A joint audit security defense method against multi-poisoning attacks in federated learning

Abstract

The present invention discloses a joint audit security defense method for federated learning multi-factor poisoning attacks, which belongs to the field of artificial intelligence security and information security technology, including S1, building a federated learning model, including a server and K clients; S2, training the federated learning model to obtain a global model; S3, setting a defense algorithm on the server side to detect the gradient update uploaded by the client, and scoring the client through an evaluation algorithm, modifying the corresponding aggregation weight, thereby obtaining a new round of global model. The present invention adopts the above-mentioned joint audit security defense method for federated learning multi-factor poisoning attacks, which can effectively detect a variety of different malicious attack behaviors, ensure that the training task can be carried out, reduce the damage of the attack to the training task, and improve the robustness and efficiency of the task.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security and information security technology, and in particular to a joint audit security defense method against federated learning multi-poisoning attacks. Background Art

[0002] Artificial intelligence (AI) has been a rapidly developing technology in recent years. It builds models and iteratively trains them on datasets to produce models suitable for a variety of tasks. Training deep neural networks requires massive amounts of data input to extract the inherent characteristics of the data. The more samples are input, the better the trained model. Therefore, obtaining large amounts of data samples is crucial for AI technology.

[0003] Traditional centralized learning requires a significant amount of computation, requiring all data to be collected and centrally processed by a single computing center. As data volumes increase, the computational overhead becomes prohibitively high, making it difficult for typical computing centers to handle the burden. This increases both computational costs and time. Furthermore, collecting and uploading large amounts of data adds additional communication overhead and storage pressure.

[0004] Distributed learning is an improvement over centralized learning frameworks. It no longer requires data to be centralized in a single computing center. Instead, it allows data to be distributed across different nodes, with training coordinated by a central server. The network model structure is determined by the task and typically published by the central server. Nodes provide computing power and, under the coordination of the central server, download a shared model and a portion of the dataset. They then perform iterative training and send the trained local models to the central server. The central server aggregates the local models of these nodes to generate a global model. This approach essentially matches the performance of centralized data training. The advantage of distributed learning is that it distributes the computational burden across nodes. The central server only needs to manage the distribution and aggregation of these models, reducing the central server's computational overhead. The difference between distributed learning and centralized learning is that distributed learning no longer requires high computing power from the central server. Its parallel architecture reduces computation time, but this also increases communication overhead with the nodes.

[0005] However, with the development of modern society, both businesses and individuals are paying more attention to the privacy of their own data, resulting in a growing reluctance to upload private data. This makes it increasingly difficult to collect sufficient data samples to meet the performance requirements of the model. Furthermore, the collected data often comes from different institutions and departments, and the organization and characteristics of this data may vary, forming "data silos." Therefore, a method is needed to organize different types of data from different sources.

[0006] Driven by the dual imperatives of privacy and data silos, federated learning has emerged. Federated learning also falls under the umbrella of distributed machine learning, but its scope of application differs. Similarly, typical federated learning involves multiple nodes participating in training, potentially from different companies or departments, managed by a central server. Unlike traditional distributed learning, federated learning provides not only computing power but also data. This means data does not need to be uploaded to a server but can be stored locally. The central server broadcasts training tasks, and nodes decide whether to participate. Participants can join or leave the training task at any time. Participants simply download the shared model from the central server, train it on their local private dataset, and then upload their own model gradient updates. This avoids the risk of exposing personal privacy while also completing the task of training data. The central server aggregates these uploaded model updates to form a global model. Furthermore, because both dataset storage and training occur on the client side, there's no need to transfer large amounts of data samples back and forth between the client and server, significantly reducing server-side storage and computational pressure. In general, federated learning has two major benefits. First, it ensures the confidentiality of the client's local data set, eliminating the need to disclose private data to the outside world. Second, it coordinates the local data of all parties, providing strong support for training a good global model.

[0007] However, as researchers delve deeper into federated learning, they've discovered security risks associated with this training model. The client's dataset isn't visible to the server, making the gradient updates uploaded by the client unreliable. The server can't use the dataset to verify the gradients of the participating parties. This raises a security concern in federated learning: malicious attackers on the client side can upload erroneous gradient updates to compromise global model training, a practice known as poisoning. Attackers can target two types of targets: untargeted attacks, such as data poisoning and model poisoning, which aim to degrade the performance of the final model or even prevent convergence. Targeted attacks, such as backdoor attacks, involve attackers crafting their own attack tasks and manipulating the final model to achieve them. For example, in a recognition task, attackers could deliberately trick the main model into misidentifying one object as another. Such attacks can significantly degrade the performance of the final model and pose serious risks in real-world applications.

