A membership inference attack method for federated learning

Abstract

The present invention discloses a member inference attack method for federated learning. Through the information of multiple training rounds of the model in the training process, the model parameter change pattern is observed, the utilization of the longitudinal information in the training process is fully strengthened, and the attack is completed through the deviation parameters of the last layer. At the same time, local attacks and global attacks are designed for the two models in the federated learning system to evaluate the privacy leakage risk of federated learning. For local attacks, the difference between member data and non-member data is fully learned based on the neural network to achieve the distinction between member and non-member data. For global attacks, the source of member data is inferred based on fine-grained difference comparison. In addition, the present invention performs attacks without interfering with model training, and there is no risk of being detected by the system. The deviation change difference between member data and non-member data is enhanced through feature amplification operations, and a stronger attack effect is achieved with fewer parameters. The method is highly efficient.

Description

Technical Field

[0001] The present invention relates to the field of machine learning technology, and in particular to a member reasoning attack method for federated learning. Background Art

[0002] In recent years, thanks to continuous breakthroughs in computing device capabilities, deep learning has been widely applied in fields such as data mining, computer vision, and natural language processing, providing users with a variety of intelligent and convenient services. While these intelligent services provide convenience, they also increase the risk of data privacy leaks. With the increasing number of privacy leaks, users are increasingly concerned about protecting their personal data privacy.

[0003] To protect the privacy of endpoint data, federated learning has been proposed as a way to conduct efficient machine learning across multiple participants or computing nodes. Federated learning systems do not require direct sharing of personal data and offer advantages such as high data privacy, efficient model training, and low communication overhead. Federated learning has become a popular research topic in scenarios such as the transmission of massive amounts of data and the deployment of large numbers of heterogeneous distributed devices. However, as research into federated learning systems deepens, researchers have discovered that it is vulnerable to various inference attacks, as adversaries can reveal each participant's training data based on the parameters uploaded to the aggregator.

[0004] At present, reasoning attacks on federated learning models mainly include membership reasoning attacks, attribute reasoning attacks, and model inversion attacks. In attribute reasoning attacks, the attacker's goal is to infer the attributes and statistical laws of the data set based on the model. In model inversion attacks, the attacker's goal is to use the output of the model to train and construct a malicious model, thereby recovering the user's private training data. However, in membership reasoning attacks, the attacker's goal is to infer whether a specific data record exists in the training set. Compared with the first two types of attacks, membership reasoning attacks more intuitively expose the degree of privacy leakage of training data. For example, if a user's data is used for a hospital's disease analysis training, it will reveal that the user has suffered from a certain disease. In a federated learning environment, multiple hospitals jointly analyze data, and the attacker can further infer which hospital the person has visited, seriously infringing on the user's privacy. Therefore, the present invention mainly studies the membership reasoning attack method for federated learning.

[0005] In a machine learning classification task, the target model uses a set of labeled data sets to train the model. The data is input into the trained target model, and the model calculates and outputs the probability value of the sample belonging to each category. These probability vectors are called confidence. The category with the highest confidence value in the probability vector is selected as the predicted label of the sample. The performance of the model is evaluated by testing the performance of the model on the test data set. For the membership inference attack model, the following assumptions are made: the attacker can access and query the target model, input a data sample, and obtain the output prediction vector of the target model for the data sample. Depending on the access rights to the target model, membership inference attacks are divided into two types: (1) the attacker can only obtain the output probability vector of the target model for a given input, but cannot obtain the specific structure or parameter values ​​of the model, which is called a black-box membership inference attack; (2) the attacker has access to the model structure and specific model parameters of the target model, which is called a white-box membership inference attack.

