A federated machine learning method for cross-round confrontation backdoor malicious attacks based on an OPTICS algorithm

Abstract

The application provides a federated machine learning method for cross-round confrontation of backdoor malicious attacks based on an OPTICS algorithm. The method distinguishes the node gradient of the node participating in aggregation in each iteration through OPTICS clustering, and sorts the participating nodes according to the clustering result. On this basis, the concept of credit score is introduced, and the nodes at the back of the queue are reduced in the score, and the nodes at the front of the queue are increased in the score in each round of aggregation, so as to realize the comparison of nodes across iterations. The nodes with credit scores lower than a certain threshold will be excluded from the calculation process of federated gradient aggregation, and the remaining nodes will normally participate in the aggregation calculation. After the new global parameters are calculated, the server will distribute the new global parameters to all users, and each user will train the model parameters in the next round according to the received central model parameters. Compared with other federated learning algorithms, the method can realize the identification of backdoor malicious attackers across rounds and eliminate the influence.

Description

Technical Field

[0001] This invention belongs to the field of federated learning in artificial intelligence, and in particular relates to methods for combating backdoor malicious attacks in federated learning. Background Technology

[0002] Federated learning is a distributed machine learning technique. Its core idea is to train models in a distributed manner across multiple data sources that have local data. Without exchanging local individual or sample data, it constructs a global model based on virtual fused data by exchanging model parameters or intermediate results. This achieves a balance between data privacy protection and data sharing computation, namely, a new application paradigm of "data is available but not visible" and "the model moves while the data does not move".

[0003] Federated machine learning algorithms train and maintain local models at distributed user sites using local user data and data distributed from a central server, and periodically transmit local model parameters to the central server. The central server aggregates model parameters from different users using some method to obtain central model parameters, and then distributes the central model parameters to each user for updating their local models.

[0004] Since the advent of federated learning, the threat of backdoor attacks has persisted due to its distributed, multi-client communication characteristics. If a backdoor attack occurs while aggregating local models from different clients, the central server will aggregate the false parameters sent by the attacker along with those uploaded by trustworthy nodes, contaminating the model, worsening training performance, and potentially even completely destroying it when the number of attackers is large. Therefore, it is crucial to design effective methods to address backdoor attacks in federated learning, identify and eliminate the influence of malicious attackers, and ensure the effectiveness of the trained model. Over the years, researchers have proposed numerous algorithms based on FedAvg to address this problem, such as MultiKrum and foolsGold. However, the analysis modules in these algorithms perform poorly on some datasets, such as binary classification datasets like bank credit card datasets. Furthermore, these algorithms are suitable for a sampling rate C=1, where all nodes participate in training in each round. However, in real-world production applications, federated learning involves numerous nodes, and the central server only needs to collect results from a subset of nodes in each round to complete the aggregation (i.e., sampling rate C<1). In such cases, the aforementioned algorithms are difficult to apply.

[0005] OPTICS (Ordering Points To Identify the Clustering Structure) is a clustering algorithm that improves upon the DBSCAN algorithm. It addresses the DBSCAN algorithm's tendency to overlook "noise" points that could potentially form clusters. OPTICS introduces two new concepts: core distance and reachability distance. Core distance refers to the distance between a given point and the minimum number of points (MinPts) required to form a cluster. Reachability distance is the distance between two points. Using these two distances, OPTICS constructs two lists: one storing the core distance for each point, and the other storing reachability scores calculated using the reachability distance. Clustering is then based on peaks and troughs in the reachability scores. Currently, there is no precedent for using OPTICS in federated learning algorithms. Summary of the Invention

[0006] Technical issue: In federated learning algorithms based on federated machine learning, each node user trains its local dataset according to its own database to obtain local model parameters, and then transmits the local model parameters to the central server. The central server aggregates the model parameters of all users to generate a central model, which is then distributed to users for the next round of model training.

[0007] Due to its distributed, multi-client communication characteristics, the central server is vulnerable to backdoor attacks launched by malicious attackers, and the model obtained by direct aggregation is severely contaminated.

[0008] To address the aforementioned technical problems, this invention provides a federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm. The method uses the core distance calculated by the OPTICS algorithm to rank the training nodes in each round, and then uses a credit score mechanism to compare the integrity of the models across rounds, ultimately eliminating malicious attackers.

[0009] Technical solution

[0010] A federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm is characterized by: using the OPTICS algorithm to evaluate the honesty of the training nodes and calculate their credit scores, excluding nodes with credit scores below a threshold, and eliminating the influence of malicious nodes as much as possible.

