Tag-flipping attack client detection method, global model training method and device

Abstract

This invention discloses a method for detecting clients that launch label-flipping attacks, a global model training method, and an apparatus. This invention uses the average reputation value of the client and the quality value of the training data to detect clients that launch label-flipping attacks. Compared with a single indicator, this reduces the false detection rate of normal clients being misidentified as malicious clients. Furthermore, the average reputation value of the client is calculated based on the reputation value of each round, so even if the training model is continuously iterated, the attack behavior of label-flipping attackers can still be detected.

Description

Technical Field

[0001] This invention relates to a method for detecting client-side tag-flipping attacks, a global model training method, and an apparatus, belonging to the field of network information security and data privacy protection technology. Background Technology

[0002] Federated learning is a popular distributed machine learning method that allows participating data owners to store their original data locally (on the client side) without uploading it to a central server. Furthermore, the interaction between local users and the central server only involves exchanging model parameters or the final computation results. This "data stays put, model moves" interaction model ensures that the central server cannot infer the original data from local users during the learning process, thus meeting data owners' privacy needs and greatly increasing their enthusiasm for participating in machine learning.

[0003] However, precisely because the central server cannot directly access the original data of the trainers in federated learning, it cannot detect malicious clients that may be carrying malicious data. Malicious clients can then participate in the overall training by carrying or tampering with the training data they provide, thereby attacking the overall model training accuracy and causing the final model training result to move closer to the attacker's desired direction. This is a problem that urgently needs to be solved in current federated learning.

[0004] Label flipping attacks are a type of attack that modifies the data in the training samples, causing the overall model training result to be incorrect. Although there have been some advancements in detection methods for label flipping attackers (i.e., label flipping attack clients), in federated learning environments, because the central server does not directly access the original data trained by the client, but rather directly accesses the data trained by the client, existing detection methods have the following drawbacks when applied to federated learning:

[0005] 1) Existing detection methods are carried out in sync with the overall training of federated learning. As the training model iterates, the attack behavior of label flipping attackers will be hidden under the high accuracy of the overall model training and will be difficult to detect.

[0006] 2) Existing detection methods often use a single metric to evaluate the client, which can lead to the misdetection of normal clients as malicious clients, resulting in a decrease in the accuracy and recall of the final trained model. Summary of the Invention

[0007] This invention provides a method for detecting client-side tag-flipping attacks, a global model training method, and an apparatus, which solve the problems disclosed in the background art.

[0008] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0009] Tag-flipping attack client detection methods include:

[0010] The reputation value and quality value of the training data for each round are obtained from the client. The round refers to the round in which the client uses the training data to train the global model. The reputation value is calculated based on the tag recall rate of the global model training. The quality value is calculated based on the prior distribution and posterior distribution of the tags.

[0011] Calculate the client's average reputation score based on the reputation score in each round;

[0012] Detect clients that launch label-flipping attacks based on the client's average reputation score and the quality score of the training data.

[0013] The formula for calculating the reputation score in each round is as follows:

[0014]

[0015] In the formula, Let m be the reputation value of the d-th client in the i-th round, m be the data type, and Num be the number of data types. j Let j be the number of data in the j-th category. This represents the number of successfully identified data points of the j-th category, calculated based on the tag recall rate.

[0016] The formula for calculating the training data quality score is:

[0017]

[0018] In the formula, DQ d Let D be the training data quality value for the d-th client. d Let d be the training data distribution for the d-th client. Indicates that the independent variable x is from D d Mid-sampling, Indicates that the independent variable z is from G w Sampling in (z|y), G w (z|y) is generated by generator G wThe generated latent feature values ​​are y, which is the label sequence during training. Acc(argmaxh(z),argmaxh(f(x))) is a function that calculates the sum of the same elements in argmaxh(z) and argmaxh(f(x)). argmaxh(z) is the prediction of the feature z corresponding to the label based on the global model. argmaxh(f(x)) is the prediction based on the client training data samples.

[0019] Based on the client's average reputation score and the quality score of the training data, detect clients that engage in label-flipping attacks, including:

[0020] Based on the average reputation score of the clients, identify clients whose average reputation score is less than the threshold and add them to the malicious client set S1.

[0021] K-means clustering is performed on the training data quality values ​​of all clients to obtain two clusters of data. Clients with lower quality data in the lower cluster are added to the malicious client set S2.

[0022] Calculate the intersection of the malicious client set S1 and the malicious client set S2 to obtain the clients involved in the label flipping attack.

[0023] A client-side detection device for label-flipping attacks includes:

[0024] The acquisition module retrieves the reputation value and the quality value of the training data for each round from the client. The round refers to the round in which the client trains the global model using the training data. The reputation value is calculated based on the label recall rate of the global model training, and the quality value is calculated based on the prior distribution and posterior distribution of the labels.

