A collusion attack tracing method and system based on a federated learning computing power network
By constructing and embedding a unique fingerprint vector matrix for each client in the federated learning computing network, the problem of existing technologies being unable to trace malicious participants is solved, achieving efficient attack attribution, reducing communication and computing costs, and making it suitable for collusion attack detection in multi-center federated learning models.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HUNAN UNIV
- Filing Date
- 2024-01-16
- Publication Date
- 2026-07-31
AI Technical Summary
Existing malicious attack detection methods cannot trace the malicious actors, resulting in huge communication overhead and high computing costs during the training of federated learning models.
In a federated learning computing network, a unique fingerprint vector matrix is constructed for each client and embedded in the loss function. The server parses and updates the fingerprint vector matrix to trace malicious attacking clients.
It enables efficient tracing of malicious attacks, reduces unnecessary communication overhead and computing costs, has high portability and robustness, and can detect collusive attacks from multiple clients.
Smart Images
Figure CN117892840B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence security technology, and more specifically, to a method and system for tracing the source of collusion attacks in federated learning computing networks. Background Technology
[0002] Currently, the latest applications of federated learning models have expanded to important fields such as autonomous driving and smart healthcare. However, a federated learning model with good performance needs to be trained using the computing power of multiple supercomputing centers, and this training process requires a huge investment of time and money.
[0003] However, during the training of federated learning models, there are often instances where malicious edge computing nodes (malicious participants) steal, occupy, or even attack and tamper with the trained federated learning model in an unauthorized manner. Existing malicious attack detection methods mainly obtain the parameters of malicious participants through anomaly detection methods.
[0004] However, the existing malicious attack detection methods mentioned above have a significant drawback: since the method cannot trace the malicious party, it needs to continuously acquire the parameters of the malicious party during subsequent iterative training, resulting in huge communication overhead and high computing power costs. Summary of the Invention
[0005] In view of the above-mentioned defects or improvement needs of existing technologies, this invention provides a collusion tracing and defense method and system for federated learning computing power networks. Its purpose is to solve the technical problem that existing malicious attack detection methods cannot trace the malicious participants, which leads to the need to continuously obtain the parameters of the malicious participants in the subsequent iterative training process, resulting in huge communication overhead and high computing power costs.
[0006] To achieve the above objectives, according to one aspect of the present invention, a method for tracing the source of collusion attacks in federated learning computing networks is provided, comprising the following steps:
[0007] (1) The server sends the initial convolutional neural network (CNN) model to each client in the computing environment. The loss function of the CNN model sent to the i-th client contains the fingerprint vector corresponding to the i-th client. i represents the number of the client among all clients, and i∈[1, number]. number represents the total number of clients in the computing environment.
[0008] (2) The server receives the CNN model from each client, parses the CNN model from each client to obtain the loss function corresponding to the CNN model, extracts the current fingerprint vector from the loss function, and constructs the fingerprint vector matrix a' based on the current fingerprint vectors corresponding to all clients.
[0009] (3) The server updates the fingerprint vector matrix a' obtained in step (2) to obtain the updated fingerprint vector matrix a”:
[0010] (4) The server determines the client that will carry out the attack based on the updated fingerprint vector matrix a” obtained in step (3);
[0011] Preferably, the fingerprint vector corresponding to each client is constructed through the following steps:
[0012] (1-1) Initialize each element of the fingerprint vector matrix a of size number*number to be 0;
[0013] (1-2) Set the counter cnt1 = 1;
[0014] (1-3) Initialize the values of count_x and count_y to 0;
[0015] (1-4) Set counter j = 1 and counter m = 1;
[0016] (1-5) Determine if j is equal to number. If yes, proceed to step (1-11); otherwise, proceed to step (1-6).
[0017] (1-6) Determine if m is equal to number. If it is, proceed to step (1-10); otherwise, proceed to step (1-7).
[0018] (1-7) Determine whether the element a[m][j] in the m-th row and j-th column of the fingerprint vector matrix a is less than cnt1, and at the same time determine whether count_x and count_y are less than the preset threshold k. If they are, proceed to step (1-8); otherwise, proceed to step (1-9).
[0019] (1-8) Set the element a[m][j] in the m-th row and j-th column of the fingerprint vector matrix a to 1, and set count_x = count_x + 1 and count_y = count_y + 1, then proceed to step (1-9);
[0020] (1-9) Set j = j + 1 and return to step (1-5);
[0021] (1-10) Set m = m + 1 and return to step (1-6);
[0022] (1-11) Perform a two's complement operation on each element in the obtained fingerprint vector matrix a to obtain the fingerprint vector matrix A after the two's complement operation.
