Federal learning poisoning attack detection method

Abstract

The invention belongs to the technical field of network security, and particularly relates to a federal learning poisoning attack detection method, which comprises the following steps that: (1) a server initializes a model and a learning rate and broadcasts the model and the learning rate to a client; (2) the client receives the global model of the server, calculates a local update weight by using a local data set, and uploads the local update weight to the server; (3) the server generates an adversarial network through a cyclic variational auto-encoder to detect and reject malicious clients; (4) the server calculates the global model weight of the next round through the updated weight uploaded by the normal client; and (5) continuously iterating the step (2) to the step (4) until the global model is converged. The federal learning poisoning attack detection method based on the cyclic variational auto-encoder generative adversarial network can effectively prevent the poisoning attack of a malicious client from damaging the performance of a global model.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for detecting a federated learning poisoning attack. Background Art

[0002] Federated learning is a promising distributed machine learning paradigm that enables decentralized management of data and thus protects data privacy. Unlike traditional centralized approaches that require data sets to be centralized, federated learning allows isolated clients to independently train local models on their own data, which are then aggregated by a central server to build a global model. Through iterative local training and global aggregation, federated learning is able to converge to a high-performance global model without exposing client data to central servers or other clients. This paradigm has significant advantages, including the protection of data privacy, improved model accuracy through collaborative learning of distributed data sources, and improved scalability by leveraging distributed computing resources. It protects data privacy by eliminating the need for data centralization, enhances model accuracy, and improves system scalability. However, federated learning systems are vulnerable to attacks by malicious clients due to the inability to directly control client behavior. Such attacks include data poisoning attacks, in which adversaries inject contaminated data into training datasets, and model poisoning attacks, which involve the manipulation of model updates. There are two goals for poisoning attacks: targeted attacks, which aim to manipulate the federated model to generate specific labels for specific samples; and untargeted attacks, which aim to cause universal misclassification of all test samples. The stealthy and deceptive nature of these attacks allows adversaries to subtly influence the convergence of distributed models, making detection a formidable challenge. Therefore, while federated learning offers significant advantages over traditional machine learning, ensuring its security and robustness against these threats remains a vital concern. Summary of the invention

[0003] The purpose of the present invention is to provide a method for detecting federated learning poisoning attacks in view of the above-mentioned deficiencies in the prior art.

[0004] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions: A method for detecting a federated learning poisoning attack comprises the following steps: (1) The server initializes the model and learning rate and broadcasts them to the client; (2) The client receives the global model from the server, calculates the local update weights using the local data set, and then uploads the local update weights to the server; (3) The server generates an adversarial network through a cyclic variational autoencoder to detect and remove malicious clients; (4) The server calculates the global model weights for the next round using the local update weights uploaded by the normal client; (5) Continue to iterate steps (2) to (4) until the global model converges.

[0005] As a preferred solution, the cyclic variational autoencoder generative adversarial network includes a generator and a discriminator, and the generator adopts a cyclic variational autoencoder, including a dual encoder and a decoder; Weight of partial updates uploaded by the client First pass the first encoder to generate hidden variables , the hidden variable Input to the decoder to generate reconstruction update weights , the generated reconstruction update weight Input the second encoder to generate hidden variables , and calculate the hidden variables and hidden variables The mean and The square of the Euclidean distance between and Input the discriminator to calculate the adversarial loss.

[0006] As a preferred solution, the step (3) specifically includes the following steps: The updated weight error of each client is calculated by generating an adversarial network through a cyclic variational autoencoder; Determine whether the updated weight error of the client is greater than the dynamic error threshold; if so, it is a malicious client; if not, it is a normal client.

[0007] As a preferred solution, the updated weight error is calculated using a composite loss function; The composite loss function is: ; in, Indicates that the first encoder Parameterized Hidden Variables , and use the decoder Reconstructing local update weights The expected log-likelihood of ; Indicates that given the hidden variable The local update weights are observed under the condition likelihood of; Represents hidden variables The variational posterior distribution of With its prior distribution The KL divergence between Represents two hidden variables and The mean and The square of the Euclidean distance between them; Indicates that the second encoder Parameterized latent variables The variational posterior distribution of With its prior distribution The KL divergence between is the weight factor.

[0008] As a preferred solution, the dynamic error threshold is: ; in, For the The update weight error of each client, is the number of clients.