[0011] Specifically, the steps include the following:

[0012] Step 10: The randomly selected training users receive the global parameters sent by the central server, use machine learning algorithms to train and update the local model, and then upload the updated local model parameters to the central server.

[0013] Step 20: After receiving the user's local model parameters, the central server uses the OPTICS algorithm to calculate the received local model parameters and updates the credit score of each node based on the calculation results.

[0014] Step 30: The central server, based on the threshold set by the system and the credit scores of each participating user, excludes nodes with credit scores below the threshold, and aggregates the remaining nodes according to the federated averaging algorithm to obtain a new round of global parameters.

[0015] Further: In step 20, the OPTICS algorithm is used to calculate the local model parameters, and the method for updating the credit score of each node based on the calculation results is as follows:

[0016] Step 201: The central server uses the OPTICS algorithm to calculate the received local model parameters and obtain the sorting result orderList of the training nodes in this round;

[0017] Step 202: The central server updates the credits of all participating nodes in this round based on the sorting result orderList;

[0018] Further: The method for calculating the sorting result orderList of the uploaded nodes in step 201 is as follows:

[0019] Step 2011: The central server loads the model parameter data from the upload node.

[0020] Step 2012: Use the OPTICS algorithm to process the model parameter data. Perform clustering calculations to obtain the core distance of each node;

[0021] Step 2013: Sort the core distances of each node in ascending order to obtain the sorted result orderList.

[0022] Further: The method for updating the credits of all participating nodes in this round based on the sorting result orderList in step 202 is as follows:

[0023] Step 2021: Calculate the number n of nodes that changed credit scores in this round. prop

[0024] n prop =th×C×K

[0025] Where th represents the overall threat level, and its value should be the proportion of malicious backdoor attackers to the total number of training nodes (not exceeding 50%); C represents the sampling rate, which is the proportion of training nodes in each round to the total number of nodes; and K represents the total number of nodes.

[0026] Step 2022: Update the credit score of the participating nodes in this round of training according to the sorting result orderList, and sort the first n nodes in orderList. prop Each node adds a credit score α to the next n nodes in the orderList. prop Each node's credit score α is reduced, resulting in the updated credit scores (credits) for each participating node. The value of α is determined by the node's position (i) in the orderList, specifically:

[0027]

[0028] Where β is a parameter, which is generally taken as 1;

[0029] Step 2023: Standardize the updated credit scores of each node to be within the range of [-2β, 2β] to avoid extreme values ​​interfering with subsequent calculations.

[0030] Further: In step 30, the method for excluding nodes with credit scores below the threshold and aggregating the remaining nodes using the federated averaging algorithm to obtain the new round of global parameters is as follows:

[0031] Step 301: Calculate the lowest credit score (min credits) among the participating nodes in this round of training;

[0032] Step 302: Iterate through the credit scores (credits) of all participating nodes in this round of training. If a participating node's credit score equals the minimum credit score (min credits) and is less than the system's set threshold M, then remove that node from the set S participating in the aggregation calculation for this round. r Delete it. The threshold M is typically set to M=1.

[0033] Step 303: Perform federated averaging on the remaining nodes to obtain the new round of global parameters:

[0034]

[0035] Beneficial effects

[0036] This invention calculates the ranking of training nodes in each round using the OPTICS algorithm, and then compares the integrity of all nodes across rounds through a globally effective credit score mechanism, thereby effectively identifying malicious attackers and protecting the federated learning model from or reducing the impact of malicious attackers. Attached Figure Description

[0037] Figure 1 This is a schematic diagram illustrating the sorting of training nodes in each round based on the OPTICS algorithm in an embodiment of the present invention;

[0038] Figure 2 This is a schematic diagram of the cross-round credit scoring mechanism according to an embodiment of the present invention;

[0039] Figure 3 This is a schematic diagram illustrating a malicious attack method simulated during the verification process of an embodiment of the present invention;

[0040] Figure 4 This is a graph showing the experimental results of simulating the impact of different numbers of attackers on the FedAvg algorithm on the GERMAN CREDIT dataset during the verification process of this invention embodiment;

[0041] Figure 5 This is the accuracy result of the method (OrderedOptics) proposed in this invention and other comparison algorithms in the malicious attack resistance experiment on the GERMAN CREDIT training set during the verification process of the embodiments of this invention;

[0042] Figure 6 This is the recall result of the method (OrderedOptics) proposed in this invention and other comparison algorithms in the malicious attack resistance experiment on the GERMAN CREDIT training set during the verification process of the embodiments of this invention;

[0043] Figure 7 This is the accuracy result of the method (OrderedOptics) proposed in this invention compared with other comparative algorithms in a malicious attack resistance experiment on the GERMAN CREDIT training set during the verification process of this invention embodiment;

[0044] Figure 8 This is the F1 score result of the method (OrderedOptics) proposed in this invention and other comparison algorithms in the malicious attack resistance experiment on the GERMAN CREDIT training set during the verification process of the embodiments of this invention. Detailed Implementation

[0045] The technical solutions provided in this application will be further described below with reference to specific embodiments and accompanying drawings. The advantages and features of this application will become clearer from the following description.

