User local data distribution reasoning attack method based on federal learning

Abstract

The invention relates to the technical field of machine learning, in particular to a user local data distribution reasoning attack method based on federal learning. The method comprises the steps of generating an auxiliary data set, constructing a simulated attack user data set, training a shadow model, training a user model, calculating cosine similarity, adjusting the data proportion of various labels in the simulated attack user data set, forming an updated federal learning global model, judging a training termination condition, and obtaining a training result. Obtaining local data distribution of the target attack user; according to the method, the data privacy security problem caused by federal learning distributed training characteristics is solved; by deploying an auxiliary data set and a shadow model at a server side, analyzing and simulating an attack user data set by using a gradient direction, the distribution of local data of a target attack user on each category is dynamically deduced, the label distribution of the target attack user is revealed, and meanwhile, the method has relatively high concealment, adaptability and effectiveness.

Description

Technical Field

[0001] The present invention relates to the technical field of machine learning, and in particular to a user local data distribution reasoning attack method based on federated learning. Background Art

[0002] Federated learning is a distributed machine learning framework with broad application prospects in the fields of medicine, finance, and the Internet of Things. Federated learning enables joint training of data stored on IoT devices without leaving the local machine, thereby effectively solving the "data island" and "data privacy protection" problems caused by geographical isolation and data security of IoT devices. Due to the characteristics of distributed training in federated learning, the server can perform member inference attacks, attribute inference attacks, etc. on the model parameters or model gradient information uploaded by the participating users, threatening the data privacy security of federated learning. Summary of the invention

[0003] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to propose a user local data distribution inference attack method based on federated learning. By deploying auxiliary data sets and shadow models on the server side, and utilizing gradient direction analysis and simulation to attack user data sets, the distribution of local data of the target attack user in various categories is dynamically inferred, revealing the label distribution of the target attack user, while having high concealment, adaptability and effectiveness.

[0004] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0005] A method for attacking user local data distribution inference based on federated learning, the method comprising:

[0006] Step 1: For each classification label of the N classification tasks in federated learning, collect the data corresponding to each label to form N auxiliary data sets;

[0007] Step 2: randomly collect data or randomly extract data from the auxiliary data set to construct a simulated attack user data set;

[0008] Step 3: Use the federated learning global model to train N auxiliary data sets to generate N shadow models;

[0009] Step 4: Use the federated learning global model to train the local data of several users to obtain several user models;

[0010] Step 5: select any one of the user models as the target attack user model, obtain the model gradient of the target attack user model and the model gradients of the N shadow models, and calculate the cosine similarity between the model gradient of the target attack user model and the model gradient of the N shadow models;

[0011] Step 6: According to the cosine similarity, adjust the data ratio of each type of label in the simulated attack user data set, and use the constraint condition to correct the data ratio;

[0012] Step 7: Aggregate the model gradients of several user models to form an updated federated learning global model;

[0013] Step 8, determine whether the updated federated learning global model meets the training termination condition. If so, execute step 9. If not, send the updated federated learning global model to several users and execute steps 3 to 8.

[0014] Step 9: According to the data proportion of each type of label in the simulated attack user data set, the local data distribution of the target attack user is obtained.

[0015] The auxiliary dataset is represented as:

[0016] D={D 1 ,D 2 ,…,D N},

[0017] Where D represents the set of auxiliary data sets, D i represents the i-th auxiliary data set, D i Only data with label i is included.

[0018] The shadow model is expressed as:

[0019]

[0020] in, Indicates the i-th shadow model in the t-th round in the auxiliary dataset D i Update results after training, η represents the model learning rate, which is set to 0.001. represents the gradient operation, L(·) represents the cross entropy loss function, Represents the global model obtained by aggregating all user models in round t.

[0021] The cosine similarity is expressed as:

[0022] s={s 1 ,s 2 ,…,s N},

[0023]

[0024] Among them, s represents the set of cosine similarities, s irepresents the cosine similarity between the target attack user and the i-th shadow model, <·> represents the inner product operation, and ||·|| represents the modulus length operation.