[0006] In a black-box membership inference attack, the attacker constructs multiple shadow models to better mimic the characteristics of the target model in order to obtain a better attack model. Shadow models are trained using datasets with the same distribution as the target model, allowing the attacker to know which data was used to train the shadow models. The attacker labels the outputs of the shadow models as "in" or "out" based on whether they were present in the shadow model's training dataset, generating a set of labeled data for training the attack model. This data is then trained in a supervised manner to generate an attack model that can determine whether a data record was used to train the target model. Other methods use thresholds, such as prediction accuracy and information entropy, to distinguish between members and non-members. In black-box membership inference attacks, the attacker is external to the system, and the available model parameters are limited to output vectors, prediction confidence, and loss. However, in federated learning, the initiator may be an insider with greater knowledge of the system, such as a specific participant or a central aggregator. Therefore, the parameters available for attack include not only the final model output but also various internal parameters during the training process. The threat of an insider poses a greater risk of information leakage.

[0007] In federated learning scenarios, attacks can be initiated by internal participants or central aggregators. White-box access to the target model by internal attackers is realistic. In a white-box membership inference attack, the attacker can obtain not only all final model outputs but also various internal parameters during model training, including intermediate layer outputs, model weights, model biases, and model gradients, enabling a more powerful membership inference attack. Furthermore, in federated learning, the central aggregator can obtain local model parameters from all participants. Membership inference attacks can be further refined into source inference attacks, which infer the source of the data.

[0008] Previous methods for membership inference attacks against federated learning (Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP). IEEE, 739–753) have incorporated model parameters from multiple training rounds into deep learning network training to perform membership inference. However, attacking a single training round cannot fully exploit the changing patterns of model parameters during training. Furthermore, this method exploits all intermediate outputs and weight parameters during model training. While fully utilizing these intermediate parameters, it also incurs significant overhead. Current methods for source inference attacks in federated learning (Georg Pichler, Marco Romanelli, Leonardo Rey Vega, and Pablo Piantanida. 2022. Perfectly Accurate Membership Inference by a Dishonest Central Server in Federated Learning. arXiv preprint arXiv:2203.16463(2022)) use a malicious central aggregator to perform the attack by maliciously modifying gradient parameters. Although this method is effective, it can severely affect model training results and is extremely easy to detect. Summary of the Invention

[0009] In order to reduce overhead and avoid being discovered by the detection system, this paper proposes a membership inference attack method for federated learning, which measures the privacy risk of the federated learning model without affecting model training.

[0010] In order to achieve the above object, the present invention provides the following technical solutions:

[0011] The present invention provides a member reasoning attack method for federated learning, comprising the following steps:

[0012] S1. Define the following attack function:

[0013] D target :Z=(x,y)

[0014]

[0015] Among them, D target is an uncertain dataset similar to the target model training dataset, z is the target data owned by the attacker, x is the input vector, and y is the data label of the target classification task; F is the attack function, if F(z) = 0, it means that the data record is not used for model training, if F(z) = 1, it means that the data record is part of the target model training set;

[0016] y=W i *x i +b i

[0017] Among them, W i represents the weight of the i-th layer neural network, b i represents the model bias, which characterizes the average distance between the model output and the true label of the data;

[0018] S2. For a local attack scenario initiated by a certain participant, we infer whether the target data exists in the entire target training set by learning the deviation changes between multiple training rounds of the model. For participant i, the inference attack is expressed as follows:

[0019] z∈{D non}or{D train}→F(z)∈{0,1}

[0020] Among them, D train is all the training sets in federated learning, D non Including the test set and other data that are not in the training set; the attacker uses the attack function F to determine whether the data point z is in the training set;

[0021] S3. For the global attack scenario initiated by the central aggregator, the source of the target data is inferred through difference comparison. The member source inference attack launched by the global attacker is defined as follows:

[0022] z∈{D1}or{D2}or...or{D n}→F(z)∈{1,2,...,n}

[0023] Assume there are n participants in the model, D1, D2, ..., D n Representing the local dataset of each participant, the global attacker infers the source of the target data based on the attack function F.

