Decentralized longitudinal federal forgetting learning method based on split learning attack resistance

Abstract

The invention provides a decentralized longitudinal federal forgetting learning method based on split learning attack resistance, and belongs to the technical field of network security and federal forgetting learning. A split neural network is combined with longitudinal federated learning, so that participants can be trained by using the neural network, multi-party and multi-classification learning tasks are realized, a training mode is optimized, a decentralized training protocol is designed, data privacy protection can be further improved, cross-organization and cross-domain complex cooperation can be completed, and the method is suitable for popularization and application. Carrying out anomaly screening on the loss value of the local model generated by each batch of data in a specified round by adopting a K-means clustering algorithm, and detecting an abnormal data sample of a corresponding batch; a knowledge distillation-based forgetting algorithm is provided, the forgetting algorithm generates a teacher model by retraining a high-quality data sample, and the global model subjected to poisoning attack is used as a student model to perform knowledge distillation with the teacher model, so that the model performance is recovered, and the influence caused by poisoning attack is eliminated.

Description

Technical Field

[0001] The present invention relates to the field of network security and federated forgetting learning technology, and specifically to a decentralized vertical federated forgetting learning method based on split learning to resist poisoning attacks. Background Art

[0002] Data plays an important role in training methods, and various countries have also introduced laws related to data. In 2016, the European Union proposed the General Data Protection Regulation (GDPR); in 2018, California, the United States, enacted the California Consumer Protection Act (CCPA), which established the right to request that data be forgotten. In recent years, China has also issued the "Opinions on Building a Data Basic System to Better Play the Role of Data Elements" and the "Three-Year Action Plan for "Data Elements ×" (2024-2026)", which are sufficient to prove the value of data utilization. Therefore, in order to make better use of data, the field of federated forgetting learning was born. Federated forgetting learning can delete the impact caused by training data. It is a derivative field of federated learning. It not only inherits the characteristics of federated learning to protect data privacy and avoid data islands, but also can meet the right to be forgotten.

[0003] Federated forgetting learning is a novel forgetting technology based on special distributed learning and is widely used by researchers. Because federated learning is divided into horizontal federated learning and vertical federated learning according to the different data sample IDs and features, federated forgetting learning is also divided into horizontal federated forgetting learning and vertical federated forgetting learning. Vertical federated learning is mainly used in data scenarios where the participants have the same user group but different characteristics, such as banks, lending companies, and insurance companies in the same region. Vertical federated learning can be applied in finance, medical care, the Internet and other fields. Therefore, vertical federated forgetting learning has a wider application prospect than horizontal federated forgetting learning.

[0004] However, most of the existing vertical federated forgetting learning cannot achieve multi-party and multi-classification learning tasks, and there is still room for expansion. The shortcomings of the existing vertical federated forgetting learning methods are mainly reflected in the following aspects: First, most methods only remove the impact of malicious attacks on the global model, lack strategies for detoxifying local models, and cannot effectively resist the local model deviation caused by poisoning attacks. Second, many methods use artificially constructed rules or complex network structures to identify malicious samples, which lack robustness and universality in practical applications.

[0005] With the widespread application of federated learning, poisoning attacks as a new security threat have gradually attracted people's attention. In a poisoning attack, malicious participants deliberately introduce false information by uploading poisoned data or perturbing local models, causing the final global model to deviate or even fail. In the existing research on federated forgetting learning, the research on horizontal federated forgetting learning is significantly more than that on vertical federated forgetting learning, and there have been studies on horizontal federated forgetting learning that consider poisoning attacks, but there are very few studies on vertical federated forgetting learning, and the research involving poisoning attacks is even the tip of the iceberg. Therefore, how to effectively identify and defend against poisoning attacks in vertical federated learning and realize multi-party multi-classification learning tasks has become a very challenging problem. There is an urgent need for a vertical federated forgetting learning technology that can resist poisoning attacks to improve the security and reliability of vertical federated learning systems. Summary of the invention

[0006] In view of the above-mentioned problems existing in the prior art, the present invention proposes a decentralized vertical federated forgetting learning method based on split learning to resist poisoning attacks. The method effectively combines split learning with vertical federated learning, realizes multi-party and multi-classification prediction tasks through neural network training, and completes the decentralization of servers. The local model loss value generated by each iteration in each round of training is used to screen batches of abnormal data samples that have been attacked by poisoning, and knowledge distillation is used to forget the malicious effects of poisoning attacks, thereby improving the accuracy of the final forgetting model.

