is the (third) label; when the (second) labels in the independent variable dimension are different from the (third) labels in the gradient dimension, the result of the preset operation of the two is the (second) label, so when the (second) labels of the test samples 1-3 in the independent variable dimension are (x1', δ1', y1), (xi', δi', y1), (xm', δm', y2), and the (third) labels of the test samples 1-3 in the gradient dimension are (x1', δ1', y1), (xi', δi', y2), (xm', δm', y2), the (first) labels of the test samples 1-3 are (x1', δ1', y1), (xi', δi', y1), (xm', δm', y2) respectively.

[0053] According to some optional embodiments of the present application, the prevention method of the member inference attack further comprises: determining a plurality of target test samples corresponding to each parameter server, and obtaining a shadow model of the target test sample to obtain a plurality of shadow models; determining a plurality of members belonging to the trust domain according to the plurality of shadow models.

[0054] In the related art, when the division of trust domains is adopted for member inference attacks, the members of the federated learning are divided into different trust domains according to their local sample size and computing power, the attack model can analyze whether each realistic sample generated by the generative adversarial network (GAN network) causes the shadow model to produce an overfitting reaction, thereby establishing the correspondence between the realistic sample and the member in the domain, and identifying the members participating in the federated learning through learning. In the present embodiment, the division of trust domains is based on the shadow model of each target sample, so that the prediction accuracy of the attack model for different samples in the same trust domain is almost the same, the overfitting reaction detected by the attack model is not significant, and the local samples of other members in the domain cannot be mastered, and an attack on a certain member cannot be established, thereby achieving the purpose of preventing member inference attacks. When the attack model performs member inference, it encounters a dilemma, the inter-domain parameter sharing is limited due to the isolation of the trust domain, and the shadow models corresponding to the other members in the domain have no significant difference in overfitting reaction to each realistic sample. Therefore, the attacker cannot master the local samples of other members in the domain, and cannot establish an attack on a certain member.

[0055] According to an optional embodiment of the present application, determining the members belonging to the trust domain according to the plurality of shadow models comprises: classifying the plurality of target test samples through any two of the plurality of shadow models to obtain a classification result, wherein the classification result comprises: a first classification result of one of the any two shadow models on the plurality of target test samples, and a second classification result of the other of the any two shadow models on the plurality of local test samples; determining a Land coefficient of each of the plurality of shadow models according to the first classification result and the second classification result to obtain a plurality of Land coefficients; determining a difference value of any two of the plurality of Land coefficients to obtain a plurality of difference values; determining a plurality of target difference values from the plurality of difference values, and determining a plurality of target Land coefficients corresponding to the plurality of target difference values, and a plurality of target shadow models corresponding to the plurality of target Land coefficients, wherein the target difference value is a difference value greater than a preset value; and attributing the members corresponding to the plurality of target shadow models to the same trust domain.

[0056] In the present embodiment, the Land coefficient of the shadow model of each local sample is determined, the division of the trust domain is based on the Land coefficient, and the Land coefficient of the shadow model of each test sample is determined; the similarity of two shadow models is determined by calculating the difference value of the Land coefficients of the two shadow models; for example, a plurality of pairs of shadow models corresponding to the difference values (i.e. target difference values) greater than a preset value are determined as a plurality of most similar shadow models, and the plurality of pairs of shadow models are divided into the same trust domain, or two shadow models corresponding to two Land coefficients (i.e. target difference values) with the smallest difference value are determined as the two most similar shadow models, and the two models are divided into the same trust domain.