[0023] (1-12) Generate a corresponding fingerprint vector for each client based on the fingerprint vector matrix A obtained after the two's complement operation in step (1-11).
[0024] Preferably, when number is 7, k is 3; when number is 13, k is 4; when number is 31, k is 6; and when number is 133, k is 11.
[0025] Preferably, during the bit complement operation in step (11), if the first element from top to bottom in a column is 0, no operation is performed on that column; if the first element from top to bottom in a column is 1, all elements in that column except the first element are inverted, and the last element is inverted and then incremented by one.
[0026] Preferably, step (3) includes the following sub-steps:
[0027] (3-1) Set counter b = 1 and counter c = 1;
[0028] (3-2) Determine if b is equal to number. If it is, the process ends; otherwise, proceed to step (3-3).
[0029] (3-3) Determine if c is equal to number. If it is, proceed to step (3-8); otherwise, proceed to step (3-4).
[0030] (3-4) Determine whether the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' is less than the threshold τ. If it is, proceed to step (3-5); otherwise, proceed to step (3-6).
[0031] (3-5) Set the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' to 0, and then proceed to step (3-7);
[0032] (3-6) Set the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' to 1, and then proceed to step (3-7);
[0033] (3-7) Set the counter c = c + 1 and return to step (3-3);
[0034] (3-8) Set the counter b = b + 1 and return to step (3-2).
[0035] Preferably, step (4) includes the following sub-steps:
[0036] (4-1) Set counter d = 1, counter e = 1, and counter f = 2;
[0037] (4-2) Determine if f is greater than number. If it is, proceed to step (4-9); otherwise, proceed to step (4-3).
[0038] (4-3) Determine if d is equal to number. If it is, proceed to step (4-6); otherwise, proceed to step (4-4).
[0039] (4-4) Determine if e is equal to number. If yes, proceed to step (4-7); otherwise, proceed to step (4-5).
[0040] (4-5) Perform bitwise AND (&) operations on all elements in the e-th column, the e+1-th column, ..., the e+f-1-th column of the fingerprint vector matrix a”, and determine whether the resulting AND vector is a column of the fingerprint vector matrix a. If it is, it means that the e-th client has launched an attack. At this time, record e in the pre-created one-dimensional array g[], and then proceed to step (4-6). Otherwise, proceed to step (4-7).
[0041] (4-6) Set the counter d = d + 1 and return to step (4-3);
[0042] (4-7) Set the counter e = e + 1 and return to step (4-4);
[0043] (4-8) Set the counter f = f + 1 and return to step (4-2);
[0044] (4-9) Output array g[], where each element represents the number of the client that performed the attack among all number clients.
[0045] According to another aspect of the present invention, a collusion attack attribution system for federated learning computing power networks is provided, comprising:
[0046] The first module, located on the server, is used to send the initial convolutional neural network (CNN) model to each client in the computing environment. The loss function of the CNN model sent to the i-th client embeds the fingerprint vector corresponding to the i-th client, where i represents the client's number among all clients and i∈[1, number], and number represents the total number of clients in the computing environment.
[0047] The second module, located on the server, receives CNN models from each client, parses the CNN models from each client to obtain the loss function corresponding to the CNN model, extracts the current fingerprint vector from the loss function, and constructs a fingerprint vector matrix a' based on the current fingerprint vectors corresponding to all clients.
[0048] The third module, located on the server side, is used to update the fingerprint vector matrix a' obtained from the second module to obtain the updated fingerprint vector matrix a”.
[0049] The fourth module, located on the server side, is used to determine the client that will execute the attack based on the updated fingerprint vector matrix a” obtained from the third module.
[0050] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects:
[0051] (1) Since the method of the present invention can trace the client that performs the malicious attack through a unique fingerprint vector, it can solve the technical problem that the existing malicious attack detection method cannot trace the malicious party and needs to continuously obtain the parameters of the malicious party in the subsequent iterative training process, resulting in huge communication overhead and high computing power cost.
[0052] (2) The method of the present invention has a simple integration process, high portability to other artificial intelligence and Internet of Things applications, and can achieve efficient attack tracing and detection, reducing unnecessary waste of computing power costs;
[0053] (3) The method of the present invention can solve the problem of tracing the source of malicious collusion attacks initiated by multiple clients and has robustness to the global system. Attached Figure Description
[0054] Figure 1 This is a flowchart of the collusion attack tracing method for federated learning computing power networks according to the present invention. Detailed Implementation
[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.