[0007] To achieve the above object, the technical solution of the present invention is:

[0008] A decentralized vertical federated forgetting learning method based on split learning to resist attacks includes the following steps:

[0009] Step 1: Select data samples from each institution that need to be trained together, reasonably split the data sample features and labels into n parts, and then allocate local data to the participants A, B...N of vertical federated learning, and add malicious noise generated by Gaussian function to some data sample features, so that some data samples are subject to poisoning attacks;

[0010] Step 2: Combine the split neural network with vertical federated learning and adopt a decentralized training protocol so that each participant has a unique training network structure and conducts collaborative training through the activation values ​​of the intermediate layers;

[0011] Step 3: In the specified round of iterative training, record the loss values ​​and data batches of the local model generated by different batches of data training, use the loss values ​​as data points through the K-means algorithm, and filter out normal clusters and abnormal clusters;

[0012] Step 4: Load the abnormal cluster data samples in step 3, select some normal cluster data samples for training to generate a teacher model, use the global model generated by training the normal cluster data samples as the student model, perform knowledge distillation between the student model and the teacher model, generate the final forgetting model, and eliminate the influence of malicious attacks on the student model;

[0013] Step 5: All participants collaborate in training, using the average pooling method as the aggregation mechanism. Each participant generates an activation value based on the test set, and finally calculates the prediction result. The model performance of the final forgetting model is judged based on the difference between the prediction result and the true value.

[0014] Based on the above scheme, the training method of split neural network and vertical federated learning is adopted, which not only enhances privacy protection, but also reduces communication overhead, distributes communication costs among various participants, and can perform multi-party and multi-classification learning tasks. In addition, the loss value is used as a standard to reflect the performance of the model. The loss value is used as a data point for the K-means algorithm to filter out abnormal batches of data samples. The teacher model is generated according to the normal data samples, and the teacher model and the local model with malicious influence are subjected to knowledge distillation to eliminate the impact of poisoning attacks on the local model. Then, the local models of various participants are trained collaboratively, which can not only resist the impact of poisoning attacks, but also improve the robustness of the model.

[0015] Furthermore, the step 1 specifically includes:

[0016] Step 1.1: Integrate the data samples of each institution with the same ID to obtain a complete training set D = (D X ,D Y ), and then assign local data to each participant, where participant N has a unique data label, and the local data of the participant is shown in formula (1):

[0017]

[0018] In the formula, Represents the local data characteristics of participant N, D X is the data feature of the complete data set, D Y is the label of the data feature in the complete data set, split(·) is the function of splitting the data sample, D N It is the local data of the participants;

[0019] Step 1.2: You need to build a poisoning attack scenario and use a Gaussian function to generate malicious noise:

[0020]

[0021] Among them, the malicious noise η obeys the mean μ and variance σ2 Gaussian distribution of

[0022] Step 1.3: Add malicious noise to the local data features of some participants, so that some participants are subject to poisoning attacks:

[0023]

[0024] In the formula, Represents the local data characteristics of the attacked party.

[0025] Furthermore, step 2 specifically includes:

[0026] Step 2.1: Split the neural network as a training method in vertical federated learning, and design each local model according to the local data characteristics of each participant;

[0027] Step 2.2: Fine-tune the training method and design it into a decentralized training method. First, all participants generate activation vectors a based on local training data. i :

[0028] a i =[a i1 ,a i2 ,…,a im ] (4)

[0029] In the formula, m represents the total number of data sample label categories, and the category with the highest probability is determined as the predicted label; a i1 …a im represents the activation vector of participant i corresponding to category m.

[0030] Participant N acts as a temporary server to receive the activation vectors of each participant. Participant N calculates the loss value l of each participant based on the label features. i , expressed by formula (6):

[0031]

[0032] Where L(·) is the loss function, is the predicted label of participant i, is the true label stored in participant N corresponding to the local data of participant i.

