Federal learning poisoning attack defense method based on feature screening, program, equipment and storage medium

Abstract

The invention belongs to the technical field of industrial internet security, and particularly relates to a federal learning poisoning attack defense method based on feature screening, a program, equipment and a storage medium. According to the method, the key features of the local model are collected and screened, the key features of the global model of the last round of federated learning are obtained, and the Euclidean distance between the key features of the local model and the key features of the global model is calculated, so that whether the local model corresponding to the key features is a benign model or not is judged; therefore, federal learning only aggregates a benign model, and defense of poisoning attacks is realized. According to the method, the key features extracted by the local model during classification are screened, the influence of non-key features on malicious client detection is eliminated, the difference between the benign model and the malicious model is amplified, and the malicious client is detected and filtered by using the statistical distance between the key features of different models, so that more effective defense is realized.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet security technology, and specifically relates to a method, program, device and storage medium for defending against federated learning poisoning attacks based on feature screening. Background Art

[0002] Industrial defect detection has long been one of the most important research areas in the field of industrial vision, with the goal of detecting defects on the surfaces of various industrial products. Industrial defect recognition based on federated learning can solve the data island problem of traditional centralized methods. Federated learning can train a global model when the data set is decentralized. It does not require data cloud aggregation. It improves the global model by aggregating the parameter updates of local training of federated members, and achieves convergence or reaches the specified accuracy after multiple rounds of iterations. However, due to its distributed characteristics, federated learning is vulnerable to threats from malicious participants, the most common of which is data poisoning attacks, where attackers or hijacked participants can use carefully crafted poisoned data to undermine the performance of the global model. For example, in industrial defect recognition based on federated learning, malicious enterprises can easily add specific perturbations to local real samples to mislead the global model to produce wrong predictions, which brings unprecedented risks to other participants. The existence of malicious threats greatly challenges the effectiveness and reliability of defect recognition models. Summary of the invention

[0003] The purpose of the present invention is to provide a method, program, device and storage medium for defending against poisoning attacks in federated learning based on feature screening, so as to ensure the security of federated learning in industrial applications.

[0004] The federated learning poisoning attack defense method based on feature screening includes the following steps:

[0005] Step 1: Collect local models uploaded by local participants, including benign models uploaded by benign participants and malicious models uploaded by malicious participants, build a model verification set and set a threshold;

[0006] Step 2: Input the model verification set into the collected local models in sequence, obtain the information of the last convolutional layer of each local model, including the feature map in the forward propagation process and the gradient information in the backward propagation process, calculate the importance weight of the feature map, and select the P feature maps with the highest importance weight as the key features of the local model;

[0007] Step 3: Get the global model of the previous round of federated learning, input the model verification set into the global model, obtain the information of the last convolutional layer of the global model, including the feature map in the forward propagation process and the gradient information in the backward propagation process, calculate the importance weight of the feature map, and select the P feature maps with the highest importance weight as the key features of the global model;

[0008] Step 4: For each local model, calculate the Euclidean distance between the key features of the local model and the key features of the global model. If the calculated Euclidean distance is less than the threshold, the local model corresponding to the key feature is determined to be a benign model; otherwise, the local model corresponding to the key feature is determined to be a malicious model.

[0009] Step 5: Use the federated averaging algorithm to aggregate the benign models, obtain a new global model, and upload it to the central server.

[0010] A computer device / equipment / system includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of a method for defending against a federated learning poisoning attack based on feature screening.

[0011] A computer-readable storage medium stores a computer program / instruction, which, when executed by a processor, implements the steps of a federated learning poisoning attack defense method based on feature screening.

[0012] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a method for defending against a federated learning poisoning attack based on feature screening.

[0013] The beneficial effects of the present invention are:

[0014] The present invention screens the key features extracted by the local model during classification, eliminates the influence of non-key features on malicious client detection, amplifies the difference between benign models and malicious models, and uses the statistical distance between key features of different models to detect and filter malicious clients, thereby achieving more effective defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is an overview diagram of the federated learning poisoning attack defense method based on feature screening in the present invention.

[0016] Figure 2 Screening overview graphs for key features.

[0017] Figure 3 Diagram of the data poisoning attack defense process based on feature screening.

[0018] Figure 4 This is a pseudo code diagram for obtaining the key features of the model in the present invention. DETAILED DESCRIPTION

[0019] The present invention is further described below in conjunction with the accompanying drawings.

[0020] This paper focuses on the security issues of federated learning under industrial defect recognition, analyzes the existing federated learning poisoning attack defense methods, and proposes a feature screening-based defense method for industrial defect recognition scenarios.

