Machine learning poisoning attack method, system, equipment and medium

Abstract

The invention discloses a machine learning poisoning attack method, system and device and a medium, and the method comprises the steps: firstly initializing a training round number r, a trigger delta, a learning rate and the number of participants, then training the trigger delta in a malicious participant in a front # imgabs0 # round of federated learning, then training the malicious participant in a rear # imgabs1 # round of federated learning to generate a universal trigger vector vec, a universal trigger embedding is generated, and finally, the malicious participant performs double-trigger backdoor attack; the system, the equipment and the medium are used for realizing the machine learning poisoning attack method. According to the method, double triggers are adopted to maximize the influence of malicious participants on the prediction result of the top model, so that the success rate of implementing backdoor attack in a multi-participant scene can be greatly improved, and the method has important reference significance for researching the security problem and defense scheme of longitudinal federated learning in the multi-participant scene; and the effect of protecting the training safety of the longitudinal relation learning model in a multi-participant scene by related workers is improved.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a machine learning poisoning attack method, system, device and medium. Background Art

[0002] Federated Learning (FL) is a distributed machine learning technology. Its core idea is to allow multiple participants to jointly build and train machine learning models while maintaining data privacy. The emergence of this technology is mainly to solve the problem of data silos and the need for personal privacy protection. Federated learning is divided into horizontal federated learning (HFL) and vertical federated learning (VFL). In vertical federated learning, the data sets of the participants have the same sample ID space, but different feature spaces. This scenario is common in joint model training in the fields of banking, insurance, and medical care.

[0003] Current research shows that backdoor attacks are possible in two-party vertical federated learning scenarios. Malicious participants may inject backdoors during training, causing the model to produce incorrect predictions under specific trigger conditions, thereby reducing the model's availability. The main idea of ​​existing attack methods is to use carefully constructed trigger vectors to replace the local embeddings of a very small number of target class samples. This method has an attack success rate of up to 94% in two-party scenarios, and does not affect the accuracy of the model's main task.

[0004] As vertical federated learning technology is promoted and deployed, the number of participants in collaborative training gradually changes from a two-party scenario to a multi-party scenario. The success rate of the above-mentioned backdoor attack method in a multi-party scenario will drop significantly. In a four-party scenario, when each participant divides all sample feature spaces equally for training, the success rate of the above-mentioned attack method will drop to 20%. This is because as the number of participants increases, the impact of malicious participants on the top-level model will gradually decrease (assuming that each party holds the same number of features), resulting in a smaller impact of the backdoor on the model's prediction results, causing a decrease in the success rate of the attack.

[0005] The Chinese patent application with publication number CN118296597A discloses a federated learning backdoor attack method, program, device and storage medium based on a learnable trigger. However, since this method is used in horizontal federated learning, it has the disadvantage of being unable to solve the problem that malicious parties cannot obtain sample labels in vertical federated learning.

[0006] He Y, Shen Z, Hua J, et al. published Backdoor Attack Against Split Neural Network-Based Vertical Federated Learning (Backdoor Attack Against Split Neural Network-Based Vertical Federated Learning[J].IEEE Transactions on Information Forensics and Security, 2023.). This paper used a general backdoor attack method to perform backdoor attacks during the training phase of vertical federated learning. However, since this attack method relies on the proportion of malicious participants in the top-level model reasoning phase, it has the disadvantage of greatly reducing the attack success rate in multi-participant scenarios.

[0007] Chen P, Du X, Lu Z et al. published Universal adversarial backdoor attacks to fool vertical federated learning (Universal adversarial backdoor attacks to fool vertical federated learning [J]. Computers & Security, 2024, 137: 103601.) This paper trains a universal trigger to perform federated learning backdoor attacks. However, since the attack is carried out in the vertical federated learning reasoning phase, it is more easily detected by anomalies. In addition, this attack method is also not suitable for multi-party scenarios. It has weak anti-anomaly detection capabilities and is not suitable for multi-party vertical federated learning scenarios. Summary of the invention

[0008] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide a machine learning poisoning attack method, system, device and medium. By using a general trigger vector plus a target label trigger, this dual trigger method is aimed at multi-participant scenarios, that is, vertical federated learning backdoor attacks with more than 2 participants, thereby improving the success rate of backdoor attacks by malicious participants.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is:

[0010] A machine learning poisoning attack method, including the following four stages:

[0011] Phase 1: System initialization, including initializing the number of training rounds r, trigger δ, learning rate, and number of participants;

[0012] Phase 2: Before Federated Learning The malicious participants in the round train trigger δ;

[0013] Phase 3: After Federated Learning In each round, the malicious party trains and generates a universal trigger vector vec to generate a universal trigger embedding;

[0014] Phase 4: After federated learning completes r rounds of training in phases 2 and 3, the malicious party conducts a double-trigger backdoor attack.

