An attack defense image classification method based on angle similarity detection

Abstract

The application discloses an attack defense image classification method based on angle similarity detection, and aims at robust convergence training of federated learning under a Byzantine attack. Differences between an attacker and a normal client are analyzed, angles between convolution kernel gradients are determined as a measurement standard for attack detection, and malicious convolution kernels are removed based on the measurement standard, so as to reduce the influence of the attacker on a model. Through robust convergence training, the defense performance of the federated learning under various Byzantine attacks is improved, and the accuracy of image classification based on the federated learning is improved.

Description

Technical Field

[0001] This invention belongs to the field of machine learning security technology, specifically relating to an attack and defense image classification method based on angle similarity detection. Background Technology

[0002] In recent years, machine learning has been widely applied to data analysis to provide data-driven analysis, decision-making, and prediction. Machine learning has diverse applications, including speech recognition, image recognition, and computer vision. Federated learning is a new form of machine learning that collaboratively trains a global model across multiple devices while keeping data on the user's local device to protect privacy, significantly reducing the risk of sensitive information exposure. Furthermore, federated learning can accelerate the training speed of machine learning models by enabling parallel computing across multiple devices through a distributed architecture.

[0003] The Parameter Server (PS) architecture is a typical structure used in federated learning. In a PS architecture, a central parameter server is responsible for maintaining global model parameters, while multiple clients perform local computations on their respective local datasets. These local models are periodically synchronized with the central server, enabling collaborative model updates without centrally sharing the original data. The PS architecture is crucial for scalable and efficient federated learning. However, federated learning systems based on the PS architecture are vulnerable to attacks. These attacks are deliberate actions targeting the system with the aim of maliciously disrupting or manipulating the training process of federated learning. Attackers attempt to obtain unauthorized information or influence the model's training results.

[0004] Byzantine attacks are a typical form of attack in federated learning. A Byzantine attack refers to the deliberate provision of incorrect information by a subset of clients, thereby disrupting the normal operation of the system. In federated learning, Byzantine attacks may manifest as clients sending incorrect local model updates or model parameters, thus affecting the training process of the global model. The main impact of Byzantine attacks on federated learning is either increased model training time or reduced model inference accuracy. Because clients may transmit malicious updates, the global model's learning process is interfered with, leading to a deterioration in the quality of the final model. Therefore, protecting federated learning systems from Byzantine attacks is crucial.

[0005] Several solutions have been proposed to mitigate Byzantine attacks during the training of federated learning systems, which can be broadly categorized into distance-based and angle-based defenses. Distance-based defenses use distance as a metric to identify and eliminate malicious clients. These methods determine malicious attackers by evaluating the distances between different clients, identifying the client with the largest distance as the attacker, and aggregating the remaining clients. However, this approach requires prior knowledge of the number of malicious attackers, a stringent requirement that is difficult to implement. Angle-based defenses consider the angle between the client's gradient and the global model gradient as the difference between clients. These angle values ​​are used to assess the similarity between the gradients of different clients, identifying clients with larger angle values ​​as malicious attackers. However, since the angles between all vectors in high-dimensional space are approximately 90 degrees, this approach struggles to distinguish between malicious attackers and normal clients when facing Byzantine attacks, especially with a large number of model parameters, leading to lower model accuracy. Summary of the Invention

[0006] In view of this, the present invention proposes an attack defense image classification method based on angle similarity detection, which can achieve high-precision federated learning image classification in the face of Byzantine attacks.

[0007] This invention proposes an attack and defense image classification method based on angle similarity detection, comprising the following steps:

[0008] Step 1: Construct the training sample dataset. The server uses a small dataset with normal data labeling as the local training sample dataset, denoted as the first local training set; the client uses the training sample dataset as the local training sample dataset, denoted as the second local training set.

[0009] Step 2: Build an image classification model based on federated learning, deploy the image classification model as a global model and a local model on the server, and deploy the image classification model as a local model on the client; initialize the global model;

[0010] Step 3: The server trains its local model using the first local training set to obtain the server model, and the client trains its local model using the second local training set to obtain the client model. The angle between the gradient of each convolutional kernel in the client model and the gradient of the corresponding convolutional kernel in the server model is calculated. Convolutional kernels with a cosine value greater than zero are considered normal convolutional kernels. The gradients of all normal convolutional kernels in the client model and the server convolutional kernel are merged to form a new global model gradient. The global model gradient is used to update the global model, server model, and client model. If the number of training rounds has not reached the preset value, Step 3 is executed; otherwise, the current global model is the trained image classification model based on federated learning.

[0011] Step 4: In actual use, the image to be classified is input into the trained image classification model based on federated learning to complete the classification.