[0046] This invention provides a federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm. The method is characterized by: the OPTICS algorithm calculating the ranking of the training nodes in each round, and then using a globally effective credit score mechanism to compare the integrity of all nodes across rounds, thereby effectively identifying malicious attackers and protecting the model from or reducing the impact of malicious attackers.

[0047] like Figure 1 This is a schematic diagram illustrating the sorting of training nodes in each round based on the OPTICS algorithm in an embodiment of the present invention;

[0048] like Figure 2 This is a schematic diagram of the cross-round credit scoring mechanism according to an embodiment of the present invention;

[0049] Combined with appendix Figure 1 , 2 The algorithm aggregation diagram and related formulas further describe the design of the present invention. A federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm includes the following steps:

[0050] Step 10: The randomly selected training users receive the global parameters sent by the central server, use a certain machine learning algorithm to train and update the local model, and then upload the updated local model parameters to the central server.

[0051] For example, in a cross-bank credit card data federation processing center, each bank uses its credit card transaction data to train a model and then passes the new model parameters to the processing center's server.

[0052] During the t-th training round, there are global gradient parameters. And N bank nodes A1, A2, A3…A N They uploaded their respective local model parameters WC1, WC2, WC3…WC N .

[0053] At the start of training, there is one or more malicious attackers B1, B2, B3...B N It infiltrated this federated learning cluster, posing as a legitimate participating bank, and also obtained global parameters issued by the central server. And it falsified the local model parameters WF1, WF2, WF3…WF N Uploaded to the central server.

[0054] The central server cannot directly distinguish between parameters uploaded by malicious attackers and parameters uploaded by trustworthy banks. Therefore, from the central server's perspective, it receives data from nodes UN1, UN2, UN3...UN NUploaded model parameters WL1, WL2, WL3…WL N .

[0055] Step 201: The central server uses the OPTICS algorithm to calculate the received local model parameters and obtain the sorting result orderList of the training nodes in this round;

[0056] In this example of credit card data processing, during the t-th round of training, there are N unknown nodes UN1, UN2, UN3…UN N They uploaded their respective local model parameters WL1, WL2, WL3…WL N .

[0057] The central server loads the local model parameters WL1, WL2, WL3…WL uploaded by each training node. N Then, the OPTICS algorithm is used to obtain the clusters of each training node.

[0058] The central server sorts the training nodes based on the core distance of the cluster. Specifically, the core distance is calculated as follows: for any point P among the training nodes, the core distance of point P is the distance disP from the farthest point r in the neighborhood centered on P to point P. The core distance represents the average distance of each node in the cluster, acting as the cluster core, to other nodes. The smaller this average distance, the greater its similarity to other nodes. Therefore, based on the core distance of each node, these nodes are sorted from smallest to largest, resulting in the sorted list orderList.

[0059] Step 202: The central server updates the credits of all participating nodes in this round based on the sorting result orderList;

[0060] The central server stores the credits of all nodes. For example, credits[1] represents the credit of the unknown node UN1. Every time UN1 uploads parameters, although the central server does not know the specific identity of UN1, it knows that UN1 uploaded the parameters. Therefore, these credits will be permanently stored in the central server until all rounds of training in this federated learning are completely finished. Even if the unknown node UN1 is not selected by the central server to participate in some rounds, its credits[1] will still be saved and will not be cleared. If it is the first round of training, the central server will initialize the credits of all nodes to 0.

[0061] In this example of credit card data processing, during the t-th training round, we have UN1, UN2, UN3…UN N The unknown nodes uploaded their respective local model parameters WL1, WL2, WL3…WL N Moreover, the global gradient parameter at this time is Credit is divided into credits[N].

[0062] Step 2021: Calculate the number n of nodes that changed credit scores in this round. prop

[0063] n prop =th×C×K

[0064] Where th represents the overall threat level, and its value should be the proportion of malicious backdoor attackers to the total number of training nodes (not exceeding 50%); C represents the sampling rate, which is the proportion of training nodes in each round to the total number of nodes; and K represents the total number of nodes.