[0057] According to another optional embodiment of the present application, determining the RAND coefficient of each shadow model in the plurality of shadow models according to the first classification result and the second classification result comprises: determining a first quantity of first target classification results, wherein the first target classification result is that the first classification result indicates that the plurality of groups of local test samples belong to the same class of samples and the second classification result indicates that the plurality of groups of local test samples belong to the same class of samples; determining a second quantity of second target classification results, wherein the second target classification result is that the first classification result indicates that the plurality of groups of local test samples belong to the same class of samples and the second classification result indicates that the plurality of groups of local test samples do not belong to the same class of samples, or the first classification result indicates that the plurality of groups of local test samples do not belong to the same class of samples and the second classification result indicates that the plurality of groups of local test samples belong to the same class of samples; determining a third quantity of third target classification results, wherein the third target classification result is that the first classification result indicates that the plurality of groups of local test samples do not belong to the same class of samples and the second classification result indicates that the plurality of groups of local test samples do not belong to the same class of samples; determining a first sum of the first quantity and the third quantity, and determining a second sum of the first quantity and the second quantity and the third quantity; and determining a ratio of the first sum to the second sum as the RAND coefficient of each shadow model.

[0058] The RAND coefficient (RAND) = (SS+DD) / (SS+DD+SD+DS), wherein SS (the first target classification result) represents the number of times (i.e., the first quantity) that, when any two shadow models are used to classify two test samples corresponding to the two shadow models, the (first) classification result of one of the two shadow models indicates that the two test samples belong to the same class, and the (second) classification result of the other shadow model also indicates that the two test samples belong to the same class. DD (the third target classification result) represents the number of times (i.e., the third quantity) that, when any two shadow models are used to classify two test samples corresponding to the two shadow models, the (first) classification result of one of the two shadow models indicates that the two test samples do not belong to the same class, and the (second) classification result of the other shadow model also indicates that the two test samples do not belong to the same class. SD and DS (the second target classification result) respectively represent the number of times that, when any two shadow models are used to classify two test samples corresponding to the two shadow models, the (first) classification result of one of the two shadow models indicates that the two test samples belong to the same class, and the (second) classification result of the other shadow model indicates that the two test samples do not belong to the same class (i.e., the second quantity).

[0059] Figure 3 is a structural diagram of a member inference attack prevention device according to an embodiment of the present application, as shown in Figure 3As shown, the prevention apparatus comprises: an acquisition module 30, configured to acquire a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally on the corresponding members, the plurality of target test samples are copies of a plurality of test samples, and the plurality of test samples are sent by a parameter server in federated learning; a determination module 32, configured to determine a first label of each target test sample in the plurality of target test samples, to obtain a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to a similarity between the local sample and the test sample; a generation module 34, configured to acquire a federated learning model stored locally on the members, and generate shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples, and the federated learning model, wherein the other members are a plurality of members in federated learning except for a member corresponding to the federated learning model; and a sending module 36, configured to send the shared parameters to the attack model.

[0060] It should be noted that, Figure 3 The preferred implementation of the embodiment shown can be seen from Figure 2 The related description of the embodiment shown will not be repeated here.

[0061] According to the embodiments of the present application, a non-volatile storage medium is also provided, and the non-volatile storage medium stores a computer program. When a device in which the non-volatile storage medium is located runs the computer program, the above-mentioned member inference attack prevention method is executed.

[0062] The non-volatile storage medium is used to store a program for performing the following functions: acquiring a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally on the corresponding members, the plurality of target test samples are copies of a plurality of test samples, and the plurality of test samples are sent by a parameter server in federated learning; determining a first label of each target test sample in the plurality of target test samples, to obtain a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to a similarity between the local sample and the test sample; acquiring a federated learning model stored locally on the members, and generating shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples, and the federated learning model, wherein the other members are a plurality of members in federated learning except for a member corresponding to the federated learning model; and sending the shared parameters to the attack model.

[0063] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising a memory and a processor, the memory stores a computer program, and the processor is configured to execute the above-mentioned member inference attack prevention method through the computer program.

[0064] The processor in the electronic device is configured to run a program for performing the following functions: obtaining a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally on the corresponding members, the plurality of target test samples are copies of a plurality of test samples, and the plurality of test samples are sent by a parameter server in federated learning; determining a first label of each target test sample in the plurality of target test samples to obtain a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to the similarity between the local sample and the test sample; obtaining a federated learning model stored locally on the member, generating shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples and the federated learning model, wherein the other members are a plurality of members in federated learning except for the member corresponding to the federated learning model; and sending the shared parameters to the attack model.