[0024] Furthermore, the process of reasoning about the attack in step S2 for the local attack scenario includes:

[0025] S21. Attack signature construction: Obtain the model bias of the last layer of the neural network, use multiple training rounds to calculate the deviation change, subtract the deviation change values ​​in all adjacent training rounds to obtain the variable value, and horizontally concatenate all variable values ​​to obtain the attack vector;

[0026] S22, attack feature amplification: an exponential function with the natural constant e as the base is used to amplify the sample's features;

[0027] S23. Attack model training: The local attacker uses the local data he has to train the attack model. The attack model consists of multiple conv-relu-pool modules and linear-relu modules, and finally outputs the classification probability through the softmax layer.

[0028] Furthermore, the specific process of constructing the attack signature in step S21 includes:

[0029] In all selected training rounds, the local attacker obtains the global model parameters from the central aggregator and obtains the global model according to the global parameters Repeat this step to obtain all global models required for the attack As shown below:

[0030]

[0031] Where k represents the number of global models selected for attack, Represents the global model of the i-th training round; for each data record, it is input into all global models Obtain the change value of the model bias Δbias, and obtain the difference between the obtained model bias change values ​​in adjacent training rounds to obtain Δbias s , as shown below:

[0032]

[0033] Finally, all the variable values ​​of Δbias are horizontally connected to obtain the attack vector V local, as shown below:

[0034]

[0035] Furthermore, the calculation method of attack feature amplification in step S22 is as follows:

[0036]

[0037] Where Δb i is the bias change Δbias s The features in , m is the magnification factor.

[0038] Furthermore, the specific process of attack model training in step S23 includes:

[0039] For all data in the training set, input them into all saved global models in turn Calculate the attack vector V for each data local , then Add attack dataset D attack ;

[0040] For all data in the test set, input them into all saved global models in turn Calculate the attack vector V for each data local , then Add attack dataset D attack ;

[0041] Finally, the neural network is constructed and attacked by the dataset D attack Perform training to obtain the attack model M attack , using the attack dataset D attack Perform target data source inference in step S3.

[0042] Furthermore, the process of reasoning the attack for the global attack scenario in step S3 includes:

[0043] S31. Attack signature construction: Obtain the model bias of the last layer of the neural network. Use multiple training rounds to calculate the deviation change of each data record on each participant's local model. Vertically concatenate all deviation changes to obtain the attack vector, so that deviation changes in the same training round are placed in the same row of the attack vector.

[0044] S32, attack feature amplification: an exponential function with the natural constant e as the base is used to amplify the sample's features;

[0045] S33, fine-grained difference comparison: The model deviation difference corresponding to each node is compared as a separate input, and the model deviation differences are merged to determine the membership by comparing the model deviation differences of different local models.

[0046] Furthermore, the specific process of constructing the attack signature in step S31 includes:

[0047] In all selected training rounds, the global attacker obtains the parameters submitted by the local participants and calculates these parameters to obtain the local model Repeat this operation to obtain all local models of participant i As shown below:

[0048]

[0049] Where k represents the number of attack training rounds selected by the global attacker;

[0050] Then, we get all the local models needed for the global attack. As shown below:

[0051]

[0052] Where n represents the number of participants;

[0053] For each data record x, Get the local model M of x at each participant local Model bias change Δbias on l , and finally all changes Δbias l Vertical connections are made so that the deviation changes in the same training round are in the same row of the attack vector.

[0054] Furthermore, the attack vector constructed in step S31 is represented as follows:

[0055]

[0056] in, The model deviation change obtained by participant i in the selected training round j is used to generate an attack vector for each target data and used for the fine-grained difference comparison in step S32.

[0057] Furthermore, the calculation method of the amplification attack feature in step S32 is as follows:

[0058]

[0059] Where Δb i represent Each of the yes The nth element of , m is the magnification factor.

[0060] Furthermore, the process of fine-grained difference comparison in step S33 includes:

[0061] For a target data x, classify x as the data with the minimum model bias change Δbias i The party that is represented as follows:

[0062] S i ={i|Δbias i =min{Δbias1,Δbias2,...,Δbias n}}

[0063] Among them S i Represents the source of target data;

[0064] Calculate the source of the extreme value of the model deviation of each node, expressed as N i , the global reasoning formula is expressed as follows:

[0065] S i ={i|N i =max{N1, N2, ..., N n}}

[0066] By comparing each item in the model deviation sequence and counting the number of the maximum model deviations that appear in each participant, the participant with the largest number of model deviations is the source of the target data.