[0025] The average reputation score calculation module calculates the client's average reputation score based on the reputation score in each round.

[0026] The detection module detects clients engaging in label-flipping attacks based on the client's average reputation score and the quality score of the training data.

[0027] The detection module is configured as follows:

[0028] Based on the average reputation score of the clients, identify clients whose average reputation score is less than the threshold and add them to the malicious client set S1.

[0029] K-means clustering is performed on the training data quality values ​​of all clients to obtain two clusters of data. Clients with lower quality data in the lower cluster are added to the malicious client set S2.

[0030] Calculate the intersection of the malicious client set S1 and the malicious client set S2 to obtain the clients involved in the label flipping attack.

[0031] Global model training methods include:

[0032] Using the above-mentioned label-flipping attack client detection method, the client performing the label-flipping attack is detected and removed from all clients.

[0033] The remaining clients are used for federated learning global model training.

[0034] A global model training apparatus, comprising:

[0035] The detection and removal module uses the above-mentioned label flip attack client detection method to detect the label flip attack client and remove the label flip attack client from all clients.

[0036] The training module uses the remaining clients to train the global model through federated learning.

[0037] A computer-readable storage medium stores one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform a label-flipping attack client detection method or a global model training method.

[0038] A computer device includes one or more processors and one or more memories, wherein one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, the one or more programs including instructions for performing a label-flipping attack client detection method or a global model training method.

[0039] The beneficial effects achieved by this invention are as follows: This invention uses the average reputation value of the client and the quality value of the training data to detect clients that perform label flipping attacks. Compared with a single indicator, it reduces the false detection rate of normal clients being misidentified as malicious clients. Furthermore, the average reputation value of the client is calculated based on the reputation value of each round, so even if the training model is continuously iterated, the attack behavior of label flipping attackers can still be detected. Attached Figure Description

[0040] Figure 1 A flowchart for client-side detection methods for label flipping attacks;

[0041] Figure 2 This is a schematic diagram illustrating the principle of global model training. Detailed Implementation

[0042] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0043] like Figure 1 As shown, the client-side detection method for tag-flipping attacks includes the following steps:

[0044] Step 1: Obtain the reputation value and quality value of the training data for each round from the client. The round refers to the round in which the client uses the training data to train the global model. The reputation value is calculated based on the tag recall rate of the global model training. The quality value is calculated based on the prior distribution and posterior distribution of the tags.

[0045] Step 2: Calculate the client's average reputation score based on the reputation score in each round.

[0046] Step 3: Detect clients that are engaging in label flipping attacks based on the average reputation score of the client and the quality score of the training data.

[0047] The above method is implemented on the central server of federated learning. This method uses the average reputation value of the client and the quality value of the training data to detect clients that are attacking label flipping attacks. Compared with a single indicator, it reduces the false detection rate of normal clients being misidentified as malicious clients. Moreover, the average reputation value of the client is calculated based on the reputation value of each round, so even if the training model is continuously iterated, the attack behavior of label flipping attackers can still be detected.

[0048] Federated learning, as an emerging distributed machine learning method, can protect client privacy data while training a global model. The central server first distributes the global model to each local client. Each client uses its own raw data (i.e., training data) to train the global model. After training, the locally trained model is uploaded to the central server, which then performs global aggregation. This process is repeated until the required number of training rounds or the required training parameters are met.

[0049] To detect clients engaging in label-flipping attacks, i.e. malicious clients, this invention sets up two metrics: a reputation value for each round and a quality value for the training data. The reputation value is used to ensure that malicious clients participating in pre-training are identified while maintaining the participation of normal clients. The quality value is used to detect and determine whether a client is malicious without training.

[0050] Both metrics are calculated on the client side. Specifically, after the client receives the global model distributed by the central server, it trains the global model using training data. In each round of training, the client records and averages the success rate of identifying each category in the global model, which serves as its reputation score for that round. This can be expressed by the following formula:

[0051]

[0052] In the formula, Let m be the reputation value of the d-th client in the i-th round, m be the data type, and Num be the number of data types. j Let j be the number of data in the j-th category. This represents the number of successfully identified data points in the j-th category, calculated based on the tag recall rate. Data refers to all the data owned by each client, which is categorized into different categories, called tags for that data. For example, a client might have a vast number of images of cars, clothes, etc., as its data. For any given image, the specific image is called data, and the category it belongs to, such as "car" or "clothes," is called a tag.

