Decentralized vertical federated forgetting learning method based on split learning to resist attacks

Abstract

The present invention provides a decentralized vertical federated forgetting learning method based on split learning to resist attacks, which belongs to the field of network security and federated forgetting learning technology. The split neural network is combined with vertical federated learning, so that the participants can use the neural network for training, realize multi-party and multi-classification learning tasks, optimize the training method, and design a decentralized training protocol, which can further enhance data privacy protection and complete complex cross-organizational and cross-domain cooperation. Then, the K-means clustering algorithm is used to perform abnormal screening on the loss value of the local model generated by each batch of data in the specified round, and abnormal data samples of the corresponding batch are detected; and a forgetting algorithm based on knowledge distillation is proposed. The forgetting algorithm generates a teacher model by retraining high-quality data samples, and uses the global model that has been attacked by poisoning as a student model to perform knowledge distillation with the teacher model, thereby restoring the model performance and eliminating the impact of the poisoning attack.

Description

Technical Field

[0001] The present invention relates to the field of network security and federated forgetting learning technology, and specifically to a decentralized vertical federated forgetting learning method based on split learning to resist poisoning attacks. Background Art

[0002] Data plays a crucial role in training methods, and various countries have enacted data-related laws. In 2016, the European Union introduced the General Data Protection Regulation (GDPR); in 2018, California enacted the California Consumer Protection Act (CCPA), which established the right to be forgotten. In recent years, China has also issued the "Opinions on Building a Data Infrastructure System to Better Leverage the Role of Data Elements" and the "Data Elements ×" Three-Year Action Plan (2024-2026), demonstrating the value of data utilization. Therefore, to better utilize data, the field of federated unlearning has emerged. Federated unlearning, which removes the effects of training data, is a derivative of federated learning. It inherits the characteristics of federated learning in protecting data privacy and avoiding data silos while also addressing the right to be forgotten.

[0003] Federated forgetting learning, a novel forgetting technique based on specialized distributed learning, has been widely used by researchers. Because federated learning is divided into horizontal and vertical federated learning based on data sample IDs and features, federated forgetting learning is further divided into horizontal and vertical federated forgetting learning. Vertical federated learning is primarily used in data scenarios where participants share a common user base but differ in characteristics, such as banks, lending companies, and insurance companies in the same region. Vertical federated learning can be applied in finance, healthcare, the internet, and other fields. Therefore, vertical federated forgetting learning has broader application prospects than horizontal federated forgetting learning.

[0004] However, most existing vertical federated forgetting learning methods are unable to achieve multi-party and multi-classification learning tasks, and there is still room for improvement. The shortcomings of existing vertical federated forgetting learning methods are mainly reflected in the following aspects: First, most methods only target the global model to remove the impact of malicious attacks, lacking strategies for detoxifying local models and unable to effectively resist the local model bias caused by poisoning attacks. Second, many methods use artificially constructed rules or complex network structures to identify malicious samples, which lacks robustness and universality in practical applications.

[0005] With the widespread application of federated learning, poisoning attacks have gradually attracted attention as a new security threat. In a poisoning attack, malicious parties intentionally introduce erroneous information by uploading poisoned data or perturbing local models, causing the final global model to deviate or even fail. Among existing research on federated forgetting learning, horizontal federated forgetting learning has significantly more research than vertical federated forgetting learning. While research on horizontal federated forgetting learning has considered poisoning attacks, research on vertical federated forgetting learning is scarce, and research involving poisoning attacks is even more limited. Therefore, how to effectively identify and defend against poisoning attacks in vertical federated learning and implement multi-party, multi-classification learning tasks has become a highly challenging problem. A vertical federated forgetting learning technology that can resist poisoning attacks is urgently needed to improve the security and reliability of vertical federated learning systems. Summary of the Invention

[0006] In response to the above-mentioned problems existing in the prior art, the present invention proposes a decentralized vertical federated forgetting learning method based on split learning to resist poisoning attacks. The method effectively combines split learning with vertical federated learning, realizes multi-party and multi-classification prediction tasks through neural network training, and also completes the decentralization of servers. The local model loss value generated in each iteration of each round of training is used to screen batches of abnormal data samples that have been attacked by poisoning, and knowledge distillation is used to achieve forgetting of the malicious effects of poisoning attacks, thereby improving the accuracy of the final forgetting model.