[0008] However, current defenses against poisoning attacks are still incomplete. The anonymity of client datasets greatly complicates anomaly detection. Some existing methods assume the existence of an auxiliary dataset on the server side to assist in verifying the anomalies of the gradients uploaded by participants. However, this approach is not feasible because client data distributions are diverse and not publicly available, making it impractical to construct a single dataset. Some classic algorithms achieve good results under the premise of independent and identically distributed (IID), but the data in federated learning is not IID, so these defense methods are not well-suited for federated learning. In recent years, researchers have proposed several defense strategies suitable for federated learning scenarios. However, with this, more complex and varied attack methods have emerged. Conventional defense methods are no longer sufficient to meet the requirements of today's multi-attack scenarios. For example, some defenses are effective against untargeted attacks but have little effect against targeted attacks. This means that such defense systems remain flawed.

[0009] Therefore, this invention provides a security defense strategy for multiple attack scenarios based on a federated learning model. This strategy requires no server-side auxiliary dataset construction and only requires specialized computations on the gradient updates uploaded by participating parties. Furthermore, it can handle a variety of attack vectors, maintaining excellent training results under varying attack scenarios and offering more stable performance than existing defense algorithms. Summary of the Invention

[0010] The purpose of the present invention is to provide a joint audit security defense method against federated learning multi-poisoning attacks, so as to solve the security improvement measures for federated learning technology existing in the above-mentioned background technology. Federated learning technology is often used for big data model training in privacy protection scenarios. Under privacy protection, the local data information of the participants is usually not disclosed. The server cannot review the model provided by the user, which makes the training task very vulnerable to attacks by malicious users, thereby reducing the effectiveness of the model. Although there are some methods for detecting malicious gradients at this stage, they are still not enough to resist diversified malicious attack behaviors, so that the model performance is still greatly disturbed in the joint attack mode.

[0011] To achieve the above objectives, the present invention provides a joint audit security defense method against federated learning multi-poisoning attacks, comprising the following steps:

[0012] S1. Build a federated learning model, including a server and K clients. Let k = 0, 1, 2…, K represent the kth client. The dataset owned by the kth client is The amount of data is Use z k =(x k ,yk ) represents the input data label pair. The data of different clients are not independent and identically distributed, which means that the input data features or labels of different clients are different, and the data volume is also different. The total amount of local data of all clients is recorded as The model is recorded as The gradient is recorded as

[0013] S2. Train the federated learning model to obtain a global model;

[0014] S3. Set up a defense algorithm on the server side to detect the gradient updates uploaded by the client, score the client through an evaluation algorithm, modify the corresponding aggregation weights, and thus obtain a new round of global model.

[0015] Preferably, the federated learning model training in step S2 is performed for T iterations, as follows:

[0016] S21. The server publishes the learning task. The clients participating in the training apply to connect to the server. The server broadcasts the task parameters, such as the model network, optimizer, and loss function F(ω,z), to all clients.

[0017] S22, server-side initialization model parameters ω 0 , the client initializes the model parameters Set up the optimizer;

[0018] S23. In the iteration round t=1, 2, ..., T, a random number of clients join the aggregation of this round. These users are called participants, with S t Representing the collection of these clients, the server sends a t Send the current global model parameters ω t ;

[0019] S24, Participant i∈S t Replace the current global model parameters with your own model parameters According to the learning rate γ t , local iteration number j = 1, 2, ..., τ, train your own local model according to the following expression:

[0020]

[0021] S25, Participant i∈S t After performing τ local iterations locally, the model is obtained Then calculate its own gradient update:

[0022]

[0023] S26, Participant i∈S t Uploading your own gradient updates The server collects all gradient updates and aggregates them through the aggregation algorithm G(·) to obtain a new round of global model;

[0024] S27. Repeat steps S23 to S26 until the model convergence requirement is met or the maximum number of iterations T is reached, the model convergence is completed, the final global model is obtained, and the federated learning task is completed.

[0025] Step S23 simulates the client set that accesses the server at the current time in actual application. There may be malicious attackers mixed in, and these attackers are denoted as For malicious attackers They may tamper with the dataset or upload forged gradient updates; if it is data poisoning, the attacker's local dataset will be tampered with Then formula (1) will be modified into the following form:

[0026]

[0027] If the model is poisoned, then (2) will be modified to in, It is an attack algorithm used by malicious actors to modify gradients. If it is a targeted attack, such as a backdoor attack, it is implemented by combining data poisoning and model poisoning.