[0015] The second stage training trigger δ specifically includes:

[0016] In the early stage of vertical federated learning training, the benign participants conduct normal federated learning training, that is, forward propagating the feature input x_in to the underlying model, and the underlying model converts the feature input into a feature embedding vector v through its own neural network. n , and then forward propagated to the top model. The initial training is set as Round iteration;

[0017] In each round of vertical federated learning training iteration at the beginning of training, the malicious party uses the PGD method to iteratively optimize the trigger δ. After multiple rounds of iterative optimization, the trigger δ of the malicious party has an inhibitory effect on predicting samples as non-target categories; the trigger δ of the tth round of training t The update formula is shown in formula (1):

[0018]

[0019] The specific idea is that the value of the new round of triggers is equal to the value of the previous round of triggers minus the product of the step size and the value of the sign function; the outermost coefficient π of formula (1) is a restriction coefficient, which is used to limit the value of the trigger to a reasonable range; α is the step size parameter; the value of the sign function sgn() is +1 or -1, and the positive and negative values ​​are consistent with the positive and negative values ​​of the input of the sign function, and its input is the gradient value obtained from the loss function; the parameter L represents the loss function, where τ is the backdoor attack target label; x_in represents the input of the malicious participant plus the value of the previous round of triggers, and the predicted value is the label result predicted by the federated learning model F in the current round, Θ * is the model parameter of the malicious party;

[0020] The problem of finding the optimal solution of trigger δ is regarded as a two-level optimization problem of loss function and trigger. The formal expression of this problem is shown in formula (2):

[0021]

[0022] In formula (2), in the above two-level optimization problem, the upper optimization problem is to minimize the loss function L of the vertical federated learning, so as to find the most suitable federated learning model parameter Θ; the lower optimization problem is to limit the value of the trigger on the non-target samples. The solution of the upper optimization affects the solution of the lower optimization. Solving the two-level optimization problem and training the final generated trigger δ is optimal.

[0023] The generation of the third stage universal trigger embedding specifically includes:

[0024] The malicious party uses the sample set corresponding to the target label to execute the mean shift algorithm. The malicious party takes the sample set as input and outputs the feature embedding v n , calculate v n The distance from the center point of the sample in the spatial coordinates, and the feature embedding at the center point is used as the trigger embedding vec to replace the original feature embedding v n After the feature embedding transmitted by the malicious party to the top model is replaced by the trigger embedding, the top model will mistakenly predict the non-target sample label as the target sample label. Then the malicious party will look for an optimal trigger embedding. The probability of misdetection of the top model is the highest, which can be expressed as:

[0025]

[0026] vec in formula (3) t Represents the trigger embedding of the target category; D train Represents the sample targets of all training sets; vec train represents the embedding generated normally by the malicious party’s training set; y≠y t The label of the sample is not equal to the target category label; the role of formula (3) is to maximize the trigger embedding vec t And all non-target category samples (x, y)∈D in the training set train The minimum Euclidean distance between embeddings; in the vertical federation scenario, the malicious party does not have the label data, and the constraint y≠y t If this condition cannot be satisfied, the coordinates of the target label cluster center point are obtained through the mean shift algorithm, and the position of the cluster center point in the malicious participant feature space is used to replace the position of other non-target class samples in the malicious participant feature space. Then, the replaced sample will be close to this cluster, causing the model to predict it as the same label as this class, thereby obtaining the optimal trigger embedding in formula (3) without knowing the sample label. The above process can be expressed as formulas (4) to (6):

[0027]

[0028] xi To find the data point located at the center of the spatial coordinate system in the data set, first use the kernel density estimation method shown in formula (4) to find the kernel function, where exp is the kernel function and h is the bandwidth parameter; formula (5) calculates the other data points in the target sample data set for the data point x i The coordinate influence of m(x i ) represents the other points in the data set for x i The impact of the new position; K(x j -x i ) is the kernel function value, and the function of formula (6) is to update the data point x i The new position of x is obtained by using the training phase. i The feature embedding obtained after passing through the underlying model is used as the trigger embedding vec.

