A method and system for defending against federated learning backdoor attacks

Abstract

This invention relates to a method and system for defending against backdoor attacks in federated learning, belonging to the field of information security. The method first performs data preprocessing operations on the terminal before executing local training, converting the data from the time domain to the frequency domain and designing a low-pass filter to filter high-frequency signals introduced by backdoor samples. Second, malicious uploads and updates are detected on the server side, the cosine similarity between the pre-global model and the local model is calculated, and an appropriate threshold is set to filter maliciously uploaded local model updates. Finally, a global aggregation operation is performed on the remaining non-malicious uploads and updates to obtain an updated global model, and differential privacy technology is used to perturb the obtained global model. This invention fully considers the scenario where backdoor attacks occur in different locations, mitigating backdoor attacks in federated learning without affecting the model's performance on benign data, thus solving the problem of backdoor attack defense in federated learning.

Description

Technical Field

[0001] This invention belongs to the field of information security and relates to a method and system for defending against federated learning backdoor attacks. Background Technology

[0002] With the rapid development of computer and network technologies, the use of terminal devices (such as smartphones and wearable devices) has become increasingly widespread. The use of smart terminal devices has brought convenience to human life, and the massive amounts of raw data generated and collected by these devices provide tremendous support for training machine learning models. Traditional machine learning model training typically employs a centralized, cloud-based learning approach, requiring each terminal device to upload all its generated or collected data to a cloud data center, and then train and infer a global model based on the uploaded raw dataset. However, uploading all training data to the cloud not only puts enormous pressure on cloud network bandwidth but also leaks users' personal privacy information. Moreover, with increasing awareness of user privacy, various countries have enacted relevant laws and regulations to restrict data transmission, resulting in a large amount of raw data existing as "data silos," significantly reducing the value of data utilization. To address this issue, Google proposed the concept of federated learning in 2016, breaking down the "data silo" phenomenon. Federated learning can retain the raw data of devices locally while collaboratively training a global model, effectively protecting user privacy without affecting data availability.

[0003] While federated learning can effectively protect user privacy, it is vulnerable to various attacks, such as adversarial attacks, poisoning attacks, and backdoor attacks. Since backdoor attacks only misclassify specific samples and do not affect the learning accuracy of the main learning task, they have become one of the most dangerous and stealthy attacks. Therefore, designing defenses against backdoor attacks is a key focus of current research on federated learning attack defense. To make federated learning robust to backdoor attacks, researchers have proposed numerous defense schemes. Existing research schemes can be divided into three different defense methods based on different stages of model training: pre-aggregation, pre-aggregation, and post-aggregation. Pre-aggregation defense aims to detect and remove backdoor samples, thereby eliminating the impact of backdoor attacks; pre-aggregation defense refers to reducing the impact of malicious updates during global model aggregation by identifying, deleting, or reducing them; and post-aggregation defense repairs the backdoor model after the federated learning model training is completed.

[0004] While these approaches improve the robustness of federated learning against backdoor attacks to some extent, they still have the following shortcomings: First, existing research methods typically make detailed assumptions about the attacker's attack strategy and the underlying distribution of the dataset. Regarding attack strategies, detailed assumptions are made about the attacker's specific attack model, their understanding of the local training process on the terminal device, how the attacker generates backdoor samples, and whether the attackers cooperate. Regarding the underlying distribution of the dataset, existing research usually assumes that the dataset satisfies the independent and identically distributed property, which is fundamentally different from the non-independent and identically distributed property of federated learning. Second, although these approaches introduce differential privacy techniques into federated learning to defend against backdoor attacks by adding noise to gradients or updates, thus mitigating the impact of backdoor attacks, they cannot completely detect malicious updates or samples, and excessive noise can negatively impact the model's performance on the main task.

[0005] In summary, federated learning emerged to address the issues of sensitive user data leakage and model usability problems caused by cloud-based training. However, federated learning is vulnerable to backdoor attacks, which can cause the model to misclassify data with certain characteristics. Therefore, backdoor attack defense is a fundamental and crucial problem in federated learning. While existing research methods have proposed many effective defenses at different stages of model training—before aggregation, pre-aggregation, and post-aggregation—they often have other shortcomings. For example, existing methods typically make detailed assumptions about the attacker's attack strategy and the underlying distribution of the dataset, or they cannot completely detect malicious updates or samples. Therefore, to better address the attack defense problem of federated learning, it is necessary to design a method that can mitigate backdoor attacks without affecting the model's performance on the dataset. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method and system for defending against backdoor attacks in federated learning, which effectively solves the problem of defending against backdoor attacks in federated learning.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] Option 1:

[0009] A federated learning backdoor attack defense method firstly involves the terminal performing data preprocessing operations before executing local training, converting the data from the time domain to the frequency domain, and designing a low-pass filter to filter high-frequency signals introduced by backdoor samples in the data. Secondly, malicious upload updates are detected on the server side, the cosine similarity between the pre-global model and the local model is calculated, and an appropriate threshold is set to filter maliciously uploaded local model updates. Finally, a global aggregation operation is performed on the remaining non-malicious upload updates to obtain the updated global model, and differential privacy technology is used to perturb the obtained global model.