[0028] Preferably, the aggregation algorithm in step S26 is:

[0029]

[0030] Preferably, since the malicious participants’ attacks are all poisoning the global model through malicious gradients, and the gradient update is also the most important information presented by the participants to the server, the detection of gradients is a key step in defense. Through the detection of gradients, researchers have proposed many classic algorithms. For example, traditional defense methods such as Krum are to calculate the Euclidean distance from the participant set S. t Filter out users who are considered reliable Aggregating their gradient updates assumes that malicious gradients will be far away from normal gradients. However, the federated learning architecture is heterogeneous, which means that the gradients of benign users may also show large differences, which does not mean that they are aggressive. Another method is to calculate the cosine similarity between the gradients of participants, eliminate users with high similarity, and filter out users that are considered reliable. However, their standards for detecting malicious users are not rational enough and are often inadequate for defending against multiple attacks, resulting in a single attack. This invention establishes a defense algorithm on the server side to detect the gradient updates uploaded by the participants, and uses an evaluation algorithm to score the clients and modify the corresponding aggregation weights, as follows:

[0031] S31. The server will detect the attacker based on the three indicators of joint estimation value χ, cosine similarity α, and Euclidean distance β. Before the training begins, the server initializes the list l corresponding to these three indicators. χ ,l α ,l β , record the number of bad behaviors of the participants;

[0032] S32, in the iteration round t=1,2,...,T, the server collects the data from the participant S t Gradient collection And calculate the current joint estimate χ for each user i , evaluate the credibility of the participant based on the joint estimation value and then record it in the corresponding list;

[0033] S33. After calculating the joint estimated value of the participants, the server has made a preliminary judgment on the maliciousness of the participants and eliminated the participants with more obvious malicious behavior. The server sets the participants. Calculate a mean gradient for all users in

[0034]

[0035] S34, this mean gradient It is called the standard for subsequent detection, and the server calculates the remaining gradient The cosine similarity with the mean gradient is then used to evaluate the user's suspiciousness and record it in the list;

[0036] S35. The server detects the Euclidean distance β of the participants and calculates the residual gradient. The Euclidean distance from the mean gradient is recorded in a list according to the degree of suspicion;

[0037] S36. In the iteration round t=1, 2, ..., T, the server records the results of the first t-1 detections and records them in the list l χ ,l α ,l βAt the same time, the server also records the number of times each client is selected as an aggregation participant. For each client k = 0, 1, 2, .., K, the ratio of the number of times it is recorded in the list to the number of times it is selected as an aggregation participant is calculated, and three scores s related to the joint estimate, cosine similarity, and Euclidean distance are obtained. k ,χ,s k,α ,s k,β , and then use the relevant calculation method to get the malicious evaluation value of client k from these three scores

[0038] S37. For the aggregated participant set Initial aggregation weight is the ratio of the client dataset size;

[0039]

[0040] S38. For the tth iteration, the server divides the suspicious users into the list according to three indicators. In the case where participant i exists in Then reduce the aggregate weight of the participant; the malicious evaluation value of each client is obtained from step S36 The server considers the top 30% of clients with the largest malicious evaluation values ​​as attackers. If participant i belongs to the attacker set, its aggregate weight is further reduced. The final modified weight is

[0041] S39. The server obtains a new set of participants. We also get a new set of weights Then, according to the weighted aggregation method, a new round of global model is obtained as follows

[0042]

[0043] Preferably, step S32 specifically includes:

[0044] S321. For each participant Computing and other participants Cosine similarity cs of gradient update of j≠i ij ;

[0045]

[0046] S322, the server pre-sets a hyperparameter n x , participants Select The largest nx and calculate the mean to obtain the joint estimated value χ of participant i i ;

[0047] S323, the server obtains the joint estimated value of the participants and checks them one by one. If i >0.7, the participant i is considered a malicious user and is removed from the set In addition, we get a new set of participants If no participant meets the above formula, then select the n with the largest joint estimate x Participants are considered as suspected attackers and are considered as bad behavior and recorded in the list. middle.

[0048] The joint estimate is an important indicator for judging the degree of abnormality. Generally speaking, if χ i If the threshold is exceeded, then the participant is likely to be a malicious attacker, because attackers will implement joint attacks and they usually show similar characteristics to achieve a higher level of attack, so the joint estimate is a very effective detection indicator. i If the threshold is not exceeded, it means that the degree of union among the participants is not significant and further testing is needed.

[0049] Preferably, step S34 specifically includes:

[0050] S341. For each participant According to formula (7), the cosine similarity α between it and the mean gradient is calculated i , and then get an array of cosine similarities about all participants and mean gradients Calculate the median of this array mean and variance

[0051] S342, if It is believed that α i Smaller participants are suspicious targets of attack; if It is believed that α i Larger parties are suspicious targets of attack;

[0052] S343. If the new set of participants is equal to the original set That is, the joint estimation value does not show the obvious joint attack tendency of the participants. The server pre-sets a hyperparameter n α , select α from the range in step S342 i Maximum or minimum n α Gradient, record its corresponding participant number in the list In the case of a misconduct, it is considered as a misconduct;

[0053] S344: If some malicious users have been identified in step S32, Then it is considered that the detection has been completed based on the similarity feature, and no additional identification of suspicious users is required based on cosine similarity.

[0054] Both cosine similarity α and the joint estimate χ are calculated based on cosine values. Although malicious users may exhibit abnormal characteristics in both cosine similarity and the joint estimate, their detection principles are different. Combining them is used to prevent more diverse attacks.