[0067] Compared with the prior art, the present invention has the following beneficial effects:

[0068] The member inference attack method for federated learning proposed in the present invention observes the change pattern of model parameters through multiple training rounds of information of the model during the training process, fully strengthens the utilization of longitudinal information in the training process, and completes the attack through the deviation parameters of the last layer. At the same time, the present invention designs two types of attacks for the two models in the federated learning system: local attacks and global attacks, in order to evaluate the privacy leakage risk of federated learning. For local attacks, the differences between member data and non-member data are fully learned based on the neural network to achieve the distinction between member and non-member data. For global attacks, the source of member data is inferred based on fine-grained difference comparison. In addition, the present invention performs attacks without interfering with model training, and there is no risk of being detected by the system. The deviation change difference between member data and non-member data is enhanced through feature amplification operations, and a stronger attack effect is achieved with fewer parameters. The method is highly efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0070] Figure 1 This embodiment of the present invention provides a member reasoning attack scenario for federated learning.

[0071] Figure 2 This is a local reasoning attack model provided by an embodiment of the present invention.

[0072] Figure 3 This is a global membership inference attack model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0073] To reduce overhead while avoiding the risk of detection by detection systems, this paper proposes a membership inference attack method based on model bias. This method measures the privacy risk of federated learning models without affecting model training. Weights and bias are two important parameters in neural networks. Weights determine the direction of the decision surface, while bias determines the distance along that direction. In other words, bias is the average distance between the predicted probability of a dataset and the ground truth label. Compared to weights, bias is much smaller in data.

[0074] In the attack model, the attacker is assumed to be honest but curious, making inferences based solely on the information obtained, without risk of detection. During training, the model is trained for multiple rounds, and the deviation change between each round is calculated. The attack is then carried out based on the difference in deviation change. Each data record in the training set affects many model parameters through training and backpropagation. During training, the model is optimized to minimize the difference between the training set and the actual output. When samples outside the training set are input to the model, the model will discover "unprecedented" data samples, which will significantly change the model parameters and lead to large deviations. Therefore, each non-training sample will leave a pattern of variation in the model deviation that is different from the training samples.

[0075] In a federated learning framework, two types of models are involved: local and global. Therefore, two types of attacks are considered: local and global, with the attackers being participants and a central aggregator, respectively. This paper designs a deep learning-based attack model for local attackers. By learning the deviations between the model's training rounds, it infers whether the target data exists in the entire training set. The central aggregator, which has access to local models from all parties, considers a global attack model based on difference comparison to infer that the data belongs to a specific participant.

[0076] To better understand the present technical solution, the following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solution in the embodiments of the present invention. Obviously, the examples described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field based on this application fall within the scope of protection of the present invention.

[0077] 1. Federated Learning Member Inference Attack Scenario

[0078] Machine learning is a statistically based modeling technique that relies on large amounts of data to ensure performance, inevitably raising data security concerns. To reduce the risk of data leakage, researchers have proposed federated learning. In federated learning, multiple participants interact to train a machine learning model. Participant data is stored locally, and the training process only involves the transmission of gradients or model parameters. This is very effective in protecting the privacy of sensitive data.

[0079] This paper considers a federated learning scenario involving a central aggregator and N participants. These participants collaborate to train a deep learning network, sharing the same model architecture. The central aggregator initializes model parameters and distributes them to each participant. Each participant then trains a local model on its own local dataset using backpropagation. After each training epoch, the participant sends the model parameters or gradients to the central aggregator, which then updates the model based on the received parameters. This training process is repeated until the model converges.

[0080] Membership inference attacks pose a serious threat to the privacy of federated learning models, which aim to determine whether a data record belongs to the training dataset of the target model.