[0025] According to the cosine similarity, the data ratio of each type of label in the simulated attack user data set is adjusted, including:

[0026] The cosine similarity is normalized and expressed as:

[0027]

[0028] in, is the normalized cosine similarity vector, ∑ represents the summation operation, Represents the i-th cosine similarity value after unitization;

[0029] According to the normalized cosine similarity, the number of simulated attack user data sets on each label is proportionally allocated, expressed as:

[0030]

[0031] Among them, M i It represents the total amount of data added to the simulated attack user dataset on the i-th label, and Q represents the total amount of data added to the simulated attack user dataset in a single time.

[0032] The constraint conditions include: class non-overlapping constraint, post-adjustment non-increasing constraint and decreasing adjustment constraint.

[0033] The training termination conditions include:

[0034] Condition 1: The performance of the global model of federated learning reaches the specified expected goal;

[0035] Condition 2: The loss function of the global model of federated learning converges;

[0036] The training termination condition is reached when any one of condition 1 and condition 2 is met.

[0037] A user local data distributed reasoning attack system based on federated learning, comprising:

[0038] The auxiliary dataset construction module collects the data corresponding to each classification label of the N classification tasks in federated learning to form N auxiliary datasets;

[0039] A simulated attack user data set construction module randomly collects data or randomly extracts data from an auxiliary data set to construct a simulated attack user data set;

[0040] The shadow model training module uses the federated learning global model to train N auxiliary data sets and generate N shadow models;

[0041] The user model training module uses the federated learning global model to train the local data of several users to obtain several user models;

[0042] A cosine similarity calculation module selects any one of several user models as a target attack user model, obtains a model gradient of the target attack user model and a model gradient of N shadow models, and calculates a cosine similarity between the model gradient of the target attack user model and the model gradient of the N shadow models;

[0043] The data ratio adjustment module adjusts the data ratio of each type of label in the simulated attack user data set according to the cosine similarity, and corrects the data ratio using constraint conditions;

[0044] The model update module aggregates the model gradients of several user models to form an updated federated learning global model;

[0045] The termination condition judgment module determines whether the updated federated learning global model meets the training termination condition. If so, the operation of the data distribution simulation module is executed. If not, the updated federated learning global model is sent to several users, and the operation of the shadow model training module-termination condition judgment module is executed.

[0046] The data distribution simulation module obtains the local data distribution of the target attack user based on the data proportion of each type of label in the simulated attack user data set.

[0047] An electronic device, comprising:

[0048] at least one processor;

[0049] and, a memory communicatively coupled to the at least one processor;

[0050] Among them, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above-mentioned user local data distribution inference attack methods based on federated learning.

[0051] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements any of the above-mentioned methods for attacking user local data distribution based on federated learning.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] 1. This invention proposes for the first time to conduct inference attacks on the distribution of user local data. By analyzing the model updates uploaded by users during the federated learning process, the distribution ratio information of user data is revealed. In existing research and practice, inference attacks on the distribution of user local data are proposed for the first time, which not only demonstrates the potential security vulnerabilities in the federated learning system, but also provides new perspectives and challenges for further research and the formulation of defense measures. This innovative attack method, due to its uniqueness and foresight, has important theoretical and practical significance for the security research field of federated learning.

[0054] 2. The present invention adopts a variety of strategies, including gradient direction analysis, dynamic data distribution adjustment, constraint optimization based on actual feedback, and historical information correction mechanism, which ensure that the simulated attack user dataset can dynamically simulate the target attack user's model update process with high accuracy and adaptability. Through the use of these comprehensive strategies, the simulated attack user dataset can not only capture the subtle changes in the target attack user model update, but also accurately simulate the distribution characteristics of the target attack user's local data.

[0055] In summary, by deploying auxiliary datasets and shadow models on the server side, utilizing gradient direction analysis, and constructing a simulated attack user dataset, the distribution of the target attack user's local data in each category is dynamically inferred, revealing the label distribution of the target attack user, while having high concealment, adaptability, and effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0057] The technical solution of the present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0058] Generally, federated learning uses private data distributed locally to obtain a machine learning model with good predictive capabilities through distributed training. Specifically, the central server obtains and updates the global model parameters of federated learning by aggregating the local model parameters obtained by local users through local training. Then, the central server uses the global model parameters to update the global model of federated learning. The global model update process of federated learning is iterative until the determined training termination condition is met.