[0007] To achieve the above object, the technical solution of the present invention is:

[0008] A decentralized vertical federated forgetting learning method based on split learning to resist attacks includes the following steps:

[0009] Step 1: Select data samples from each institution that need to collaborate on training, split the data sample features and labels into n parts, and then allocate local data to the participants A, B, ... N in vertical federated learning. Add malicious noise generated by a Gaussian function to some data sample features, exposing some data samples to poisoning attacks.

[0010] Step 2: Combine split neural networks with vertical federated learning, using a decentralized training protocol so that each participant has a unique training network structure and performs collaborative training through the activation values ​​of the intermediate layers;

[0011] Step 3: In the specified round of iterative training, record the loss values ​​and data batches of the local model generated by training different batches of data. Use the loss values ​​as data points through the K-means algorithm to screen out normal clusters and abnormal clusters.

[0012] Step 4: Load the abnormal cluster data samples from step 3, select some normal cluster data samples for training to generate a teacher model, use the global model generated by training the normal cluster data samples as the student model, perform knowledge distillation between the student model and the teacher model, generate the final forgetting model, and eliminate the influence of malicious attacks on the student model;

[0013] Step 5: All participants collaborate in training, using the average pooling method as the aggregation mechanism. Each participant generates activation values ​​based on the test set, and finally calculates the prediction results. The performance of the final forgetting model is judged based on the difference between the prediction results and the true values.

[0014] Based on the above solution, the adoption of a split neural network and vertical federated learning training method not only enhances privacy protection but also reduces communication overhead, distributing communication costs among all participants, and enabling multi-party, multi-classification learning tasks. Furthermore, using loss values ​​as a metric to reflect model performance, the K-means algorithm uses loss values ​​as data points to filter out anomalous batches of data samples. A teacher model is generated based on normal data samples, and knowledge distillation is performed between the teacher model and the local model containing malicious influences to eliminate the impact of poisoning attacks on the local model. The local models of each participant are then trained collaboratively, which not only protects against the impact of poisoning attacks but also improves the robustness of the model.

[0015] Furthermore, the step 1 specifically includes:

[0016] Step 1.1: Integrate the data samples of each institution with the same ID to obtain the complete training set D = (D X ,D Y ), and then assign local data to each participant, where participant N has a unique data label. The local data of the participant is shown in formula (1):

[0017]

[0018] Where, Represents the local data characteristics of participant N, D X is the data feature of the complete dataset, D Y is the label of the data feature in the complete data set, split(·) is the function of splitting the data sample, D N It is the local data of the participants;

[0019] Step 1.2: You need to build a poisoning attack scenario and use the Gaussian function to generate malicious noise:

[0020]

[0021] Among them, the malicious noise η obeys the mean μ and variance σ2 Gaussian distribution;

[0022] Step 1.3: Add malicious noise to the local data features of some participants, causing them to be subjected to poisoning attacks:

[0023]

[0024] Where, Represents the local data characteristics of the attacked party.

[0025] Furthermore, step 2 specifically includes:

[0026] Step 2.1: Use split neural networks as a training method in vertical federated learning, and design each local model based on the local data characteristics of each participant;

[0027] Step 2.2: Fine-tune the training method and design it into a decentralized training method. First, all participants generate activation vectors a based on local training data. i :

[0028] a i =[a i1 ,a i2 ,…,a im ] (4)

[0029] In the formula, m represents the total number of data sample label categories, and the category with the highest probability is determined as the predicted label; a i1 …a im represents the activation vector of participant i corresponding to category m.

[0030] Participant N acts as a temporary server to receive the activation vectors of each participant. Participant N calculates the loss value l of each participant based on the label features. i , expressed by formula (6):

[0031]

[0032] Where L(·) is the loss function, is the predicted label of participant i, is the true label stored in participant N corresponding to the local data of participant i.