[0009] As a preferred solution, in step (4), the global model weight of the tth round is The calculation formula is: ; in, Indicates the number of normal clients. Indicates Client No. Local update weights of rounds; for: .

[0010] As a preferred solution, in step (2), during the local model training process, each client uses its local training data and the received Global model weights for the round Perform local learning process; Client No. Local update weights for rounds Then the update is performed by stochastic gradient descent method SGD, and the update formula is: ; in, It is The learning rate of the local model training of each client, It is The training dataset of clients, Indicates Each client optimizes the gradient of the loss locally.

[0011] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention provides a novel method for detecting malicious clients. Since the range of benign clients’ update weight parameters is limited and malicious clients’ attacks are diverse, this method can effectively capture the concise and information-intensive latent representations from benign clients’ update weight parameters, and identify malicious activities in the latent space, thus maintaining the security and stability of the entire system. (2) The present invention utilizes an encoder-decoder-encoder loop framework and adopts a loop consistency mechanism internally to ensure accurate mapping of statistical details of benign updates. By introducing an adversarial training mode, the cyclic variational autoencoder generative adversarial network can remain sensitive to a variety of abnormal behaviors and remain resistant to complex poisoning attacks. In addition, a dynamic threshold strategy is designed in the cyclic variational autoencoder generative adversarial network to prevent attackers from learning the detection mechanism of the cyclic variational autoencoder generative adversarial network in advance; (3) The present invention has been empirically verified on three widely used classification datasets (FashionMNIST, CIFAR10 and IMDB) and has been extensively tested on several detection methods. The results show that the present invention exhibits significant effectiveness in combating various types of malicious attacks (sign flipping, additive noise, label flipping attacks) and achieves the highest attack detection rate in a highly heterogeneous federated learning environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a flow chart of a method for detecting a federated learning poisoning attack according to Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the interaction between the server and the local client of the method for detecting a federated learning poisoning attack according to Embodiment 1 of the present invention; Figure 3 A schematic diagram of a cyclic variational autoencoder generating an adversarial network according to Embodiment 1 of the present invention; Figure 4 This is a comparison chart of the accuracy of the detection method of Example 1 of the present invention and the existing conventional algorithm under a sign flip attack with a malicious ratio of 10%; Figure 5 This is a comparison chart of the accuracy of the detection method of Example 1 of the present invention and the existing conventional algorithm under a sign flip attack with a malicious ratio of 20%; Figure 6 This is a comparison chart of the accuracy of the detection method of Example 1 of the present invention and the existing conventional algorithm under additive noise attack with an attack ratio of 10%; Figure 7 This is a comparison chart of the accuracy of the detection method of Example 1 of the present invention and the existing conventional algorithm under an additive noise attack with an attack ratio of 20%; Figure 8This is a comparison chart of the accuracy of the detection method of Example 1 of the present invention and the existing conventional algorithm under a label flipping attack with an attack ratio of 10%; Fig. 9 This is a comparison chart of the accuracy of the detection method of Example 1 of the present invention and the existing conventional algorithm under a label flipping attack with an attack ratio of 20%. DETAILED DESCRIPTION

[0013] In order to more clearly illustrate the embodiments of the present invention, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, other accompanying drawings and other implementation methods can be obtained based on these accompanying drawings without creative work.

[0014] Embodiment 1: like Figure 1 As shown, the detection method of the federated learning poisoning attack based on the cyclic variational autoencoder generative adversarial network of this embodiment includes the following steps: (1) The server initializes the model and learning rate and broadcasts them to each client; (2) The client receives the global model from the server, calculates the local update weights using the local data set, and then uploads the local update weights to the server; Specifically, Figure 2 As shown, there are During the local model training process, each participating local client uses its local training data and the received Global Model of Rounds Perform local learning process, Client No. Local update weights for rounds Then the update is performed by stochastic gradient descent method SGD, and the update formula is as follows: ; in, It is The learning rate of the local model training of each client, It is The training dataset of clients, Indicates Each client optimizes the gradient of the loss locally.

[0015] Each client in this embodiment updates parameters based on the parameters obtained from the global model and local data, with the aim of optimizing the local loss function, thereby contributing to the improvement of the global model while maintaining the privacy of individual data.

