Federal learning data poisoning attack system and method based on privacy reasoning, program and storage medium

Abstract

The invention belongs to the technical field of artificial intelligence security, and particularly relates to a federal learning data poisoning attack system and method based on privacy reasoning, a program and a storage medium. The invention provides an actual data poisoning attack model, attack hypotheses are reduced, and poisoning attack quality is ensured. Effective poisoning attack can be realized under the condition that an attacker is not required to have a verification data set with the same distribution as a benign client. According to the method, data acquisition is realized through a privacy reasoning technology, data diversity of attackers is enriched through data enhancement, poisoning attacks are finally realized by modifying the corresponding relation between data and real labels, the effectiveness of a federated learning model is greatly destroyed, the method can be deployed in a framework based on federated learning, and the method is suitable for popularization and application. And the method is suitable for various distributed machine learning scenes.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology, and specifically relates to a federated learning data poisoning attack system, method, program and storage medium based on privacy reasoning. Background Art

[0002] Federated learning, as a distributed framework, allows multiple participants to jointly train learning models in a collaborative manner. In the federated learning framework, only model parameters are shared between parameter servers and participants, and private data is not uploaded. This method protects the privacy of data and prevents parameter servers from directly accessing private data. However, due to the characteristics of the federated learning framework, it is vulnerable to active attacks by internal participants. Specifically, attackers can affect model performance by uploading malicious updates. However, existing data poisoning attack methods require the attacker to have a verification dataset with the same distribution as the benign client, and require the attacker to contain a certain amount of data locally to ensure the effectiveness of the attack, which severely limits the implementation of poisoning attacks. Summary of the invention

[0003] The purpose of the present invention is to provide a federated learning data poisoning attack system, method, program and storage medium based on privacy reasoning.

[0004] A data poisoning attack system for federated learning based on privacy reasoning, including a privacy data reasoning module, a data enhancement module and a poisoned data generation module;

[0005] The privacy data inference module is used to obtain the federated learning global model from the federated learning central server, and generate a training data set similar to the user's privacy data by using two generative adversarial network models as an image data generator and a label data generator respectively;

[0006] The data enhancement module is used to randomly erase an area for each image in the training data set and fill the area with random values ​​to increase the diversity of the training data set;

[0007] The poisoned data generation module is used to modify the correspondence between data and labels in the training data set to generate a poisoned data set, so that the labels of the real data are wrong, resulting in the model being unable to effectively identify the real category of the data.

[0008] A data poisoning attack method for federated learning based on privacy reasoning includes the following steps:

[0009] Step 1: Obtain the federated learning global model from the federated learning central server and generate a training dataset similar to the user's private data through the private data inference module;

[0010] Step 2: Process the training data set through the data enhancement module. For each image in the training data set, a random area is erased and filled with random values ​​to increase the diversity of the training data set.

[0011] Step 3: Use the poisoned data generation module to modify the correspondence between data and labels in the training data set, so that the labels of the real data are wrong, resulting in the model being unable to effectively identify the real category of the data, and generating a poisoned data set;

[0012] Step 4: Merge the training dataset with the poisoned dataset, train the local model and upload it to the central server.

[0013] Furthermore, the step 1 is specifically as follows:

[0014] Step 1.1: Obtain the global model of federated learning;

[0015] Step 1.2: Initialize the pseudo image generator and pseudo label generator;

[0016] Step 1.3: Generate random noise for pseudo data and pseudo labels;

[0017] Step 1.4: Iteratively update the fake image generator and update the generator and discriminator at the same time;

[0018] Step 1.5: Iteratively update the pseudo-label generator, and update the generator and discriminator at the same time;

[0019] Step 1.6: Return the generated pseudo data and pseudo labels to obtain a training dataset similar to the user's private data.

[0020] Furthermore, the step 2 is specifically as follows:

[0021] Step 2.1: Define the height h and length w of the image;

[0022] Step 2.2: Randomly generate the erasing area S, the height H and the width W of the erasing rectangle;

[0023] S=h*w*U(s min ,s max )

[0024] H = sqrt(S*r)

[0025]

[0026] Where r is a random value, r = U(r min ,r max );

[0027] Step 2.3: Randomly select an erasing area (x0, y0), erase the image (x0, y0, x0+w, y0+H) in the area, and return the erased data.

[0028] A computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the above-mentioned federated learning data poisoning attack method based on privacy reasoning.

[0029] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned federated learning data poisoning attack method based on privacy reasoning.