[0033] Participant N sends the loss values ​​of other participants to other participants, and all participants perform backpropagation based on the loss values ​​to update local model parameters.

[0034] Furthermore, step 3 specifically includes:

[0035] Step 3.1: Set a forget interval variable δ to determine whether the current training round needs to record the parameters of each local model generated in each iteration and perform knowledge distillation. The judgment model is expressed by formula (6):

[0036] t%δ==0 (6)

[0037] Where t is the number of current training rounds. If the result of formula (6) is true, the parameters of each local model are recorded and knowledge distillation is performed. If the result is false, the next round of training is continued.

[0038] Step 3.2: Assuming that the result of formula (6) is true, each participant initializes the set I i , stores the local model loss value generated by the iterative batch and the corresponding batch data sample training in each round Where the batch size is β, the total number of iteration batches is the total number of local training data divided by the batch size β, and α is the index of the iteration batch; is the loss value of the local model generated by the αth batch of training data of participant i;

[0039] Step 3.3: Select each participant set I i The loss value in is used as the data point, and the data point is divided into two clusters through the K-means algorithm. The cluster with the smaller mean value of the data point is regarded as a normal sample, and the other cluster is an abnormal sample.

[0040] Furthermore, step 4 specifically includes:

[0041] Step 4.1: Initialize the abnormal batch sequence corresponding to round t for each participant Store the batches corresponding to the loss values ​​in the abnormal clusters into Generate a teacher model based on the training of other batch data samples except the abnormal batch sequence;

[0042] Step 4.2: Calculate the soft label p and obtain the probability information of the category, which is expressed by formula (7):

[0043]

[0044] Where T is the temperature coefficient, exp(·) is the exponential function; m represents the total number of data sample label categories, z j The result of the model output layer represents the value of the jth class; z i The result of the model output layer represents the value of the i-th category;

[0045] Next, calculate the soft label loss L according to the soft label soft and hard label loss L hard , as shown in formulas (8) and (9):

[0046]

[0047] Where p i is the soft label of category i, q i is the predicted label of category i generated by the student model, Y i is the true label of category i;

[0048] Step 4.3: Calculate the distillation loss based on the soft label loss and hard label loss, and then perform backpropagation to update the student model. The student model is the forget model. When the last round of forget operation is performed, the student model is the final forget model L KD , as expressed in formula (10):

[0049] L KD =εL soft +(1-ε)L hard (11)

[0050] Where ε is the weight factor that balances the influence of the two.

[0051] Furthermore, step 5 specifically includes:

[0052] Step 5.1: Send the test set as input data to each participant, so that the final forgetting model of each participant outputs an activation vector, and these activation vectors are averaged and pooled to generate the final prediction result.

[0053] The present invention also provides a decentralized vertical federated forgetting learning model based on split learning to resist attacks, which is used to execute the method described above, and the model includes:

[0054] Data preprocessing module: This module integrates data samples with the same ID from various institutions to form a complete training set. It also rationally splits the data sample features and labels into n parts, distributes local data to each participant in vertical federated learning, and has the function of adding malicious noise generated by a Gaussian function to some data sample features to simulate poisoning attacks.

[0055] Decentralized Training Module: This module combines split neural networks with vertical federated learning to design a decentralized training protocol, ensuring that each participant has a unique training network structure and collaborative training through the activation values ​​of intermediate layers. This module is also responsible for recording the loss values ​​and data batches of each local model during a specified round of iterative training.

[0056] Anomaly detection and screening module: Uses the K-means algorithm to perform cluster analysis on the recorded loss values, screening out normal clusters and abnormal clusters to determine which data batches are affected by the poisoning attack;

[0057] Knowledge distillation module: Loads abnormal data samples and some normal data samples, trains and generates a teacher model, and uses the global model generated by normal training as the student model. Through knowledge distillation between the teacher model and the student model, it generates a forgetting model to eliminate the impact of malicious attacks on model performance;

[0058] Model aggregation and evaluation module: All participants collaborate in training, and the average pooling method is used to aggregate the activation values ​​of each participant to generate the final prediction result. The performance of the forgetting model is evaluated by comparing it with the true value.