[0029] The dual-trigger backdoor attack includes:

[0030] Benign participants perform normal model updates during the entire r rounds of training;

[0031] After the training of trigger δ and universal trigger embedding vec is completed, the malicious party uses these two triggers to perform backdoor attacks. First, the malicious party u o It traverses its own local dataset. If a sample in the dataset belongs to the target label auxiliary dataset, the feature embedding corresponding to the sample in its underlying model is replaced with the trigger embedding. Otherwise, the trigger is injected into the input of the malicious party, thereby changing the normal feature embedding of the sample into a feature embedding with a trigger. The feature embedding is then sent to the top-level model. During the prediction process, the top-level model will mistakenly identify samples with non-target labels as the target labels required by the malicious party for feature embeddings with triggers.

[0032] A system for machine learning a poisoning attack method, comprising:

[0033] Initialization module, system initialization, including initialization of the number of training rounds r, trigger δ, learning rate, and number of participants;

[0034] Training trigger module, before federated learning The malicious party in the round trains the trigger δ; after the federated learning In each round, the malicious party trains and generates a universal trigger vector vec to generate a universal trigger embedding;

[0035] Attack module, malicious parties conduct double-trigger backdoor attacks.

[0036] A machine learning poisoning attack method device, comprising:

[0037] Memory: used to store a computer program for implementing the machine learning poisoning attack method;

[0038] Processor: used to implement the machine learning poisoning attack method when executing the computer program.

[0039] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a machine learning poisoning attack method are implemented.

[0040] Compared with the prior art, the beneficial effects of the present invention are:

[0041] 1. The present invention adopts the PGD method to train the first trigger, which is an inhibitory trigger. It realizes the inhibitory effect on the situation where the label is judged as a non-backdoor attack target category label during the top-level model reasoning. It has the effect of reducing the probability of the top-level model predicting the non-backdoor attack target label as the correct label, reducing the reasoning performance of the top-level model, and reducing the availability of the federated learning model.

[0042] 2. The present invention trains a universal trigger embedding and replaces the embedding of the backdoor attack target sample with the universal embedding, thereby achieving the situation in which malicious participants cannot obtain labels in vertical federated learning but still can train a universal trigger embedding, and can perform backdoor attacks on vertical federated learning of different models, which has the effect of increasing the probability that the top-level model predicts samples with trigger embedding as backdoor attack target labels.

[0043] 3. The present invention adopts a backdoor attack method combining dual triggers to realize backdoor attacks on multi-participant vertical federated learning scenarios. Inhibitory triggers are added to non-target samples to suppress the probability that the top-level model predicts the non-target sample category. For target samples, the input is replaced with a universal trigger embedding so that the top-level model predicts the backdoor attack target category. The method has strong applicability and anti-anomaly detection capabilities, and is suitable for any vertical federated learning model in multi-participant scenarios, greatly improving the success rate of backdoor attacks in this scenario.

[0044] In summary, the present invention has the effect of improving the success rate of backdoor attacks in multi-participant vertical federated learning scenarios, has strong versatility in attack methods for different federated learning training models, has strong anti-anomaly detection capabilities, and improves the security protection of vertical connection learning model training in multi-participant scenarios by relevant workers. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is the principle of backdoor attack in vertical federated learning.

[0046] Figure 2This is a flow chart of the double-trigger backdoor attack of the present invention.

[0047] Figure 3 This is a comparison chart of the main task accuracy of the present invention in vertical federated learning with and without backdoor attacks.

[0048] Figure 4 This is a comparison chart of the attack accuracy of the present invention under different labels when performing backdoor attacks on three parties and the latest vertical federal backdoor attack accuracy.