[0059] Based on the idea of ​​federated learning, the idea of ​​the present invention is: by deploying auxiliary data sets and shadow models on the server side, using gradient direction analysis and constructing simulated attack user data sets, dynamically inferring the distribution of target attack user local data in various categories. Specifically: First, the server collects and analyzes the gradient information uploaded by the user, and then compares the cosine similarity between it and the gradient information of the shadow model trained on different auxiliary data sets. Through this similarity, the server adjusts the data distribution of the simulated attack user data set to match the actual distribution of the target client. In this process, three constraints are applied: class non-overlapping, post-adjustment non-increasing and decremental adjustment constraints, combined with the historical information correction strategy, to optimize the accuracy of the prediction results.

[0060] A distributed reasoning attack method for user local data based on federated learning, such as Figure 1 As shown, the method includes:

[0061] Step 1: For each classification label of the N classification tasks in federated learning, collect image samples corresponding to each label from the real world to form N auxiliary datasets, ensuring that each dataset contains only a single category of labels;

[0062] The auxiliary dataset is represented as:

[0063] D={D 1 ,D 2 ,…,D N},

[0064] Where D represents the set of auxiliary data sets, D i represents the i-th auxiliary data set, D i Only data with label i is included.

[0065] Step 2: randomly collect data or randomly extract data from the auxiliary data set to construct a simulated attack user data set;

[0066] Step 3: In each round of federated learning, the server uses the federated learning global model to train the N auxiliary data sets collected in step 1. The model trained on each auxiliary data set is called a shadow model. A total of N shadow models are generated to simulate the update direction of the global model after learning on a single category.

[0067] The shadow model is expressed as:

[0068]

[0069] in, Indicates the i-th shadow model in the t-th round in the auxiliary dataset D i Update results after training, η represents the model learning rate, which is set to 0.001. represents the gradient operation, L(·) represents the cross entropy loss function, Represents the global model obtained by aggregating all user models in round t.

[0070] Step 4: Use the federated learning global model to train the local data of several users to obtain several user models;

[0071] Step 5: select any one of the user models as the target attack user model, obtain the model gradient of the target attack user model and the model gradients of the N shadow models, and calculate the cosine similarity between the model gradient of the target attack user model and the model gradient of the N shadow models obtained in step 3 to evaluate the similarity between them;

[0072] The cosine similarity is expressed as:

[0073] s={s 1 ,s 2 ,…,s N},

[0074]

[0075] Among them, s represents the set of cosine similarities, s i represents the cosine similarity between the target attack user and the i-th shadow model, <·> represents the inner product operation, and ||·|| represents the modulus length operation.

[0076] Step 6: According to the cosine similarity obtained in step 5, the data ratio of each type of label in the simulated attack user data set is adjusted, and the data ratio is corrected using constraint conditions, specifically including:

[0077] Step 6.1, normalize the cosine similarity obtained in step 5 and express it as:

[0078]

[0079] in, is the normalized cosine similarity vector, ∑ represents the summation operation, Represents the i-th cosine similarity value after unitization;

[0080] Step 6.2, according to the normalized cosine similarity, the number of simulated attack user data sets on each label is proportionally allocated, expressed as:

[0081]

[0082] Among them, M irepresents the total amount of data added to the simulated attack user dataset on the i-th label, Q represents the total amount of data added to the simulated attack user dataset at a single time, and the function of increasing the amount of data in the simulated attack user dataset on all labels is called f(Q).

[0083] Step 6.3, apply class non-overlapping constraints to avoid over-prediction of certain classes, specifically:

[0084] Compare the maximum cosine similarity after normalization in the tth round The maximum cosine similarity after unitization with the t-1th round Whether the corresponding labels are the same:

[0085]

[0086] If they are the same, the data of the simulated attack user data set is adjusted to the distribution ratio of the t-1th round, otherwise it is still adjusted according to the ratio of the tth round.

[0087] Step 6.4, apply the non-increasing and decreasing adjustment strategies to ensure the rationality and gradualness of the data distribution adjustment, specifically:

[0088] The adjusted non-incremental strategy constrains the total amount of data added for each label in the tth round to not exceed twice its initial data amount.

[0089] The decreasing adjustment strategy constrains the total amount of data added to the simulated attack user data set to decrease:

[0090] Q′=α*Q,

[0091] Where Q′ represents the total amount of increased data after decreasing, and α represents the attenuation factor set to 0.8.