[0016] (3) The server generates an adversarial network through a cyclic variational autoencoder to detect and remove malicious clients; Specifically, Figure 2 and Figure 3 As shown in Figure 2, the cyclic variational autoencoder generative adversarial network architecture follows the basic structure of the generative adversarial network, which includes a complex generator and a discriminator In the context of detecting malicious clients in federated learning, the generator is similar to a cyclic variational autoencoder, which contains a dual encoder (Right now )and (Right now ) and a decoder (Right now ), the local update weight uploaded by the client First pass through the first encoder Generate the first hidden variable ,Will Input to decoder Generate reconstruction update weights , and calculate the reconstruction loss; the generated reconstruction update weight is input to the second encoder Generate the second hidden variable , and calculate and The mean and The square of the Euclidean distance between and Input to the discriminator This unique configuration is able to transform local model updates into latent representations, thereby learning to update distribution features through variational inference. In the adversarial training setting, the discriminator It is possible to distinguish the actual weight distribution of the local model from the distribution synthesized by the generator, ensuring accurate reconstruction. Therefore, the updated weight error of the client is calculated by generating an adversarial network through a cyclic variational autoencoder. The updated weight error adopts a composite loss function, which consists of the following four parts: 1. Reconstruction loss ; Specifically, the reconstruction loss Indicates that the encoder Parameterized latent variables , and use the decoder Refactoring Input This term aims to minimize the expected log-likelihood of the original input and the latent variables The difference between the reconstructed outputs, thus facilitating the model’s ability to accurately reconstruct the input data; 2. Hidden variables KL divergence ; Specifically, the KL divergence of the latent variable is a hidden variable The posterior distribution of The KL divergence between ; this term ensures that the distribution of latent variables does not deviate from its prior assumptions, which helps prevent overfitting; 3. Squared loss of mean difference ; Specifically, Represents two hidden variables and The mean and The square of the Euclidean distance between them is used to enhance the model's sensitivity to data changes; 4. Hidden variables KL divergence ; Specifically, Indicates that the second encoder Parameterized Hidden Variables The variational posterior distribution of With its prior distribution The KL divergence between is used to adjust the second latent variable The distribution of and its prior distribution The deviation between .

[0017] Therefore, the composite loss function is: ; in, Indicates that the encoder Parameterized Hidden Variables , and use the decoder Refactoring Input The expected log-likelihood of Indicates that given the hidden variable The original local update is observed under the condition The likelihood of , which is determined by the parameters of the decoding network parameterization; this term aims to minimize the original input and the The difference between the reconstructed outputs, thus facilitating the model’s ability to accurately reconstruct the input data; Represents hidden variables The variational posterior distribution of With its prior distribution The KL divergence between them ensures that the distribution of latent variables does not deviate from its prior assumptions, which helps prevent overfitting; Represents two hidden variables and The mean and The square of the Euclidean distance between them is used to enhance the model's sensitivity to data changes; Represents hidden variables The variational posterior distribution of With its prior distribution The KL divergence between is the weight factor.

[0018] This embodiment uses the update weight error as the quality assessment standard for the client model update to measure the difference between the model update vector and the normal update vector, and determines the client as a malicious client when the update weight error exceeds the dynamic error threshold. The dynamic error threshold is calculated as follows: ; in, For the The update weight error of each client, is the number of clients; dynamic threshold Update the average of the weight errors for all clients. Therefore, set the weight : ; Among them, when When A client is involved in malicious activities, that is, a malicious client; when When The clients are benign, i.e., normal clients. This determination is based on the observation that malicious actors usually have higher anomaly scores, indicating that their updates are significantly more abnormal than normal clients.

[0019] Furthermore, before using the cyclic variational autoencoder to generate an adversarial network, it needs to be pre-trained. The training process can be divided into two parts: variational inference learning and adversarial learning. Variational inference learning is consistent with the above-mentioned loss function calculation process, and finally uses error back propagation for update; adversarial learning introduces a discriminator to improve the accuracy of the cyclic variational autoencoder generative adversarial network model in identifying anomalies, and the goal is to minimize the loss function (i.e., adversarial loss): ; The above-mentioned minimization loss function can be specifically referred to the prior art and will not be described here. This embodiment focuses on malicious client detection to improve efficiency, privacy and robustness, reduce communication overhead, and reduce the risk of privacy leakage. The cyclic variational autoencoder generates an adversarial network to accurately reconstruct weights, which helps to quickly detect malicious behavior and enhances the sensitivity of the model to harmful updates by preventing overfitting, thereby enhancing the overall robustness of the model. represents a probability distribution that reflects the true distribution of legitimate model updates, while represents the distribution of fake updates produced by the generator. Indicates that the generator handles local update weights The output of is to generate synthetic model updates.