[0010] The method specifically includes the following steps:

[0011] S1: Initialization: Randomly select n terminals from all N terminals participating in training, and initialize the global model. Distribute to the selected n terminals;

[0012] S2: Local model update: per terminal c i ∈C is the global model received from the previous communication round r-1. Update the local model for the current communication round r. Where the terminal set C = {c1, c2, ..., c n}, r = 1, 2, ..., T, where r represents the global communication iteration round and T represents the total number of global training communication rounds;

[0013] S3: Local data spectrum filtering: for each terminal c i ∈C will each have their own local training dataset D i The time domain is transformed to the frequency domain, and the high-frequency signals generated by the backdoor samples are filtered by the designed IIR low-pass filter, thereby mitigating the impact of backdoor attacks on local training of federated learning.

[0014] S4: Local model training: per terminal c i ∈C Local dataset D′ after spectrum filtering i,j Perform local model training to obtain the local model in the current iteration round r.

[0015] S5: Local model update transmission: per terminal c i ∈C is based on the local model obtained through training Calculate its local model update And on Encryption is performed, and the encrypted local model is updated. Upload to the server;

[0016] S6: Malicious Local Update Filtering: The server filters each received terminal update. iEncrypted local update uploaded by ∈C Perform pre-aggregation operations to obtain a pre-aggregated global model Meanwhile, each terminal c i Calculate their local model updates separately Compared with the pre-global model Cosine similarity S between i And the obtained cosine similarity S i The value is compared with the set threshold γ, and malicious local updates are deleted;

[0017] S7: Temporary global model calculation: Update the remaining uploads Perform aggregation operations to obtain a temporary global model

[0018] S8: Temporary Global Model Perturbation: Combining differential privacy techniques with the obtained temporary global model By perturbing the model, we obtain the perturbed global model.

[0019] S9: Final Global Model: Repeat the above steps continuously for T iterations to obtain the final global model.

[0020] Furthermore, step S1 specifically includes the following steps:

[0021] S11: Initialize global model parameters The total number of terminals N participating in training, the total number of terminals n used for global aggregation in each round, and the corresponding terminal set C = {c1, c2, ..., c n The total number of global training communication rounds T, the total number of local training rounds E, the batch size during training (batch_size), and the batch size during testing (test_batch_size);

[0022] S12: Set global model parameters Distributed to each terminal c in set C i .

[0023] Furthermore, in step S3, local data spectrum filtering specifically includes the following steps:

[0024] S31: Terminal c i Before local training, the local dataset D i =d i,1 ,d i,2 ,…,d i,z Transform from the time domain to the frequency domain, where d i,z This represents the z-th sample from the i-th terminal; specifically: terminal c i D i Each sample d ini,j The transformed sample U is obtained by performing a two-dimensional DCT discrete cosine transform. i,j Where i represents the i-th terminal and j represents the j-th sample;

[0025] S32: By a determined sampling frequency f samp , passband cutoff frequency f p Stopband cutoff frequency f s α passband attenuation p and stopband attenuation α s The design of an IIR low-pass filter considers five key parameters, specifically: first, the passband cutoff frequency f... p and stopband cutoff frequency f s Normalization operations are performed to obtain the normalized passband cutoff frequency ω. p and the normalized stopband cutoff frequency ω s :

[0026] ω p =f p / (f samp / 2)

[0027] ω s =f s / (f samp / 2)

[0028] Secondly, ω p and ω s Converted into analog filter index Ω respectively p and Ω s :

[0029]

[0030]

[0031] Then, Ω p Ω s α p α s Substituting the following attenuation function and frequency response function, calculate the filter order R and 3dB cutoff frequency Ω. c It is worth noting that due to the smaller passband attenuation α p It can retain more information in the passband and has a larger stopband attenuation α s This can better suppress signals or noise within the stopband; therefore, α is usually chosen. p =1, α s =20.

[0032] α(Ω)=-10lg|H(jΩ)| 2

[0033]

[0034] Where Ω represents the variable in the decay function, by substituting Ω p α can be calculated p Substitute Ω s α can be derived s H(jΩ) represents the frequency response function, and α(Ω) represents the decay function;

[0035] The calculated filter order R and 3dB cutoff frequency Ω c They are represented as follows:

[0036]

[0037]

[0038] Finally, the filter order R and Ω c Substituting the transfer function H(s) of the low-pass filter, we obtain the designed digital low-pass filter H(z):

[0039]

[0040] The transfer function H(s) of the low-pass filter is: z represents the z-plane, through which... By making a replacement, the analog low-pass filter can be converted into a digital low-pass filter;

[0041] S33: Using the low-pass filter H(z) designed in step S32 and the data sample U obtained from the conversion in step S31 i,j A filtering operation is performed to remove the high-frequency signals generated by the backdoor sample, thereby obtaining the processed data sample D′. i,j :D′ i,j =U i,j ×H(z).

