Federal learning attack prevention method, system and device and storage medium

Abstract

The invention provides a federal learning attack prevention method, system and device and a storage medium, and belongs to the technical field of privacy computing. The method comprises the following steps: synchronizing clocks of participating nodes through an aggregation node, setting a network delay threshold value, a VDF time parameter and a security parameter, obtaining a public parameter through an initialization function, and issuing related calculation parameters to the participating nodes; randomly generating a cross validation graph, and issuing a model and a front node address to a target node; carrying out local model training by the target node, carrying out VDF calculation by utilizing current model parameters and random numbers generated by the target node and the front node, generating training and calculation result information, and submitting the training and calculation result information to the aggregation node for verification; time verification and VDF verification are carried out on training and calculation result information, and whether model parameters are accepted to participate in aggregation is determined according to verification results; and aggregating the model parameters submitted by the verified nodes by using a weighted average algorithm through the aggregation nodes to form a new global model.

Description

Technical Field

[0001] The present invention belongs to the field of privacy computing technology, and more specifically, relates to a federated learning attack prevention method, system, device and storage medium. Background Art

[0002] As a cutting-edge distributed machine learning technology, the background technology of federated learning is mainly derived from solving the two core challenges currently facing the field of artificial intelligence: data silos and data privacy protection. With the explosive growth of data volume, it is difficult to integrate data between different institutions to form "data silos", which limits the effectiveness of AI models. At the same time, with the strict implementation of data protection regulations (such as GDPR), user privacy and data security have become insurmountable red lines. Federated learning came into being. It allows multiple data owners to jointly train models through encryption and distributed computing technology without directly sharing the original data, which not only protects data privacy, but also breaks data silos and realizes efficient collaborative use of data. This technical background has laid a solid foundation for the widespread application of federated learning in multiple industries.

[0003] Federated learning is essentially distributed learning. The data exists on each participating node. Each participating node needs to train the model separately and then send it to the aggregation node for model aggregation. Any abnormality in the model of each node will lead to deviations in the final result or even model disasters. In the process of federated learning, federated communication often becomes the target of malicious attacks. Attackers usually intercept and modify the model parameters sent by participating nodes to aggregation nodes to disrupt model training or even direct model training. Commonly used communication encryption methods are likely to be hacked.

[0004] In this case, how to design a method that can resist federated communication attacks and ensure the security of the federated learning process even when the communication process is monitored has become an urgent problem to be solved. Summary of the invention

[0005] In view of the above problems, the purpose of the present invention is to provide a method, system, device and storage medium for preventing federated learning attacks, which utilizes the advantages that the VDF calculation process is time-consuming and cannot be shortened, but the verification process is fast, and at the same time designs a cross-verification method for upstream and downstream nodes to effectively prevent malicious programs from illegally tampering with the model parameters submitted by the nodes to disrupt or even control the overall training effect, so that federated learning can still ensure the security and stability of the overall process even if the node communication process is monitored or even intercepted and tampered.

[0006] In order to achieve the above object, the present invention is implemented through the following technical solutions: In a first aspect, an embodiment of the present application provides a method for preventing attacks by federated learning, including: Synchronize the clocks of participating nodes through the aggregation node, set the network delay threshold, VDF time parameters and security parameters, obtain public parameters through the initialization function, and send relevant calculation parameters to participating nodes; The cross-validation graph is randomly generated through the aggregation node, and the model and the address of the previous node are sent to the target node; the target node performs local model training, uses the current model parameters, the random numbers generated by the target node and the previous node to perform VDF calculations, and generates training and calculation result information and submits it to the aggregation node for verification; The aggregation node verifies the training and calculation result information by time and VDF, and decides whether to accept the model parameters for aggregation based on the verification results; The model parameters submitted by the verified nodes are aggregated using a weighted average algorithm through the aggregation node to form a new global model.

[0007] In an optional embodiment, the method further comprises: When time verification or VDF verification fails, an alarm is issued through the aggregation node and the corresponding node is rejected from participating in the model aggregation.

[0008] In an optional implementation, the clocks of the participating nodes are synchronized through the aggregation node, the network delay threshold, VDF time parameters and security parameters are set, the common parameters are obtained through the initialization function, and the relevant calculation parameters are sent to the participating nodes, including: The aggregation node and each participating node are synchronized through the clock server; The network delay threshold net_t is set through the aggregation node, and the VDF time parameter vdf_tt and security parameter vdf_s are set before the task starts.