[0065] Step 2022: Based on the sorting result orderList obtained in step 201, sort the first n elements in orderList... prop Each node adds a credit score, i.e., credits[i] = credits[i] + α, and then n prop Each node reduces its credit score, i.e., credits[i] = credits[i] - α.

[0066] The formula for calculating α is:

[0067]

[0068] Where β is a parameter, typically taken as 1.

[0069] Step 2023: Standardize the updated credit scores of each node to be within the range of [-2β, 2β] to avoid extreme values ​​interfering with subsequent calculations.

[0070] Step 30: The central server, based on the threshold set by the system and the credit scores of each participating user, excludes nodes with credit scores below the threshold, and aggregates the remaining nodes according to the federated averaging algorithm to obtain a new round of global parameters.

[0071] In this example of credit card data processing, during the t-th round of training, in step 202, the training nodes UN1, UN2, UN3…UN have already been calculated. N The new credit score is credits[N].

[0072] Calculate the lowest credit score (min credits) among the participating nodes in this round. Iterate through the credit scores (credits[N]) of all participating nodes in this round and find the node i whose credit score is lower than the lowest credit score (min credits) and less than the system-set threshold M. The number of nodes i can be 0 or multiple. The threshold M is generally set to M = -1.

[0073] All nodes UN1, UN2, UN3…UN participating in this round of training N Form a set S, then remove all nodes i with low credit scores from S. Then, calculate the gradients of the remaining nodes in S: WL1, WL2, ..., WL... N Aggregation is performed to obtain a new round of global parameters.

[0074] This invention uses Figure 3 An attack experiment was conducted using one of the malicious attack methods shown. Specifically, the attacker controlled one or more clients and reversed the labels of their training data. Taking a credit card dataset as an example, assuming the original data label – whether it's a fraudulent account – has a value of 0 (not fraudulent); the attacker reverses this label to 1 (fraudulent). After completing this malicious data reversal, the attacker normally trains the data using global gradients and uploads the results to a central server. The attacker's uploaded results are mixed with those uploaded by legitimate clients and enter the central server's aggregation calculation, thus interfering with the next round of global gradients and ultimately reducing or even destroying the federated learning model.

[0075] The classic federated learning algorithm FedAvg was used for training on the public credit card dataset GERMAN CREDIT.

[0076] To measure algorithm performance, we use four metrics for comprehensive comparison: accuracy, recall, precision, and F1 score. Accuracy is the most fundamental metric, simply referring to the accuracy of the algorithm's predictions. Recall, also known as the full count, represents the proportion of correctly predicted positive samples out of all actual positive samples. For credit card datasets with relatively few fraudulent positive samples, recall is a crucial metric. In bank credit card data analysis practice, the efficiency of fraud sample identification is the most important metric for business personnel. Precision, also known as the accuracy rate, refers to the proportion of correctly predicted positive samples out of all predicted positive samples. In credit card business practice, too many false positives can lead to frequent alerts in the business system, blocking business processes and consuming significant time. Therefore, a metric is needed to measure the algorithm's false positive rate. A higher precision indicates more accurate positive judgments and a lower false positive rate, making it an important business metric. The F1 score is obtained by harmonic averaging of recall and precision, and thus comprehensively reflects the algorithm's ability to identify positive samples, that is, to identify as many positive samples as possible while minimizing false positives.

[0077] The specific calculation method is as follows:

[0078]

[0079] The meanings of TP, FP, TN, and FN are shown in Table 1:

[0080] Table 1. Confusion Matrix of Embodiments of the Invention

[0081]

[0082] Experimental results show that the algorithm's accuracy, recall, precision, and F1 score all decreased significantly, and the greater the number of attackers, the greater the decrease in these metrics. The results are as follows... Figure 4 As shown.

[0083] Then, the basic FL algorithm FedAvg was successively replaced with the federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm proposed in this invention, and two typical malicious attack defense algorithms, MultiKrum and foolsGold, for comparison. Keeping all other conditions unchanged, the above experiment was repeated. The results of the comparative experiments are as follows: Figure 5-8 As shown.

[0084] Figure 5-8This paper presents the OrderedOptics federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm proposed in this invention, and its comparative algorithms, training results on the GERMAN CREDIT training set under different numbers of attackers. It can be seen that when the number of attackers is small, i.e., 10%, the various metrics of the algorithms are quite similar. However, the method proposed in this invention shows stable performance on most metrics, while MultiKrum shows better recall. This is because it removes a certain number of nodes equally in each round. These nodes, even if not malicious, are nodes with excessive heterogeneity. This approach alleviates some heterogeneity, thus resulting in a better recall rate.

