A federated learning backdoor attack method based on global model reverse technology

Abstract

The application discloses a federated learning backdoor attack method based on global model reverse technology, and proposes a global model reverse technology-based federated learning backdoor attack method for injecting a backdoor behavior into a global model under the premise that a server of the federated learning cannot access any real training data. First, a global model reverse algorithm is used on the global model updated through aggregation to obtain a virtual data set. Then, a part of data in the virtual data set is randomly selected for poisoning, and the poisoned data is mixed with unpoisoned data to obtain a poisoned virtual data set. Finally, the model is retrained using the poisoned virtual data set to obtain a global model with a backdoor. The method of the application supplements the existing backdoor attack methods for the federated learning, supplements the backdoor attack methods for the federated learning initiated by a malicious server, reveals a new security threat in the federated learning, and thus achieves the purpose of damaging the model integrity in the federated learning.

Description

Technical Field

[0001] This invention relates to the field of federated learning security in the computer field, and in particular to a method for attacking backdoors in federated learning based on global model reverse engineering technology. Background Technology

[0002] Federated learning is an emerging distributed machine learning framework designed to solve the model training problem in scenarios with distributed data. The core technologies of federated learning include model aggregation and model updating. Model aggregation refers to merging the model parameters uploaded from all devices to form a global model. Model updating involves training the model on each device and then uploading the local model parameters to a central server for aggregation. Traditional distributed machine learning model training requires all data to be centralized on a central server, which presents problems such as privacy leaks and difficulties in data sharing. Federated learning, on the other hand, distributes model training across multiple devices and only uploads local model update parameters to the central server, avoiding the centralization of private data and privacy leaks. This results in better privacy protection and data security, and based on this, federated learning is now widely used in various fields, such as healthcare, finance, and the Internet of Things (IoT).

[0003] However, due to the distributed nature of federated learning, the local training dataset and training process cannot be viewed. Therefore, while federated learning boasts powerful performance, it is also vulnerable to Byzantine attacks. Several researchers have proposed that federated learning is susceptible to backdoor attacks from malicious clients. This involves attackers controlling one or more malicious clients to train a backdoored model locally and then injecting the backdoor into the global model by sending updates to the server. The backdoored model will predict the target label set by the attacker for input samples with backdoor triggers, without affecting the prediction accuracy of clean input samples. Therefore, backdoor attacks are often difficult to detect, potentially causing serious consequences in various tasks within federated learning. These attacks pose security vulnerabilities to the federated learning process; therefore, analyzing and researching the security of federated learning is of great significance for its application and development. Summary of the Invention

[0004] The problem to be solved by this invention is to provide a backdoor attack method for federated learning based on global model reverse engineering technology. Without accessing any real dataset, a backdoor global model is trained on the server side. By widely distributing the backdoor global model to all devices participating in federated learning, all devices' models are equipped with a backdoor.

[0005] This invention adopts the following technical solution: a federated learning backdoor attack method based on global model reverse engineering technology, comprising the following steps:

[0006] Step 1: Construction of the virtual dataset after reverse update: On the server side of federated learning, aggregate all local models uploaded by local clients, update the current global model using the federated learning aggregation method to obtain a new global model, and use the global model reverse algorithm on the new global model to obtain a virtual dataset.

[0007] Step 2, Poisoning Virtual Dataset Construction: Select a portion of input samples from the virtual dataset, add the backdoor triggers selected by the attacker to these input samples, and change their labels to the target labels to obtain the poisoned virtual dataset;

[0008] Step 3: Construction of the retrained global model with backdoor: A portion of the new global model is retrained using the poisoned virtual dataset to obtain a global model with backdoor; the server distributes the global model with backdoor to all clients participating in federated learning, so that all clients' local models have backdoors.

[0009] Specifically, in each training round t of federated learning, the current global model is G. t-1 The new global model obtained after aggregation is G. t For the new global model G t After using the global model inverse algorithm, a virtual dataset (x', y') is obtained. This virtual dataset, along with the real dataset (x, y) in the local model, is used to train a new global model G. t The effect is the same.

[0010] Furthermore, the global model inverse algorithm is the GMI algorithm, which includes the following steps:

[0011] Step 1.1: In the first round of federated learning, randomly initialize the input sample x', randomly and uniformly sample from all possible labels of the local model's real dataset, and fix the label y';

[0012] Step 1.2: In the current global model training epoch t, ​​based on x' and y' and the current global model G... t-1 The virtual gradient is calculated by inputting a virtual sample x' into the current global model G. t-1 In the process, the output value is obtained, the loss value between the output value and the label y' is calculated, and the virtual gradient g' is calculated using the following formula:

[0013]

[0014] in, This indicates that the above output value and label y' have undergone the loss function. The calculated loss value The integer notation for partial derivatives indicates that the numerator is the partial derivative of the denominator.

[0015] Step 1.3: Collect the number of data samples S of the m customers selected to participate in this training from all customers, and standardize the local iteration number E and the local mini-batch size B.

[0016] Step 1.4: Calculate the average number of data samples from the above m customers, and then apply the new global model G. t And the current global model G t-1 The average equivalent gradient is calculated using the local iteration count E and the mini-batch size B.