[0033] Participant N sends the loss values ​​of other participants to other participants, and all participants perform backpropagation based on the loss values ​​to update local model parameters.

[0034] Furthermore, step 3 specifically includes:

[0035] Step 3.1: Set a forget interval variable δ to determine whether the current training round needs to record the parameters of each local model generated in each iteration and perform knowledge distillation. The judgment model is expressed by formula (6):

[0036] t%δ==0 (6)

[0037] Where t is the number of current training rounds. If the result of formula (6) is true, the parameters of each local model are recorded and knowledge distillation is performed. If the result is false, the next round of training is continued.

[0038] Step 3.2: Assuming that the result of formula (6) is true, each participant initializes the set I i , storing the local model loss value generated by the iteration batch and the corresponding batch data sample training in each round The batch size is β, the total number of iteration batches is the total number of local training data divided by the batch size β, and α is the index of the iteration batch; is the loss value of the local model generated by the αth batch of training data of participant i;

[0039] Step 3.3: Select each participant set I i The loss values ​​in are used as data points, and the data points are divided into two clusters through the K-means algorithm. The cluster with the smaller mean value of data points is regarded as a normal sample, and the other cluster is an abnormal sample.

[0040] Furthermore, step 4 specifically includes:

[0041] Step 4.1: Initialize the abnormal batch sequence corresponding to the tth round for each participant Store the batches corresponding to the loss values ​​in the abnormal clusters into Generate a teacher model based on the training of other batch data samples except the abnormal batch sequence;

[0042] Step 4.2: Calculate the soft label p and obtain the probability information of the category to which it belongs, which is expressed by formula (7):

[0043]

[0044] Where T is the temperature coefficient, exp(·) is the exponential function, m represents the total number of data sample label categories, and z j The result of the model output layer represents the value of the jth class; z i The result of the model output layer represents the value of the i-th category;

[0045] Next, the soft label loss L is calculated according to the soft label. soft and hard label loss L hard , as shown in formulas (8) and (9):

[0046]

[0047] In the formula, p i is the soft label of category i, q i is the predicted label of category i generated by the student model, Y i is the true label of category i;

[0048] Step 4.3: Calculate the distillation loss based on the soft label loss and the hard label loss, and then perform back propagation to update the student model. The student model is the forget model. When the last round of forget operation is performed, the student model is the final forget model L KD , as expressed in formula (10):

[0049] L KD =εL soft +(1-ε)L hard (11)

[0050] In the formula, ε is the weight factor that balances the influence of the two.

[0051] Furthermore, step 5 specifically includes:

[0052] Step 5.1: Send the test set as input data to each participant, so that the final forgetting model of each participant outputs an activation vector, and these activation vectors are averaged and pooled to generate the final prediction result.

[0053] The present invention also provides a decentralized vertical federated forgetting learning model based on split learning to resist attacks, which is used to execute the method described, and the model includes:

[0054] Data preprocessing module: used to integrate the same ID data samples of various institutions to form a complete training set, and reasonably split the data sample features and labels into n parts, allocate local data to each participant of vertical federated learning, and have the function of adding malicious noise generated by Gaussian function to some data sample features to simulate poisoning attacks;

[0055] Decentralized training module: Combining split neural networks with vertical federated learning, a decentralized training protocol is designed to ensure that each participant has a unique training network structure and conducts collaborative training through the activation values ​​of the intermediate layers. This module is also responsible for recording the loss values ​​and data batches of each local model in a specified round of iterative training;

[0056] Anomaly detection and screening module: Use the K-means algorithm to perform cluster analysis on the recorded loss values, screen out normal clusters and abnormal clusters, and determine which data batches are affected by the poisoning attack;

[0057] Knowledge distillation module: loads abnormal data samples and some normal data samples, trains and generates a teacher model, and uses the global model generated by normal training as the student model. Through knowledge distillation between the teacher model and the student model, a forgetting model is generated to eliminate the impact of malicious attacks on model performance;

[0058] Model aggregation and evaluation module: All participants collaborate in training, and use the average pooling method to aggregate the activation values ​​of each participant to generate the final prediction result, and evaluate the performance of the forgetting model by comparing it with the true value.