[0081] The member reasoning attack method for federated learning proposed in this invention first defines the following attack function:

[0082] D target :Z=(x,y)

[0083]

[0084] Among them, D target It is an uncertain data set similar to the target model training data set, z is the target data owned by the attacker, x is the input vector, and y is the data label of the target classification task; F is the attack function. If F(z) = 0, it means that the data record is not used for model training. If F(z) = 1, it means that the data record is part of the target model training set.

[0085] In federated learning, this paper considers two internal attack scenarios: Figure 1As shown in Figure 2, one is a local attack scenario, that is, an attack initiated by a certain participant, and the other is a global attack scenario, that is, an attack initiated by a central aggregator. In either case, the attacker is performing a white-box attack, that is, the attacker knows the entire model structure and related parameters.

[0086] For a local attacker in federated learning, it can obtain the global model issued by the central aggregator, and thus infer membership from the entire training set. For participant i, its inference attack can be expressed as follows:

[0087] z∈{D non}or{D train}→F(z)∈{0,1}

[0088] Among them, D train is all the training sets in federated learning, D non Including the test set and other data that are not in the training set. The attacker uses the attack function F to determine whether the data point z is in the training set.

[0089] A global attacker can not only obtain the global model, but also the local model of each participant. Therefore, as an extension of the local attack, the global attack can further infer which participant the data comes from. The member provenance inference attack launched by the global attacker is defined as follows:

[0090] z∈{D1}or{D2}or...or{D n}→F(z)∈{1,2,...,n}

[0091] Assume there are n participants in the model, D1, D2, ..., D n Representing the local dataset of each participant, the global attacker infers the data source based on the attack function F.

[0092] The goal of this paper is to launch membership inference attacks in federated learning and measure unintentional data privacy leakage. The federated learning model is based on neural networks, where the formula of artificial neurons can be expressed as:

[0093] y=W i *x i +b i

[0094] Among them, W i Represents the weight of the i-th layer neural network (Weight), b i Represents the model bias. W i and b i Both are important parameters of the neural network. According to the gradient descent algorithm, the loss function derives these two parameters respectively to achieve the update of the network.

[0095] In previous methods, only the weight parameter W i By calculating the gradient The loss value is used to perform membership inference, which leads to huge overhead due to the large number of parameters. However, bias is also an important parameter, which makes the model more flexible to adapt to the data distribution. Bias characterizes the average distance between the model output and the true label of the data. Without bias, all segmentation lines will pass through the origin, which is unrealistic. In neural networks, the bias parameter is for the entire data and is much smaller in magnitude than the weight. Therefore, the present invention proposes an efficient membership inference attack method based on bias, and considers two attack methods: local attack and global attack under the federated learning framework.

[0096] 2. Local Membership Inference Attack

[0097] This paper proposes a membership inference attack against local attackers. In the local attack, we consider an honest but curious participant as the local attacker, who performs a passive membership inference attack without disrupting the model's training process.

[0098] The local attacker obtains the parameters of the global model before each training epoch and completes the training locally with its own data. The local attacker and the central aggregator have the same model structure, so the local attacker can obtain the current global model and master various internal parameters. The local attacker can save multiple epochs of the global model and distinguish members from non-members by observing the difference in deviations. The structure of the inference model is as follows Figure 2 The attack process consists of three steps: attack feature construction, attack feature amplification, and attack model training.