[0017] Step 1.5: Optimize the virtual input x' by minimizing the distance between the virtual gradient and the average equivalent gradient to obtain the virtual dataset (x', y').

[0018] Furthermore, in step 2, the trigger mode Δ and the target label y are selected. Δ A portion of the virtual dataset (x', y') is randomly selected and poisoned to obtain a poisoned virtual dataset, which is then used as the final training dataset. The formula is as follows:

[0019] x′ poi =x′+Δ

[0020] y′ poi =y′+y Δ

[0021] Where, x′ poi and y′ poi These represent the poisoned input data and the poisoned target label, respectively.

[0022] Furthermore, in step 3, the retraining method is as follows: freeze the new global model G. t Some layers or parameters are trained only on a subset of the layers or parameters, resulting in a global model with a backdoor, G. t bd ; G t bd After being sent to all customers participating in federated learning, all customers' local models contain a backdoor.

[0023] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0024] 1. This invention proposes and implements a method for backdoor attacks on federated learning on the server side. Through this method, attackers can perform backdoor attacks on the global model without accessing any real training dataset.

[0025] 2. The global model trained by the federated learning backdoor attack method based on global model inversion technology in this invention can achieve a high attack success rate and has good concealment, while not affecting the prediction accuracy of the global model on clean datasets, making the backdoor global model in federated learning difficult to detect. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the federated learning backdoor attack method based on global model reverse engineering technology of the present invention.

[0027] Figure 2 This is a schematic diagram of the GMI algorithm flow of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the application will be further described in detail below with reference to the accompanying drawings. The described embodiments are only a part of the embodiments involved in this invention. All non-innovative embodiments based on these embodiments by other researchers in the art are within the protection scope of this invention. Furthermore, the step numbers in the embodiments of this invention are only set for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0029] To enable effective backdoor attacks on federated learning without accessing any real training dataset, this invention proposes an attack method based on global model inversion techniques, as follows: Figure 1 As shown, it includes the following steps:

[0030] Step 1: Apply the GMI algorithm (Global Model Inverse Algorithm) to the aggregated and updated global model to obtain a virtual dataset.

[0031] First, on the server side of federated learning, all local models uploaded by local clients are aggregated. These local models are then used to update the current global model using a certain federated learning aggregation method to obtain a new global model. A global model inverse algorithm is then used on the new global model to obtain a virtual dataset. This virtual dataset performs similarly to the local training dataset in training machine learning models.

[0032] In particular, federated learning aggregation methods, including the FedAvg method.

[0033] Step 2: Randomly select a portion of data from the virtual dataset, poison it, and mix it with the unpoisoned data to obtain a poisoned virtual dataset.

[0034] Select a subset of input samples from the virtual dataset, add the attacker's chosen backdoor triggers to these input samples, and change their labels to the target labels. The resulting poisoned virtual dataset is used as the final retraining dataset.

[0035] Step 3: Retrain the model using the poisoned virtual dataset to obtain a global model with a backdoor.

[0036] The poisoned virtual dataset is used to retrain a portion of the new global model, which is then backdoored. The server then distributes the backdoored global model to all clients participating in federated learning, thus making all clients' local models backdoored as well.

[0037] In one embodiment of the present invention,

[0038] First, establish the global model after reverse updating.

[0039] In each round t of federated learning, the current global model is G. t-1 The updated global model is G. t ,

[0040] For the updated global model G t Use such as Figure 2 The GMI algorithm shown produces a virtual dataset (x', y') that has the same effect as the real dataset (x, y) in training the global model.

[0041] like Figure 2 As shown, the GMI algorithm specifically includes the following steps:

[0042] 1. In the first round of federated learning, the input sample x' is randomly initialized, and then random uniform sampling is performed from all possible labels in the dataset and the label y' is fixed.

[0043] 2. Input the virtual sample x' into the current global model G t-1 The output value is obtained, the loss value between the output value and the label y' is calculated, and the virtual gradient g' is calculated using the following formula:

[0044]

[0045] 3. Collect the number of data samples Si (i = 1, 2, ..., m) of the m customers selected to participate in this training from all customers, and standardize the local iteration number E and the local mini-batch size B.

[0046] 4. According to S avg =S i / m calculates the average value S of these data sample sizes. avgAnd based on the updated global model G t And the current global model G t-1 The average equivalent gradient g is calculated using the following formula, along with the local iteration count E and mini-batch size B. eq :

[0047]

[0048] 5. Through Minimize the virtual gradient g' and the average equivalent gradient g eq Optimize by the distance between them, and obtain x'* from the virtual input x', as shown in the following formula:

[0049] x′=x′ * -x′

[0050] 6. By obtaining the optimized virtual input x', we finally obtain a virtual dataset (x',y') that has the same effect as the real training dataset (x,y) in training the global model.

[0051] Then, poison the virtual dataset.

[0052] In this embodiment, a trigger pattern Δ and a target label yΔ are selected, and then a portion of the virtual dataset (x', y') is randomly selected for poisoning:

[0053] x′ poi =x′+Δ

[0054] y′ poi =y′+yΔ

[0055] Obtain the poisoned virtual dataset and use it as the final retraining dataset.