[0092] Step 7: Aggregate the model gradients of several user models on the server to form an updated federated learning global model;

[0093] Step 8, determine whether the updated federated learning global model meets the training termination condition. If so, execute step 9. If not, send the updated federated learning global model to several users for further training, and execute steps 3 to 8.

[0094] The training termination conditions include:

[0095] Condition 1: The performance of the global model of federated learning reaches the specified expected goal;

[0096] Condition 2: The loss function of the global model of federated learning converges;

[0097] If any one of condition 1 and condition 2 is met, the training termination condition is reached and the training can be terminated.

[0098] Step 9: According to the data proportion of each type of label in the simulated attack user data set, the local data distribution of the simulated target attack user is obtained.

[0099] A user local data distributed reasoning attack system based on federated learning, comprising:

[0100] The auxiliary dataset construction module collects the data corresponding to each classification label of the N classification tasks in federated learning to form N auxiliary datasets;

[0101] A simulated attack user data set construction module randomly collects data or randomly extracts data from an auxiliary data set to construct a simulated attack user data set;

[0102] The shadow model training module uses the federated learning global model to train N auxiliary data sets and generate N shadow models;

[0103] The user model training module uses the federated learning global model to train the local data of several users to obtain several user models;

[0104] A cosine similarity calculation module selects any one of several user models as a target attack user model, obtains a model gradient of the target attack user model and a model gradient of N shadow models, and calculates a cosine similarity between the model gradient of the target attack user model and the model gradient of the N shadow models;

[0105] The data ratio adjustment module adjusts the data ratio of each type of label in the simulated attack user data set according to the cosine similarity, and corrects the data ratio using constraint conditions;

[0106] The model update module aggregates the model gradients of several user models to form an updated federated learning global model;

[0107] The termination condition judgment module determines whether the updated federated learning global model meets the training termination condition. If so, the operation of the data distribution simulation module is executed. If not, the updated federated learning global model is sent to several users, and the operation of the shadow model training module-termination condition judgment module is executed.

[0108] The data distribution simulation module obtains the local data distribution of the simulated target attack user according to the data proportion of each type of label in the simulated attack user data set.

[0109] An electronic device, comprising:

[0110] at least one processor;

[0111] and, a memory communicatively coupled to the at least one processor;

[0112] Among them, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above-mentioned user local data distribution inference attack methods based on federated learning.

[0113] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements any of the above-mentioned methods for attacking user local data distribution based on federated learning.

[0114] The effect of the present invention is further described below in conjunction with simulation experiments.

[0115] 1. Simulation experiment conditions:

[0116] The hardware platform of the simulation experiment of the present invention is: the processor is Intel (R) Xeon (R) Silver 4210 CPU, the main frequency is 2.20 GHz, the memory is 256 GB, and the GPU is 4 NVIDIA GeForce RTX 3090.

[0117] The software platform for the simulation experiment of the present invention is: Ubuntu 18.04 operating system and python 3.9.

[0118] The data sets used in the simulation experiments of the present invention are the MNIST data set, the Fashion-MNIST data set, the CIFAR-10 data set, and the AG-News data set.

[0119] The MNIST dataset was collected by Yann LeCun and others from the National Institute of Standards and Technology. The dataset contains a large number of handwritten digit images from 0 to 9, with 60,000 images in the training set and 10,000 images in the test set. Each image is a 28x28 pixel grayscale image with pixel values ​​between 0 and 255.

[0120] The Fashion-MNIST dataset was collected by the German fashion technology company Zalando. The dataset covers 70,000 front-facing images of different products from 10 categories, including T-shirts, pants, pullovers, dresses, coats, sandals, shirts, sneakers, bags, and boots. Each category contains 6,000 images, of which 60,000 are used for training and 10,000 for testing. The image format of Fashion-MNIST is 28x28 grayscale images.

[0121] The CIFAR-10 dataset was collected by Alex Krizhevsky, Vindo Nair, and Geoffrey Hinton. The dataset covers 10 categories of color images, including airplanes, cars, birds, cats, deer, dogs, frogs, horses, ships, and trucks, with 1,000 images in each category. The entire dataset contains 60,000 32×32 color images. The dataset is divided into two parts, 50,000 and 10,000, of which 50,000 images are used for training and 10,000 images are used for testing.