[0042] Furthermore, in step S4, the local model in the current iteration round r is obtained. The calculation formula is:

[0043]

[0044] in, This represents the global model in the previous communication round r-1, where η represents the learning rate. This represents the loss function used for training the local model. It is worth noting that the cross-entropy loss function is used here.

[0045] Furthermore, in step S5, the local model update transmission specifically includes the following steps:

[0046] S51: Terminal ci Calculate its local model update

[0047]

[0048] S52: Terminal c i Update the local model trained using the key pairs issued by the server. Perform encryption to obtain the encrypted model update. It is worth noting that, in order to facilitate the subsequent calculation of cosine similarity, the local model needs to be modified here. Normalization is performed before encryption.

[0049] S53: Each terminal c i Upload the encrypted local model update after step S52

[0050] Furthermore, in step S6, the malicious local update screening specifically includes the following steps:

[0051] S61: Update all uploaded local models Perform a pre-aggregation operation to obtain the pre-aggregated global model for the r-th round of communication iteration.

[0052]

[0053] in, Let denot be the global encryption model in the (r-1)th round, η be the learning rate, and |D| be the global encryption model. i | indicates terminal c i The size of the local dataset;

[0054] S62: Calculate c for each terminal i Encrypted local model With pre-aggregated global model Cosine similarity S between i :

[0055]

[0056] Where cos(·) represents the function for calculating cosine similarity, and the similarity S i The value range of S is [-1, 1]. i A value of -1 indicates complete dissimilarity, while a value of 1 indicates complete similarity.

[0057] S63: The cosine similarity value S calculated based on step S62. i When S is compared with a pre-set threshold γ, i When >γ, it indicates that the model update is being uploaded. terminal c i If it is a malicious terminal, delete it. It prevents it from participating in global aggregation operations; conversely, when S i When ≤γ, it indicates that the model update is uploaded. terminal c i As a normal terminal, it will continue to participate in subsequent operations. It is worth noting that the threshold γ needs to be set in a trade-off between model performance and backdoor defense effectiveness, to obtain the optimal value.

[0058] Furthermore, in step S7, the temporary global model The calculation formula is:

[0059]

[0060] in, Let |D| represent the global model parameters of the previous iteration, η represent the learning rate, k represent the remaining number of terminals participating in the aggregation, and |D| represent the number of terminals participating in the aggregation. i | indicates terminal c i The size of the local dataset.

[0061] Furthermore, in step S8, the perturbed global model is obtained.

[0062]

[0063] in, This represents the temporary global model obtained in step S7, where Enc(·) represents the homomorphic encryption function, and N(0,σ) represents the temporary global model obtained in step S7. 2 () represents Gaussian noise; δ represents the relaxation term, with a value of δ∈(0,1); Δf represents the L2 sensitivity, which is usually 1; ∈ represents the privacy budget, which is negatively correlated with the intensity of noise.

[0064] Option 2:

[0065] A federated learning backdoor attack defense system includes an initialization module, a local operation module, and a server operation module.

[0066] The initialization module is used to initialize global model parameters. The total number of terminals participating in training N, the total number of terminals used for global aggregation in each round n, and the terminal set C = {c1, c2, ..., c n The parameters initialized are: total number of global communication rounds T, total number of local training rounds E, batch size during training (batch_size), and batch size during testing (test_batch_size). These parameters are then broadcast to each terminal c participating in the training. i ;

[0067] The local operation module is used for each terminal c i Based on the local training data D′ after spectrum filtering i,j Perform local model training and update the encrypted local model for the current iteration r. Uploaded to the server, specifically including the following sub-modules:

[0068] The global model receiving submodule is used for the set C = {c1, c2, ..., c...} n All terminals in the process receive the global model parameters from the previous iteration (r-1) sent by the server. And utilize global model parameters Update local model parameters

[0069] The spectrum filtering submodule is used to filter the spectrum of each terminal before local model training. i Local training data sample d ∈C i,j Convert to the frequency domain U using Discrete Cosine Transform (DCT) operation i,j The high-frequency signal caused by the backdoor attack is filtered out using a designed low-pass filter H(z), thus obtaining the processed sample D′. i,j ;

[0070] The local training submodule is used for each terminal c i ∈C is based on the preprocessed data sample D′ i,j Perform local model training to obtain the local model for the current iteration r.

[0071] The local model update calculation submodule is used for each terminal c i ∈C computes the local model update for the current iteration r.

[0072] The local model update encryption submodule is used for each terminal c i ∈C updates the computed local model Perform homomorphic encryption to obtain the encrypted local model update.