[0009] Use the Initialize(vdf_tt, vdf_s) function to calculate and obtain the public parameters op=(ep, vp).

[0010] The calculation parameter ep is sent to each participating node through the aggregation node, and the verification parameter vp is saved.

[0011] In an optional implementation, the randomly generating a cross-validation graph by aggregating nodes and sending the model and the address of the preceding node to the target node includes: A cross-validation graph is randomly generated by aggregating nodes to ensure that each node has only one upstream node and one downstream node.

[0012] The model to be trained and the address of the front node a are sent to the target node b through the aggregation node; The target node b is an arbitrary node, and the preceding node a is an upstream node of the target node b.

[0013] In an optional implementation, the target node performs local model training, performs VDF calculation using the current model parameters, the target node, and random numbers generated by the preceding node, and generates training and calculation result information and submits it to the aggregation node for verification, including: When the target node b receives the model to be trained and the address of the preceding node a, it generates a random number b_num and performs local model training; After the training is completed, the target node b initiates an encryption request to the front node a, and the front node a records the access time a_t and generates a random number a_num and returns it to the target node b; Through the target node b, the random numbers a_num, b_num and the current model parameters are concatenated into the concatenated parameter p1, and the verifiable delay function VDF is calculated together with the calculation parameter ep to obtain the calculation result y and the proof v; The current model parameters of the target node b, the calculation result y, the proof v, the random number b_num and the timestamp b_t are submitted to the aggregation node.

[0014] In an optional implementation, the time verification and VDF verification of the training and calculation result information are performed by the aggregation node, and whether to accept the model parameters to participate in the aggregation is determined according to the verification results, including: Through the aggregation node, the current time T, access time a_t, preset network delay threshold net_t and VDF time parameter vdf_tt are used for time verification to verify whether the time difference diff_t is less than net_t + vdf_tt; where diff_t=T- a_t; If the time verification passes, concatenate the random numbers a_num, b_num and the current model parameters into the verification parameter p2, and use the verification parameter p2, verification parameter vp, calculation result y and proof v to perform VDF verification; If the VDF verification passes, the model parameters of the target node b are accepted to participate in model aggregation.

[0015] In an optional implementation, the aggregating node uses a weighted average algorithm to aggregate the model parameters submitted by the verified nodes to form a new global model, including: Collect the model parameters of all nodes that have passed time verification and VDF verification through the aggregation node; All model parameters are aggregated using a weighted average algorithm; After aggregation is completed, a new global model is formed for use or evaluation.

[0016] In a second aspect, the embodiment of the present application further provides a federated learning attack prevention system, including: The initialization module is used to synchronize the clocks of participating nodes through the aggregation node, set the network delay threshold, VDF time parameters and security parameters, obtain public parameters through the initialization function, and send relevant calculation parameters to participating nodes; The federated modeling module is used to randomly generate a cross-validation graph through the aggregation node, and send the model and the address of the previous node to the target node; the target node performs local model training, uses the current model parameters, the random numbers generated by the target node and the previous node to perform VDF calculations, and generates training and calculation result information and submits it to the aggregation node for verification; Aggregation node verification module, used to perform time verification and VDF verification on training and calculation result information through aggregation nodes, and decide whether to accept model parameters for aggregation based on the verification results; The model aggregation module is used to aggregate the model parameters submitted by the verified nodes using the weighted average algorithm through the aggregation node to form a new global model.

[0017] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the steps of the federated learning attack prevention method as described in any one of the above items are implemented.

[0018] In a fourth aspect, an embodiment of the present application further provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of preventing federated learning attacks as described in any of the above items are implemented.

[0019] It can be seen from the above technical solutions that the present invention has the following advantages: In the federated learning attack prevention method provided by the present application, a cross-validation graph is used to organize participating nodes to perform cross-validation between nodes. In each round of training, each node applies for a random number from the upstream node and performs VDF calculations with the random number of the node and the trained model parameters. The aggregation node performs security verification of the node based on the VDF calculation results and proofs as well as the random number and other parameters submitted by its upstream node. Only nodes that pass the verification can participate in model aggregation. This method can effectively prevent malicious programs from tampering with the model parameters uploaded by the node to interfere with federated learning.