[0049] Figure 5 This is a comparison chart of the attack accuracy of the present invention under different labels when performing backdoor attacks on four parties and the accuracy of the latest vertical federal backdoor attack. DETAILED DESCRIPTION

[0050] The present invention will be described in detail below in conjunction with the accompanying drawings.

[0051] like Figure 1 As shown, the machine learning model structure trained by the vertical federated learning system considered in the present invention is a split neural network (SplitNN). A complete split neural network can be divided into a bottom model and a top model. The bottom model is owned by each participant, and the top model is held by the server. The participant who owns the bottom model only holds sample features but no sample labels; the server that owns the top model holds all sample labels. In the vertical federated learning scenario, there is usually a participant who holds both the bottom model and the top model, that is, it holds both some features and all sample labels. Such a participant is called an active party; other participants only hold the bottom model and some sample labels. These participants are called passive parties.

[0052] The entire model training process is summarized as follows: First, each participant (including the active party and the passive party) inputs their local data into their latest underlying model and sends the output embedding to the active party; then, the active party connects the embedding of each participant as the input of the top model; then, the active party compares the output of the top model with the true label it holds to calculate the loss, and back-propagates the loss (gradient information) to each participant; finally, each participant updates its own underlying model parameters based on the gradient information received by back-propagation, completing a round of training. The above process will be iterated multiple times until the model converges or reaches a predefined number of training rounds.

[0053] The present invention has the following assumptions about the backdoor attack scenario of the above-mentioned vertical federated learning: the active party will not launch a backdoor attack; the malicious participants who launch a backdoor attack can only be passive parties holding some sample features. They only have the underlying model structure and cannot obtain or modify the top-level model and sample labels. They can only control the input and output of their own underlying models.

[0054] The principle of backdoor attack in vertical federated learning is as follows Figure 1 As shown in the figure, the malicious party first obtains a certain number of <sample, label> pairs through a specific method, then uses a specific algorithm to generate a backdoor trigger, adds the backdoor trigger to the original training data, and then sends the malicious embedding with the backdoor trigger to the active party. The top-level model of the active party aggregates the embeddings of all participants for prediction. When the predicted sample is a sample with a trigger, the prediction result of the top-level model will be the label result pre-set by the malicious party. When the predicted sample is not a sample with a trigger, the top-level model outputs a normal prediction result.

[0055] The federated learning system framework considered in this invention is as follows: Figure 1 The solution proposed in this invention has the following assumptions about the system:

[0056] 1. Assume that there are n users in the system, denoted as {u1,u2…,u n-1 ,u top}, where n≥2. The models trained by the federated learning system are divided into bottom-level models and top-level models. Each participant has a bottom-level model, u i The underlying model is denoted as f i , the top model consists of the only active party u top all.

[0057] 2. There is only one malicious participant in the system, and the rest are normal participants.

[0058] 3. When dividing the data set, the features of the sample data are evenly divided according to the number of participants in the underlying model, and each participant has the same number of sample features.

[0059] 4. The malicious party has a small auxiliary sample set, and the data labels in this sample set are the target labels of the backdoor attack. The target label is the model prediction label set by the attacker when performing the backdoor attack. It is forced to be output when the model input contains the trigger pattern embedded by the attacker. This is reasonable and achievable in actual scenarios.

[0060] 5. The features owned by each participant constitute its own feature space. Each local training sample input is a vector in the feature space. The closer the vector is to the coordinate axis of a feature in the feature space, the stronger the correlation between the sample and this feature.

[0061] The present invention proposes a vertical federated learning backdoor attack method in a multi-participant scenario. The method designs a double trigger so that the prediction contribution of the malicious party in the multi-participant scenario can suppress the prediction contribution of the benign party, thereby increasing the top-level model's dependence on the output of the malicious party's bottom-level model, thereby improving the success rate of the backdoor attack. The relevant theories and technologies required to generate the double trigger are explained below.

[0062] (1) Two-layer optimization problem:

[0063] The two-level optimization problem is divided into an upper level and a lower level. The decision of the upper level problem affects the decision of the lower level problem. To obtain the solution of the upper level problem, it is necessary to solve the lower level problem first.