[0056] The basic idea of this invention is to address the collusion attack problem of ownership in multi-center federated learning models by using a unique fingerprint technology to trace malicious clients. This invention mainly includes four core steps: constructing a corresponding fingerprint vector matrix for each client; embedding the corresponding fingerprint vector into a loss function and distributing it to each client; extracting the current fingerprint vector where the attack occurred; and performing identity recognition on distributed clients and tracing the collusion attack of malicious clients. Its purpose is to solve the problem that existing malicious attack detection methods cannot trace malicious participants, leading to significant communication overhead and high computational costs in continuously acquiring malicious participant parameters during subsequent iterations.
[0057] like Figure 1 As shown, this invention provides a method for tracing the source of collusion attacks in federated learning computing networks, comprising the following steps:
[0058] (1) The server sends the initial Convolutional Neutral Network (CNN) model to each client in the computing environment. The loss function of the CNN model sent to the i-th client is embedded with the fingerprint vector corresponding to the i-th client. i represents the number of the client among all clients, and i∈[1, number]. number represents the total number of clients in the computing environment.
[0059] More specifically, the fingerprint vector corresponding to the i-th client is constructed through the following steps:
[0060] (1-1) Initialize each element of the fingerprint vector matrix a of size number*number to be 0;
[0061] (1-2) Set the counter cnt1 = 1;
[0062] (1-3) Initialize the values of count_x and count_y to 0;
[0063] (1-4) Set counter j = 1 and counter m = 1;
[0064] (1-5) Determine if j is equal to number. If yes, proceed to step (1-11); otherwise, proceed to step (1-6).
[0065] (1-6) Determine if m is equal to number. If it is, proceed to step (1-10); otherwise, proceed to step (1-7).
[0066] (1-7) Determine whether the element a[m][j] in the m-th row and j-th column of the fingerprint vector matrix a is less than cnt1, and at the same time determine whether count_x and count_y are less than the preset threshold k. If they are, proceed to step (1-8); otherwise, proceed to step (1-9).
[0067] Specifically, the value of k is related to the total number of clients in the computing environment. For a detailed description of the specific correspondence between the two, please refer to the article Min Wu, Wade Trappe, Z Jane Wang, and KJ Ray Liu. 2004. Collusion-resistant multimedia fingerprinting: a unified framework. In Security, Steganography, and Watermarking of Multimedia Contents VI, Vol. 5306. International Society for Optics and Photonics, 748–760.
[0068] For example, when the number is 7, the value of k is 3; when the number is 13, the value of k is 4; when the number is 31, the value of k is 6; and when the number is 133, the value of k is 11.
[0069] (1-8) Set the element a[m][j] in the m-th row and j-th column of the fingerprint vector matrix a to 1, and set count_x = count_x + 1 and count_y = count_y + 1, then proceed to step (1-9);
[0070] (1-9) Set j = j + 1 and return to step (1-5);
[0071] (1-10) Set m = m + 1 and return to step (1-6);
[0072] For example, assuming the total number of clients in the computing environment is number = 7, and k = 3, after steps (1-1) to (1-10) above, the fingerprint vector matrix a is obtained as follows:
[0073]
[0074] The advantage of the above steps (1-1) to (1-10) is that they can efficiently construct a unique binary fingerprint vector.
[0075] (1-11) Perform a two's complement operation on each element in the obtained fingerprint vector matrix a to obtain the fingerprint vector matrix A after the two's complement operation.
[0076] Specifically, during the two's complement operation, if the first element from top to bottom in a column is 0, no operation is performed on that column; if the first element from top to bottom in a column is 1, all elements in that column except the first element are inverted, and the last element is inverted before being incremented. For the example above, the fingerprint vector matrix A obtained after this step is:
[0077]
[0078] (1-12) Generate a corresponding fingerprint vector for each client based on the fingerprint vector matrix A obtained after the two's complement operation in step (1-11);
[0079] Specifically, for the example above, the fingerprint vector corresponding to the first client is:
[0080] fp1=[+U1+u2―u3+u4+U5+U6+U7]
[0081] The first element + corresponds to the first value 1 in the first column of the fingerprint vector matrix A after the two's complement operation obtained in step (1-11), and the third element - corresponds to the third value 0 in the first column of the fingerprint vector matrix A after the two's complement operation obtained in step (1-11). u1, u2, ..., u7 are all empty cells.
[0082] For the example above, the set of fingerprint vectors consisting of the fingerprint vectors corresponding to all number (7 in this example) clients is as follows:
[0083]
[0084] The advantage of the above steps (1-11) to (1-12) is that the fingerprint is embedded on the server side to reduce the interference of malicious clients on the secure embedding of the fingerprint vector. Because of the existence of malicious clients, it is impossible to securely embed the constructed fingerprint vector from the user level.