[0056] Finally, a new global model is trained.

[0057] By retraining a portion of the new global model using a poisoned virtual dataset, a global model with a backdoor can be obtained. The trained global model with a backdoor is G. t bd .

[0058] In federated learning, the server will send the backdoor global model G in each round. t bd The message was distributed to all customers, thus all customers participating in federated learning were vulnerable to a backdoor attack.

[0059] The attack effectiveness of the global model is verified using the test set, which mainly includes verification on clean data and verification on poisoned data.

[0060] The success rate of the backdoor global model on poisoned data should be no less than 50%, and the prediction accuracy on the clean test set should be similar to that of the clean model.

[0061] After completing the above steps, the attacker can obtain a global model with a backdoor.

[0062] Furthermore, a federated learning framework is built using PyTorch, and the attack method of this invention is applied within the federated learning framework to perform a backdoor attack on the global model therein.

[0063] First, the method of this invention was tested on three publicly available datasets: the MNIST dataset, the Fashion-MNIST dataset, and the Human Activity Recognition (HAR) dataset. For the MNIST and Fashion-MNIST datasets, convolutional neural networks were used as the global model for testing, while for the HAR dataset, a fully connected neural network was used as the global model for testing.

[0064] Then, the attack success rate and clean data prediction accuracy are used to measure the attack results. For the MNIST dataset, the method of the present invention can achieve an attack success rate of 99.6% and a clean data prediction accuracy of 96.3%; for the Fashion-MNIST dataset, the method of the present invention can achieve an attack success rate of 90.2% and a clean data prediction accuracy of 84.1%; for the HAR dataset, the method of the present invention can achieve an attack success rate of 99.8% and a clean data prediction accuracy of 90.9%.

[0065] Therefore, it can be seen that the method of the present invention is very effective in attacking the global model in federated learning, and still guarantees the prediction accuracy of the global model on clean data, thus proving the stealth of the attack method of the present invention.

[0066] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A federated learning backdoor attack method based on global model reverse engineering, characterized in that, Each round of training in federated learning includes the following steps: Step 1: Construction of the virtual dataset after reverse update: On the server side of federated learning, aggregate all local models uploaded by local clients, update the current global model using the federated learning aggregation method to obtain a new global model, and use the global model reverse algorithm on the new global model to obtain a virtual dataset. The global model inverse algorithm is the GMI algorithm, which includes the following steps: Step 1.1: In the first round of federated learning, randomly initialize the input sample x', randomly and uniformly sample from all possible labels of the local model's real dataset, and fix the label y'; Step 1.2: In the current global model training epoch t, ​​based on x' and y' and the current global model... Calculate the virtual gradient; Step 1.3: Collect the number of data samples S of the m customers selected to participate in this training from all customers, and standardize the local iteration number E and the local mini-batch size B. Step 1.4: Calculate the average number of data samples from the above m customers, and then apply the new global model. and the current global model The average equivalent gradient is calculated using the local iteration count E and the mini-batch size B. Step 1.5: Optimize the virtual input x' by minimizing the distance between the virtual gradient and the average equivalent gradient to obtain the virtual dataset. ; Step 2, Poisoning Virtual Dataset Construction: Select a portion of input samples from the virtual dataset, add the backdoor triggers selected by the attacker to these input samples, and change their labels to the target labels to obtain the poisoned virtual dataset; Select trigger mode and target tags Randomly select virtual dataset A portion of the dataset is poisoned to obtain a poisoned virtual dataset, which is then used as the final training dataset, as shown in the following formula: ； ； in, and These represent the poisoned input data and the poisoned target label, respectively. Step 3: Construction of the retrained global model with backdoor: A portion of the new global model is retrained using the poisoned virtual dataset to obtain a global model with backdoor; the server distributes the global model with backdoor to all clients participating in federated learning, so that all clients' local models have backdoors.

2. The federated learning backdoor attack method based on global model reverse engineering technology according to claim 1, characterized in that, In each training round t of federated learning, the current global model is The new global model obtained after aggregation is For the new global model After using the global model inverse algorithm, a virtual dataset is obtained. The virtual dataset and the real dataset (x, y) in the local model are used to train a new global model. The effect is the same.

3. In the federated learning backdoor attack method based on global model inversion technology according to claim 1, in step 1.2, the virtual gradient calculation method is: inputting virtual sample x' into the current global model. In the process, the output value is obtained, the loss value between the output value and the label y' is calculated, and the virtual gradient is calculated using the following formula. : ； in, This represents the loss value obtained after applying the loss function ℒ(·) to the above output value and the label y'. The integer notation for partial derivatives indicates that the numerator is the partial derivative of the denominator.

4. In the federated learning backdoor attack method based on global model reverse engineering technology according to claim 1, in step 3, the retraining method is: freezing the new global model. Some layers or parameters are trained only on a subset of layers or parameters, resulting in a global model with a backdoor. ;Will After being sent to all customers participating in federated learning, all customers' local models contain a backdoor.

Images