[0065] Through the above steps, the trust domain can be divided based on the Rand coefficient of the shadow model; the shared parameters and the labels of the test samples are generated based on the local similarity function, and the shared parameters not including the local samples and the labels of the test samples not affected by the weights are generated through the method of dividing the trust domain, thereby improving the data security and achieving the technical effect of preventing member inference attacks.

[0066] It should be noted that each module in the above-mentioned member inference attack prevention device can be a program module (for example, a set of program instructions for implementing a certain specific function) or a hardware module. For the latter, it can be in the following form, but is not limited thereto: the form of each module is a processor, or the functions of each module are implemented by a processor.

[0067] The above-mentioned sequence numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0068] In the above-mentioned embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0069] In the several embodiments provided by the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the device embodiment described above is only illustrative, and for example, the division of the units can be a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interface, unit or module, and can be electrical or other forms.

[0070] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e. may be located in one place, or may be distributed to multiple units. Part or all of the units may be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0071] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware, or in the form of a software functional unit.

[0072] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part that contributes to the related art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various program code storage media.

[0073] The above is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A method of preventing a membership inference attack, the method comprising: The method comprises the following steps: obtaining a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally on the corresponding members, and the plurality of target test samples are copies of a plurality of test samples sent by a parameter server in federated learning; determining a first label of each target test sample in the plurality of target test samples, obtaining a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to the similarity between the local sample and the test sample; obtaining a federated learning model stored locally on the member, and generating shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples and the federated learning model, wherein the other members are a plurality of members in the federated learning except the member corresponding to the federated learning model; sending the shared parameters to the attack model.

2. The method of claim 1, wherein, The plurality of local samples are obtained by the following method: determining the number of test samples in a test sample group as a target number, wherein the test sample group is composed of the plurality of test samples; classifying a plurality of local samples locally stored by each member in the plurality of members into a plurality of local sample groups, wherein the number of local samples in each local sample group in the plurality of local sample groups is the target number.

3. The method of claim 2, wherein, Determining a first label of each target test sample in the plurality of target test samples comprises: obtaining a first sample value of each local sample in a plurality of local sample groups, obtaining a plurality of first sample values, and obtaining a second sample value of each test sample in a test sample group, obtaining a plurality of second sample values; wherein each local sample is generated locally by a member in federated learning, and each test sample is generated locally by a parameter server in federated learning; determining the plurality of first labels based on the plurality of first sample values and the plurality of second sample values by using a local similarity function.

4. The method of claim 3, wherein, Determining the plurality of first labels based on the plurality of first sample values and the plurality of second sample values by using the local similarity function comprises: determining a first covariance value of each local sample group and the test sample group based on the first sample value, the second sample value and the target number, obtaining a plurality of first covariance values; arranging the plurality of first covariance values in ascending order to obtain a covariance sequence; determining a plurality of target covariance values in the covariance sequence in descending order, and determining a plurality of target local sample groups corresponding to the plurality of target covariance values; determining a second label of each target test sample in the independent variable dimension according to the plurality of target local sample groups; determining the first label of each target test sample according to the second label.

5. The method of claim 4, wherein, Determining the first label of each target test sample according to the second label comprises: obtaining a plurality of first gradient parameters of a shadow model of each target local sample in the target local sample group, wherein the first gradient parameters are initial gradient parameters, and the shadow model is generated by training the local sample; obtaining a plurality of second gradient parameters of a shadow model of each target test sample in a plurality of target test samples belonging to the same parameter server as the target local sample group; determining a second covariance value of the plurality of first gradient parameters and the plurality of second gradient parameters; determining a third label of each target test sample in the gradient dimension according to the second covariance value; determining an operation result of a preset operation of the second label and the third label of each target test sample as a first label of each target test sample.