[0012] Furthermore, the method for initializing the global model is as follows: the shape and number of convolutional kernels in the global model are initialized to be the same as those in the local model on the server side, and all elements in the gradient of the global convolutional kernel are set to 0.

[0013] Furthermore, the cosine value of the included angle is calculated as follows: first, the two convolution kernels are arranged into two one-dimensional vectors, and then the inner product of the two one-dimensional vectors is divided by the magnitude of each of the two one-dimensional vectors to obtain the cosine value of the two one-dimensional vectors.

[0014] Furthermore, the method of converging the normal convolution kernel gradients of all clients at the same position in the server model with the server convolution kernel gradient to form a new global model gradient is as follows: divide the normal convolution kernel gradients of all clients at the same position in the server model by their own convolution kernel gradient magnitude, and then accumulate them with the server convolution kernel gradient; divide the accumulated result by the number of convolution kernels involved in the accumulation and then multiply it by the magnitude of the server convolution kernel gradient to obtain the global model convolution kernel gradient at this position; and combine the global model convolution kernel gradients at each position to form the global model gradient to complete the convergence of the global model gradient.

[0015] Furthermore, the method of updating the global model using the global model gradient is as follows: multiply the global gradient by the learning rate and subtract this value from the global model to obtain the updated global model, where the learning rate is a hyperparameter of federated learning.

[0016] Beneficial effects:

[0017] 1. This invention provides robust convergence training for federated learning under Byzantine attacks. By analyzing the differences between attackers and normal clients, the angle between the gradients of convolutional kernels is determined as the metric for attack detection. Malicious convolutional kernels are then removed based on this metric to mitigate the impact of attackers on the model. Through robust convergence training, the defensive performance of federated learning under various Byzantine attacks is improved, thereby enhancing the accuracy of image classification based on federated learning.

[0018] 2. By eliminating malicious convolutional kernels instead of malicious clients, this invention can preserve the diversity of data without affecting the model's accuracy, thereby improving the generalization of the global model and further enhancing the accuracy of image classification based on federated learning. Attached Figure Description

[0019] Figure 1 This is a training structure diagram of an attack and defense image classification method based on angle similarity detection provided by the present invention.

[0020] Figure 2 This is a schematic diagram of the gradient convergence process for an attack and defense image classification method based on angle similarity detection provided by the present invention. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] This invention provides an image classification method for attack defense based on angle similarity detection. The core idea is as follows: A small dataset with normal data is deployed on a server. The server and clients are trained using their own local datasets, and a global model is aggregated on the server. First, the angle between the gradient of each convolutional kernel on each client and the gradient of the corresponding server convolutional kernel is calculated in parallel. Then, malicious client convolutional kernels with an angle greater than 90 degrees are removed. Finally, the remaining convolutional kernels are aggregated as the convolutional kernels in the global model. By removing malicious convolutional kernels, the impact of Byzantine attacks on the global model is reduced, improving the inference accuracy of the global model.

[0023] This invention provides an attack and defense image classification method based on angle similarity detection, which mainly includes the following steps:

[0024] Step 1: Construct a training sample dataset. The samples in the training sample dataset are images. The size of the images is the same as the size of the images that need to be classified during model inference, and the number of categories is the same. The server uses a small dataset with normal data labeling as the local training sample dataset, which is denoted as the first local training set. The client uses the training sample dataset as the local training sample dataset, which is denoted as the second local training set.

[0025] The training sample dataset used during training should ensure that each image is dissimilar to enrich the diversity of the dataset and ensure the generalization ability of the model.

[0026] Step 2: Build an image classification model based on federated learning. Deploy the image classification model as a global model and a local model on the server, and deploy the image classification model as a local model on the client. Initialize the shape and number of convolutional kernels in the global model to be the same as those in the local model on the server, and set all elements in the gradient of the global convolutional kernel to 0.

[0027] Step 3: Train the federated learning-based image classification model using the first and second local training sets. The training structure is as follows: Figure 1 As shown, it includes the following steps:

[0028] Step 3.1: The server uses the first local training set to train its deployed local model to obtain the server model, and the client uses the second local training set to train its deployed local model to obtain the client model.

[0029] Step 3.2: For each client, calculate the angle between the gradient of each convolutional kernel in its client model and the gradient of the corresponding convolutional kernel in the server in a parallel manner, and record this angle as the target angle.

[0030] Federated learning training is essentially a gradient descent process in convex optimization. Angle-based attacker elimination methods are more robust than distance-based methods because the correctness of the gradient descent direction is more important than the correctness of the gradient magnitude. For example, if the descent direction is incorrect, convex optimization may enter a local minimum or diverge. However, if the gradient magnitude is large, convex optimization can reach the ideal global optimum by increasing the number of iterations.