[0055] Preferably, step S35 specifically includes:

[0056] S351. For each participant The Euclidean distance β between it and the mean gradient is calculated according to the following formula i , and then get an array of Euclidean distances between all participants and the mean gradient

[0057] (8)

[0058] S352. Calculate the Euclidean distance array β t The mean of

[0059] S353: The server pre-sets the maximum threshold β of the Euclidean distance. max and the minimum threshold β min , check the gradients in the set of participants one by one and β t If the mean is too large, the gradient is clipped. If it is too small, the gradient is amplified. Then record the gradients that need to be clipped or enlarged in a list middle.

[0060] Unlike previous methods, participants whose joint estimate exceeds a certain threshold are considered malicious and removed from the set. However, if the gradient detected using Euclidean distance exceeds the threshold, the participant is not removed; instead, the gradient is corrected. Because the joint estimate evaluates joint behavior, if it meets the malicious behavior criteria, it indicates that there are a significant number of attackers among the participants. The effectiveness of their attacks will be positively correlated with the number of attackers, and measures must be taken to prevent them. However, if the Euclidean distance metric meets the malicious behavior criteria, it does not necessarily indicate a coordinated attack; it may simply be a single-action attack. In this case, by limiting the extent of their attack, their attack can be mitigated and even the variance of the aggregated gradient can be increased, promoting model convergence.

[0061] Therefore, the present invention adopts the above-mentioned joint audit security defense method against federated learning multi-poisoning attacks, which has the following beneficial effects:

[0062] (1) A security defense measure against poisoning attacks in federated learning. This mainly detects gradient anomalies uploaded by participants using three indicators: joint estimate, cosine similarity, and Euclidean distance. Combined with the detection algorithm, it can take into account most attack behaviors, because most attack behaviors will show special forms on the gradient.

[0063] (2) The present invention does not simply determine whether a client is a malicious attacker based on a single detection. Instead, it can create a list on the server side to record the client's historical behavior and comprehensively calculate the client's malicious evaluation value. At the same time, the present invention is not limited to eliminating malicious attackers, but also adds them to the aggregation, but reduces their aggregation weight, which not only ensures the convergence efficiency of the model but also weakens the attacker's attack effect;

[0064] (3) It can maintain the performance of the model to the greatest extent under the premise of attacks, reduce the impact of attackers on the accuracy of the model, and improve the robustness of model training.

[0065] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 This is the training flow chart of the federated learning model of the present invention;

[0067] Figure 2 This is a flow chart of the defense method adopted by the present invention;

[0068] Figure 3 This is a schematic diagram of the defense performance of an embodiment of the present invention in the data_poison scenario;

[0069] Figure 4 This is a schematic diagram of the defense performance of an embodiment of the present invention in a reverse scenario;

[0070] Figure 5 Schematic diagram of the defense performance of an embodiment of the present invention in a LIE scenario;

[0071] Figure 6 Schematic diagram of the defense performance of an embodiment of the present invention in a SF scenario;

[0072] Figure 7 This is a schematic diagram of the defense performance of an embodiment of the present invention in the label_flip scenario;

[0073] Figure 8 This is a schematic diagram of the attacker success rate in the label_flip scenario according to an embodiment of the present invention;

[0074] Figure 9 This is a schematic diagram of the defense performance of an embodiment of the present invention in a backdoor scenario;

[0075] Figure 10 Schematic diagram of the attacker success rate in a backdoor scenario according to an embodiment of the present invention. DETAILED DESCRIPTION

[0076] Example

[0077] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0078] like Figure 1-2 As shown in FIG, a joint audit security defense method for federated learning multi-poisoning attacks includes the following steps:

[0079] S1. Build a federated learning model, including a server and K clients. Let k = 0, 1, 2…, K represent the kth client. The dataset owned by the kth client is The amount of data is Use z k =(x k ,t k ) represents the input data label pair. The data of different clients are not independent and identically distributed, which means that the input data features or labels of different clients are different, and the data volume is also different. The total amount of local data of all clients is recorded as The model is recorded as The gradient is recorded as

[0080] S2. Federated learning model training requires T iterations to obtain a global model, as follows:

[0081] S21. The server publishes the learning task. The clients participating in the training apply to connect to the server. The server broadcasts the task parameters, such as the model network, optimizer, and loss function F(ω,z), to all clients.

[0082] S22, server-side initialization model parameters ω 0 , the client initializes the model parameters Set up the optimizer;

[0083] S23. In the iteration round t=1, 2, ..., T, a random number of clients join the aggregation of this round. These users are called participants, with S t Representing the collection of these clients, the server sends a t Send the current global model parameters ω t ;

[0084] S24, Participant i∈S t Replace the current global model parameters with your own model parameters According to the learning rate γ t , local iteration number j = 1, 2, ..., τ, train your own local model according to the following expression:

[0085]

[0086] S25, Participant i∈S t After performing τ local iterations locally, the model is obtained Then calculate its own gradient update:

[0087]

[0088] S26, Participant i∈S t Uploading your own gradient updates The server collects all gradient updates and aggregates them through the aggregation algorithm G(·) to obtain a new round of global model; the general aggregation algorithm is

[0089]

[0090] S27. Repeat steps S23 to S26 until the model convergence requirement is met or the maximum number of iterations T is reached, the model convergence is completed, the final global model is obtained, and the federated learning task is completed.