6. The method of claim 5, wherein, The operation rule of the preset operation includes: if the second label and the third label are the same, the operation result of the preset operation of the second label and the third label is the third label; if the second label and the third label are different, the operation result of the preset operation of the second label and the third label is the second label.

7. The method of claim 1, wherein, The method further includes: determining a plurality of target test samples corresponding to each parameter server, and obtaining a shadow model of the target test sample to obtain a plurality of shadow models; determining a plurality of members belonging to a trust domain according to the plurality of shadow models.

8. The method of claim 7, wherein, Determining a plurality of members belonging to a trust domain according to the plurality of shadow models includes: classifying the plurality of target test samples by any two shadow models in the plurality of shadow models to obtain a classification result, wherein the classification result includes a first classification result of one of the any two shadow models on the plurality of target test samples, and a second classification result of the other of the any two shadow models on the plurality of target test samples; wherein classifying the plurality of target test samples by any two shadow models in the plurality of shadow models includes classifying two target test samples corresponding to the any two shadow models by the any two shadow models; determining a plurality of Land coefficients of each shadow model in the plurality of shadow models according to the first classification result and the second classification result to obtain a plurality of Land coefficients; determining a plurality of difference values of any two Land coefficients in the plurality of Land coefficients; determining a plurality of target difference values from the plurality of difference values, and determining a plurality of target Land coefficients corresponding to the plurality of target difference values, and a plurality of target shadow models corresponding to the plurality of target Land coefficients, wherein the target difference value is a difference value greater than a preset value; attributing the members corresponding to the plurality of target shadow models to the same trust domain.

9. The method of claim 8, wherein, Determining a plurality of Land coefficients of each shadow model in the plurality of shadow models according to the first classification result and the second classification result includes: determining a first number of first target classification results, wherein the first target classification result is that the first classification result indicates that the plurality of target test samples belong to the same class of samples and the second classification result indicates that the plurality of target test samples belong to the same class of samples; determining a second number of second target classification results, wherein the second target classification result is that the first classification result indicates that the plurality of target test samples do not belong to the same class of samples and the second classification result indicates that the plurality of target test samples belong to the same class of samples, or the first classification result indicates that the plurality of target test samples belong to the same class of samples and the second classification result indicates that the plurality of target test samples do not belong to the same class of samples; determining a third number of third target classification results, wherein the third target classification result is that the first classification result indicates that the plurality of target test samples do not belong to the same class of samples and the second classification result indicates that the plurality of target test samples do not belong to the same class of samples; determining a first sum of the first number and the third number, and determining a second sum of the first number and the second number and the third number; determining a ratio of the first sum and the second sum as the Land coefficient of each shadow model.

10. A device for preventing member reasoning attacks, characterized in that, comprising: an acquisition module, configured to acquire a plurality of local samples and a plurality of target test samples, wherein the plurality of local samples are generated locally by a plurality of members in federated learning, the plurality of local samples are stored locally on a corresponding member, and the plurality of target test samples are copies of a plurality of test samples, which are sent by a parameter server in federated learning; a determination module, configured to determine a first label of each target test sample in the plurality of target test samples, to obtain a plurality of first labels, wherein the first label is used to indicate a classification result of the target test sample, and the classification result is determined according to a similarity between a local sample and a test sample; a generation module, configured to acquire a federated learning model stored locally on the member, and generate shared parameters shared by other members and an attack model according to the plurality of first labels, the plurality of target test samples, and the federated learning model, wherein the other members are a plurality of members in the federated learning except for a member corresponding to the federated learning model; a sending module, configured to send the shared parameters to the attack model.

11. A non-volatile storage medium, comprising: The non-volatile storage medium stores a computer program, wherein a device in which the non-volatile storage medium is located executes the member inference attack prevention method of any one of claims 1 to 9 by running the computer program.

12. An electronic device comprising a memory and a processor, characterized in that The memory stores a computer program, and the processor is configured to execute the member inference attack prevention method of any one of claims 1 to 9 by running the computer program.

Images