[0073] Parallel training submodule, for each terminal c i Local model training is performed in parallel within C;

[0074] The local model update and upload submodule is used for each terminal c i ∈C will update the calculated encryption. Uploaded to the server;

[0075] The server operation module is used for updating the received local model on the server side. Anomaly detection is performed to remove malicious model uploads and updates, while legitimate model uploads and updates are federated and aggregated. After T iterations, the final global model is obtained. Specifically, it includes the following sub-modules;

[0076] The local model update receiving submodule is used to receive updates from each terminal c. i The local model update uploaded by ∈C in the current iteration round r

[0077] The pre-aggregated global model submodule is used to process each received terminal c i Local model update of ∈C Perform pre-aggregation operations to obtain a pre-aggregated global model

[0078] The cosine similarity calculation submodule is used to calculate the cosine similarity for each terminal c. i ∈C local model With pre-aggregated global model Cosine similarity S between i ;

[0079] The anomaly detection submodule is used to detect anomalies in each terminal c based on a pre-set threshold γ. i The upload and update of ∈C are judged, and malicious uploads and updates are deleted.

[0080] The temporary global model calculation submodule is used to upload and update the remaining data. Perform aggregation operations to obtain a temporary global model

[0081] The temporary global model perturbation submodule is used to combine differential privacy techniques with the obtained temporary global model. Perturbation is applied to obtain the perturbed global model.

[0082] The global model distribution submodule is used to distribute the trained global model. Send to each selected terminal c i ∈C, proceed to the next round of iterative training;

[0083] The iterative training submodule is used to iterate the entire global model training process to obtain a global model after T iterations.

[0084] The beneficial effects of this invention are as follows:

[0085] (1) This invention can effectively mitigate the impact of backdoor attacks on model training by designing a low-pass filter to filter out high-frequency signals generated by backdoor samples before model training.

[0086] (2) By designing a cosine similarity calculation formula in the pre-aggregation stage, this invention can effectively screen out malicious upload updates and delete them, while ensuring the normal collaborative aggregation process of clean upload updates.

[0087] (3) By perturbing the global model in the global aggregation stage, this invention can effectively defend against backdoor attacks based on the global model that are more harmful. The process has low implementation complexity and can be combined with other data preprocessing defense methods to achieve backdoor attack defense operations.

[0088] (4) The implementation process of this invention includes data spectrum filtering, differential privacy mechanism, etc., which reduces computational complexity, has low system resource consumption, is easy to implement efficiently, and has important market value.

[0089] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0090] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0091] Figure 1 The overall flow of the federated learning backdoor attack defense method provided in the embodiments of the present invention;

[0092] Figure 2 A detailed flowchart of the backdoor attack defense method based on federated learning provided for embodiments of the present invention;

[0093] Figure 3 A schematic diagram of a federated learning backdoor attack defense system provided in an embodiment of the present invention;

[0094] Figure 4 A schematic diagram illustrating the working principle of the federated learning backdoor attack defense method provided in this embodiment of the invention. Detailed Implementation

[0095] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0096] Please see Figures 1-4 The following example illustrates the specific implementation steps of this invention using 100 hospitals using their own X-ray image data to jointly train a global pneumonia detection model. The goal is to defend against backdoor attacks during the model training process while protecting hospital data privacy.

[0097] The method provided by this invention can be automated using computer software technology. Figure 1 This is a flowchart illustrating the overall method of an embodiment of the present invention. See also: Figure 1 , combined Figure 2 Detailed flowchart of specific steps in embodiments of the present invention and Figure 4 The working principle diagram of this invention embodiment shows the specific steps of an embodiment of the federated learning backdoor attack defense method of this invention, which include:

[0098] Step S1, Initialization: Randomly select n terminals from all N terminals participating in training, and initialize the global model. Distribute to the selected n terminals, including the following sub-steps:

[0099] In this embodiment, 100 hospitals participate in training the global model. It is assumed that 10 terminals are randomly selected to participate in global aggregation in each communication iteration. A ResNet18 neural network is used as the base model for both the global and local models. This network consists of 18 weighted layers, including convolutional and fully connected layers. The global model is initialized and distributed to the 10 selected terminals. The specific implementation is as follows:

[0100] Step S11, initialize global model parameters The total number of terminals participating in training N, the total number of terminals used for global aggregation in each round n, and the corresponding terminal set C = {c1, c2, ..., c n The total number of global training communication rounds T, the total number of local training rounds E, the batch size during training (batch_size), and the batch size during testing (test_batch_size) are all specified.

[0101] In this embodiment, global model parameters are randomly initialized. Suppose that the weight parameters of a certain layer in the initial model parameters are: The total number of terminals is N = 100, the number of terminals used for aggregation in each round is n = 10, the randomly selected terminal set is represented as C = {8, 9, ..., 58} (where the numbers represent the terminal numbers), the total number of global communication rounds is T = 300, the number of local training rounds is E = 3, the batch size during the training phase is batch_size = 64, and the batch size during the testing phase is test_batch_size = 100.

[0102] Step S12, set the global model parameters Distributed to each terminal c in C i .

[0103] In this embodiment, global model parameters Initialization complete, relevant hyperparameter settings complete. Global model parameters... Distribute to each terminal in C = {8, 9, ..., 58}.

[0104] Step S2, Local Model Update: Each terminal c i ∈C is the global model received from the previous communication round r-1. Update the local model for the current communication round r.

[0105]

[0106] Where r = 1, 2, ..., T, and i represents the i-th terminal.