[0099] 2.1 Attack Signature Construction

[0100] Given that the last layer contains more information about specific points in the training set, we focus on the bias of the last layer, use multiple epochs to calculate the bias change, and combine to determine the membership. In all selected epochs, the local attacker obtains the global model parameters from the central aggregator and obtains the global model based on the global parameters. Repeat the above steps to obtain all global models required for the attack As shown below:

[0101]

[0102] Where k represents the number of global models selected for attack, Represents the global model of the i-th epoch. For each data record, it is input into all global models To fully capture the variation of bias during training, we subtract the obtained bias variation values ​​in adjacent epochs to obtain Δbias. s :

[0103]

[0104] Finally, the attack vector V local is a horizontal connection between all variable values ​​of Δbias, as follows:

[0105]

[0106] 2.2 Attack Signature Amplification

[0107] In the actual model training process, there is a serious problem with bias-based reasoning attacks: the order of magnitude of the bias change is very small. Therefore, the order of magnitude of all samples is very small, which makes the classifier unable to learn the distinguishable features between members and non-members well. In order to solve this problem, the present invention designs a new method to amplify the differences between feature items. The number of biases in the last layer is the same as the number of final classifications. Each member data record may not affect all biases, but only a part of them. Therefore, the bias change matrix is ​​relatively sparse, and it is necessary to capture the change law of its non-zero items. In the process of feature amplification, it is necessary to ensure that (1) the zero elements in the matrix remain zero after conversion, and (2) the difference of non-zero elements is as large as possible. Therefore, the present invention proposes a feature amplification method based on an exponential function, that is, an exponential function with the natural constant e as the base to amplify the features of the sample. The calculation method is as follows:

[0108]

[0109] Where Δb i is the bias change Δbias s The features in m are magnification coefficients. This method amplifies the sample features through the explosive growth of the exponential function and ensures that the value of element 0 remains unchanged after the transformation. The processed Δbias s Lateral connections are made to the attack model for training.

[0110] 2.3 Attack Model Training

[0111] The attack model consists of multiple conv-relu-pool modules and linear-relu modules, and finally outputs the classification probability through the softmax layer. The local attacker uses the local data he has to train the attack model. For all the data in the training set, it is sequentially input into all the saved global models. Calculate the attack vector V for each data local, then Add attack dataset D attack For all the data in the test set, the processing method is similar to that of the training set data, and then Join D attack Finally, the neural network is constructed and passed through D attack Perform training to obtain the attack model M attack , using D attack Perform subsequent membership inference on the target data record.

[0112] 3. Global Membership Inference Attack

[0113] Similar to the local inference attack, consider an honest but curious central aggregator as a global attacker. The global attacker has more prior knowledge and can further infer that the data comes from a certain participant based on the local attack. In this global membership inference attack, the focus is on the member source inference attack initiated by the global attacker. After training each epoch, the global attacker obtains local parameters from each participant and performs aggregation operations on all local parameters to update the global model. The global attacker saves local models for multiple epochs and determines which participant the data comes from by comparing the bias differences of different local models. Similarly, the global attack considers the bias changes of the last layer and uses models of multiple epochs to determine the source of members. The global attack classifies the data records to be tested to the participant with the smallest bias change. The structure of the global attack is shown in Figure 3 The process of global membership inference attack includes attack feature construction and difference comparison.

[0114] 3.1 Attack Signature Construction

[0115] In all selected epochs, the global attacker obtains the parameters submitted by the local participants and calculates these parameters to obtain the local model Repeat the above operation to obtain all local models of participant i As shown below:

[0116]

[0117] Among them, k represents the number of attack epochs selected by the global attacker. Finally, all the local models required for the global attack are obtained As shown below:

[0118]

[0119] Where n represents the number of participants. For each data record x, Get the local model M of x at each participant localBias change Δbias l Then all Δbias l Perform vertical connections so that the deviation changes in the same epoch are in the same row of the attack vector. The constructed attack vector is expressed as follows:

[0120]

[0121] in, Represents the bias change obtained by participant i on the selected epoch j, generates an attack vector for each target data, and is used for fine-grained difference comparison.