[0059] Furthermore, the data preprocessing module includes:

[0060] Data integration unit: used to integrate the same ID data samples of various institutions into a complete training set;

[0061] Data distribution unit: distributes local data to each participant, one of which contains a unique data tag;

[0062] Poisoning simulation unit: Uses Gaussian function to generate malicious noise and adds it to the local data features of some participants to simulate poisoning attack scenarios.

[0063] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored and running on the memory. When the processor executes the program, it implements the decentralized vertical federated forgetting learning method based on split learning to resist attacks.

[0064] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the decentralized vertical federated forgetting learning method based on split learning to resist attacks.

[0065] The beneficial effects of the present invention include: the present invention splits the neural network and vertical federated learning, enabling participants to use neural networks for training, realizing multi-party and multi-classification learning tasks, and optimizing the training method, designing a decentralized training protocol, which can further enhance data privacy protection and complete complex cross-organizational and cross-domain cooperation. Then, the K-means clustering algorithm is used to perform abnormal screening on the loss value of the local model generated by each batch of data in the specified round, and abnormal data samples of the corresponding batch are detected; and a forgetting algorithm based on knowledge distillation is proposed. The forgetting algorithm generates a teacher model by retraining high-quality data samples, and uses the global model that has been poisoned as a student model to perform knowledge distillation with the teacher model, thereby restoring the model performance and eliminating the impact of the poisoning attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1This is a schematic diagram of the overall structure of the decentralized vertical federated forgetting learning model based on split learning to resist attacks according to the present invention;

[0067] Figure 2 Schematic diagram of the process of the decentralized vertical federated forgetting learning method for resisting attacks based on split learning according to the present invention;

[0068] Figure 3 This is a flowchart of step 3 in the federated forgetting learning method described in the present invention. DETAILED DESCRIPTION

[0069] The embodiments of the present invention are implemented on the premise of the technical solution of the present invention, and detailed implementation methods and specific operation processes are given, but the protection scope of the present invention is not limited to the following embodiments.

[0070] Example 1: This example uses Windows system as the development environment, Pycharm as the development platform, Python as the development language, and Pytorch as the development framework. It adopts the decentralized vertical federated forgetting learning method based on split learning to resist poisoning attacks of the present invention to complete label prediction for image datasets and text datasets.

[0071] The present invention conducts experiments using the MNIST dataset and the DryBean dataset as input data. In this embodiment, using the MNIST dataset as input data as an example, the federated forgetting method for malicious terminal interference training includes the following steps:

[0072] Step 1: Set the local model structure of each participant, add Gaussian noise to 40% of the data sample features to implement the poisoning attack, and assign 2 participants and 3 participants to the MNIST dataset and DryBean dataset respectively;

[0073] Step 2: Start longitudinal federated learning. Based on the training round and forget interval variables, determine whether to record the local model loss value and batch index generated by each iteration batch. Then, use the K-means algorithm to divide the loss values ​​into two clusters: normal clusters and abnormal clusters. Then, find the corresponding batch index based on the loss value in the abnormal cluster to identify the malicious training data samples that have been poisoned.

[0074] Step 3: Eliminate malicious training data samples from each participant's local data, use other normal data samples to train and generate a teacher model, treat the local model that was previously attacked by malicious attacks as the student model, and perform knowledge distillation between the student model and the teacher model to forget the impact of the malicious attack on the student model. When the training round is completed, the student model is the final forgotten model. The results of the final forgotten models of each participant are aggregated through the average pooling mechanism to generate the final prediction result. The present invention uses accuracy as the evaluation criterion and determines the accuracy by calculating the number of consistent predicted labels and true labels of the test set data divided by the total number of test sets.

[0075] Based on the above steps, the present invention was compared with a single participant, retrained vertical federated learning, a single participant subjected to a poisoning attack, and a vertical federated learning method subjected to a poisoning attack. As can be seen from Tables 1 and 2, the accuracy of the proposed method on two common test sets is only slightly lower than that of the retraining method, and the two accuracy rates are very close. This is because all training data samples used in retraining are high-quality and have not been subjected to poisoning attacks, so its accuracy should be the highest.