[0020] (4) The server calculates the global model weights for the next round using the updated weights uploaded by the normal client; Specifically, after excluding the local update weights of malicious clients, only the local update weights of normal clients are used for global aggregation. Global model weights for the round The calculation formula is as follows: ; in, Indicates the number of normal clients. Indicates Client No. Local update weights for the round.

[0021] (5) Continue to iterate steps (2) to (4) until the global model converges.

[0022] In order to verify the effectiveness of the detection method of this embodiment, the publicly available fashion dataset FashionMNIST, the Canadian Institute for Advanced Research 10 dataset CIFAR10 and the Internet Movie Database dataset IMDB are used, and four experimental datasets are set according to the different distributions of the datasets: FashionMNIST-IID, CIFAR10-IID, CIFAR10-non-IID and IMDB datasets, where IID stands for independent and identically distributed, and non-IID stands for non-independent and identically distributed. For the FashionMNIST-IID dataset, a logistic regression model is trained; for the CIFAR10-IID and CIFAR10-non-IID datasets, a convolutional neural network is used as the client model; for the IMDB dataset, a bidirectional long short-term memory neural network is trained. Malicious attacks are injected during the training process to simulate model contamination attacks, and the detection method of this embodiment (referred to as CycleVAE-GAN) is compared with five existing detection methods (Krum algorithm Krum, multi-Krum algorithm MKrum, geometric median algorithm GeoMed, trimmed mean algorithm Tmean, variational autoencoder VAE, and undefended federated average algorithm FedAvg) to evaluate its effectiveness. In the test, a typical federated learning model training scenario is adopted, and 150 rounds are trained on the FashionMNIST-IID and IMDB datasets, and 300 rounds are trained on the CIFAR10-IID and CIFAR10-non-IID datasets, and the number of clients participating in each round is 100. The local update weight update uploaded by the client is modified or the local dataset of the client is destroyed to poison the attack. Different settings are made for different attack methods.

[0023] Sign flipping attacks, additive noise attacks, and label flipping attacks were used in the test. Specifically, in a sign flipping attack, the malicious client maliciously adds a negative sign to the local update before the data is transmitted to the server, causing these updates to go in the opposite direction during the optimization process. The purpose of this attack is to interfere with the entire learning process, causing the global model to converge in the wrong direction, thereby reducing model performance and accuracy.

[0024] In additive noise attacks, noise randomly drawn from a Gaussian distribution is added to local updates. The purpose of adding this noise is to introduce errors and uncertainties, interfere with parameter updates during model training, and thus affect the stability and generalization ability of the model. Due to its randomness, additive noise makes this type of attack difficult to detect directly, especially when the data itself has large variability.

[0025] In a label flipping attack, the attacker intentionally mislabels data samples. By incorrectly changing the labels of data samples from one category to another, the attacker can cause the model to learn the wrong classification pattern. This attack has a very direct and destructive impact on the model, and its detection requires an effective data monitoring and verification mechanism to identify and correct incorrect label information.

[0026] like Figures 4 to 9 As shown in Figure 2, the test accuracy trends of various defense mechanisms in communication rounds on the CIFAR10-non-IID dataset are described.

[0027] like Figure 4 and Figure 5 As shown in the figure, under the sign flipping attack, the detection method of this embodiment always outperforms other existing detection methods, and maintains excellent global model accuracy at both 10% and 20% malicious ratios. MKrum, GeoMed, and Tmean achieved slightly worse results, while Krum's performance was still below 50% accuracy; FedAvg and VAE were ineffective in attacker detection, initially showing slight improvements, but always performing poorly.

[0028] like Figure 6 and Figure 7 As shown, under the background of additive noise attack, Tmean and the detection method of this embodiment perform well, MKrum and GeoMed perform well, Krum and VAE perform averagely, and the accuracy of FedAvg fluctuates around 10%.

[0029] like Figure 8 As shown, in the label flipping attack, with a 10% attacker ratio, GeoMed, Tmean and the detection method of this embodiment perform well, while Krum performs poorly, and FedAvg, MKrum and VAE show instability.