[0122] Fine-grained difference comparison. Since the bias of the last layer is used, a string of Δbias is obtained, whose length is equal to the number of nodes in the last layer. The bias difference corresponding to each node is compared as a separate input and merged to determine the membership. For a target data x, x is classified as having the smallest Δbias. i The party that is represented as follows:

[0123] S i ={i|i={i|Δbias i =min{Δbias1,Δbias2,…,Δbias n}}

[0124] Among them S i Represents the source of the target data. Similar to local attacks, first amplify the sample features. The calculation method is as follows:

[0125]

[0126] Where Δb i represent Each of the yes The nth element of , m is the amplification factor. A data record will only affect a portion of the nodes in the model, so after the above operation, the node with a large bias change will greatly increase the difference with other nodes. Therefore, the source of the extreme value of bias of each node is calculated, expressed as N i , the global reasoning formula can be expressed in detail as:

[0127] S i ={i|N i =max{N1, N2, ..., N n}}

[0128] By comparing each item in the bias sequence and calculating the maximum number of biases that appear in each participant, the participant with the most appearances is the source of the target data, thus completing the global membership inference attack.

[0129] In summary, the present invention addresses the existence of two models in federated learning: the local model and the global model. Considering malicious adversaries within these two models, namely malicious participants and malicious central aggregators, local membership inference attacks and global membership inference attacks are designed for these two models, respectively. Malicious participants can only access the global model from the central aggregator. Using the global model across multiple communication rounds, they can infer member data information from other participants. The malicious central aggregator can obtain not only the global model across all communication rounds but also the local model from each participant, allowing it to further infer the specific source of the data. Furthermore, the present invention fully utilizes information from multiple communication rounds during model training, executing a membership inference attack by exploiting the differences in model bias parameters during training. In this method, the membership inference attacker does not affect the original model training process; only the intermediate results are saved to complete the attack, eliminating the risk of system detection. Furthermore, when selecting attack parameters, this method only uses the bias parameters of the last layer of the model for attack. Feature amplification is used to amplify the differences in parameter changes between members and non-members. This significantly reduces the number of parameters compared to other methods that use weight parameters, improving attack accuracy while reducing time overhead.

[0130] The foregoing description is merely a detailed description of the preferred embodiments and principles of the present invention and is not intended to limit the scope of protection of the present invention. For those skilled in the art, any modifications, equivalent substitutions, improvements, etc. made based on the ideas provided by the present invention and within the spirit and principles of the present invention should be considered to be within the scope of protection of the present invention.

Claims

1. A membership inference attack method for federated learning, characterized by: The following steps are involved: S1. Define the following attack function: D target :z=(x,y) Among them, D target is an uncertain dataset similar to the target model training dataset, z is the target data owned by the attacker, x is the input vector, and y is the data label of the target classification task; F is the attack function, if F(z) = 0, it means that the target data is not used for model training, if F(z) = 1, it means that the target data is part of the target model training set; y=W i *x i +b i Among them, W i represents the weight of the i-th layer neural network of the target model, b i represents the model bias, which characterizes the average distance between the model output and the true label of the data; S2. For a local attack scenario initiated by a participant, we infer whether the target data exists in the entire target training set by learning the deviation changes between multiple training rounds of the target model. For participant i, the inference attack is expressed as follows: z∈{D non }or{D train }→F(z)∈{0,1} Among them, D train is all the training sets in federated learning, D non Including the test set and other data that are not in the training set; the attacker uses the attack function F to determine whether the target data point z is in the training set; Step S2: The process of reasoning about the attack in a local attack scenario includes: S21. Attack signature construction: Obtain the model bias of the last layer of the target model's neural network. Use multiple training rounds to calculate the bias change. Subtract the bias change values ​​in all adjacent training rounds to obtain the variable value. Horizontally concatenate all variable values ​​to obtain the attack vector. S22, attack feature amplification: an exponential function with the natural constant e as the base is used to amplify the sample's features; S23, attack model training: The local attacker uses the local data he has to train the attack model. The attack model consists of multiple conv-relu-pool modules and linear-relu modules, and finally outputs the classification probability through the softmax layer; S3. For the global attack scenario initiated by the central aggregator, the source of the target data is inferred through difference comparison. The member source inference attack launched by the global attacker is defined as follows: z∈{D1}or{D2}or…or{D n }→F(z)∈{1,2,…,n} Assume that there are n participants in the target model, D1, D2, ..., D n Representing each participant’s local dataset, the global attacker infers the source of the target data based on the attack function F; Step S3: The process of reasoning about the attack on the global attack scenario includes: S31. Attack signature construction: Obtain the model bias of the last layer of the target model's neural network. Use multiple training rounds to calculate the deviation change of each target data point on each participant's local model. Vertically concatenate all deviation changes to obtain an attack vector, ensuring that deviation changes from the same training round are in the same row of the attack vector. S32, attack feature amplification: an exponential function with the natural constant e as the base is used to amplify the sample's features; S33, fine-grained difference comparison: The target model deviation difference corresponding to each node is compared as a separate input, and the target model deviation differences are merged to determine the membership by comparing the model deviation differences of different local models.