[0053] Since training data can also contain malicious data, the quality value of the training data can be calculated based on the prior and posterior distributions of the labels. The prior and posterior distributions need to be learned with prior knowledge; here, they are approximate estimates based on experience. Where B is the set of clients considered benevolent, and b is a client in that set. This means that x′ is from the data set D b M obtained from * (x′) is the label corresponding to x′, and the posterior distribution. Where |B| is the number of sets of clients considered to be benevolent.

[0054] Specifically, the latent feature values ​​are first calculated based on the prior and posterior distributions of the labels, and then the quality value is further calculated. The formula can be expressed as:

[0055] G w (x|y)=argmaxE y～p(y) E z～Q(z|y) [logp(y|x)]

[0056] In the formula, p(y) is the prior distribution of the label, and E y～p(y) This indicates that y is obtained by sampling from p(y), E z～Q(z|y) This indicates that the independent variable z is sampled from Q(z|y), where Q(z|y) represents the distribution of z in y;

[0057]

[0058] In the formula, DQ d Let D be the training data quality value for the d-th client. d Let d be the training data distribution for the d-th client. Indicates that the independent variable x is from D d Mid-sampling, Indicates that the independent variable z is from G w Sampling in (z|y) represents the source of the independent variables x and z in the binary function, G. w (z|y) is generated by generator G w The generated latent feature values ​​are y, which is the label sequence during training. Acc(argmaxh(z),argmaxh(f(x))) is a function that calculates the sum of the same elements in argmaxh(z) and argmaxh(f(x)). argmaxh(z) is the prediction of the feature z corresponding to the label based on the global model. argmaxh(f(x)) is the prediction based on the client training data samples.

[0059] Each client uploads its reputation score and training data quality score for each round to the central server. Since training accuracy improves with each round, the reputation score in later rounds is higher than that in earlier rounds. Therefore, before obtaining the final reputation score for each client, it is necessary to average the reputation scores obtained in each round, as follows:

[0060]

[0061] In the formula, n is the total number of training rounds, Cre d Let d be the average reputation value of the d-th client.

[0062] Furthermore, based on the average reputation value of each client, clients with an average reputation value less than a threshold can be identified and added to the malicious client set S1. K-means clustering is then performed on the training data quality values ​​of all clients to obtain two clusters of data. Clients with lower data in the lower cluster are added to the malicious client set S2. The intersection of the malicious client set S1 and the malicious client set S2 is calculated to obtain the clients involved in the label flipping attack.

[0063] This invention adds a reputation score metric, quantifying the degree of client malice. Furthermore, when comparing reputation scores, an averaging method is used to ensure that clients are not incorrectly identified as malicious due to differences in training rounds, thus improving the accuracy of client detection. It also adds a data quality metric, using the K-means algorithm to cluster the data quality of each client, providing another layer of malicious client detection and improving the comprehensiveness of client detection. Through this dual detection of reputation score and data quality, only clients judged as malicious in both detections are processed, reducing the false detection rate of normal clients being misidentified as malicious and ensuring the participation rate of normal clients in the overall model training.

[0064] Based on the same technical solution, this invention also discloses a corresponding virtual device (such as software) for the above method, and a tag-flipping attack client detection device, comprising:

[0065] The acquisition module retrieves the reputation value and the quality value of the training data for each round from the client. The round refers to the round in which the client trains the global model using the training data. The reputation value is calculated based on the tag recall rate of the global model training, and the quality value is calculated based on the prior distribution and posterior distribution of the tags.

[0066] The average reputation score calculation module calculates the client's average reputation score based on the reputation score in each round.

[0067] The detection module detects clients engaging in label-flipping attacks based on the client's average reputation score and the quality score of the training data.

[0068] The detection module is specifically configured as follows: based on the average reputation value of the clients, find the clients whose average reputation value is less than the threshold, and add the found clients to the malicious client set S1; perform K-means clustering on the training data quality values ​​of all clients to obtain two clusters of data, and add the clients in the lower cluster of data to the malicious client set S2; calculate the intersection of the malicious client set S1 and the malicious client set S2 to obtain the clients that are engaged in label flipping attacks.

[0069] The aforementioned device is installed on the central server of federated learning. The method uses the average reputation value of the client and the quality value of the training data to detect clients that are attacking label flipping attacks. Compared with a single indicator, it reduces the false detection rate of normal clients being misidentified as malicious clients. Furthermore, the average reputation value of the client is calculated based on the reputation value of each round, so even if the training model is continuously iterated, the attack behavior of label flipping attackers can still be detected.