[0107] In this embodiment, the terminal receives global model parameters. Each terminal C = {8, 9, ..., 58} uses global model parameters. To override local model parameters

[0108] Step S3, Local Data Spectrum Filtering: Each terminal c i ∈C will use their respective local training data D i The process involves transforming the signal from the time domain to the frequency domain and using the IIR low-pass filter designed in step S3-2 to filter out high-frequency signals generated by backdoor samples. This mitigates the impact of backdoor attacks on local training in federated learning, enabling terminal c to... i For example, it includes the following sub-steps:

[0109] Step S31, terminal c i Before local training, the local dataset D i =d i,1 ,d i,2 ,...,d i,zTransform from the time domain to the frequency domain, where d i,z Let c represent the z-th sample from the i-th terminal. Specifically, terminal c i D i Each sample d in i,j The transformed sample U is obtained by performing a two-dimensional DCT discrete cosine transform. i,j Where i represents the i-th terminal and j represents the j-th sample;

[0110] In this embodiment, the local dataset of terminal c8 is an X-ray image dataset, denoted as D8 = d 8,1 ,d 8,2 ,…,d 8,z Assuming the first image data is Where d 8,1 This represents the first sample from the 8th terminal, where each item d in the local dataset... 8,1 It contains samples and labels. The dataset D8 contains d... 8,z The sample can be transformed by two-dimensional DCT to obtain

[0111]

[0112] Among them, U 8,1 This represents the result of converting the first sample of the 8th terminal to the frequency domain;

[0113] Step S32, using the determined sampling frequency f samp , passband cutoff frequency f p Stopband cutoff frequency f s α passband attenuation p Stopband attenuation α s The design of an IIR low-pass filter considers five key parameters. Specifically, the first step is to determine the passband cutoff frequency f. p and stopband cutoff frequency f s Normalization operations are performed to obtain the normalized passband cutoff frequency ω. p and the normalized stopband cutoff frequency ω s :

[0114] ω p =f p / (f samp / 2)

[0115] ω s =f s / (f samp / 2)

[0116] Secondly, ω p and ω s Converted into analog filter index Ω respectively p and Ω s :

[0117]

[0118] Then, Ω p Ω s α p α s By substituting the following attenuation function and frequency response function, the filter order R and 3dB cutoff frequency Ω can be calculated. c It is worth noting that due to the smaller passband attenuation α p It can retain more information in the passband and has a larger stopband attenuation α s This can better suppress signals or noise within the stopband; therefore, α is usually chosen. p =1, α s =20;

[0119] α(Ω)=-10lg|H(jΩ)| 2

[0120]

[0121] The calculated filter order R and 3dB cutoff frequency Ω c They are represented as follows:

[0122]

[0123]

[0124] Finally, the filter order R and Ω c Substituting the transfer function H(s) of the low-pass filter, we obtain the designed digital low-pass filter H(z):

[0125]

[0126] The transfer function H(s) of the low-pass filter is:

[0127] In this embodiment, an IIR low-pass filter is designed. Five metrics are determined: f samp =1000, f p =150, f s =250, α p =1, α s =20. For the passband cutoff frequency f p and stopband cutoff frequency f s Normalization operations are performed to obtain ω. p and ω s :

[0128] ω p =f p / (fsamp / 2)=0.3

[0129] ω s =f s / (f samp / 2)=0.5

[0130] ω p and ω s Converted into analog filter index Ω respectively p and Ω s :

[0131]

[0132] Ω p Ω s α p α s By substituting the attenuation function and the frequency response function, the filter order R and the 3dB cutoff frequency Ω can be calculated. c They are respectively:

[0133]

[0134]

[0135] The calculated filter order R and Ω c Substitute s k The coefficient vectors a and b of the transfer function H(s) of the analog low-pass filter are obtained as follows:

[0136] a=[1.00000000e+00 1.30707814e+03 8.54226636e+05 3.53929304e+089.77616843e+10 1.71195634e+13 1.49894845e+15]

[0137] b = [1.49894845e + 15]

[0138] Will Substituting these values, we can obtain the coefficient vectors a0 and b0 of the digital low-pass filter:

[0139] a0=[1.00000000e+00 1.30707814e+03 8.54226636e+05 3.53929304e+089.77616843e+10 1.71195634e+13 1.49894845e+15]

[0140] b0 = [1.49894845e + 15]

[0141] Step S33: Utilize the designed low-pass filter H(z) and the data sample U obtained from step S3-1. i,j A filtering operation is performed to remove the high-frequency signals generated by the backdoor sample, thereby obtaining the processed data sample D′. i,j :

[0142] D′ i,j =U i,j ×H(z).

[0143] In this embodiment, the designed low-pass filter is H. z The sample is U 8,1 , for U 8,1 The filtering operation yields D′ 8,1 :

[0144]

[0145] Step S4, Local Model Training: Each terminal c i ∈C Local dataset D′ after spectrum filtering i,j Perform local model training to obtain the local model in the current iteration round r.