[0122] The AG-News dataset is collected by Cornell University in the United States. The dataset covers 120,000 English news articles in four categories, including World, Sports, Business, and Sci / Tech. The dataset consists of about 300,000 news titles and descriptions, with 3,000 training samples and 1,900 test samples in each category. These data come from more than 2,000 news sources in the AG News corpus.

[0123] 2. Simulation content and results analysis:

[0124] The simulation experiment of the present invention uses the present invention and two existing technologies (PPA preference reasoning attack method and LIA category reasoning attack method) to perform user local data distribution reasoning attacks on the above four data sets. The scenario simulated by the simulation experiment is that 20 users jointly train a federated learning global model, and the reasoning attack is performed on the data distribution of one of the 20 users.

[0125] In the simulation experiment, the two existing technologies used are:

[0126] The prior art PPA preference reasoning attack method refers to the preference reasoning attack method proposed by Zhou et al. in “PPA: preference profiling attack against federated learning 2023”, referred to as the PPA preference reasoning attack method.

[0127] The prior art LIA category reasoning attack method refers to the category reasoning attack method proposed by Ramakrishna et al. in “Inferring class-label distribution in federated learning 2022.”, referred to as the LIA category reasoning attack method.

[0128] In order to verify the effect of the simulation experiment of the present invention, the following four evaluation indicators (Wasserstein distance, KL divergence, JS divergence, and L1 distance) are used to evaluate the results of the user local data distribution inference attack of the three methods respectively. The smaller the distance, the better the inference attack effect, otherwise the worse the inference attack effect. All the calculation results are plotted in Table 1, and the bold data in the table represent the optimal results.

[0129] Table 1. List of training results of the present invention and various prior arts in simulation experiments

[0130]

[0131] As can be seen from Table 1, the distance between the predicted distribution of the method of the present invention and the actual distribution of the target attack user on four different indicators is the closest regardless of the data set. On the FashionMNIST, CIFAR and AG News data sets, the reasoning attack results of the present invention are one order of magnitude smaller than those of the two comparison methods. In particular, on the AG News data set, the distance between the predicted results of the present invention and the actual distribution of the target attack user is only 0.0007. This shows that the user local data distribution reasoning attack proposed by the present invention is more accurate than the comparison method, and the predicted distribution is more consistent with the actual distribution.

[0132] This invention proposes for the first time to conduct inference attacks on the distribution of user local data. By analyzing the model updates uploaded by users during the federated learning process, the distribution ratio information of user data is revealed. In existing research and practice, inference attacks on the distribution of user local data are proposed for the first time, which not only demonstrates the potential security vulnerabilities in the federated learning system, but also provides new perspectives and challenges for further research and the formulation of defense measures. This innovative attack method, due to its uniqueness and foresight, has important theoretical and practical significance for the security research field of federated learning.

[0133] The present invention adopts a variety of strategies, including gradient direction analysis, dynamic data distribution adjustment, constraint optimization based on actual feedback, and historical information correction mechanism, which ensure that the simulated attack user dataset can dynamically simulate the target attack user's model update process with high accuracy and adaptability. Through the use of these comprehensive strategies, the simulated attack user dataset can not only capture the subtle changes in the target attack user model update, but also accurately simulate the distribution characteristics of the target attack user's local data.

[0134] In summary, by deploying auxiliary datasets and shadow models on the server side, utilizing gradient direction analysis, and constructing a simulated attack user dataset, the distribution of the target attack user's local data in each category is dynamically inferred, revealing the label distribution of the target attack user, while having high concealment, adaptability, and effectiveness.