[0064] (2) Projected Gradient Descent (PGD):

[0065] PGD ​​is an optimization algorithm that is mainly used to find the minimum value of the loss function. It has a wide range of applications in machine learning, deep learning, computer vision and other fields. It achieves the purpose of minimizing the loss function by updating parameters according to the direction of gradient descent in each iteration step. Compared with other optimization algorithms, PGD has many advantages, such as it is insensitive to the choice of initial points, can handle constrained problems, and it runs very fast.

[0066] (3) Mean Shift Algorithm:

[0067] The mean shift algorithm is a non-parametric clustering algorithm widely used in image processing and computer vision. It discovers the mode (or cluster center) in the data distribution by iteratively moving data points to data-dense areas. The mean shift algorithm does not require the number of clusters to be specified in advance and is a density-based clustering method.

[0068] like Figure 2 As shown in the figure, a machine learning poisoning attack method includes the following four stages:

[0069] Phase 1: System initialization, including initializing the number of training rounds r, trigger δ, learning rate, and number of participants;

[0070] Phase 2: Before Federated Learning The malicious participants in the round train trigger δ;

[0071] Phase 3: After Federated Learning In each round, the malicious party trains and generates a universal trigger vector vec to generate a universal trigger embedding;

[0072] Phase 4: After federated learning completes r rounds of training in phases 2 and 3, the malicious party conducts a double-trigger backdoor attack.

[0073] The second stage training trigger δ specifically includes:

[0074] In the early stage of vertical federated learning training, the benign participants conduct normal federated learning training, that is, forward propagating the feature input x_in to the underlying model, and the underlying model converts the feature input into a feature embedding vector v through its own neural network. n , and then forward propagated to the top model. The initial training is set as Round iteration;

[0075] In each round of vertical federated learning training iteration at the beginning of training, the malicious party uses the PGD method to iteratively optimize the trigger δ. After multiple rounds of iterative optimization, the trigger δ of the malicious party has the inhibitory effect on predicting samples as non-target categories; the trigger δ of the tth round of training t The update formula is shown in formula (1):

[0076]

[0077] The specific idea is that the value of the new round of triggers is equal to the value of the previous round of triggers minus the product of the step size and the value of the sign function; the outermost coefficient π of formula (1) is a restriction coefficient, which is used to limit the value of the trigger to a reasonable range; α is the step size parameter; the value of the sign function sgn() is +1 or -1, and the positive and negative values ​​are consistent with the positive and negative values ​​of the input of the sign function, and its input is the gradient value obtained from the loss function; the parameter L represents the loss function, where τ is the backdoor attack target label; x_in represents the input of the malicious participant plus the value of the previous round of triggers, and the predicted value is the label result predicted by the federated learning model F in the current round, Θ * is the model parameter of the malicious party;

[0078] From formula (1), we can see that the value of the trigger δ in each round of update is related to the value of the trigger δ in the previous round; whether the trigger δ can reach the optimal value depends not only on the fixed parameters, but also on the gradient of the loss function. The gradient is related to the loss function itself. Therefore, the problem of solving the optimal solution of trigger δ can be regarded as a two-level optimization problem of loss function and trigger. The formal expression of this problem is shown in formula (2):

[0079]

[0080] In formula (2), in the above two-level optimization problem, the upper optimization problem is to minimize the loss function L of the vertical federated learning, so as to find the most suitable federated learning model parameter Θ; the lower optimization problem is to limit the value of the trigger on the non-target samples. The solution of the upper optimization affects the solution of the lower optimization. Solving the two-level optimization problem and training the final generated trigger δ is optimal.

[0081] This process can be described by Algorithm 1 as follows:

[0082]

[0083]

[0084] The generation of the third stage universal trigger embedding specifically includes:

[0085] The malicious party uses the sample set corresponding to the target label to execute the mean shift algorithm. The malicious party takes the sample set as input and outputs the feature embedding v n , calculate v n The distance from the center point of the sample in the spatial coordinates, and the feature embedding at the center point is used as the trigger embedding vec to replace the original feature embedding v n After the feature embedding transmitted by the malicious party to the top model is replaced by the trigger embedding, the top model will mistakenly predict the non-target sample label as the target sample label. The principle is that in the spatial coordinate system, each participant uses its own features as the coordinate axis. The samples corresponding to a certain label must be distributed near the same cluster center, and the center points of different categories must be at the center of this cluster and far away from other categories. The malicious party then looks for an optimal trigger embedding. The probability of misdetection of the top model is the highest, so that the position of this embedding in the space has the largest embedding distance with other non-target category samples, which can be expressed by the formula:

[0086]

[0087] vec in formula (3) t Represents the trigger embedding of the target category; D train Represents the sample targets of all training sets; vec train represents the embedding generated normally by the malicious party’s training set; y≠y t The label of the sample is not equal to the target category label; the role of formula (3) is to maximize the trigger embedding vec t And all non-target category samples (x, y)∈D in the training set train The minimum Euclidean distance between embeddings; in the vertical federation scenario, the malicious party does not have the label data, and the constraint y≠y tIf this condition cannot be satisfied, the coordinates of the target label cluster center point are obtained through the mean shift algorithm, and the position of the cluster center point in the malicious participant feature space is used to replace the position of other non-target class samples in the malicious participant feature space. Then, the replaced sample will be close to this cluster, causing the model to predict it as the same label as this class, thereby obtaining the optimal trigger embedding in formula (3) without knowing the sample label. The above process can be expressed as formulas (4) to (6):

[0088]

[0089]

[0090] x i To find the data point located at the center of the spatial coordinate system in the data set, first use the kernel density estimation method shown in formula (4) to find the kernel function, where exp is the kernel function and h is the bandwidth parameter; formula (5) calculates the other data points in the target sample data set for the data point x i The coordinate influence of m(x i ) represents the other points in the data set for x i The impact of the new position; K(x j -x i ) is the kernel function value, and the function of formula (6) is to update the data point x i The new position of x is obtained by using the training phase. i The feature embedding obtained after passing through the underlying model is used as the trigger embedding vec.

[0091] The general trigger embedding generation stage can be expressed algorithmically as follows:

[0092]

[0093]

[0094] The dual-trigger backdoor attack includes:

[0095] Benign participants perform normal model updates during the entire r rounds of training;

[0096] After the training of trigger δ and universal trigger embedding vec is completed, the malicious party uses these two triggers to perform backdoor attacks. First, the malicious party u oIt traverses its own local dataset. If a sample in the dataset belongs to the target label auxiliary dataset, the feature embedding corresponding to the sample in its underlying model is replaced with the trigger embedding. Otherwise, the trigger is injected into the input of the malicious party, thereby changing the normal feature embedding of the sample into a feature embedding with a trigger. The feature embedding is then sent to the top-level model. During the prediction process, the top-level model will mistakenly identify samples with non-target labels as the target labels required by the malicious party for feature embeddings with triggers.

[0097] The above attack steps can be expressed by Algorithm 3.

[0098]

[0099]

[0100] A system for machine learning a poisoning attack method, comprising:

[0101] Initialization module: system initialization, including initialization of the number of training rounds r, trigger δ, learning rate, and number of participants, which is used to implement the first stage of a machine learning poisoning attack method;

[0102] Training trigger module, before federated learning The malicious party in the round trains the trigger δ; after the federated learning In the round, the malicious party trains to generate a universal trigger vector vec to generate a universal trigger embedding for implementing the second and third stages of a machine learning poisoning attack method;

[0103] Attack module, where the malicious party conducts a double-trigger backdoor attack, which is used to implement the fourth stage of a machine learning poisoning attack method.

[0104] A machine learning poisoning attack method device, comprising:

[0105] Memory: used to store a computer program for implementing the machine learning poisoning attack method;

[0106] Processor: used to implement the machine learning poisoning attack method when executing the computer program.

[0107] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a machine learning poisoning attack method are implemented.

[0108] The present invention designs a backdoor attack method for vertical federated learning in a multi-party scenario. The method uses dual triggers, namely: a trigger that suppresses the prediction probability of other types of targets and a general trigger for backdoor attacks, to maximize the impact of malicious participants on the prediction results of the top-level model. Compared with the existing solutions, the advantage of the method proposed in the present invention is that the success rate of backdoor attacks in multi-party scenarios will be greatly improved, which has important reference significance for studying the security issues and defense solutions of vertical federated learning in multi-party scenarios.

