Federal learning data poisoning attack method based on label and feature cooperative disturbance, program, device and storage medium
By using the data poisoning attack method of tag and feature collaborative perturbation in federated learning, poisoning data containing tag noise and feature noise is generated, which solves the problem of data poisoning attack in industrial defect identification, and achieves efficient attack effect and Bypass common defense methods.
Patent Information
- Application Number
- CN202411384514.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2024-12-31
AI Technical Summary
Federated learning is vulnerable to data poisoning in industrial defect identification, and malicious actors can destroy the performance of the global model by adding specific perturbation data, resulting in the effectiveness and reliability of the model being challenged.
Using a federated learning data poisoning attack method based on label and feature collaborative perturbation, the label and feature information of the original data are learned through the poisoning generator, and poisoning data that meets the original data labels are generated, and the real data labels are generated through the conditional generation of adversarial network training. Flip, generate poisoned data containing label noise and feature noise, bypassing common defense methods.
The effectiveness and concealment of attacks are achieved simultaneously, and the generated poisoned data can destroy the correspondence between the tag and the data, disrupt the characteristic distribution of the data, and reduce the effectiveness of industrial defect identification.
Smart Images
Figure CN119227749A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of industrial Internet security technology, and specifically relates to a federated learning data poisoning attack method, program, device and storage medium based on label and feature collaborative perturbation. Background Art
[0002] Industrial defect detection has long been one of the most important research areas in the field of industrial vision, with the goal of detecting defects on the surfaces of various industrial products. Industrial defect recognition based on federated learning can solve the data island problem of traditional centralized methods. Federated learning can train a global model when the data set is decentralized. It does not require data cloud aggregation. It improves the global model by aggregating the parameter updates of local training of federated members, and achieves convergence or reaches the specified accuracy after multiple rounds of iterations. However, due to its distributed characteristics, federated learning is vulnerable to threats from malicious participants, the most common of which is data poisoning attacks, where attackers or hijacked participants can use carefully crafted poisoned data to undermine the performance of the global model. For example, in industrial defect recognition based on federated learning, malicious enterprises can easily add specific perturbations to local real samples to mislead the global model to produce wrong predictions, which brings unprecedented risks to other participants. The existence of malicious threats greatly challenges the effectiveness and reliability of defect recognition models. Summary of the invention
[0003] The purpose of the present invention is to provide a method, program, device and storage medium for federated learning data poisoning attack based on label and feature collaborative perturbation.
[0004] The federated learning data poisoning attack method based on label and feature collaborative perturbation includes the following steps:
[0005] Step 1: The training module of the poisoning generator learns the labels and feature-related information of the original data;
[0006] Step 2: The malicious actor obtains the label information corresponding to the local data, uses the poisoned generator to generate poisoned data that satisfies the label of the original data, and replaces the original data with the poisoned data;
[0007] Step 3: Malicious participants use poisoned data to train a local malicious model and upload the local malicious model to the central server to complete the poisoning attack.
[0008] Furthermore, the step 1 is specifically as follows:
[0009] Step 1.1: Initialize the generator G and the discriminator D;
[0010] Step 1.2: Generator G generates satisfying condition y fake False data;
[0011] fake_img←G(z,y fake )
[0012] Step 1.3: Update the discriminator D using the real data and flipped labels;
[0013]
[0014] Step 1.4: The discriminator D identifies whether the data generated by the generator G is real data or false data, and returns the result to the generator G;
[0015] fake←D(fake_img,y fake )
[0016] Step 1.5: The generator G is updated according to the return result of the discriminator D, and the objective function is as follows:
[0017]
[0018] A computer device / equipment / system comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned federated learning data poisoning attack method based on label and feature collaborative perturbation.
[0019] A computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the above-mentioned federated learning data poisoning attack method based on label and feature collaborative perturbation.
[0020] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned federated learning data poisoning attack method based on label and feature collaborative perturbation.
[0021] The beneficial effects of the present invention are:
[0022] The present invention provides a federated learning data poisoning attack that can achieve both attack effectiveness and concealment. The attack flips the real data labels during the training process of the conditional generative adversarial network to make the generator generate poisoned data. In addition, the generated poisoned data contains poisonous noise by controlling the training rounds of the conditional generative adversarial network, destroying the corresponding relationship between the label and the data while disturbing the characteristic distribution of the data. The generated poisoned data contains both label noise and characteristic noise. The present invention can bypass common defense methods and greatly reduce the effectiveness of industrial defect recognition. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1This is an overview of the federated learning data poisoning attack method based on label and feature collaborative perturbation in the present invention.
[0024] Figure 2 This is a diagram of the federated learning data poisoning attack framework.
[0025] Figure 3 An overview of the poison generator training module. DETAILED DESCRIPTION
[0026] The present invention is further described below in conjunction with the accompanying drawings.
[0027] This paper focuses on the security issues of federated learning under industrial defect identification, analyzes the existing federated learning poisoning attacks, and proposes a data poisoning attack method based on label and feature collaborative perturbation.