2. The member reasoning attack method for federated learning according to claim 1 is characterized in that: The specific process of constructing the attack signature in step S21 includes: In all selected training rounds, the local attacker obtains the global model parameters from the central aggregator and obtains the global model according to the global model parameters. Repeat this step to obtain all global models required for the attack As shown below: Where k represents the number of global models selected for attack, Represents the global model of the i-th training round; for each target data, it is input into all global models Obtain the change value of the model bias Δbias, and obtain the difference between the obtained model bias change values ​​in adjacent training rounds to obtain Δbias s , as shown below: Finally, all the variable values ​​of Δbias are horizontally connected to obtain the attack vector V local , as shown below:

3. The member reasoning attack method for federated learning according to claim 2 is characterized in that: The calculation method of attack feature amplification in step S22 is as follows: Where Δb i is the bias change Δbias s The features in , m is the magnification factor.

4. The member reasoning attack method for federated learning according to claim 3 is characterized in that: The specific process of attack model training in step S23 includes: For all data in the training set, input them into all saved global models in turn Calculate the attack vector V for each data local , then Add attack dataset D attack ; For all data in the test set, input them into all saved global models in turn Calculate the attack vector V for each data local , then Add attack dataset D attack ; Finally, the attack model neural network is constructed and the attack dataset D is used to attack Perform training to obtain the attack model M attack , using the attack dataset D attack Perform target data source inference in step S3.

5. The member reasoning attack method for federated learning according to claim 1 is characterized in that: The specific process of constructing the attack signature in step S31 includes: In all selected training rounds, the global attacker obtains the parameters submitted by the local participants and calculates these parameters to obtain the local model Repeat this operation to obtain all local models of participant i As shown below: Where k represents the number of attack training rounds selected by the global attacker; Then, we get all the local models needed for the global attack. As shown below: Where n represents the number of participants; For each target data x, Get the local model M of x at each participant local Model bias change Δbias on l , and finally all changes Δbias l Vertical connections are made so that the deviation changes in the same training round are in the same row of the attack vector.

6. The member reasoning attack method for federated learning according to claim 5 is characterized in that: The attack vector constructed in step S31 is represented as follows: in, The model deviation change obtained by participant i in the selected training round j is used to generate an attack vector for each target data and used for the fine-grained difference comparison in step S32.

7. The member reasoning attack method for federated learning according to claim 6 is characterized in that: The calculation method of the amplification attack feature in step S32 is as follows: Where Δb i represent Each of the yes The nth element of , m is the magnification factor.

8. The member reasoning attack method for federated learning according to claim 7, characterized in that: The process of fine-grained difference comparison in step S33 includes: For a target data x, classify x as the data with the minimum model bias change Δbias i The party that is represented as follows: S i ={i∣Δbias i =min{Δbias1,Δbias2,…,Δbias n }} Among them S i Represents the source of target data; Calculate the source of the extreme value of the model deviation of each node, expressed as N i , the global reasoning formula is expressed as follows: S i ={i∣N i =max{N1,N2,…,N n }} By comparing each item in the model deviation sequence and counting the number of the maximum model deviations that appear in each participant, the participant with the largest number of model deviations is the source of the target data.

Images