[0021] The method for defending against poisoning attacks of federated learning based on feature screening is characterized by comprising the following steps:

[0022] Step 1: Collect local models uploaded by local participants, including benign models uploaded by benign participants and malicious models uploaded by malicious participants, build a model verification set and set a threshold;

[0023] Step 2: Input the model verification set into the collected local models in turn, obtain the information of the last convolutional layer of each local model, including the feature map in the forward propagation process and the gradient information in the backward propagation process, calculate the importance weight of the feature map, and select the P feature maps with the highest importance weight as the key features of the local model. It is believed that these feature maps represent the key features learned by the model, such as Figure 4 As shown;

[0024] Step 3: Get the global model of the previous round of federated learning, input the model verification set into the global model, obtain the information of the last convolutional layer of the global model, including the feature map in the forward propagation process and the gradient information in the backward propagation process, calculate the importance weight of the feature map, and select the P feature maps with the highest importance weight as the key features of the global model;

[0025] Step 4: For each local model, calculate the Euclidean distance between the key features of the local model and the key features of the global model. If the calculated Euclidean distance is less than the threshold, the local model corresponding to the key feature is determined to be a benign model; otherwise, the local model corresponding to the key feature is determined to be a malicious model.

[0026] When comparing, the key features of the previous global model are used as the standard. From the above analysis, we can see that the key features of the benign client should be similar to the key features of the global model, while the key features of the malicious model are not similar to the features of the global model. The distance between the key features is defined as follows:

[0027] dis i =||kmap g -kmap i || 2

[0028] Step 5: Use the federated averaging algorithm to aggregate the benign models, obtain a new global model, and upload it to the central server.

[0029] Figure 1The figure shows a flow chart of the steps of the federated learning poisoning attack defense method described in the present invention. First, the present invention collects and screens the key features of the local model, compares the key features of the model during classification to eliminate the interference of non-key features on malicious client detection, and detects and filters malicious models based on the distance analysis between the key features of different models. After screening out the key features of the model, a comparison method based on Euclidean distance is used to identify the difference between the key features of the benign model and the key features of the malicious model.

[0030] Figure 2 This is an overview of feature screening; the validation set is input into each local model to collect relevant information of the last convolutional layer of the model. This includes the feature map information output during the forward propagation process and the gradient information output during the backward propagation process, where the gradient information corresponds to the weight of each feature map. After collecting the gradient information, the gradient values ​​are sorted from large to small, and the feature maps corresponding to the top 50% of the gradient values ​​are selected. The selected feature maps represent the key features of the model.

[0031] Figure 3 This is a data poisoning attack defense process based on feature screening. When detecting malicious clients, it is first assumed that the server can collect a small amount of clean data as a validation set. The data distribution of this validation set does not need to be consistent with the distribution of the client's local data. After collecting the local model uploaded by the client, the server uses the validation set to calculate the key feature map kmap of each client's local model. i And the key feature map kmap of the previous round of global model g , then calculate the kmap for each client i With kmap g The Euclidean distance between i If the distance is less than the given threshold, the corresponding client model is considered to be a benign model, otherwise it is a malicious model. Finally, the calculated benign model is used to update the global model, and the global model is sent to the client for a new round of training.

[0032] In the federated learning scenario of industrial defect identification, there is a lot of noise in the defect data itself, and the poisoned data contains malicious noise injected by attackers. This causes the model to inevitably learn non-critical features related to noise during training, which interfere with malicious client detection, making it difficult for traditional defense methods to accurately distinguish between the noise in the original data and the poisonous noise injected by attackers, reducing the effectiveness of the defense methods.

[0033] The present invention takes into account the high noise characteristics of industrial defect data, and by screening the key features extracted by the local model during classification, eliminates the influence of non-key features on malicious client detection, and amplifies the difference between benign models and malicious models. The statistical distance between key features of different models is used to detect and filter malicious clients, achieving more effective defense.

[0034] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A federated learning poisoning attack defense method based on feature screening, characterized in that: The following steps are involved: Step 1: Collect local models uploaded by local participants, including benign models uploaded by benign participants and malicious models uploaded by malicious participants, build a model verification set and set the threshold; Step 2: Input the model verification set into the collected local models in sequence, obtain the information of the last convolutional layer of each local model, including the feature map in the forward propagation process and the gradient information in the backward propagation process, calculate the importance weight of the feature map, and select the P feature maps with the highest importance weight as the key features of the local model; Step 3: Get the global model of the previous round of federated learning, input the model verification set into the global model, obtain the information of the last convolutional layer of the global model, including the feature map in the forward propagation process and the gradient information in the backward propagation process, calculate the importance weight of the feature map, and select the P feature maps with the highest importance weight as the key features of the global model; Step 4: For each local model, calculate the Euclidean distance between the key features of the local model and the key features of the global model. If the calculated Euclidean distance is less than the threshold, the local model corresponding to the key feature is determined to be a benign model; otherwise, the local model corresponding to the key feature is determined to be a malicious model. Step 5: Use the federated averaging algorithm to aggregate the benign models, obtain a new global model, and upload it to the central server.

2. A computer device / equipment / system comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method of claim 1.

3. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

4. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

Images