[0030] The beneficial effects of the present invention are:

[0031] The present invention provides a practical data poisoning attack model, which reduces attack assumptions and ensures the quality of poisoning attacks. The present invention can achieve effective poisoning attacks without requiring the attacker to have a verification data set with the same distribution as the benign client. The present invention achieves data acquisition through privacy reasoning technology, enriches the attacker's data diversity through data enhancement, and finally implements poisoning attacks by modifying the correspondence between data and true labels, which greatly undermines the effectiveness of the federated learning model. It can be deployed in a federated learning-based architecture and is applicable to a variety of distributed machine learning scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a schematic diagram of a federated learning data poisoning attack system based on privacy reasoning in the present invention.

[0033] Figure 2 Schematic diagram of the privacy data inference module in the present invention.

[0034] Figure 3 Schematic diagram of the privacy-inference-based federated learning data poisoning attack performed by the present invention. DETAILED DESCRIPTION

[0035] The present invention is further described below in conjunction with the accompanying drawings.

[0036] Existing data poisoning attack methods require the attacker to meet certain attack assumptions and have the same data distribution and data volume as the client. Failure to meet the basic attack assumptions will affect the effectiveness of the attack. However, this attack assumption is unrealistic in the federated learning framework. Generally speaking, the attacker of the poisoning attack cannot have a verification data set with the same distribution as the benign client.

[0037] The present invention proposes a federated learning data poisoning attack model based on privacy reasoning, which does not require the attacker to have a verification data set with the same distribution as the benign client. Specifically, when the attacker's own data volume is not enough to produce a good poisoning attack effect, the present invention can obtain the private data and labels of the benign client through privacy reasoning, supplement the attacker's private data set through data enhancement, and then change the real label of the data in the data set to implement the poisoning attack.

[0038] Figure 1 A schematic diagram of a data poisoning attack system for federated learning based on privacy reasoning in the present invention, including a privacy data reasoning module, a data enhancement module, and a poisoned data generation module;

[0039] Privacy Data Inference Module: The privacy data inference module is responsible for generating data similar to user data. The module introduces two generative adversarial network models as image data generator and label data generator respectively. The global model parameters shared between the central server and the client are trained on the training data of each participant, so they can be used to update the discriminator network. By optimizing the two generators to approximate the real data, stable training data is obtained.

[0040] Data enhancement module: The data enhancement module is responsible for enhancing the data obtained by the privacy data inference module and increasing data diversity. The data enhancement mainly uses random erasure technology, which randomly erases an area in the input image for each picture and fills the area with random values.

[0041] Poisoned data generation module: The poisoned data generation module is responsible for generating poisoned data. The generation of poisoned data is to modify the correspondence between the target data and the label in the data set, so that the label of the real data is wrong, resulting in the model being unable to effectively identify the real category of the data.

[0042] The data poisoning process based on privacy reasoning described in the present invention includes the following steps:

[0043] 1) Obtain the global model of federated learning;

[0044] 2) Initialize the image generator and label generator;

[0045] 3) Generate random noise for pseudo data and pseudo labels;

[0046] 4) Use generative adversarial networks to obtain false data and labels;

[0047] 5) Perform random erasure data enhancement;

[0048] 6) Select false labels;

[0049] 7) Replace the true label with the selected false label;

[0050] 8) Add data and false labels to the dataset;

[0051] The privacy data reasoning module includes the following steps:

[0052] 1) Obtain the global model of federated learning;

[0053] 2) Initialize the pseudo image generator and pseudo label generator;

[0054] 3) Generate random noise for pseudo data and pseudo labels;

[0055] 4) The pseudo image generator is iteratively updated, and the generator G and the discriminator D are updated at the same time;

[0056] 5) The pseudo-label generator is iteratively updated, and the generator G and the discriminator D are updated at the same time;

[0057] 6) Return the generated pseudo data and pseudo labels

[0058] The data enhancement module enhances the data according to the following steps:

[0059] 1) Define the height h and length w of the image;

[0060] 2) Randomly generate the erasing area S, the height H and the width W of the erasing rectangle;

[0061] S=h*w*U(s min ,s max )

[0062] H=sqrt(S*r)

[0063]

[0064] Where r is a random value, r = U(r min ,r max );

[0065] 3) Randomly select an erasing area (x0, y0), erase the image (x0, y0, x0+w, y0+H) in the area, and return the erased data.