[0091] Step S23 simulates the client set that accesses the server at the current time in actual application. There may be malicious attackers mixed in, and these attackers are denoted as For malicious attackers They may tamper with the dataset or upload forged gradient updates; if it is data poisoning, the attacker's local dataset will be tampered with Then formula (1) will be modified into the following form:

[0092]

[0093] If the model is poisoned, then (2) will be modified to in, It is an attack algorithm used by malicious actors to modify gradients. If it is a targeted attack, such as a backdoor attack, it is implemented by combining data poisoning and model poisoning.

[0094] S3. Since the attacks of malicious participants are all poisoning the global model through malicious gradients, and the gradient update is also the most important information presented by the participants to the server, the detection of gradients is a key step in defense. Through the detection of gradients, researchers have proposed many classic algorithms. For example, traditional defense methods such as Krum are to calculate the Euclidean distance from the participant set S. t Filter out users who are considered reliable Aggregating their gradient updates assumes that malicious gradients will be far away from normal gradients. However, the federated learning architecture is heterogeneous, which means that the gradients of benign users may also show large differences, which does not mean that they are aggressive. Another method is to calculate the cosine similarity between the gradients of participants, eliminate users with high similarity, and filter out users that are considered reliable. However, their standards for detecting malicious users are not rational enough and are often inadequate for defending against multiple attacks, resulting in a single attack. This invention establishes a defense algorithm on the server side to detect the gradient updates uploaded by the participants, and uses an evaluation algorithm to score the clients and modify the corresponding aggregation weights, as follows:

[0095] S31. The server will detect the attacker based on the three indicators of joint estimation value χ, cosine similarity α, and Euclidean distance β. Before the training begins, the server initializes the list l corresponding to these three indicators. χ ,l a ,l β , record the number of bad behaviors of the participants;

[0096] S32, in the iteration round t=1,2,...,T, the server collects the data from the participant S t Gradient collection And calculate the current joint estimate χ for each user i , evaluate the credibility of the participant based on the joint estimation value and then record it in the corresponding list;

[0097] S321. For each participant Computing and other participants Cosine similarity cs of gradient update of j≠i ij ;

[0098]

[0099] S322, the server pre-sets a hyperparameter n x , participants Select The largest n x and calculate the mean to obtain the joint estimated value χ of participant i i ;

[0100] S323, the server obtains the joint estimated value of the participants and checks them one by one. If i >0.7, then the participant i is considered a malicious user and is removed from the set In addition, we get a new set of participants If no participant meets the above formula, then select the n with the largest joint estimate x Participants are considered as suspected attackers and are considered as bad behavior and recorded in the list. middle.

[0101] The joint estimate is an important indicator for judging the degree of abnormality. Generally speaking, if χ i If the threshold is exceeded, then the participant is likely to be a malicious attacker, because attackers will implement joint attacks and they usually show similar characteristics to achieve a higher level of attack, so the joint estimate is a very effective detection indicator. i If the threshold is not exceeded, it means that the degree of union among the participants is not significant and further testing is needed.

[0102] S33. After calculating the joint estimated value of the participants, the server has made a preliminary judgment on the maliciousness of the participants and eliminated the participants with more obvious malicious behavior. The server sets the participants. Calculate a mean gradient for all users in

[0103]

[0104] S34, this mean gradient It is called the standard for subsequent detection, and the server calculates the remaining gradient The cosine similarity with the mean gradient is then used to evaluate the user's suspiciousness and record it in the list;

[0105] S341. For each participant According to formula (7), the cosine similarity α between it and the mean gradient is calculated i , and then get an array of cosine similarities about all participants and mean gradients Calculate the median of this array mean and variance

[0106] S342, if It is believed that α i Smaller participants are suspicious targets of attack; if It is believed that α i Larger parties are suspicious targets of attack;

[0107] S343. If the new set of participants is equal to the original set That is, the joint estimation value does not show the obvious joint attack tendency of the participants. The server pre-sets a hyperparameter n α , select α from the range in step S342 i Maximum or minimum n α Gradient, record its corresponding participant number in the list In the case of a misconduct, it is considered as a misconduct;

[0108] S344: If some malicious users have been identified in step S32, Then it is considered that the detection has been completed based on the similarity feature, and no additional identification of suspicious users is required based on cosine similarity.

[0109] Both cosine similarity α and the joint estimate χ are calculated based on cosine values. Although malicious users may exhibit abnormal characteristics in both cosine similarity and the joint estimate, their detection principles are different. Combining them is used to prevent more diverse attacks.

