Self-adaptive dynamic parameter replacement strategy for resisting hidden backdoor attack in federated learning

Abstract

The invention relates to the field of federated learning security, in particular to a self-adaptive dynamic parameter replacement strategy, and aims to resist hidden backdoor attacks in federated learning. Federal learning is a distributed machine learning technology and allows clients to cooperatively train a deep neural network without centrally storing data. However, federal learning is susceptible to backdoor attacks due to the distributed characteristics. As the research on backdoor attack is deeper, the arrangement of the backdoor is more and more hidden, and the existing defense scheme can be bypassed, so that how to detect the hidden backdoor becomes an urgent problem to be solved. In the invention, a self-adaptive dynamic parameter replacement strategy is provided, and aims to defend hidden backdoor attacks in federated learning. Specifically, each client maintains a small-scale clean data set, dynamically monitors the change of model parameters, replaces parameters with low update frequency in # imgabs0 turns, realizes back door removal, and ensures the safety and robustness of the federated learning model.

Description

Technical Field

[0001] The present invention relates to the field of federated learning security, and in particular to an adaptive dynamic parameter replacement strategy, which is intended to resist hidden backdoor attacks in federated learning. Background Art

[0002] Federated Learning (FL) allows multiple clients to collaboratively train deep neural networks (DNNs) on their private data. Specifically, the server distributes a global model to each client, and the client uses local private data to train on the received global model and uploads the model update to the server. FL requires that the server is agnostic to the client's data, which solves the data privacy and security issues in traditional centralized machine learning.

[0003] However, FL also brings new privacy issues and security challenges. Since the client data and model training are black box types to the server, FL is vulnerable to backdoor attacks. The attacker injects backdoor triggers during the model training process, causing the model to exhibit expected malicious behavior under specific trigger conditions, while behaving normally under normal circumstances. In addition, as the backdoor triggers are designed to be more covert, such as the latest backdoor attack work, IBA (Irreversible Backdoor Attack), in order to enhance the concealment of the backdoor, the attacker adds very small perturbations to the clean image to form an attack image, so that the difference in the heat map generated in the latent space is minimized; in order to enhance the persistence of the attack, IBA selectively attacks those model parameters that are unlikely to be updated during the main task learning process. At the same time, the parameters of the global model in the previous round are used to guide the model update of the current round, so that the backdoor effect persists.

[0004] At the beginning of their design, existing defense methods either only consider that malicious parameter updates will be very obvious, and eliminate malicious updates with large changes through clustering, or only weaken malicious parameters through methods such as mean and median. Unfortunately, none of the above defense schemes consider the parameters that are rarely updated during the federated learning aggregation process, allowing covert backdoor attacks, such as IBA, to effectively bypass these defense methods. Summary of the invention

[0005] In order to overcome the defect that existing defense schemes in federated learning fail to effectively deal with covert backdoor attacks, the present invention provides an adaptive dynamic parameter replacement strategy, which aims to defend against covert backdoor attacks in federated learning.

[0006] The technical method adopted by the present invention is: each client maintains a small-scale clean data set and dynamically monitors the changes in model parameters. The parameters with low update frequency within a round are replaced to remove the backdoor, which effectively addresses the impact of hidden backdoor attacks on the security of the federated learning system and enhances the robustness of the system. The present invention has the following four features: (1) Adaptive dynamic replacement mechanism: allows each client to adaptively monitor and replace the less-changing parts of the local model parameters based on the small-scale clean dataset it holds, ensuring the security and stability of the model during the federated learning process; (2) Targeted defense against attacks: The proposed method focuses on defending against covert backdoor attacks. It can effectively identify and replace the bottom k% parameters that are less frequently updated and exploited by covert backdoor attacks, preventing attackers from implanting backdoors in the model and ensuring that the replacement process does not affect normal model training. (3) Scalability of dynamic parameter selection: This solution supports dynamic monitoring of parameter changes during multiple rounds of training, ensuring that the selected parameters can be adaptively adjusted in each round. Parameter replacement is not only based on updates generated by training, but can also be dynamically selected based on historical gradient changes over multiple rounds to ensure the continuity of defense; (4) Combining the efficiency of the federated learning framework: By combining adaptive dynamic parameter replacement with the FedAvg aggregation mechanism of federated learning, the security and robustness issues of IBA attack defense in practical applications are solved.