[0020] This application introduces a verifiable delay function (VDF) for time verification and VDF verification, ensuring that participating nodes have enough time to calculate before submitting model parameters, effectively preventing attacks by malicious nodes through rapid generation or tampering of model parameters. At the same time, by setting network delay thresholds and security parameters, the security and credibility of the system are further enhanced. In addition, when time verification or VDF verification fails, the system will issue an alarm and refuse the corresponding node to participate in model aggregation, thereby eliminating potential security risks in a timely manner.

[0021] This application randomly generates a cross-validation graph through an aggregation node, and sends the model and the address of the preceding node to the target node, thus realizing the distributed processing of model training. After the target node performs model training locally, it uses the current model parameters and the generated random numbers to perform VDF calculations, and submits them to the aggregation node for verification. This mechanism not only improves the parallelism and efficiency of model training, but also enhances the accuracy and generalization ability of the model through cross-validation.

[0022] This application aggregates the model parameters submitted by the verified nodes using a weighted average algorithm through the aggregation nodes to form a new global model. This aggregation method not only takes into account the model parameters of each node, but also balances the impact of different nodes on the global model through weighted average, thereby improving the stability and performance of the global model. At the same time, the new global model formed after the aggregation is completed can be used for subsequent use or evaluation, providing strong support for the continuous optimization and improvement of federated learning.

[0023] This application effectively improves the security and credibility of federated learning by introducing VDF verification, setting network delay thresholds and security parameters, randomly generating cross-validation graphs, and using weighted average algorithms for model aggregation. It also optimizes the efficiency and accuracy of model training, providing strong guarantees for the widespread application of federated learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0025] Figure 1 A flowchart of a federated learning attack prevention method provided for this application.

[0026] Figure 2 A flowchart of the VDF calculation and verification process provided in this application.

[0027] Figure 3This is a schematic diagram of a federated learning attack prevention method provided by this application.

[0028] Figure 4 A flowchart of another federated learning attack prevention method provided for this application.

[0029] Figure 5 A schematic diagram of the structure of the federated learning attack prevention system provided for this application.

[0030] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0031] In the specific steps of the building cooling and heating load adaptive calculation method described in detail below, various embodiments of the present disclosure will be described more comprehensively. The present disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present disclosure to the specific embodiments disclosed herein, but the present disclosure should be understood to cover all adjustments, equivalents and / or alternatives that fall within the spirit and scope of the various embodiments of the present disclosure.

[0032] In order to clearly describe the technical solutions of the embodiments of the present application, some terms and technologies involved in the embodiments of the present application are briefly introduced below: VDF: As an innovative cryptographic construction, the background technology of Verifiable Delay Function (VDF) deeply reflects the urgent need for efficient, secure and transparent time delay verification mechanism. VDF is based on mathematical problems that are difficult to accelerate in parallel, such as the continuous square problem or difficult calculations based on elliptic curves. It designs a function that can be calculated sequentially within a given time, but any attempt to accelerate its execution through parallel calculation will be effectively blocked. This feature makes VDF a key technology for implementing time-based security protocols and mechanisms (such as fair lottery, time-locked contracts, etc.). The background technology of VDF not only involves advanced number theory, the design and analysis of cryptographic algorithms, but also covers a deep understanding of computational complexity. Through a carefully designed VDF, the system can ensure that the calculation process does consume enough time without leaking any intermediate state of the calculation, thereby enhancing the security and credibility of the system. In addition, the verification process of VDF is usually efficient, allowing any third party to quickly verify the correctness of the calculation result without repeating the entire calculation process, further improving the practicality and scalability of the system.

[0033] Hereinafter, the terms "include" or "may include" used in various embodiments of the present disclosure indicate the presence of disclosed functions, operations, or elements, and do not limit the addition of one or more functions, operations, or elements. In addition, as used in various embodiments of the present disclosure, the terms "include", "have", and their cognates are intended only to indicate specific features, numbers, steps, operations, elements, components, or a combination of the foregoing, and should not be understood as first excluding the presence of one or more other features, numbers, steps, operations, elements, components, or a combination of the foregoing or the possibility of adding one or more features, numbers, steps, operations, elements, components, or a combination of the foregoing.