[0066] Figure 2It is a privacy data inference module; the upper layer of the model is an image data generator, and the lower layer is a label data generator, which consists of two generative adversarial networks. The global model parameters shared between the central server and the client are trained on the training data of each participant, so they can be used to update the discriminator's network. In other words, replacing the discriminator's network parameters with global model parameters is equivalent to training the discriminator directly on benign client data. In this way, the generative adversarial network can easily generate pseudo data and pseudo labels similar to the target data. The generator takes random vectors as input, which are independent of each other and satisfy the Gaussian distribution.

[0067] Figure 3 A schematic diagram of using the present invention to conduct a federated learning data poisoning attack based on privacy reasoning.

[0068] 1. Assume that the federated learning system contains benign clients and attackers, and has private data sets with different distributions.

[0069] 2. Execute the federated learning process to upgrade the global model and improve accuracy.

[0070] 3. For benign client C i :

[0071] a) Download the global model to replace the local model parameters

[0072] b) Train the local model on the local dataset and upload it to the central server.

[0073] 4. For attacker A i

[0074] a) Download the global model to replace the local model parameters

[0075] b) Initialize random space to simulate benign client data and labels

[0076] c) Select the target class and modify the correspondence between the data that meets the conditions and the label to generate the poisoned data set

[0077] d) Merge the training dataset with the poisoned dataset, train the local model and upload it to the central server.

[0078] 5. Repeat steps 3 and 4 until the global model converges.

[0079] The present invention provides a practical data poisoning attack model, which reduces attack assumptions and ensures the quality of poisoning attacks. The present invention can achieve effective poisoning attacks without requiring the attacker to have a verification data set with the same distribution as the benign client. The present invention achieves data acquisition through privacy reasoning technology, enriches the attacker's data diversity through data enhancement, and finally implements poisoning attacks by modifying the correspondence between data and true labels, which greatly undermines the effectiveness of the federated learning model. It can be deployed in a federated learning-based architecture and is applicable to a variety of distributed machine learning scenarios.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data poisoning attack system for federated learning based on privacy reasoning, characterized by: It includes privacy data reasoning module, data enhancement module and poisoned data generation module; The privacy data inference module is used to obtain the federated learning global model from the federated learning central server, and generate a training data set similar to the user's privacy data by using two generative adversarial network models as an image data generator and a label data generator respectively; The data enhancement module is used to randomly erase an area for each image in the training data set and fill the area with random values ​​to increase the diversity of the training data set; The poisoned data generation module is used to modify the correspondence between data and labels in the training data set to generate a poisoned data set, so that the labels of the real data are wrong, resulting in the model being unable to effectively identify the real category of the data.

2. A data poisoning attack method for federated learning based on privacy reasoning, characterized in that: The following steps are involved: Step 1: Obtain the federated learning global model from the federated learning central server and generate a training dataset similar to the user's private data through the private data inference module; Step 2: Process the training data set through the data enhancement module. For each image in the training data set, a random area is erased and filled with random values ​​to increase the diversity of the training data set. Step 3: Use the poisoned data generation module to modify the correspondence between data and labels in the training data set, so that the labels of the real data are wrong, resulting in the model being unable to effectively identify the real category of the data, and generating a poisoned data set; Step 4: Merge the training dataset with the poisoned dataset, train the local model and upload it to the central server.

3. A method for data poisoning attack based on privacy inference in federated learning according to claim 2, characterized in that: The step 1 is specifically as follows: Step 1.1: Obtain the global model of federated learning; Step 1.2: Initialize the pseudo image generator and pseudo label generator; Step 1.3: Generate random noise for pseudo data and pseudo labels; Step 1.4: Iteratively update the fake image generator and update the generator and discriminator at the same time; Step 1.5: Iteratively update the pseudo-label generator, and update the generator and discriminator at the same time; Step 1.6: Return the generated pseudo data and pseudo labels to obtain a training dataset similar to the user's private data.

4. The method for data poisoning attack based on privacy inference in federated learning according to claim 2, characterized in that: The step 2 is specifically as follows: Step 2.1: Define the height h and length w of the image; Step 2.2: Randomly generate the erasing area S, the height H and the width W of the erasing rectangle; S=h*w*U(s min ,s max ) H = sqrt(S*r) Where r is a random value, r = U(r min ,r max ); Step 2.3: Randomly select an erasing area (x0, y0), erase the image (x0, y0, x0+w, y0+H) in the area, and return the erased data.

5. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 2 to 4 are implemented.

6. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 2 to 4 are implemented.

Images