[0110] S35. The server detects the Euclidean distance β of the participants and calculates the residual gradient. The Euclidean distance from the mean gradient is recorded in a list according to the degree of suspicion;

[0111] S351. For each participant The Euclidean distance β between it and the mean gradient is calculated according to the following formula i , and then get an array of Euclidean distances between all participants and the mean gradient

[0112]

[0113] S352. Calculate the Euclidean distance array β t The mean of

[0114] S353: The server pre-sets the maximum threshold β of the Euclidean distance. max and the minimum threshold β min , check the gradients in the set of participants one by one and β t If the mean is too large, the gradient is clipped. If it is too small, the gradient is amplified. Then record the gradients that need to be clipped or enlarged in a list middle.

[0115] Unlike previous methods, participants whose joint estimate exceeds a certain threshold are considered malicious and removed from the set. However, if the gradient detected using Euclidean distance exceeds the threshold, the participant is not removed; instead, the gradient is corrected. Because the joint estimate evaluates joint behavior, if it meets the malicious behavior criteria, it indicates that there are a significant number of attackers among the participants. The effectiveness of their attacks will be positively correlated with the number of attackers, and measures must be taken to prevent them. However, if the Euclidean distance metric meets the malicious behavior criteria, it does not necessarily indicate a coordinated attack; it may simply be a single-action attack. In this case, by limiting the extent of their attack, their attack can be mitigated and even the variance of the aggregated gradient can be increased, promoting model convergence.

[0116] S36. In the iteration round t=1, 2, ..., T, the server records the results of the first t-1 detections and records them in the list l χ ,l α ,l β At the same time, the server also records the number of times each client is selected as an aggregation participant. For each client k = 0, 1, 2, .., K, the ratio of the number of times it is recorded in the list to the number of times it is selected as an aggregation participant is calculated, and three scores s related to the joint estimate, cosine similarity, and Euclidean distance are obtained. k ,χ,s k,α ,sk,β , and then use the relevant calculation method to get the malicious evaluation value of client k from these three scores

[0117] S37. For the aggregated participant set Initial aggregation weight is the ratio of the client dataset size;

[0118]

[0119] S38. For the tth iteration, the server divides the suspicious users into the list according to three indicators. In the case where participant i exists in Then reduce the aggregate weight of the participant; the malicious evaluation value of each client is obtained from step S36 The server considers the top 30% of clients with the largest malicious evaluation values ​​as attackers. If participant i belongs to the attacker set, its aggregate weight is further reduced. The final modified weight is

[0120] S39. The server obtains a new set of participants. We also get a new set of weights Then, according to the weighted aggregation method, a new round of global model is obtained as follows

[0121]

[0122] To compare with existing methods, the following briefly describes some commonly used defense algorithms:

[0123] (1) Krum: It is a classic distributed machine learning Robin algorithm. It calculates the Euclidean distance between each model, calculates the sum of the distances of the nearest neighbors for each user, and takes the model with the smallest sum of distances as the aggregation result. The experimental results in the figure use the multi-krum method, that is, the average of several models with the smallest sum of distances is taken as the aggregation result.

[0124] (2) Trimmed-mean: This is also a classic distributed machine learning security algorithm. It requires finding the geometric median of the gradients of the participating parties and then selecting the gradients with the smallest distance from the geometric median as the aggregation object. This method is also called the truncated mean. This method is similar to Krum in terms of calculation and principle.

[0125] (3) RFA: An advanced method for finding the geometric median gradient. The geometric median is defined as finding a geometric mean that minimizes the sum of the Euclidean distances of all user gradients to the median. This method uses an iterative calculation approach to find a relatively accurate geometric median gradient, which is used as the aggregation result.

[0126] (4) FABA: This method assumes that the gradient that deviates greatly from the mean is a malicious gradient. It eliminates suspicious gradients by iteratively. Each time, it calculates a mean gradient and then eliminates the gradient with the largest distance from the mean gradient.

[0127] (5) Density: This method uses density as a detection metric. A higher density of a gradient means that the average sum of the Euclidean distances between it and its neighboring gradients is smaller. It assumes that outliers with low density are high and reduces the weight of participants with high outliers.

[0128] (6) FoolsGold: This is a detection method based on cosine similarity. It calculates the cosine similarity between each user and other users, and takes the cosine similarity of the nearest gradient as the judgment basis. If it exceeds a certain threshold, the learning rate of the participant is corrected.

[0129] In this example, we will inject attacks into the CIFAR-10 image recognition task and add various defenses to compare the superiority of the present invention. Below, we will list several advanced attacks and add the aforementioned defenses to compare with this example.

[0130] (1) Data_poison: Data poisoning attack. The attacker has a normal dataset, but they modify the features or labels of most of their dataset to make it different from the normal dataset. They train a poisoned gradient on the poisoned dataset, thereby reducing the accuracy of the final model. This attack does not change the trained gradient, but only the dataset. This type of attack is not intended to accomplish a specific task and is an untargeted attack.