[0109] Experimental verification:

[0110] We verified the effectiveness of the proposed scheme through experiments. The experimental environment is DELL T7920 workstation, Intel 4210R CPU, 160G memory, Ubuntu 18.04 operating system. The programming environment is Python 3.8, Tensorflow 1.12.0, Keras 2.2.4, mpi4py 3.0.3. All experiments use the CIFAR-10 data set, which has ten categories and 50,000 data, of which 40,000 are used as training sets and 10,000 are used as test sets. The bottom model of the model is the resnet residual model, and the top model consists of three fully connected layers. There are 50 target label auxiliary data sets. The proportion of sample features occupied by malicious participants is fixed at 25%. The global training rounds are 100 rounds, of which the first 50 rounds are used for trigger δ generation training, 50 to 80 rounds are used for normal federated learning training, and 80 to 100 rounds are used for trigger embedding vec. After the training is completed, the trained model is tested for accuracy by backdoor attack.

[0111] Figure 3 The comparison of the accuracy of the main task after backdoor attack and normal training for different label categories in the four-party scenario is shown. It can be seen that there is almost no difference in the accuracy of the main task when the method proposed in the present invention is used for backdoor attack. This is because no matter when training the trigger δ or triggering the embedded vec, only the samples with the target label are operated, so even if the double trigger is added for backdoor attack, the classification of non-target samples is slightly affected.

[0112] Figure 4 The vertical federated learning training scenario with three participants is shown. The backdoor attack accuracy measured by using the dual trigger of the present invention to perform backdoor attacks on ten labels in the CIFAR-10 dataset is compared with the latest vertical federated backdoor attack accuracy. It can be seen that even in a scenario with fewer participants, such as a scenario with three participants performing federated learning, this method can still stably improve the backdoor attack accuracy for each label category.

[0113] Figure 5 The accuracy of different labels of backdoor attacks in vertical federated learning in a four-party scenario is demonstrated. The success rate of backdoor attacks measured by using the dual trigger designed by the present invention to perform backdoor attacks on ten labels in the CIFAR-10 dataset is compared with the latest vertical federated backdoor attack accuracy. It can be seen that the accuracy of backdoor attacks on all labels of this scheme is greatly improved compared with the accuracy of backdoor attacks using a single trigger, and the accuracy of backdoor attacks on some labels is improved by more than double.

Claims

1. A machine learning poisoning attack method, It is characterized in that It includes the following four stages: Phase 1: System initialization, including initializing the number of training rounds r, trigger δ, learning rate, and number of participants; Phase 2: Before Federated Learning The malicious participants in the round train trigger δ; Phase 3: After Federated Learning In each round, the malicious party trains and generates a universal trigger vector vec to generate a universal trigger embedding; Phase 4: After federated learning completes r rounds of training in phases 2 and 3, the malicious party conducts a double-trigger backdoor attack.

2. A machine learning poisoning attack method according to claim 1, It is characterized in that The second stage training trigger δ specifically includes: In the early stage of vertical federated learning training, the benign participants conduct normal federated learning training, that is, forward propagating the feature input x_in to the underlying model, and the underlying model converts the feature input into a feature embedding vector v through its own neural network. n , and then forward propagated to the top model. The initial training is set as Round iteration; In each round of vertical federated learning training iteration at the beginning of training, the malicious party uses the PGD method to iteratively optimize the trigger δ. After multiple rounds of iterative optimization, the trigger δ of the malicious party has the inhibitory effect on predicting samples as non-target categories; the trigger δ of the tth round of training t The update formula is shown in formula (1): The specific idea is that the value of the new round of triggers is equal to the value of the previous round of triggers minus the product of the step size and the value of the sign function; the outermost coefficient π of formula (1) is a restriction coefficient, which is used to limit the value of the trigger to a reasonable range; α is the step size parameter; the value of the sign function sgn() is +1 or -1, and the positive and negative values ​​are consistent with the positive and negative values ​​of the input of the sign function, and its input is the gradient value obtained from the loss function; the parameter L represents the loss function, where τ is the backdoor attack target label; x_in represents the input of the malicious participant plus the value of the previous round of triggers, and the predicted value is the label result predicted by the federated learning model F in the current round, Θ * is the model parameter of the malicious party; The problem of finding the optimal solution of trigger δ is regarded as a two-level optimization problem of loss function and trigger. The formal expression of this problem is shown in formula (2): In formula (2), in the above two-level optimization problem, the upper optimization problem is to minimize the loss function L of the vertical federated learning, so as to find the most suitable federated learning model parameter Θ; the lower optimization problem is to limit the value of the trigger on the non-target samples. The solution of the upper optimization affects the solution of the lower optimization. Solving the two-level optimization problem and training the final generated trigger δ is optimal.