[0146]

[0147] in, This represents the global model in the previous communication round r-1, where η represents the learning rate. This represents the loss function used for training the local model. It is worth noting that the cross-entropy loss function is used here.

[0148] In this embodiment, terminal c8 uses the local dataset D′ after spectrum filtering. 8,j Training a local model:

[0149]

[0150] Step S5, Local model update transmission: Each terminal c i ∈C is based on the local model obtained through training Calculate its local model update And on Encryption is performed, and the encrypted local model is updated. Uploaded to the server, using terminal c i For example, it includes the following sub-steps:

[0151] Step S51, terminal c i Calculate its local model update

[0152]

[0153] In this embodiment, the local update is calculated:

[0154] Step S52, terminal c i Update the local model trained using the key pairs issued by the server. Perform encryption to obtain the encrypted model update. It is worth noting that, in order to facilitate the subsequent calculation of cosine similarity, the local model needs to be modified here. Normalization is performed before encryption.

[0155] In this embodiment, the server generates a key pair containing a public key pk = 5543540506872093177741135 and a private key sk = 6970926632250729971387509, and shares this key pair with the terminal. The terminal uses the public key pair to upload updates. Encryption is performed to obtain To facilitate subsequent calculation of cosine similarity, the local model is also modified here. Normalize and then encrypt to obtain

[0156] Step S53, each terminal c i Upload the encrypted local model update after step S5-2

[0157] In this embodiment, the terminal will perform encrypted partial updates. Upload to the server for processing.

[0158] Step S6, Malicious Local Update Filtering: The server filters each received terminal c i Encrypted local update uploaded by ∈C Perform pre-aggregation operations to obtain a pre-aggregated global model Meanwhile, each terminal c i Calculate their local model updates separately Compared with the pre-global model Cosine similarity S between i And the obtained cosine similarity S i The value is compared with the set threshold γ to delete malicious local updates, including the following sub-steps:

[0159] Step S61: Update all uploaded local models Performing pre-aggregation operations yields the pre-aggregated global model for the r-th round of communication iterations.

[0160]

[0161] in, Let denot be the global encryption model in the (r-1)th round, η be the learning rate, and |D| be the global encryption model. i | indicates terminal c i The size of the local dataset.

[0162] In this embodiment, the server receives all partial updates. The pre-aggregation operation is performed as follows:

[0163]

[0164] Step S62, calculate c for each terminal i Encrypted local model With pre-aggregated global model Cosine similarity S between i :

[0165]

[0166] Where cos(·) represents the function for calculating cosine similarity, and the similarity S i The value range of S is [-1, 1]. i A value of -1 indicates complete dissimilarity, while a value of 1 indicates complete similarity.

[0167] In this embodiment, the cosine similarity is calculated as follows: Calculate the cosine similarity of the 10 terminals and decrypt it as S = [0.5, 0.4, 0.7, 0.8, 0.2, 0.1, 0.93, 0.23, 0.96, 0.9].

[0168] Step S63, based on the cosine similarity value S calculated in step S62 i When S is compared with a pre-set threshold γ, i When >γ, it indicates that the model update is being uploaded. terminal c i If it is a malicious terminal, delete it. This prevents it from participating in global aggregation operations. Conversely, when S... i When ≤γ, it indicates that the model update is uploaded. terminal c i As a normal terminal, it will continue to participate in subsequent operations. It is worth noting that the threshold γ needs to be set in a trade-off between model performance and backdoor defense effectiveness, to obtain the optimal value.

[0169] In this embodiment, a threshold γ = 0.95 is set, where the cosine similarity of the 9th terminal is greater than the threshold, and we determine that the upload / update is successful. It is a malicious terminal and was removed from the received uploaded updates.

[0170] Step S7, Temporary global model calculation: Update the remaining uploads. Perform aggregation operations to obtain a temporary global model

[0171]

[0172] in, Let |D| represent the global model parameters of the previous iteration, η represent the learning rate, k represent the remaining number of terminals participating in the aggregation, and |D| represent the number of terminals participating in the aggregation. i | indicates terminal c i The size of the local dataset.

[0173] In this embodiment, the remaining upload updates are aggregated to obtain a temporary global model.

[0174]

[0175] in, This represents the initial global model parameters, where η represents the learning rate of federated learning, η = 10, and D i,z Indicates terminal c i The number of local datasets, where k is the number of remaining terminals participating in the aggregation.

[0176] Step S8, Temporary Global Model Perturbation: Combine differential privacy techniques to perturb the obtained temporary global model. By applying perturbations, the final global model is obtained.

[0177] In this embodiment, differential privacy technology is used to perturb the obtained temporary global model by adding Gaussian noise, as follows.

[0178]

[0179] Where N(0,σ) 2 ) represents a value centered at 0 with variance σ. 2 Sampling from a Gaussian distribution, δ represents the relaxation term, which takes the value δ∈(0,1).

[0180] Step S9, the final global model. Repeat steps S12 to S8 repeatedly for T iterations to obtain the final global model.