[0070] Based on the above methods, this invention further discloses a global model training method, see [link to relevant documentation]. Figure 2 ,include:

[0071] S1) Using the above-mentioned label-flipping attack client detection method, detect the label-flipping attack client and remove the label-flipping attack client from all clients;

[0072] S2) Use the remaining clients to train the global model of federated learning; that is, perform normal training based on the remaining clients (similar to existing training methods, except that some clients are removed).

[0073] In the above training method, the label-flipping attack clients are removed first, and then training is performed, thereby ensuring the accuracy of the globally trained model.

[0074] Based on the same technical solution, this invention also discloses a virtual device (such as software) corresponding to the training method, and a global model training device, including:

[0075] The detection and removal module uses the aforementioned label-flipping attack client detection method to detect clients performing label-flipping attacks and remove them from all clients.

[0076] The training module uses the remaining clients to train the global model through federated learning.

[0077] Based on the same technical solution, the present invention also discloses a computer-readable storage medium that stores one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform a label-flipping attack client detection method or a global model training method.

[0078] Based on the same technical solution, the present invention also discloses a computer device, including one or more processors and one or more memories, wherein one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, and the one or more programs include instructions for executing a label-flipping attack client detection method or a global model training method.

[0079] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0080] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0081] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0082] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0083] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A client-side detection method for tag-flipping attacks, characterized in that, include: The reputation score and quality score of the training data for each round are obtained from the client. The round refers to the number of times the client trains the global model using the training data. The reputation score is calculated based on the label recall rate of the global model training, and the quality score is calculated based on the prior and posterior distributions of the labels. The formula for calculating the reputation score for each round is as follows: , Let m be the reputation value of the d-th client in the i-th round, and m be the data type. Let j be the number of data in the j-th category. The training data quality value is calculated using the formula for the number of successfully identified data in the j-th category, based on the tag recall rate. , Let d be the training data quality value for the d-th client. Let d be the training data distribution for the d-th client. Indicates that the independent variable x from Mid-sampling, Indicates that the independent variable z comes from Mid-sampling, For generator G w The generated latent feature values ​​correspond to the labels, where y is the label sequence during training. For calculation A function that sums the identical elements in a given set. This is a prediction of the feature z corresponding to the label based on a global model. For prediction based on client-side training data samples; Calculate the client's average reputation score based on the reputation score in each round; Based on the average reputation score of the clients, identify clients whose average reputation score is less than the threshold and add them to the malicious client set S1. K-means clustering is performed on the training data quality values ​​of all clients to obtain two clusters of data. Clients with lower quality data in the lower cluster are added to the malicious client set S2. Calculate the intersection of the malicious client set S1 and the malicious client set S2 to obtain the clients involved in the label flipping attack.

2. A client-side detection device for tag-flipping attacks, characterized in that, include: The acquisition module retrieves the reputation score and training data quality score for each round from the client. The round refers to the number of rounds the client uses the training data to train the global model. The reputation score is calculated based on the label recall rate of the global model training, and the quality score is calculated based on the prior and posterior distributions of the labels. The formula for calculating the reputation score for each round is as follows: , Let m be the reputation value of the d-th client in the i-th round, and m be the data type. Let j be the number of data in the j-th category. The training data quality value is calculated using the formula for the number of successfully identified data in the j-th category, based on the tag recall rate. , Let d be the training data quality value for the d-th client. Let d be the training data distribution for the d-th client. Indicates that the independent variable x from Mid-sampling, Indicates that the independent variable z comes from Mid-sampling, For generator G w The generated latent feature values ​​correspond to the labels, where y is the label sequence during training. For calculation A function that sums the identical elements in a given set. This is a prediction of the feature z corresponding to the label based on a global model. For prediction based on client-side training data samples; The average reputation score calculation module calculates the client's average reputation score based on the reputation score in each round. The detection module identifies clients with average reputation scores below a threshold based on their average reputation scores and adds them to the malicious client set S1. It then performs K-means clustering on the training data quality scores of all clients to obtain two clusters, adding the client from the lower-ranking cluster to the malicious client set S2. Finally, it calculates the intersection of the malicious client sets S1 and S2 to identify the clients involved in the label flipping attack.

3. A global model training method, characterized in that, include: Using the method described in claim 1, clients engaging in label-flipping attacks are detected, and label-flipping attack clients are removed from all clients. The remaining clients are used for federated learning global model training.

4. A global model training device, characterized in that, include: The detection and removal module uses the method described in claim 1 to detect clients that are performing tag-flipping attacks and remove them from all clients. The training module uses the remaining clients to train the global model through federated learning.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the method of claim 1 or 3.

6. A computer device, characterized in that, include: One or more processors and one or more memories, one or more programs stored in the one or more memories and configured to be executed by the one or more processors, the one or more programs including instructions for performing the method of claim 1 or 3.

Images