[0085] (2) The server receives the CNN model from each client and parses the CNN model from each client to obtain the loss function corresponding to the CNN model. It then extracts the current fingerprint vector from the loss function and constructs a fingerprint vector matrix a' based on the current fingerprint vectors corresponding to all clients. The fingerprint vector matrix is obtained by expanding all current fingerprint vectors by column.
[0086] (3) The server updates the fingerprint vector matrix a' obtained in step (2) to obtain the updated fingerprint vector matrix a”:
[0087] This step includes the following sub-steps:
[0088] (3-1) Set counter b = 1 and counter c = 1;
[0089] (3-2) Determine if b is equal to number. If it is, the process ends; otherwise, proceed to step (3-3).
[0090] (3-3) Determine if c is equal to number. If it is, proceed to step (3-8); otherwise, proceed to step (3-4).
[0091] (3-4) Determine whether the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' is less than τ. If it is, proceed to step (3-5); otherwise, proceed to step (3-6).
[0092] Specifically, the value of τ ranges from 0.5 to 0.8, with 0.8 being the preferred value.
[0093] (3-5) Set the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' to 0, and then proceed to step (3-7);
[0094] (3-6) Set the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' to 1, and then proceed to step (3-7);
[0095] (3-7) Set the counter c = c + 1 and return to step (3-3);
[0096] (3-8) Set the counter b = b + 1 and return to step (3-2);
[0097] The advantage of the above steps (3-4) is that by setting a threshold detector, the error in the cell vector caused by attacks from multiple clients can be effectively mitigated.
[0098] (4) Determine the client that performs the attack based on the updated fingerprint vector matrix a” obtained in step (3);
[0099] This step (4) includes the following sub-steps:
[0100] (4-1) Set counter d = 1, counter e = 1, and counter f = 2;
[0101] (4-2) Determine if f is greater than number. If it is, proceed to step (4-9); otherwise, proceed to step (4-3).
[0102] (4-3) Determine if d is equal to number. If it is, proceed to step (4-6); otherwise, proceed to step (4-4).
[0103] (4-4) Determine if e is equal to number. If yes, proceed to step (4-7); otherwise, proceed to step (4-5).
[0104] (4-5) Perform bitwise AND (&) operations on all elements in the e-th column, the e+1-th column, ..., the e+f-1-th column of the fingerprint vector matrix a”, and determine whether the resulting AND vector is a column of the fingerprint vector matrix a. If it is, it means that the e-th client has launched an attack. At this time, record e in the pre-created one-dimensional array g[], and then proceed to step (4-6). Otherwise, proceed to step (4-7).
[0105] (4-6) Set the counter d = d + 1 and return to step (4-3);
[0106] (4-7) Set the counter e = e + 1 and return to step (4-4);
[0107] (4-8) Set the counter f = f + 1 and return to step (4-2);
[0108] (4-9) Output array g[], where each element represents the number of the client that performed the attack among all number clients.
[0109] The advantage of steps (4-1) to (4-9) above is that they cover all possible malicious client collusion attacks through comprehensive computational operations, while maintaining low cost and high computational efficiency.
[0110] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for tracing the source of collusion attacks in federated learning computing networks, characterized in that, Includes the following steps: (1) The server sends the initial convolutional neural network (CNN) model to each client in the computing environment. The loss function of the CNN model sent to the i-th client is embedded with the fingerprint vector corresponding to the i-th client. i represents the number of the client among all clients, and i∈[1, number]. number represents the total number of clients in the computing environment. (2) The server receives the CNN model from each client, parses the CNN model from each client to obtain the loss function corresponding to the CNN model, extracts the current fingerprint vector from the loss function, and constructs the fingerprint vector matrix a' based on the current fingerprint vectors corresponding to all clients; (3) The server updates the fingerprint vector matrix a' obtained in step (2) to obtain the updated fingerprint vector matrix a'': (4) The server determines the client that will carry out the attack based on the updated fingerprint vector matrix a'' obtained in step (3).