[0181] In this embodiment, steps S12 to S8 are repeated continuously. After 300 rounds of iterative training on both the server and terminal, the final global model is obtained.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for defending against federated learning backdoor attacks, characterized in that, First, the terminal performs data preprocessing before executing local training, converting the data from the time domain to the frequency domain, and designing a low-pass filter to filter out high-frequency signals brought by backdoor samples in the data; Secondly, malicious uploads and updates are detected on the server side. The cosine similarity between the pre-global model and the local model is calculated, and a threshold is set to filter out malicious uploads and updates to the local model. Finally, a global aggregation operation is performed on the remaining non-malicious uploads and updates to obtain the updated global model, and the obtained global model is perturbed using differential privacy technology. The method specifically includes the following steps: S1: Initialization: Randomly select n terminals from all N terminals participating in training, and initialize the global model. Distribute to the selected n terminals; S2: Local model update: per terminal c i ∈C is the global model received from the previous communication round r-1. Update the local model for the current communication round r. Where the terminal set C = {c1, c2, ..., c n }, r = 1, 2, ..., T, where r represents the global communication iteration round and T represents the total number of global training communication rounds; S3: Local data spectrum filtering: for each terminal c i ∈C will each have their own local training dataset D i The signal is converted from the time domain to the frequency domain, and the high-frequency signal generated by the backdoor sample is filtered according to the designed low-pass filter. S4: Local model training: per terminal c i ∈C Local dataset D′ after spectrum filtering i,j Perform local model training to obtain the local model in the current iteration round r. S5: Local model update transmission: per terminal c i ∈C is based on the local model obtained through training Calculate its local model update And on Encryption is performed, and the encrypted local model is updated. Upload to the server; S6: Malicious Local Update Filtering: The server filters each received terminal update. i Encrypted local update uploaded by ∈C Perform pre-aggregation operations to obtain a pre-aggregated global model Meanwhile, each terminal c i Calculate their local model updates separately Compared with the pre-global model Cosine similarity S between i And the obtained cosine similarity S i The value is compared with the set threshold γ, and malicious local updates are deleted; S7: Temporary global model calculation: Update the remaining uploads Perform aggregation operations to obtain a temporary global model S8: Temporary Global Model Perturbation: Combining differential privacy techniques with the obtained temporary global model By perturbing the model, we obtain the perturbed global model. S9: Final Global Model: Repeat the above steps continuously for T iterations to obtain the final global model.

2. The federated learning backdoor attack defense method according to claim 1, characterized in that, In step S3, local data spectrum filtering specifically includes the following steps: S31: Terminal c i Before local training, the local dataset D i =d i,1 ,d i,2 ,...,d i,z Transform from the time domain to the frequency domain, where d i,z This represents the z-th sample from the i-th terminal; specifically: terminal c i D i Each sample d in i,j The transformed sample U is obtained by performing a two-dimensional DCT discrete cosine transform. i,j Where i represents the i-th terminal and j represents the j-th sample; S32: By a determined sampling frequency f samp , passband cutoff frequency f p Stopband cutoff frequency f s α passband attenuation p and stopband attenuation α s The design of an IIR low-pass filter specifically involves: first, setting the passband cutoff frequency f... p and stopband cutoff frequency f s Normalization operations are performed to obtain the normalized passband cutoff frequency ω. p and the normalized stopband cutoff frequency ω s : oh p =f p / (f samp / 2) oh s =f s / (f samp / 2) Secondly, ω p and ω s Converted into analog filter index Ω respectively p and Ω s : Then, Ω p Ω s α p α s Substituting the following attenuation function and frequency response function, calculate the filter order R and 3dB cutoff frequency Ω. c ; α(Ω)=-10lg|H(jΩ)| 2 Where Ω represents the variable in the decay function, H(jΩ) represents the frequency response function, and α(Ω) represents the decay function; The calculated filter order R and 3dB cutoff frequency Ω c They are represented as follows: Finally, the filter order R and Ω c Substituting the transfer function H(s) of the low-pass filter, we obtain the designed digital low-pass filter H(z): The transfer function H(s) of the low-pass filter is: z represents the z-plane, through which... The analog low-pass filter is replaced and converted into a digital low-pass filter. S33: Using the low-pass filter H(z) designed in step S32 and the data sample U obtained from the conversion in step S31 i,j A filtering operation is performed to remove the high-frequency signals generated by the backdoor sample, thereby obtaining the processed data sample D′. i,j :D′ i,j =U i,j ×H(z).

3. The federated learning backdoor attack defense method according to claim 1, characterized in that, In step S4, the local model in the current iteration round r is obtained. The calculation formula is: in, This represents the global model in the previous communication round r-1, where η represents the learning rate. This represents the loss function for training the local model.