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See also Figure 1 The figure is a flow chart of a method for preventing attacks by federated learning in a specific embodiment, and the method includes: S1: Synchronize the clocks of participating nodes through the aggregation node, set the network delay threshold, VDF time parameters and security parameters, obtain public parameters through the initialization function, and send relevant calculation parameters to participating nodes.

[0036] For example, first synchronize the time between the aggregation node and each participating node through the clock server. Then set the network delay threshold net_t through the aggregation node, and set the VDF time parameter vdf_tt and security parameter vdf_s before the task starts. At this time, use the Initialize(vdf_tt, vdf_s) function to calculate and obtain the public parameter op=(ep,vp). Finally, send the calculation parameter ep to each participating node through the aggregation node, and save the verification parameter vp.

[0037] It should be noted that the aggregation node is a federated learning center node, which is used for parameter aggregation and node verification. The parameter aggregation algorithm adopts a weighted average algorithm. The participating nodes are nodes that store training data, and model training is performed on such nodes. The synchronized clock is synchronized through a clock server, and the purpose is to perform time verification in the node verification stage.

[0038] S2: A cross-validation graph is randomly generated through the aggregation node, and the model and the address of the predecessor node are sent to the target node; the target node performs local model training, uses the current model parameters, the random numbers generated by the target node and the predecessor node to perform VDF calculations, and generates training and calculation result information and submits it to the aggregation node for verification.

[0039] S3: Perform time verification and VDF verification on the training and calculation result information through the aggregation node, and decide whether to accept the model parameters for aggregation based on the verification results. S4: When both time verification and VDF verification are successful, the model parameters submitted by the verified nodes are aggregated using a weighted average algorithm through the aggregation node to form a new global model.

[0040] S5: When time verification or VDF verification fails, an alarm is issued through the aggregation node and the corresponding node is rejected from participating in the model aggregation.

[0041] In this embodiment, data security and model quality in the federated learning process are effectively ensured by aggregating node clock synchronization, setting parameters, randomly generating cross-validation graphs, and introducing VDF calculation and double verification mechanisms. At the same time, a weighted average algorithm is used to aggregate verified model parameters, thereby significantly improving the accuracy and security of the global model.

[0042] In an embodiment of the present invention, based on step S2, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0043] Step S2 discloses a federated modeling process, in which the following steps are repeated in each round of training until the model converges.

[0044] The specific steps are as follows: S201: randomly generate a cross-validation graph by aggregating nodes to ensure that each node has only one upstream node and one downstream node; S202: Send the model to be trained and the address of the predecessor node a to the target node b through the aggregation node; wherein the target node b is an arbitrary node, and the predecessor node a is the upstream node of the target node b.

[0045] S203: After the target node b receives the model to be trained and the address of the preceding node a, it generates a random number b_num and performs local model training.

[0046] S204: After the training is completed, the target node b initiates an encryption request to the front node a, and the front node a records the access time a_t and generates a random number a_num and returns it to the target node b.

[0047] S205: Through the target node b, the random numbers a_num, b_num and the current model parameters are spliced ​​into the splicing parameter p1, and the verifiable delay function VDF calculation is performed together with the calculation parameter ep to obtain the calculation result y and the proof v.

[0048] S206: Submit the current model parameters of the target node b, the calculation result y, the proof v, the random number b_num and the timestamp b_t to the aggregation node.

[0049] It should be noted that the cross-validation graph is a directed single-loop graph connected end to end, that is, each node has and only has one upstream node and one downstream node, and is randomly regenerated in each training round to ensure the randomness of cross-validation; the target node b is a schematic node described in this patent, and all other nodes are the same as the target node b; the front node a is the upstream node of the target node b, responsible for providing random numbers and time verification; the random number b_num is generated immediately after receiving the model parameters, and in each training cycle (between two adjacent model parameters received from the aggregation node), the random number b_num can only be requested once by other nodes. If requested again, b_num will be regenerated; the encryption request adopts a symmetric encryption method, which can effectively improve communication efficiency. The random number a_num is consistent with the random number b_num, and is generated by the front node a after receiving the model; the splicing parameters adopt a direct splicing method; the timestamp b_t is generated when node b applies for access to the random number b_num in its downstream node, and has the same meaning as the timestamp a_t.