2. The collusion attack tracing method for federated learning computing power networks according to claim 1, characterized in that, The fingerprint vector corresponding to each client is constructed through the following steps: (1-1) Initialize each element of the fingerprint vector matrix a of size number*number to be 0; (1-2) Set the counter cnt1=1; (1-3) Initialize the values of count_x and count_y to 0; (1-4) Set counter j=1 and counter m=1; (1-5) Determine if j is equal to number. If yes, proceed to step (1-11); otherwise, proceed to step (1-6). (1-6) Determine if m is equal to number. If it is, proceed to step (1-10); otherwise, proceed to step (1-7). (1-7) Determine whether the element a[m][j] in the m-th row and j-th column of the fingerprint vector matrix a is less than cnt1, and at the same time determine whether count_x and count_y are less than the preset threshold k. If they are, proceed to step (1-8); otherwise, proceed to step (1-9). (1-8) Set the element a[m][j] in the m-th row and j-th column of the fingerprint vector matrix a to 1, and set count_x=count_x+1 and count_y=count_y+1, then proceed to step (1-9). (1-9) Set j=j+1 and return to step (1-5); (1-10) Set m=m+1 and return to step (1-6). (1-11) Perform a two's complement operation on each element in the obtained fingerprint vector matrix a to obtain the fingerprint vector matrix A after the two's complement operation; (1-12) Generate a corresponding fingerprint vector for each client based on the fingerprint vector matrix A obtained after the two's complement operation in step (1-11).
3. The collusion attack attribution method for federated learning computing power networks according to claim 1 or 2, characterized in that, When number is 7, k takes the value of 3; when number is 13, k takes the value of 4; when number is 31, k takes the value of 6; and when number is 133, k takes the value of 11.
4. The collusion attack tracing method for federated learning computing networks according to claim 2, characterized in that, During the bit complement operation in step (11), if the first element from top to bottom in a column is 0, no operation is performed on that column; if the first element from top to bottom in a column is 1, all elements in that column except the first element are inverted, and the last element is incremented by one after inversion.
5. The collusion attack tracing method for federated learning computing networks according to claim 4, characterized in that, Step (3) includes the following sub-steps: (3-1) Set counter b=1 and counter c=1; (3-2) Determine if b is equal to number. If it is, the process ends; otherwise, proceed to step (3-3). (3-3) Determine if c is equal to number. If it is, proceed to step (3-8); otherwise, proceed to step (3-4). (3-4) Determine whether the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' is less than the threshold τ. If it is, proceed to step (3-5); otherwise, proceed to step (3-6). (3-5) Set the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' to 0, and then proceed to step (3-7); (3-6) Set the element a'[b][c] in the b-th row and c-th column of the fingerprint vector matrix a' to 1, and then proceed to step (3-7); (3-7) Set the counter c = c + 1 and return to step (3-3); (3-8) Set the counter b = b + 1 and return to step (3-2).
6. The collusion attack tracing method for federated learning computing networks according to claim 5, characterized in that, Step (4) includes the following sub-steps: (4-1) Set counter d=1, counter e=1, and counter f=2; (4-2) Determine if f is greater than number. If it is, proceed to step (4-9); otherwise, proceed to step (4-3). (4-3) Determine if d is equal to number. If it is, proceed to step (4-6); otherwise, proceed to step (4-4). (4-4) Determine if e is equal to number. If yes, proceed to step (4-7); otherwise, proceed to step (4-5). (4-5) Perform a bitwise AND operation (&) on all elements in the e-th column, all elements in the e+1-th column, ..., all elements in the e+f-1-th column of the fingerprint vector matrix a'', and determine whether the resulting AND vector is a column in the fingerprint vector matrix a. If it is, it means that the e-th client has launched an attack. At this time, record e in the pre-created one-dimensional array g[], and then proceed to step (4-6). Otherwise, proceed to step (4-7). (4-6) Set the counter d = d + 1 and return to step (4-3); (4-7) Set the counter e = e + 1 and return to step (4-4). (4-8) Set the counter f = f + 1 and return to step (4-2); (4-9) Output array g[], where each element represents the number of the client that performed the attack among all number clients.
7. A collusion attack attribution system for federated learning computing networks, characterized in that, include: The first module, which is set on the server, is used to send the initial convolutional neural network (CNN) model to each client in the computing environment. The loss function of the CNN model sent to the i-th client embeds the fingerprint vector corresponding to the i-th client, where i represents the number of the client among all clients and i∈[1, number], and number represents the total number of clients in the computing environment. The second module, which is set on the server, is used to receive CNN models from each client, parse the CNN models from each client to obtain the loss function corresponding to the CNN model, extract the current fingerprint vector from the loss function, and construct the fingerprint vector matrix a' based on the current fingerprint vectors corresponding to all clients. The third module, located on the server side, is used to update the fingerprint vector matrix a' obtained from the second module, so as to obtain the updated fingerprint vector matrix a'': The fourth module, located on the server side, is used to determine the client that will execute the attack based on the updated fingerprint vector matrix a'' obtained from the third module.