4. The federated learning backdoor attack defense method according to claim 1, characterized in that, In step S5, the local model update transmission specifically includes the following steps: S51: Terminal c i Calculate its local model update S52: Terminal c i Update the local model trained using the key pairs issued by the server. Perform encryption to obtain the encrypted model update. S53: Each terminal c i Upload the encrypted local model update after step S52 5. The federated learning backdoor attack defense method according to claim 1, characterized in that, Step S6, the malicious local update screening specifically includes the following steps: S61: Update all uploaded local models Perform a pre-aggregation operation to obtain the pre-aggregated global model for the r-th round of communication iteration. in, Let denot be the global encryption model in the (r-1)th round, η be the learning rate, and |D| be the global encryption model. i | indicates terminal c i The size of the local dataset; S62: Calculate c for each terminal i Encrypted local model With pre-aggregated global model Cosine similarity S between i : Where cos(·) represents the function for calculating cosine similarity, and the similarity S i The value range of S is [-1, 1]. i A value of -1 indicates complete dissimilarity, while a value of 1 indicates complete similarity. S63: The cosine similarity value S calculated based on step S62. i When S is compared with a pre-set threshold γ, i When >γ, it indicates that the model update is being uploaded. terminal c i If it is a malicious terminal, delete it. It prevents it from participating in global aggregation operations; conversely, when S i When ≤γ, it indicates that the model update is uploaded. terminal c i It is a normal terminal and will continue to participate in subsequent operations.

6. The method for defending against federated learning backdoor attacks according to claim 1, characterized in that, In step S7, the temporary global model The calculation formula is: in, Let |D| represent the global model parameters of the previous iteration, η represent the learning rate, k represent the remaining number of terminals participating in the aggregation, and |D| represent the number of terminals participating in the aggregation. i | indicates terminal c i The size of the local dataset.

7. The federated learning backdoor attack defense method according to claim 1, characterized in that, In step S8, the perturbed global model is obtained. in, This represents the temporary global model obtained in step S7, where Enc(·) represents the homomorphic encryption function, and N(0,σ) represents the temporary global model obtained in step S7. 2 () represents Gaussian noise; δ represents the relaxation term, with values ​​δ∈(0,1); Δf represents the L2 sensitivity, and ∈ represents the privacy budget, which is negatively correlated with the intensity of noise.

8. The federated learning backdoor attack defense method according to any one of claims 1 to 7, characterized in that, Backdoor attack defense systems applicable to this method include: an initialization module, a local operation module, and a server operation module; The initialization module is used to initialize global model parameters. The total number of terminals participating in training N, the total number of terminals used for global aggregation in each round n, and the terminal set C = {c1, c2, ..., c n The parameters initialized are: total number of global communication rounds T, total number of local training rounds E, batch size during training (batch_size), and batch size during testing (test_batch_size). These parameters are then broadcast to each terminal c participating in the training. i ; The local operation module is used for each terminal c i Based on the local training data D′ after spectrum filtering i,j Perform local model training and update the encrypted local model for the current iteration r. Uploaded to the server, specifically including the following sub-modules: The global model receiving submodule is used for the set C = {c1, c2, ..., c...} n All terminals in the process receive the global model parameters from the previous iteration (r-1) sent by the server. And utilize global model parameters Update local model parameters The spectrum filtering submodule is used to filter the spectrum of each terminal before local model training. i Local training data sample d ∈C i,j Convert to the frequency domain U using Discrete Cosine Transform (DCT) operation i,j The high-frequency signal caused by the backdoor attack is filtered out using a designed low-pass filter H(z), thus obtaining the processed sample D′. i,j ; The local training submodule is used for each terminal c i ∈C is based on the preprocessed data sample D′ i,j Perform local model training to obtain the local model for the current iteration r. The local model update calculation submodule is used for each terminal c i ∈C computes the local model update for the current iteration r. The local model update encryption submodule is used for each terminal c i ∈C updates the computed local model Perform homomorphic encryption to obtain the encrypted local model update. Parallel training submodule, for each terminal c i Local model training is performed in parallel within C; The local model update and upload submodule is used for each terminal c i ∈C will update the calculated encryption. Uploaded to the server; The server operation module is used for updating the received local model on the server side. Anomaly detection is performed to remove malicious model uploads and updates, while legitimate model uploads and updates are federated and aggregated. After T iterations, the final global model is obtained. Specifically, it includes the following sub-modules; The local model update receiving submodule is used to receive updates from each terminal c. i The local model update uploaded by ∈C in the current iteration round r The pre-aggregated global model submodule is used to process each received terminal c i Local model update of ∈C Perform pre-aggregation operations to obtain a pre-aggregated global model The cosine similarity calculation submodule is used to calculate the cosine similarity for each terminal c. i ∈C local model With pre-aggregated global model Cosine similarity S between i ; The anomaly detection submodule is used to detect anomalies in each terminal c based on a pre-set threshold γ. i The upload and update of ∈C are judged, and malicious uploads and updates are deleted. The temporary global model calculation submodule is used to upload and update the remaining data. Perform aggregation operations to obtain a temporary global model The temporary global model perturbation submodule is used to combine differential privacy techniques with the obtained temporary global model. Perturbation is applied to obtain the perturbed global model. The global model distribution submodule is used to distribute the trained global model. Send to each selected terminal c i ∈C, proceed to the next round of iterative training; The iterative training submodule is used to iterate the entire global model training process to obtain a global model after T iterations.

Images