[0059] Furthermore, the data preprocessing module includes:

[0060] Data integration unit: used to integrate the same ID data samples of each institution into a complete training set;

[0061] Data distribution unit: distributes local data to each participant, one of which contains a unique data tag;

[0062] Poisoning simulation unit: Use Gaussian function to generate malicious noise and add it to the local data features of some participants to simulate poisoning attack scenarios.

[0063] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored and running on the memory, wherein when the processor executes the program, the decentralized vertical federated forgetting learning method based on split learning to resist attacks is implemented.

[0064] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the decentralized vertical federated forgetting learning method based on split learning to resist attacks is implemented.

[0065] The beneficial effects of the present invention include: the present invention splits the neural network and vertical federated learning, so that the participants can use the neural network for training, realize multi-party and multi-classification learning tasks, and optimizes the training method, designs a decentralized training protocol, which can further enhance data privacy protection and complete complex cross-organizational and cross-domain cooperation, and then uses the K-means clustering algorithm to perform abnormal screening on the loss value of the local model generated by each batch of data in the specified round, and detects the abnormal data samples of the corresponding batch; and proposes a forgetting algorithm based on knowledge distillation, which generates a teacher model by retraining high-quality data samples, and uses the global model that has been attacked by poisoning as a student model to perform knowledge distillation with the teacher model, thereby restoring the model performance and eliminating the impact of the poisoning attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1It is a schematic diagram of the overall structure of the decentralized vertical federated forgetting learning model based on split learning to resist attacks according to the present invention;

[0067] Figure 2 It is a flow chart of the decentralized vertical federated forgetting learning method for resisting attacks based on split learning according to the present invention;

[0068] Figure 3 This is a flowchart of step 3 in the federated forgetting learning method described in the present invention. DETAILED DESCRIPTION

[0069] The embodiments of the present invention are implemented on the premise of the technical solution of the present invention, and detailed implementation methods and specific operation processes are given, but the protection scope of the present invention is not limited to the following embodiments.

[0070] Example 1: This example uses Windows system as the development environment, Pycharm as the development platform, Python as the development language, and Pytorch as the development framework. It adopts the decentralized vertical federated forgetting learning method based on split learning to resist poisoning attacks of the present invention to complete label prediction for image data sets and text data sets.

[0071] The present invention uses the MNIST dataset and the DryBean dataset as input data for experiments. In this embodiment, taking the MNIST dataset as input data as an example, the federated forgetting method for malicious terminal intervention training includes the following steps:

[0072] Step 1: Set the local model structure of each participant, add Gaussian noise to 40% of the data sample features to implement poisoning attacks, and assign 2 participants and 3 participants to the MNIST dataset and DryBean dataset respectively;

[0073] Step 2: Start to perform vertical federated learning. According to the training round and forgetting interval variables, determine whether it is necessary to record the local model loss value and batch index generated by each iteration batch. Then, use the K-means algorithm to divide the loss value as a data point into two clusters: normal cluster and abnormal cluster. Then, find the corresponding batch index according to the loss value in the abnormal cluster to identify the malicious training data samples that have been attacked by poisoning.

[0074] Step 3: Eliminate malicious training data samples in the local data of each participant, use other normal data samples to train and generate a teacher model, regard the local model that was previously attacked by malicious attacks as the student model, perform knowledge distillation between the student model and the teacher model, forget the impact of malicious attacks on the student model, and when the training round is over, the student model is the final forgotten model. Aggregate the results of the final forgotten models of each participant through the average pooling mechanism to generate the final prediction result. The present invention uses accuracy as the evaluation criterion and determines the accuracy by calculating the number of consistent predicted labels and true labels of the test set data divided by the total number of test sets.

[0075] According to the above steps, the present invention is compared with the single participant of the present invention, the retrained vertical federated learning, the single participant subjected to poisoning attack, and the vertical federated learning method subjected to poisoning attack. As can be seen from Table 1 and Table 2, the accuracy of the method proposed by the present invention on two common test sets is only lower than that of the retraining method, and the accuracy of the two methods is very close. This is because all the training data samples used in the retraining are of high quality and have not been subjected to poisoning attacks, so its accuracy should be the highest.