3. A machine learning poisoning attack method according to claim 1, It is characterized in that The generation of the third stage universal trigger embedding specifically includes: The malicious party uses the sample set corresponding to the target label to execute the mean shift algorithm. The malicious party takes the sample set as input and outputs the feature embedding v n , calculate v n The distance from the center point of the sample in the spatial coordinates, and the feature embedding at the center point is used as the trigger embedding vec to replace the original feature embedding v n After the feature embedding transmitted by the malicious party to the top model is replaced by the trigger embedding, the top model will mistakenly predict the non-target sample label as the target sample label. Then the malicious party will look for an optimal trigger embedding. The probability of misdetection of the top model is the highest, which can be expressed as: vec in formula (3) t Represents the trigger embedding of the target category; D train Represents the sample targets of all training sets; vec train represents the embedding generated normally by the malicious party’s training set; y≠y t The label of the sample is not equal to the target category label; the role of formula (3) is to maximize the trigger embedding vec t And all non-target category samples (x, y)∈D in the training set train The minimum Euclidean distance between embeddings; in the vertical federation scenario, the malicious party does not have the label data, and the constraint y≠y t If this condition cannot be satisfied, the coordinates of the target label cluster center point are obtained through the mean shift algorithm, and the position of the cluster center point in the malicious participant feature space is used to replace the position of other non-target class samples in the malicious participant feature space. Then, the replaced sample will be close to this cluster, causing the model to predict it as the same label as this class, thereby obtaining the optimal trigger embedding in formula (3) without knowing the sample label. The above process can be expressed as formulas (4) to (6): x i To find the data point located at the center of the spatial coordinate system in the data set, first use the kernel density estimation method shown in formula (4) to find the kernel function, where exp is the kernel function and h is the bandwidth parameter; formula (5) calculates the other data points in the target sample data set for the data point x i The coordinate influence of m(x i ) represents the other points in the data set for x i The impact of the new position; K(x j -x i ) is the kernel function value, and the function of formula (6) is to update the data point x i The new position of x is obtained by using the training phase. i The feature embedding obtained after passing through the underlying model is used as the trigger embedding vec.

4. A machine learning poisoning attack method according to claim 1, It is characterized in that The dual-trigger backdoor attack includes: Benign participants perform normal model updates during the entire r rounds of training; After the training of trigger δ and universal trigger embedding vec is completed, the malicious party uses these two triggers to perform backdoor attacks. First, the malicious party u o It traverses its own local dataset. If a sample in the dataset belongs to the target label auxiliary dataset, the feature embedding corresponding to the sample in its underlying model is replaced with the trigger embedding. Otherwise, the trigger is injected into the input of the malicious party, thereby changing the normal feature embedding of the sample into a feature embedding with a trigger. The feature embedding is then sent to the top-level model. During the prediction process, the top-level model will mistakenly identify samples with non-target labels as the target labels required by the malicious party for feature embeddings with triggers.

5. A system based on a machine learning poisoning attack method according to any one of claims 1 to 4, It is characterized in that include: Initialization module, system initialization, including initialization of the number of training rounds r, trigger δ, learning rate, and number of participants; Training trigger module, before federated learning The malicious party in the round trains the trigger δ; after the federated learning In each round, the malicious party trains and generates a universal trigger vector vec to generate a universal trigger embedding; Attack module, malicious parties conduct double-trigger backdoor attacks.

6. A machine learning poisoning attack method and device, It is characterized in that include: Memory: used to store a computer program for implementing a machine learning poisoning attack method as described in any one of claims 1 to 4; Processor: used to implement a machine learning poisoning attack method as described in any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a machine learning poisoning attack method as described in any one of claims 1 to 4 are implemented.

Images