[0007] The implementation process mainly includes the following six steps: (1) Initialization: The client initializes the local model parameters. Each client retains a small clean dataset for subsequent parameter replacement; (2) Federated learning training: Client local training: Each client performs training on a local data set, updates model parameters, monitors the magnitude of changes in each parameter, and records the gradient changes of all parameters; (3) Dynamic parameter selection: Calculate the update amplitude of each parameter of the model, and select the bottom k% parameters with the smallest change according to the update amplitude as possible targets of IBA attack; (4) Parameter replacement: For the bottom k% parameters with small changes, recalculate their gradients using the client's small clean dataset and replace these parameters; (5) Parameter upload and aggregation: Send the updated model parameters of each client to the central server, which aggregates the parameters through FedAvg and updates the global model; (6) Global model update and evaluation: The global model is sent back to the client for the next round of training, and the accuracy of the global model and the success rate of backdoor attacks are evaluated on the test dataset. Repeat steps 2 to 6 until the model training is completed. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 flow chart DETAILED DESCRIPTION

[0009] The specific process of building an adaptive dynamic parameter replacement strategy is as follows: enter: : Client The local dataset, : Client A small clean dataset, : learning rate, : bottom k% parameter, : Round interval, : Number of training rounds for federated learning; Output: : global model parameters; (1) Initialization: (a) The central server initializes the global model , (b) Each client initializes local model parameters ; (2) Federated learning training: (a) For each round t = 1,2,...,T: Dynamic client local training phase: For each client : ① Receive the global model , ② Local model update: Using local datasets Train the model locally to get an updated local model , ③ Every Record the change of each parameter: Calculate local model parameters With global model parameters The difference between the two, record the change of each parameter ; (3) Dynamically select parameters that change less: For each client : (a) According to the recorded parameter variation , select the bottom with the smallest change Parameters, denoted as ; (4) Parameter replacement: (a) Using the client A small clean dataset Recalculate the gradients for the local model: ①Only for bottoms with small changes parameter Replace and update these parameters to values ​​recalculated based on a clean dataset; (5) Parameter upload and aggregation: (a) Client The local model parameters after replacement Upload to the central server, (b) The central server aggregates the client’s model parameters through FedAvg; (6) Global model update and evaluation: (a) Update global model parameters , (b) Use the test dataset to test the global model Perform performance evaluation and record the accuracy and attack success rate on the test set.

Claims

1. In order to overcome the defect that the existing defense schemes in federated learning cannot effectively deal with hidden backdoor attacks, the present invention provides an adaptive dynamic parameter replacement strategy to defend against hidden backdoor attacks in federated learning. The technical method adopted by the present invention is: each client maintains a small-scale clean data set and dynamically monitors the changes in model parameters. The parameters with low update frequency within a round are replaced to remove the backdoor, which effectively addresses the impact of hidden backdoor attacks on the security of the federated learning system and enhances the robustness of the system. The present invention has the following four features: (1) Adaptive dynamic replacement mechanism: allows each client to adaptively monitor and replace the less-changing parts of the local model parameters based on the small-scale clean dataset it holds, ensuring the security and stability of the model during the federated learning process; (2) Targeted defense against attacks: The proposed method focuses on defending against covert backdoor attacks. It can effectively identify and replace the bottom k% parameters that are less frequently updated and exploited by covert backdoor attacks, preventing attackers from implanting backdoors in the model and ensuring that the replacement process does not affect normal model training. (3) Scalability of dynamic parameter selection: This solution supports dynamic monitoring of parameter changes during multiple rounds of training, ensuring that the selected parameters can be adaptively adjusted in each round. Parameter replacement is not only based on the updates generated by training, but can also be dynamically selected based on historical gradient changes over multiple rounds to ensure the continuity of defense. (4) Combining the efficiency of the federated learning framework: By combining adaptive dynamic parameter replacement with the FedAvg aggregation mechanism of federated learning, the security and robustness issues of IBA attack defense in practical applications are solved. The implementation process mainly includes the following six steps: (1) Initialization: The client initializes the local model parameters. Each client retains a small clean dataset for subsequent parameter replacement. (2) Federated learning training: Client local training: Each client performs training on a local data set, updates model parameters, monitors the magnitude of changes in each parameter, and records the gradient changes of all parameters; (3) Dynamic parameter selection: Calculate the update amplitude of each model parameter and select the bottom k% parameters with the smallest change according to the update amplitude as possible targets of IBA attack; (4) Parameter replacement: For the bottom k% parameters with small changes, recalculate their gradients using the client's small clean dataset and replace these parameters; (5) Parameter upload and aggregation: Send the updated model parameters of each client to the central server, which aggregates the parameters through FedAvg and updates the global model; (6) Global model update and evaluation: The global model is sent back to the client for the next round of training. The accuracy of the global model and the success rate of backdoor attacks are evaluated on the test dataset. Steps 2 to 6 are repeated until the model training is completed.

Images