[0076] Table 1 Comparison of performance of various methods on the MNIST test set

[0077]

[0078] Table 2 Performance comparison of various methods on the Dry Bean test set

[0079]

[0080] In summary, only specific embodiments of the present invention are provided to describe the basic principles, advantages and purposes of the present invention. It should be clearly understood by those skilled in the art that the present invention is not limited to the above embodiments, and more changes and substitutions can be imagined based on the above description and without departing from the accuracy and scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A decentralized vertical federated forgetting learning method based on split learning to resist attacks, characterized in that: The method comprises the following steps: Step 1: Select data samples from each institution that need to be trained together, reasonably split the data sample features and labels into n parts, and then allocate local data to the participants A, B...N of vertical federated learning, and add malicious noise generated by Gaussian function to some data sample features, so that some data samples are subject to poisoning attacks; Step 2: Combine the split neural network with vertical federated learning and adopt a decentralized training protocol so that each participant has its own training network structure and conducts collaborative training through the activation values ​​of the intermediate layer; Step 3: In the specified round of iterative training, record the loss values ​​and data batches of the local model generated by different batches of data training, use the loss values ​​as data points through the K-means algorithm, and filter out normal clusters and abnormal clusters; Step 4: Load the abnormal cluster data samples in step 3, select some normal cluster data samples for training to generate a teacher model, use the global model generated by training the normal cluster data samples as the student model, perform knowledge distillation between the student model and the teacher model, generate the final forgetting model, and eliminate the influence of malicious attacks on the student model; Step 5: All participants collaborate in training, using the average pooling method as the aggregation mechanism. Each participant generates an activation value based on the test set, and finally calculates the prediction result. The model performance of the final forgetting model is judged based on the difference between the prediction result and the true value.

2. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 1 is characterized in that: The step 1 specifically includes: Step 1.1: Integrate the data samples of each institution with the same ID to obtain a complete training set D = (D X ,D Y ), and then assign local data to each participant, where participant N has a unique data label, and the local data of the participant is shown in formula (1): In the formula, Represents the local data characteristics of participant N, D X is the data feature of the complete data set, D Y is the label of the data feature in the complete data set, split(·) is the function of splitting the data sample, D N It is the local data of the participants; Step 1.2: You need to build a poisoning attack scenario and use a Gaussian function to generate malicious noise: Among them, the malicious noise η obeys the mean μ and variance σ 2 Gaussian distribution of Step 1.3: Add malicious noise to the local data features of some participants, so that some participants are subject to poisoning attacks: In the formula, Represents the local data characteristics of the attacked party.

3. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 1 or 2 is characterized in that: Step 2 specifically includes: Step 2.1: Split the neural network as a training method in vertical federated learning, and design each local model according to the local data characteristics of each participant; Step 2.2: Fine-tune the training method and design it into a decentralized training method. First, all participants generate activation vectors a based on local training data. i : a i =[a i1 ,a i2 ,…,a im ] (4) In the formula, m represents the total number of data sample label categories, and the category with the highest probability is determined as the predicted label; a i1 …a im represents the activation vector of participant i corresponding to category m; Participant N acts as a temporary server to receive the activation vectors of each participant. Participant N calculates the loss value l of each participant based on the label features. i , expressed by formula (5): Where L(·) is the loss function, is the predicted label of participant i, is the true label corresponding to the local data of participant i stored in participant N; Participant N sends the loss values ​​of other participants to other participants, and all participants perform backpropagation based on the loss values ​​to update local model parameters.

4. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 3 is characterized in that: Step 3 specifically includes: Step 3.1: Set a forget interval variable δ to determine whether the current training round needs to record the parameters of each local model generated in each iteration and perform knowledge distillation. The judgment model is expressed by formula (6): t%δ==0 (6) Where t is the number of current training rounds. If the result of formula (6) is true, the parameters of each local model are recorded and knowledge distillation is performed. If the result is false, the next round of training is continued. Step 3.2: Assuming that the result of formula (6) is true, each participant initializes the set I i , storing the local model loss value generated by the iteration batch and the corresponding batch data sample training in each round The batch size is β, the total number of iteration batches is the total number of local training data divided by the batch size β, and α is the index of the iteration batch; is the loss value of the local model generated by the αth batch of training data of participant i; Step 3.3: Select each participant set I i The loss values ​​in are used as data points, and the data points are divided into two clusters through the K-means algorithm. The cluster with the smaller mean value of data points is regarded as a normal sample, and the other cluster is an abnormal sample.

5. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 4 is characterized in that: Step 4 specifically includes: Step 4.1: Initialize the abnormal batch sequence corresponding to the tth round for each participant Store the batches corresponding to the loss values ​​in the abnormal clusters into Generate a teacher model based on the training of other batch data samples except the abnormal batch sequence; Step 4.2: Calculate the soft label p and obtain the probability information of the category to which it belongs, which is expressed by formula (7): Where T is the temperature coefficient, exp(·) is the exponential function, m represents the total number of data sample label categories, and z j Indicates the value of the model output layer corresponding to the jth category; z i Indicates the value of the model output layer corresponding to the i-th category; Next, the soft label loss L is calculated according to the soft label. soft and hard label loss L hard , as shown in formulas (8) and (9): In the formula, p i is the soft label of category i, q i is the predicted label of category i generated by the student model, Y i is the true label of category i; Step 4.3: Calculate the distillation loss based on the soft label loss and the hard label loss, and then perform back propagation to update the student model. The student model is the forget model. When the last round of forget operation is performed, the student model is the final forget model L KD , as expressed in formula (10): L KD =εL soft +(1-e)L hard (10) In the formula, ε is the weight factor that balances the influence of the two.

6. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 5 is characterized in that: Step 5 specifically includes: sending the test set as input data to each participant, so that the final forgetting model of each participant outputs an activation vector, and averaging and pooling these activation vectors to generate the final prediction result.

7. A decentralized vertical federated forgetting learning model based on split learning to resist attacks, used to execute the method as described in any one of claims 1-6, characterized in that: The model includes: Data preprocessing module: used to integrate the same ID data samples of various institutions to form a complete training set, and reasonably split the data sample features and labels into n parts, allocate local data to each participant of vertical federated learning, and have the function of adding malicious noise generated by Gaussian function to some data sample features to simulate poisoning attacks; Decentralized training module: Combining split neural networks with vertical federated learning, a decentralized training protocol is designed to ensure that each participant has a unique training network structure and conducts collaborative training through the activation values ​​of the intermediate layers. This module is also responsible for recording the loss values ​​and data batches of each local model in a specified round of iterative training; Anomaly detection and screening module: Use the K-means algorithm to perform cluster analysis on the recorded loss values, screen out normal clusters and abnormal clusters, and determine which data batches are affected by the poisoning attack; Knowledge distillation module: loads abnormal data samples and some normal data samples, trains and generates a teacher model, and uses the global model generated by normal training as the student model. Through knowledge distillation between the teacher model and the student model, a forgetting model is generated to eliminate the impact of malicious attacks on model performance; Model aggregation and evaluation module: All participants collaborate in training, and use the average pooling method to aggregate the activation values ​​of each participant to generate the final prediction result, and evaluate the performance of the forgetting model by comparing it with the true value.

8. The decentralized vertical federated forgetting learning model based on split learning to resist attacks according to claim 7 is characterized in that: The data preprocessing module comprises: Data integration unit: used to integrate the same ID data samples of each institution into a complete training set; Data distribution unit: distributes local data to each participant, one of which contains a unique data tag; Poisoning simulation unit: Use Gaussian function to generate malicious noise and add it to the local data features of some participants to simulate poisoning attack scenarios.

9. An electronic device comprising a memory, a processor and a computer program stored and running on the memory, characterized in that: When the processor executes the program, it implements the decentralized vertical federated forgetting learning method based on split learning to resist attacks as described in any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the decentralized vertical federated forgetting learning method based on split learning to resist attacks as described in any one of claims 1 to 6.

Images