[0031] Therefore, to enhance the robustness of defense methods in federated learning, this invention uses an angle, more precisely, cosine similarity, as a metric for distinguishing and eliminating attackers. However, there is a significant problem with using an angle: each vector is almost perpendicular in high-dimensional space, and the differences between different vectors are nearly zero. In commonly used models, the parameters are on the order of thousands, which means that the dimensionality of the vectors derived from the model gradient transformation is also on the order of thousands. Therefore, it is necessary to move these high-dimensional vectors to a low-dimensional space as much as possible without significantly disrupting the model structure, and use the angle as an indicator in this low-dimensional space to identify and eliminate attackers.

[0032] However, directly mapping the entire model gradient to a lower dimension, regardless of the mapping method used, may result in the loss of high-dimensional information about the model gradient. Therefore, this invention divides it into multiple low-dimensional gradients for parallel computation. Considering that the dimension of the model gradient increases with the model size, while the size of the convolutional kernel remains fixed, typically in 5×5 and 3×3 dimensions, and that the convolutional kernel, as the basic unit of the model, preserves the model's structural information to the greatest extent, this invention identifies and eliminates malicious attack convolutional kernels by computing the angles of multiple convolutional kernels in parallel. Using the convolutional kernel angle as a metric improves the robustness of defense methods in federated learning, thereby improving the model's inference accuracy. Furthermore, by eliminating malicious convolutional kernels rather than malicious models, the diversity of training data is preserved, improving the model's generalization performance and further enhancing its inference accuracy.

[0033] Step 3.3: Traverse all clients and determine the convolution kernels in each client whose cosine value of the target angle is greater than zero as normal convolution kernels; otherwise, determine them as malicious convolution kernels.

[0034] In calculating the angle between the client-side and server-side convolutional kernels, this invention first arranges the two kernels into two one-dimensional vectors. Then, it divides the inner product of these two one-dimensional vectors by their respective magnitudes to obtain the cosine values ​​of the two vectors. These cosine values ​​are used as the metric for each client-side convolutional kernel. Each client contains M convolutional kernels, resulting in M ​​target angles, or M cosine values.

[0035] The training process in federated learning is essentially a convex optimization gradient descent process. Since the training datasets for each client and server are of the same type of image data, the descent direction of the local convolutional kernel gradient trained on each client using its local dataset should generally be consistent with the descent direction of the local convolutional kernel gradient trained on the central server. If the descent direction of the client's convolutional kernel gradient is greater than 90 degrees from the descent direction of the server's convolutional kernel gradient, it indicates that the descent direction of the client's convolutional kernel gradient has a component opposite to that of the server's convolutional kernel gradient. This indicates that this client's convolutional kernel gradient is a malicious convolutional kernel and needs to be removed. Therefore, client convolutional kernels with an angle greater than 90 degrees are malicious convolutional kernels; that is, cosine values ​​less than 0 indicate malicious convolutional kernels, and cosine values ​​greater than 0 indicate normal convolutional kernels.

[0036] Step 3.4: Divide the gradients of all client-side convolutional kernels at the same position as the server model by their own convolutional kernel gradient magnitude, and then sum them with the server's convolutional kernel gradient. Divide the summed result by the number of convolutional kernels involved in the summation, and then multiply by the magnitude of the server's convolutional kernel gradient to obtain the global model convolutional kernel gradient at this position. The global model gradient is formed by combining the global model convolutional kernel gradients at each position according to their positions (for example, in the AlexNet model, each convolutional kernel is placed according to its position marker, starting from the first convolutional kernel of the first layer, until the last convolutional kernel of the last layer, and the convolutional kernels of all layers after placement constitute the entire AlexNet model), thus completing the convergence of the global model gradients. The gradient convergence process is as follows: Figure 2 As shown.

[0037] Federated learning training is essentially a gradient descent process in convex optimization. Angle-based attacker elimination methods are more robust than distance-based methods because the correctness of the gradient descent direction is more important than the correctness of the gradient magnitude. For example, if the descent direction is incorrect, convex optimization may enter a local minimum or diverge. However, if the gradient magnitude is large, convex optimization can reach the ideal global optimum by increasing the number of iterations.

[0038] To mitigate the impact of convolutional kernel gradient magnitude on the number of training epochs, we unify the magnitude of all convolutional kernel gradients to match the server-side kernel gradient magnitude. To ensure client-side data privacy while integrating features from each dataset, we need to combine client-side convolutional kernel gradients with features from different datasets. Since the magnitude of each convolutional kernel gradient has already been unified, we only need to synthesize them from different perspectives. Considering that the training datasets on each client are equally important as those on the server, this invention will combine the average of each normal convolutional kernel gradient to obtain the global convolutional kernel gradient.