[0085] As the proportion of attackers further increases, the gap between the proposed method (OrderedOptics) and other algorithms in various metrics widens, especially after the proportion reaches 30%. The precision, recall, and F1 score of the proposed method (OrderedOptics) are significantly higher than those of other algorithms. Meanwhile, the remaining algorithms exhibit high precision but low recall, indicating that they cannot identify positive samples in the minority class and only make predictions for a very small number of positive samples, suggesting that the algorithms have failed to defend against malicious attacks.

[0086] When the attacker's proportion eventually increased to 40%, the proposed method (OrderedOptics) exhibited a high precision but low recall failure in the early stages of training. This is due to the characteristics of the proposed method. In the early stages of training, because each node is traversed less, the credit score of each node is not accurate. If multiple extreme cases of malicious nodes exceeding 50% are encountered consecutively, the algorithm will misidentify malicious nodes as honest nodes and vice versa. However, as training progresses, this cross-round credit score accumulation method effectively compares all nodes together. As long as the number of honest nodes is greater than the number of malicious nodes, malicious nodes will eventually be identified, while honest nodes can quickly improve their credit scores. This process of deterioration followed by improvement in the proposed method (OrderedOptics) is very evident during training, ultimately achieving a significantly better malicious attack defense effect than other algorithms.

[0087] It is evident that the method (OrderedOptics) proposed in this invention has a significant defensive effect against malicious attacks.

[0088] The above description is merely a description of preferred embodiments of this application and is not intended to limit the scope of this application in any way. Any changes or modifications made by those skilled in the art based on the above-disclosed technical content should be considered as equivalent and valid embodiments and fall within the scope of protection of the technical solution of this application.

Claims

1. A federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm, characterized in that: The OPTICS algorithm is used to evaluate the honesty of the participating nodes and calculate their credit scores. Nodes with credit scores below the threshold are excluded to minimize the impact of malicious nodes. The steps include the following: Step 10: The randomly selected training users receive the global parameters sent by the central server, use machine learning algorithms to train and update the local model, and then upload the updated local model parameters to the central server. Step 20: After receiving the user's local model parameters, the central server uses the OPTICS algorithm to calculate the received local model parameters and updates the credit score of each node based on the calculation results. Step 30: The central server, based on the threshold set by the system and the credit scores of each participating user, excludes nodes with credit scores below the threshold, and aggregates the remaining nodes according to the federated averaging algorithm to obtain a new round of global parameters. Step 20 specifically involves: Step 201: The central server uses the OPTICS algorithm to calculate the received local model parameters and obtain the sorting result orderList of the training nodes in this round; Step 202: The central server updates the credits of all participating nodes in this round based on the sorting result orderList; The method for updating the credits of all participating nodes in this round based on the sorting result orderList in step 202 is as follows: Step 2021: Calculate the number of nodes with changes in credit scores in this round. ; in, To represent the overall threat level, its value should be the proportion of malicious backdoor attackers to the total number of training nodes; The sampling rate is the proportion of nodes participating in each round of training out of the total number of nodes. This represents the total number of nodes. Step 2022: Update the credit score of the participating nodes in this round of training according to the sorting result orderList, and sort the nodes at the top of orderList. Each node increases credit score After orderList Each node reduces credit score The updated credit scores for each participating node are obtained. The value is determined by the node's position in the orderList. The decision is as follows: in, For parameters; Step 2023: Standardize and restrict the updated credit scores of each node within a certain range. To avoid extreme values ​​interfering with subsequent calculations.

2. The federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm as described in claim 1, characterized in that, The method for calculating the sorting result orderList of the uploaded nodes in step 201 is as follows: Step 2011: The central server loads the model parameter data from the upload node. ; Step 2012: Use the OPTICS algorithm to process the model parameter data. Perform clustering calculations to obtain the core distance of each node; Step 2013: Sort the core distances of each node in ascending order to obtain the sorted result orderList.

3. The federated machine learning method for cross-round adversarial backdoor malicious attacks based on the OPTICS algorithm as described in claim 1, characterized in that, Step 30 specifically involves: Step 301: Calculate the lowest credit score (min credits) among the participating nodes in this round of training; Step 302: Iterate through the credit scores (credits) of all participating nodes in this round. If a participating node's credit score equals the minimum credit score (min credits) and is less than the system's set threshold M, then remove that node from the set participating in the aggregation calculation for this round. Delete; where the threshold M is generally set to M=1; Step 303: Perform federated averaging on the remaining nodes to obtain the new round of global parameters: 。

Images