[0076] Table 1 Comparison of performance of various methods on the MNIST test set

[0077]

[0078] Table 2 Performance comparison of various methods on the Dry Bean test set

[0079]

[0080] In summary, the foregoing is merely a specific embodiment of the present invention, and is intended to illustrate the basic principles, advantages, and purposes of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the foregoing embodiments, and that further modifications and substitutions are contemplated based on the foregoing description without departing from the accuracy and scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A decentralized vertical federated forgetting learning method based on split learning to resist attacks, characterized by: The method comprises the following steps: Step 1: Select data samples from each institution that need to collaborate on training, split the data sample features and labels into n parts, and then allocate local data to the participants A, B, ... N in vertical federated learning. Add malicious noise generated by a Gaussian function to some data sample features, exposing some data samples to poisoning attacks. Step 2: Combine the split neural network with vertical federated learning, using a decentralized training protocol so that each participant has their own training network structure and conducts collaborative training through the activation values ​​of the intermediate layers; Step 2 specifically includes: Step 2.1: Use split neural networks as a training method in vertical federated learning, and design each local model based on the local data characteristics of each participant; Step 2.2: Fine-tune the training method and design it into a decentralized training method. First, all participants generate activation vectors a based on local training data. i : a i =[a i1 ,a i2, …,a im ] (4) In the formula, m represents the total number of data sample label categories, and the category with the highest probability is determined as the predicted label; a i1 …a im represents the activation vector of participant i corresponding to category m; Participant N acts as a temporary server to receive the activation vectors of each participant. Participant N calculates the loss value l of each participant based on the label features. i , expressed by formula (5): Where L(·) is the loss function, is the predicted label of participant i, is the true label corresponding to the local data of participant i stored in participant N; Participant N sends the loss values ​​of other participants to other participants, and all participants perform backpropagation based on the loss values ​​to update local model parameters; Step 3: In the specified round of iterative training, record the loss values ​​and data batches of the local model generated by training different batches of data. Use the loss values ​​as data points through the K-means algorithm to screen out normal clusters and abnormal clusters. Step 4: Load the abnormal cluster data samples from step 3, select some normal cluster data samples for training to generate a teacher model, use the global model generated by training the normal cluster data samples as the student model, perform knowledge distillation between the student model and the teacher model, generate the final forgetting model, and eliminate the influence of malicious attacks on the student model; Step 5: All participants collaborate in training, using the average pooling method as the aggregation mechanism. Each participant generates activation values ​​based on the test set, and finally calculates the prediction results. The performance of the final forgetting model is judged based on the difference between the prediction results and the true values.

2. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 1 is characterized in that: The step 1 specifically includes: Step 1.1: Integrate the data samples of each institution with the same ID to obtain the complete training set D = (D X ,D Y ), and then assign local data to each participant, where participant N has a unique data label. The local data of the participant is shown in formula (1): Where, Represents the local data characteristics of participant N, D X is the data feature of the complete dataset, D Y is the label of the data feature in the complete data set, split(·) is the function of splitting the data sample, D N It is the local data of the participants; Step 1.2: You need to build a poisoning attack scenario and use the Gaussian function to generate malicious noise: Among them, the malicious noise η obeys the mean μ and variance σ 2 Gaussian distribution; Step 1.3: Add malicious noise to the local data features of some participants, causing them to be subjected to poisoning attacks: Where, Represents the local data characteristics of the attacked party.

3. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 1 is characterized in that: Step 3 specifically includes: Step 3.1: Set a forget interval variable δ to determine whether the current training round needs to record the parameters of each local model generated in each iteration and perform knowledge distillation. The judgment model is expressed by formula (6): t%δ==0 (6) Where t is the number of current training rounds. If the result of formula (6) is true, the parameters of each local model are recorded and knowledge distillation is performed. If the result is false, the next round of training is continued. Step 3.2: Assuming that the result of formula (6) is true, each participant initializes the set I i , stores the local model loss value generated by the iterative batch and the corresponding batch data sample training in each round Where the batch size is β, the total number of iteration batches is the total number of local training data divided by the batch size β, and α is the index of the iteration batch; is the loss value of the local model generated by the αth batch of training data of participant i; Step 3.3: Select each participant set I i The loss value in is used as the data point, and the data point is divided into two clusters through the K-means algorithm. The cluster with the smaller mean value of the data point is regarded as a normal sample, and the other cluster is an abnormal sample.

4. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 3 is characterized in that: Step 4 specifically includes: Step 4.1: Initialize the abnormal batch sequence corresponding to round t for each participant Store the batches corresponding to the loss values ​​in the abnormal clusters into Generate a teacher model based on the training of other batch data samples except the abnormal batch sequence; Step 4.2: Calculate the soft label p and obtain the probability information of the category, which is expressed by formula (7): Where T is the temperature coefficient, exp(·) is the exponential function; m represents the total number of data sample label categories, z j Indicates the value of the model output layer corresponding to the jth category; z i Indicates the value of the model output layer corresponding to the i-th category; Next, calculate the soft label loss L according to the soft label soft and hard label loss L hard , as shown in formulas (8) and (9): Where p i is the soft label of category i, q i is the predicted label of category i generated by the student model, Y i is the true label of category i; Step 4.3: Calculate the distillation loss based on the soft label loss and hard label loss, and then perform backpropagation to update the student model. The student model is the forget model. When the last round of forget operation is performed, the student model is the final forget model L KD , as expressed in formula (10): L KD =εL soft +(1-e)L hard (10) Where ε is the weight factor that balances the influence of the two.

5. The decentralized vertical federated forgetting learning method based on split learning to resist attacks according to claim 4 is characterized in that: Step 5 specifically includes: sending the test set as input data to each participant, making the final forgetting model of each participant output an activation vector, and averaging these activation vectors to generate the final prediction result.

6. A decentralized vertical federated forgetting learning model based on split learning to resist attacks, used to execute the method according to any one of claims 1 to 5, characterized in that: The model includes: Data preprocessing module: This module integrates data samples with the same ID from various institutions to form a complete training set. It also rationally splits the data sample features and labels into n parts, distributes local data to each participant in vertical federated learning, and has the function of adding malicious noise generated by a Gaussian function to some data sample features to simulate poisoning attacks. Decentralized Training Module: This module combines split neural networks with vertical federated learning to design a decentralized training protocol, ensuring that each participant has a unique training network structure and collaborative training through the activation values ​​of intermediate layers. This module is also responsible for recording the loss values ​​and data batches of each local model during a specified round of iterative training. Anomaly detection and screening module: Uses the K-means algorithm to perform cluster analysis on the recorded loss values, screening out normal clusters and abnormal clusters to determine which data batches are affected by the poisoning attack; Knowledge distillation module: Loads abnormal data samples and some normal data samples, trains and generates a teacher model, and uses the global model generated by normal training as the student model. Through knowledge distillation between the teacher model and the student model, it generates a forgetting model to eliminate the impact of malicious attacks on model performance; Model aggregation and evaluation module: All participants collaborate in training, and the average pooling method is used to aggregate the activation values ​​of each participant to generate the final prediction result. The performance of the forgetting model is evaluated by comparing it with the true value.

7. The decentralized vertical federated forgetting learning model based on split learning to resist attacks according to claim 6 is characterized in that: The data preprocessing module includes: Data integration unit: used to integrate the same ID data samples of various institutions into a complete training set; Data distribution unit: distributes local data to each participant, one of which contains a unique data tag; Poisoning simulation unit: Uses Gaussian function to generate malicious noise and adds it to the local data features of some participants to simulate poisoning attack scenarios.

8. An electronic device comprising a memory, a processor, and a computer program stored and running on the memory, characterized in that: When the processor executes the program, it implements the decentralized vertical federated forgetting learning method based on split learning to resist attacks as described in any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the decentralized vertical federated forgetting learning method based on split learning to resist attacks as described in any one of claims 1 to 5.

Images