[0028] Figure 1 The figure shows a flow chart of the steps of the federated learning data poisoning attack method based on label and feature collaborative perturbation according to the present invention, including:
[0029] Poisoning generator training module: This module is responsible for learning the original data labels and feature-related information. Its function is to obtain the poisoning generator and provide a basis for the fake data generation module.
[0030] Poisoned data generation module: Malicious actors use the poisoned generator to generate poisoned data that meets the label of the original data, and use the poisoned data to replace the original data. Its role is to generate poisoned data and provide a basis for local malicious model training;
[0031] Local training module: Benign participants and malicious participants use their own local data for training. Benign participants use local data to train to obtain local benign models, and malicious participants use poisoned data to train to obtain local malicious models.
[0032] The federated learning data poisoning attack method based on label and feature collaborative perturbation includes the following steps:
[0033] Step 1: The training module of the poisoning generator learns the labels and feature-related information of the original data;
[0034] Step 1.1: Initialize the generator G and the discriminator D;
[0035] Step 1.2: Generator G generates satisfying condition y fake False data;
[0036] fake_img←G(z,y fake )
[0037] Step 1.3: Update the discriminator D using the real data and flipped labels;
[0038]
[0039] Step 1.4: The discriminator D identifies whether the data generated by the generator G is real data or false data, and returns the result to the generator G;
[0040] fake←D(fake_img,y fake )
[0041] Step 1.5: The generator G is updated according to the return result of the discriminator D, and the objective function is as follows:
[0042]
[0043] Step 2: The malicious actor obtains the label information corresponding to the local data, uses the poisoned generator to generate poisoned data that satisfies the label of the original data, and replaces the original data with the poisoned data;
[0044] Step 3: Malicious participants use poisoned data to train a local malicious model and upload the local malicious model to the central server to complete the poisoning attack.
[0045] Figure 2 The framework diagram of federated learning data poisoning attack is given. Data poisoning attack destroys the training process of local models by replacing poisoned data with original data. Participants use poisoned data to train malicious local models, which then pollute the global model during the global model aggregation process.
[0046] Figure 3 The training process of the poisoned generator is given, which includes two parts: poisoned generator training and discriminator training. The poisoned generator is trained with the original data, and its purpose is to learn the relevant information of the original data and generate false data that is as similar as possible to the original data and meets the given conditional information. The discriminator is trained with the original data and the false data generated by the generator, respectively, and its purpose is to distinguish the original data from the false data as much as possible. In order to obtain the poisoned generator, we flip the label of the original data during the training process, so that the discriminator cannot learn the correspondence between the original data and the label, and then generate poisoned data that does not correspond to the label information when guiding the generator to generate false data.
[0047] Existing federated learning data poisoning attack methods mainly generate poisoned data by adding label noise or feature noise. However, directly modifying the data label will cause the model to deviate from the original decision boundary, resulting in a clear difference between the benign model and the malicious model. This difference can be easily detected by the defense method and the malicious model can be identified, thereby reducing the concealment of the attack. In addition, since there is a lot of noise in industrial defect data, if feature noise is injected into the original data, the newly added noise will overlap with the original noise, and the feature distribution of the image cannot be significantly changed, resulting in a decrease in the effectiveness of the attack.
[0048] The present invention is a federated learning data poisoning attack that achieves both attack effectiveness and concealment. The attack flips the real data labels during the training process of the conditional generative adversarial network to make the generator generate poisoned data; in addition, the generated poisoned data contains poisonous noise by controlling the training rounds of the conditional generative adversarial network. While destroying the correspondence between the label and the data, the feature distribution of the data is disturbed, and the generated poisoned data contains both label noise and feature noise. This attack method can bypass common defense methods and significantly reduce the effectiveness of industrial defect recognition.
[0049] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A federated learning data poisoning attack method based on label and feature collaborative perturbation, characterized in that: The following steps are involved: Step 1: The training module of the poisoning generator learns the labels and feature-related information of the original data; Step 2: The malicious actor obtains the label information corresponding to the local data, uses the poisoned generator to generate poisoned data that satisfies the label of the original data, and replaces the original data with the poisoned data; Step 3: Malicious participants use poisoned data to train a local malicious model and upload the local malicious model to the central server to complete the poisoning attack.
2. The method for federated learning data poisoning attack based on label and feature collaborative perturbation according to claim 1, characterized in that: The step 1 is specifically as follows: Step 1.1: Initialize the generator G and the discriminator D; Step 1.2: Generator G generates satisfying condition y fake False data; fake_img←G(z,y fake ) Step 1.3: Update the discriminator D using the real data and flipped labels; Step 1.4: The discriminator D identifies whether the data generated by the generator G is real data or false data, and returns the result to the generator G; fake←D(fake_img,y fake ) Step 1.5: The generator G is updated according to the return result of the discriminator D, and the objective function is as follows:
3. A computer device / equipment / system comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 2.
4. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.
5. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.