[0131] like Figure 3 As shown, the final accuracy of the model using this embodiment is higher than that of the existing defense method.

[0132] (2) Reverse: Model poisoning attack. The attacker’s dataset is good, but they will modify the gradient. The main method is to reverse the direction of the gradient, thereby affecting the orderly progress of the gradient descent of the global model training, ultimately reducing the accuracy of the model and even destroying its convergence.

[0133] like Figure 4 As shown in FIG, the final accuracy of the model using this embodiment is close to the baseline, and is not much different from the RFA method.

[0134] (3) LIE: This is a common attack that is considered model poisoning. Attackers collaborate, share information, and jointly tamper with uploaded gradient updates. They do not need to modify the dataset or even the training data; they only need to send a forged gradient. The effectiveness of this type of attack is no longer based on the strong offensive power of a single attacker, but rather on the greater effectiveness of multiple attackers working together.

[0135] like Figure 5 As shown, the final accuracy of the model using this embodiment is close to the baseline, far exceeding other defense methods, most of which cannot converge.

[0136] (4) SF: This is a special form of attack. This type of attack not only represents attackers who attempt to destroy the model, but also represents lazy clients who are unwilling to spend computing power but want to gain benefits. Malicious clients only train on a small part of the dataset, but exaggerate the size of their own dataset, thereby trying to gain large benefits at a low cost.

[0137] like Figure 6 As shown in FIG, the final accuracy of the model using this embodiment is close to the baseline and is better than the existing defense method.

[0138] (5) Label_flip: This refers to label flipping. This is a targeted attack that combines data poisoning and model poisoning. The attacker first needs to tamper with their own dataset according to the preset task, and then obtain malicious gradients that are consistent with the attacker's task. To achieve higher effectiveness, it is often necessary to scale the gradients to have a greater impact on the global model.

[0139] like Figure 7 As shown in the figure, the training performance of various defense methods in the Label_flipping attack scenario is demonstrated. The higher the accuracy, the better the task effect. The final accuracy of the model in this embodiment is close to the baseline. Figure 8 As shown, the attacker takes targeted attacks. The higher the attacker's accuracy, the closer the final training result is to the malicious task pre-set by the attacker. Under the effect of the model in this embodiment, the attacker's success rate is reduced by more than 20% compared to the undefended state. Compared with other defenses, it can perform at a level close to the best.

[0140] (6) Backdoor attack: This is a targeted attack that combines data poisoning and model poisoning. It is a relatively complex attack form in real-world scenarios. The attacker needs to ensure the correct execution of the main task while implementing the attacker's preset malicious task. For example, adding a trigger to the dataset will cause the data with the trigger to train the results of the malicious task.

[0141] Figure 9The training results of various defense technologies in the Backdoor attack scenario are shown. The higher the accuracy, the better the result. The final accuracy of the model using this embodiment is close to the baseline. Figure 10 The figure shows the attack success rates of backdoor attackers using different defense schemes. The lower the curve, the better the defense model. This shows that the attacker's attack success rate also decreases significantly using the model in this embodiment. The RFA method is effective in terms of accuracy, but it cannot effectively reduce the attack success rate.