[0030] like Fig. 9 As shown, under a label flipping attacker ratio of 20%, the detection methods of MKrum, GeoMed, Tmean and the present embodiment remain stable and converge rapidly. Only Tmean and the detection method of the present embodiment reach the peak accuracy, and GeoMed performs slightly worse. Krum is shown to be the worst, while FedAvg and VAE both show obvious instability.

[0031] Table 1 shows the performance of the detection method of this embodiment on the CIFAR10-non-IID dataset in the face of different attack methods and different data heterogeneity. Table 2 shows the performance of the method of this embodiment on the CIFAR10-IID dataset in the face of different attack methods and different attack ratios. Among them, TA (Test Accuracy) represents the test set accuracy in the federated learning task, and ADR (Attack Detection Rate) represents the attack detection rate.

[0032] Table 1 Performance under different attack methods and different data heterogeneity .

[0033] Table 2 Performance against different attack methods and different attack ratios .

[0034] As shown in Table 1, Parameters represent the parameters of the Dirichlet distribution, The smaller the value, the higher the heterogeneity of the data. Through observation, the detection method of this embodiment shows obvious consistency in test accuracy and attack detection rate. Parameters, which shows that the detection method of this embodiment has the ability to adapt to different heterogeneous data. As shown in Table 2, represents the proportion of attacks. Experimental results show that the detection method of this embodiment has a certain adaptability to different attack proportions.

[0035] The above description is only a detailed description of the preferred embodiments and principles of the present invention. For ordinary technicians in this field, according to the ideas provided by the present invention, there will be changes in the specific implementation methods, and these changes should also be regarded as the protection scope of the present invention.

Claims

1. A method for detecting poisoning attacks in federated learning, It is characterized in that The following steps are involved: (1) The server initializes the model and learning rate and broadcasts them to the client; (2) The client receives the global model from the server, calculates the local update weights using the local data set, and then uploads the local update weights to the server; (3) The server generates an adversarial network through a cyclic variational autoencoder to detect and remove malicious clients; (4) The server calculates the global model weights for the next round using the local update weights uploaded by the normal client; (5) Continue to iterate steps (2) to (4) until the global model converges.

2. The detection method according to claim 1, It is characterized in that The cyclic variational autoencoder generative adversarial network includes a generator and a discriminator, and the generator adopts a cyclic variational autoencoder, including a dual encoder and a decoder; Weight of partial updates uploaded by the client First pass the first encoder to generate hidden variables , the hidden variable Input to the decoder to generate reconstruction update weights , the generated reconstruction update weight Input the second encoder to generate hidden variables , and calculate the hidden variables and hidden variables The mean and The square of the Euclidean distance between and Input the discriminator to calculate the adversarial loss.

3. The detection method according to claim 2, It is characterized in that The step (3) specifically includes the following steps: The updated weight error of each client is calculated by generating an adversarial network through a cyclic variational autoencoder; Determine whether the updated weight error of the client is greater than the dynamic error threshold; if so, it is a malicious client; if not, it is a normal client.

4. The detection method according to claim 3, It is characterized in that The updated weight error is calculated using a composite loss function; The composite loss function is: ; in, Indicates that the first encoder Parameterized Hidden Variables , and use the decoder Reconstructing local update weights The expected log-likelihood of ; Indicates that given the hidden variable The local update weights are observed under the condition likelihood of; Represents hidden variables The variational posterior distribution of With its prior distribution The KL divergence between Represents two hidden variables and The mean and The square of the Euclidean distance between them; Indicates that the second encoder Parameterized latent variables The variational posterior distribution of With its prior distribution The KL divergence between is the weight factor.

5. The detection method according to claim 4, It is characterized in that The dynamic error threshold is: ； in, For the The update weight error of each client, is the number of clients.

6. The detection method according to claim 5, It is characterized in that In the step (4), Global model weights for the round The calculation formula is: ； in, Indicates the number of normal clients. Indicates Client No. Local update weights for rounds; for: 。 7. The detection method according to any one of claims 1 to 6, It is characterized in that In step (2), during the local model training process, each client uses its local training data and the received Global model weights for the round Perform local learning process; Client No. Local update weights for rounds Then the update is performed by stochastic gradient descent method SGD, and the update formula is: ； in, It is The learning rate of the local model training of each client, It is The training dataset of clients, Indicates Each client optimizes the gradient of the loss locally.

Images