[0039] Existing convergence processes typically combine data by averaging, neglecting the impact of gradient magnitude on model training, leading to an increase in the number of training epochs. In contrast, this invention requires fewer training epochs to achieve the same inference accuracy when facing Byzantine attacks that modify gradient magnitude.

[0040] Step 3.5: Update the global model using the global model gradient, and then send the global model to the client to update all local models on the client and server to the new global model.

[0041] The method of updating the global model using the global model gradient is as follows: multiply the global gradient by the learning rate and subtract this value from the global model to obtain the updated global model. The learning rate is one of the hyperparameters of federated learning and can be set based on experience.

[0042] Step 3.6: If the number of training rounds has not reached the preset number of training rounds, proceed to step 3.1; otherwise, use the global model as the federated learning-based image classification model to complete the training.

[0043] Step 4: In actual use, the image to be classified is input into the trained image classification model based on federated learning to complete the classification.

[0044] Finally, we evaluated the performance of this invention through experiments. We used the CIFAR-10 and Fashion-MNIST datasets, and tested the image classification accuracy using three models: AlexNet, ResNet-50, and GoogLeNet, under both IID and non-IID data distributions. To evaluate the invention's defense performance against different types of Byzantine attacks, we tested gradient tampering and data tampering attacks. We used a PS architecture, consisting of one central server and 10 clients, with 20% of the clients designated as malicious attackers. Training lasted for over 500 epochs. The batch size was set to 32, and the learning rate was set to 0.01. Model updates were aggregated after each training round on both the client and server sides. Experimental results show that compared to existing angle-based and distance-based solutions, this invention demonstrates advantages in algorithmic generality and fine-grained attacker exclusion, improving inference accuracy by 67% and 88%, respectively, significantly enhancing the accuracy of federated learning image classification methods under Byzantine attacks.

[0045] In summary, the above are merely preferred embodiments of the present invention, and the accompanying drawings are only used to illustrate the effectiveness of the embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An attack and defense image classification method based on angle similarity detection, characterized in that, Includes the following steps: Step 1: Construct the training sample dataset. The server uses a small dataset with normal data labeling as the local training sample dataset, which is denoted as the first local training set. The client uses the training sample dataset as its local training sample dataset, denoted as the second local training set. Step 2: Build an image classification model based on federated learning, deploy the image classification model as a global model and a local model on the server, and deploy the image classification model as a local model on the client. Initialize the global model; Step 3: The server uses the first local training set to train its deployed local model to obtain the server model, and the client uses the second local training set to train its deployed local model to obtain the client model. Calculate the angle between the gradient of each convolutional kernel in the client model and the gradient of the corresponding convolutional kernel in the server, and take the convolutional kernel with the cosine value of the angle greater than zero as the normal convolutional kernel; The normal convolutional kernel gradients of all clients in the same position as the server model are merged with the server convolutional kernel gradient to form a new global model gradient. The global model, server model and client model are updated using the global model gradient. If the number of training rounds has not reached the preset value, step 3 is executed. Otherwise, the current global model is the trained image classification model based on federated learning. Step 4: In actual use, the image to be classified is input into the trained image classification model based on federated learning to complete the classification.

2. The attack defense image classification method according to claim 1, characterized in that, The method for initializing the global model is as follows: the shape and number of convolutional kernels in the global model are initialized to be the same as those in the local model on the server side, and all elements in the gradient of the global convolutional kernel are set to 0.

3. The attack defense image classification method according to claim 1, characterized in that, The cosine value of the included angle is calculated as follows: first, arrange the two convolution kernels into two one-dimensional vectors, and then divide the inner product of the two one-dimensional vectors by the magnitude of each of the two one-dimensional vectors to obtain the cosine value of the two one-dimensional vectors.

4. The attack defense image classification method according to claim 1, characterized in that, The method for converging the normal convolution kernel gradients of all clients at the same position in the server model with the server convolution kernel gradient to form a new global model gradient is as follows: divide the normal convolution kernel gradients of all clients at the same position in the server model by their own convolution kernel gradient magnitude, and then accumulate them with the server convolution kernel gradient; divide the accumulated result by the number of convolution kernels involved in the accumulation, and then multiply it by the magnitude of the server convolution kernel gradient to obtain the global model convolution kernel gradient at this position; the global model gradient is then formed by combining the global model convolution kernel gradients at each position to complete the convergence of the global model gradients.

5. The attack defense image classification method according to claim 1, characterized in that, The method of updating the global model using the global model gradient is as follows: multiply the global gradient by the learning rate and subtract this value from the global model to obtain the updated global model, where the learning rate is a hyperparameter of federated learning.

Images