[0142] Therefore, the present invention adopts the above-mentioned joint audit security defense method against federated learning multi-poisoning attacks, which can demonstrate good defense performance in multiple attack scenarios. Compared with various existing methods, it can effectively improve the accuracy of the task and reduce the success rate of attackers.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solutions of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A joint audit security defense method for federated learning multi-poisoning attacks, characterized by: The following steps are involved: S1. Build a federated learning model, including a server and K clients. Let k = 0, 1, 2…, K represent the kth client. The dataset owned by the kth client is The amount of data is Use z k =(x k ,y k ) represents the input data label pair, the data of different clients are not independent and identically distributed, and the total amount of local data of all clients is recorded as The model is denoted as The gradient is recorded as S2. Train the federated learning model to obtain a global model; S3. Set up a defense algorithm on the server side to detect the gradient updates uploaded by the client, score the client through an evaluation algorithm, modify the corresponding aggregation weights, and thus obtain a new round of global model; Step S3 is as follows: S31. The server will detect the attacker based on the three indicators of joint estimation value χ, cosine similarity α, and Euclidean distance β. Before the training begins, the server initializes the list l corresponding to these three indicators. χ ,l α ,l β , record the number of bad behaviors of the participants; S32, in the iteration round t=1,2,...,T, the server collects the data from the participant S t Gradient collection And calculate the current joint estimate χ for each user i , evaluate the credibility of the participant based on the joint estimation value and then record it in the corresponding list; S33, the server side calculates the joint estimated value of the participants and removes the participants with obvious malicious behavior. The server side collects the participants. Calculate a mean gradient for all users in S34, this mean gradient It is called the standard for subsequent detection, and the server calculates the remaining gradient The cosine similarity with the mean gradient is then used to evaluate the user's suspiciousness and record it in the list; S35. The server detects the Euclidean distance β of the participants and calculates the residual gradient. The Euclidean distance from the mean gradient is recorded in a list according to the degree of suspicion; S36. In the iteration round t=1, 2, ..., T, the server records the results of the first t-1 detections and records them in the list l χ ,l α ,l β At the same time, the server also records the number of times each client is selected as an aggregation participant. For each client k = 0, 1, 2, .., K, the ratio of the number of times it is recorded in the list to the number of times it is selected as an aggregation participant is calculated, and three scores s related to the joint estimate, cosine similarity, and Euclidean distance are obtained. k ,χ,s k,α ,s k,β , and then use the relevant calculation method to get the malicious evaluation value of client k from these three scores S37. For the aggregated participant set Initial aggregation weight is the ratio of the client dataset size; S38. For the tth iteration, the server divides the suspicious users into the list according to three indicators. In the case where participant i exists in Then reduce the aggregate weight of the participant; the malicious evaluation value of each client is obtained from step S36 The server considers the top 30% of clients with the largest malicious evaluation values ​​as attackers. If participant i belongs to the attacker set, its aggregate weight is further reduced. The final modified weight is S39. The server obtains a new set of participants. We also get a new set of weights Then, according to the weighted aggregation method, a new round of global model is obtained as follows 2. A joint audit security defense method against federated learning multi-poisoning attacks according to claim 1, characterized in that: The federated learning model training in step S2 requires T iterations, as follows: S21. The server publishes the learning task. The clients participating in the training apply to connect to the server. The server broadcasts the task parameters to all clients, including the model network, optimizer, and loss function F(ω,z). S22, server-side initialization model parameters ω 0 , the client initializes the model parameters Set up the optimizer; S23. In the iteration round t=1, 2, ..., T, a random number of clients join the aggregation of this round. These users are called participants, with S t Representing the collection of these clients, the server sends a t Send the current global model parameters ω t ; S24, Participant i∈S t Replace the current global model parameters with your own model parameters According to the learning rate γ t , local iteration number j = 1, 2, ..., τ, train your own local model according to the following expression: S25, Participant i∈S t After performing τ local iterations locally, the model is obtained Then calculate its own gradient update: S26, Participant i∈S t Uploading your own gradient updates The server collects all gradient updates and aggregates them through the aggregation algorithm G(·) to obtain a new round of global model; S27. Repeat steps S23 to S26 until the model convergence requirement is met or the maximum number of iterations T is reached, the model convergence is completed, the final global model is obtained, and the federated learning task is completed.

3. A joint audit security defense method against federated learning multi-poisoning attacks according to claim 2, characterized in that: The aggregation algorithm in step S26 is:

4. A joint audit security defense method against federated learning multi-poisoning attacks according to claim 1, characterized in that: Step S32 specifically includes: S321. For each participant Computing and other participants Cosine similarity cs of gradient update of j≠i ij ; S322. The server pre-sets a hyperparameter n x , participants Select The largest n x and calculate the mean to obtain the joint estimated value χ of participant i i ; S323, the server obtains the joint estimated value of the participants and checks them one by one. If i >0.7, the participant i is considered a malicious user and is removed from the set In addition, we get a new set of participants If no participant meets the above formula, then select the n with the largest joint estimate x Participants are considered as suspected attackers and are considered as bad behavior and recorded in the list. middle.

5. The joint audit security defense method against federated learning multi-poisoning attacks according to claim 1 is characterized in that: Step S34 specifically includes: S341. For each participant According to formula (7), the cosine similarity α between it and the mean gradient is calculated i , and then get an array of cosine similarities about all participants and mean gradients Calculate the median of this array mean and variance S342, if It is believed that α i Small parties are suspicious targets; if It is believed that α i Large parties are suspicious targets; S343. If the new set of participants is equal to the original set The server pre-sets a hyperparameter n α , select α from the range in step S342 i Maximum or minimum n α Gradient, record its corresponding participant number in the list In the case of a misconduct, it is considered as a misconduct; S344: If some malicious users have been identified in step S32, Then it is considered that the detection has been completed based on the similarity feature, and no additional identification of suspicious users is required based on cosine similarity.

6. A joint audit security defense method against federated learning multi-poisoning attacks according to claim 1, characterized in that: Step S35 specifically includes: S351. For each participant The Euclidean distance β between it and the mean gradient is calculated according to the following formula i , and then get an array of Euclidean distances between all participants and the mean gradient S352. Calculate the Euclidean distance array β t The mean of S353: The server pre-sets the maximum threshold β of the Euclidean distance. max and the minimum threshold β min , check the gradients in the set of participants one by one and β t If the mean is larger, the gradient is clipped. If it is small, the gradient is amplified. These clipped or enlarged gradients are then recorded in a list middle.

Images