[0135] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A user local data distribution reasoning attack method based on federated learning, characterized in that: The method comprises: Step 1: For each classification label of the N classification tasks in federated learning, collect the data corresponding to each label to form N auxiliary data sets; Step 2: randomly collect data or randomly extract data from the auxiliary data set to construct a simulated attack user data set; Step 3: Use the federated learning global model to train N auxiliary data sets to generate N shadow models; Step 4: Use the federated learning global model to train the local data of several users to obtain several user models; Step 5: select any one of the user models as the target attack user model, obtain the model gradient of the target attack user model and the model gradients of the N shadow models, and calculate the cosine similarity between the model gradient of the target attack user model and the model gradient of the N shadow models; Step 6: According to the cosine similarity, adjust the data ratio of each type of label in the simulated attack user data set, and use the constraint condition to correct the data ratio; Step 7: Aggregate the model gradients of several user models to form an updated federated learning global model; Step 8, determine whether the updated federated learning global model meets the training termination condition. If so, execute step 9. If not, send the updated federated learning global model to several users and execute steps 3 to 8. Step 9: According to the data proportion of each type of label in the simulated attack user data set, the local data distribution of the target attack user is obtained.

2. According to claim 1, a method for attacking user local data distribution inference based on federated learning is characterized in that: The auxiliary dataset is represented as: D={D1,D2,…,D N }, Where D represents the set of auxiliary data sets, D i represents the i-th auxiliary data set, D i Only data with label i is included.

3. According to claim 2, a method for attacking user local data distribution inference based on federated learning is characterized in that: The shadow model is expressed as: in, Indicates the i-th shadow model in the t-th round in the auxiliary dataset D i Update results after training, η represents the model learning rate, which is set to 0.

001. represents the gradient operation, L(·) represents the cross entropy loss function, Represents the global model obtained by aggregating all user models in round t.

4. According to claim 3, a method for attacking user local data distribution inference based on federated learning is characterized in that: The cosine similarity is expressed as: s={s1,s2,…,s N }, Among them, s represents the set of cosine similarities, s i represents the cosine similarity between the target attack user and the i-th shadow model, <·> represents the inner product operation, and ||·|| represents the modulus length operation.

5. According to claim 4, a method for attacking user local data distribution inference based on federated learning is characterized in that: According to the cosine similarity, the data ratio of each type of label in the simulated attack user data set is adjusted, including: The cosine similarity is normalized and expressed as: in, is the normalized cosine similarity vector, ∑ represents the summation operation, Represents the i-th cosine similarity value after unitization; According to the normalized cosine similarity, the number of simulated attack user data sets on each label is proportionally allocated, expressed as: Among them, M i It represents the total amount of data added to the simulated attack user dataset on the i-th label, and Q represents the total amount of data added to the simulated attack user dataset in a single time.

6. According to claim 5, a method for attacking user local data distribution inference based on federated learning is characterized in that: The constraint conditions include: class non-overlapping constraint, post-adjustment non-increasing constraint and decreasing adjustment constraint.

7. According to claim 6, a method for attacking user local data distribution inference based on federated learning is characterized in that: The training termination conditions include: Condition 1: The performance of the global model of federated learning reaches the specified expected goal; Condition 2: The loss function of the global model of federated learning converges; The training termination condition is reached when any one of condition 1 and condition 2 is met.

8. A user local data distribution reasoning attack system based on federated learning, characterized in that: include: The auxiliary dataset construction module collects the data corresponding to each classification label of the N classification tasks in federated learning to form N auxiliary datasets; A simulated attack user data set construction module randomly collects data or randomly extracts data from an auxiliary data set to construct a simulated attack user data set; The shadow model training module uses the federated learning global model to train N auxiliary data sets and generate N shadow models; The user model training module uses the federated learning global model to train the local data of several users to obtain several user models; A cosine similarity calculation module selects any one of several user models as a target attack user model, obtains a model gradient of the target attack user model and a model gradient of N shadow models, and calculates a cosine similarity between the model gradient of the target attack user model and the model gradient of the N shadow models; The data ratio adjustment module adjusts the data ratio of each type of label in the simulated attack user data set according to the cosine similarity, and corrects the data ratio using constraint conditions; The model update module aggregates the model gradients of several user models to form an updated federated learning global model; The termination condition judgment module determines whether the updated federated learning global model meets the training termination condition. If so, the operation of the data distribution simulation module is executed. If not, the updated federated learning global model is sent to several users, and the operation of the shadow model training module-termination condition judgment module is executed. The data distribution simulation module obtains the local data distribution of the target attack user based on the data proportion of each type of label in the simulated attack user data set.

9. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a user local data distribution reasoning attack method based on federated learning as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a user local data distribution reasoning attack method based on federated learning is implemented as described in any one of claims 1 to 7.

Images