[0050] In an embodiment of the present invention, based on step S3, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0051] The purpose of this step is to verify the target node b. First, the current time T, a_t uploaded by the previous node a, the network delay threshold net_t, and the VDF time parameter vdf_tt are used for time verification. If the time verification passes, the random number a_num uploaded by the previous node a, the b_num uploaded by the target node b, and the model parameters submitted by the target node b are concatenated to obtain the verification parameter p2. The verification parameter p2, the verification parameter vp retained by the Initialize process, and the proof v and calculation result y uploaded by node b are used for VDF verification. If the VDF verification passes, the model parameters submitted by node b are allowed to participate in the model aggregation; if one of the time verification or VDF verification fails, an alarm is issued, and node b is rejected from participating in the model aggregation in this round.

[0052] It should be noted that the network delay threshold is set according to the network situation, and the set value needs to be smaller than the VDF time parameter vdf_tt; the Initialize(vdf_tt, vdf_s) function is the VDF process initialization function, which is designed according to the actual situation.

[0053] In this embodiment, the time verification is to use the current time T and a_t uploaded by the preceding node a to calculate the time difference diff_t, and verify whether diff_t is less than the sum of the network delay threshold net_t and the VDF time parameter vdf_tt. If so, the verification is passed; the alarm is an early warning notification mechanism that can send node abnormality warnings to the outside world.

[0054] In an embodiment of the present invention, based on step S4, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0055] First, the model parameters of all nodes that have passed time verification and VDF verification are collected through the aggregation node; then, all model parameters are aggregated using the weighted average algorithm; after the aggregation is completed, a new global model is formed for use or evaluation.

[0056] In an embodiment of the present invention, based on steps S2 and S3, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0057] See also Figure 2 As shown, this embodiment discloses a VDF calculation and verification process, which specifically includes: After the training is completed, node b uses the received address of node a to initiate an encryption request to node a. After receiving the request, node a records the current time a_t and returns the random number a_num to node b. After receiving the random number a_num, node b concatenates a_num, b_num and the model parameters generated at the end of this round of training to obtain the concatenated parameter p1. The concatenated parameter p1 is used as the input parameter for the VDF function calculation, and is used together with the calculation parameter ep issued by the aggregation node to perform VDF calculation. After the calculation is completed, the calculation result y and the proof v are obtained. Node b sends the trained model parameters, VDF calculation result y and proof v, random number b_num, and timestamp b_t to the aggregation node. The aggregation node verifies node b: first, the current time, a_t uploaded by node a, the network delay threshold net_t, and the VDF time parameter vdf_tt are used to perform time verification. If the time verification passes, the random number a_num uploaded by node a, the b_num uploaded by node b, and the model parameters submitted by node b are concatenated to obtain the verification parameter p2. The verification parameter p2, the verification parameter vp retained in the Initialize process, and the proof v and result y uploaded by node b are used to perform vdf verification. If the vdf verification passes, the model parameters submitted by node b are allowed to participate in the model aggregation; if one of the time verification or vdf verification fails, an alarm is issued to the monitoring module, and node b is rejected from participating in the model aggregation in this round; further, as a refinement and extension of the specific implementation method of the above embodiment, in order to fully illustrate the specific implementation process in this embodiment, another method for preventing federated learning attacks is provided, such as Figure 3 and Figure 4 As shown, the specific steps include: Step 101: Synchronize clocks between the aggregation node and each participating node.

[0058] Step 102: The aggregation node sets a network delay threshold net_t.

[0059] Step 103: The aggregation node sets the VDF time parameter vdf_tt and the security parameter vdf_s.

[0060] Step 104: The aggregation node calculates and obtains the public parameter op=(ep,vp) through the Initialize(vdf_tt,vdf_s) function.

[0061] Step 105: The aggregation node sends the calculation parameter ep to each participating node and saves the verification parameter vp at the same time.

[0062] Step 106: Aggregate nodes randomly generate a cross-validation graph. Step 107: The aggregation node sends the model to be trained and the address of the predecessor node a of the target node b to the target node b.

[0063] Step 108: Node b generates a random number b_num.

[0064] Step 109: Node b performs local model training.

[0065] Step 110: After the training is completed, node b uses the received address of node a to initiate an encryption request to node a.

[0066] Step 111: After receiving the request, node a records the current time a_t and returns the random number a_num to node b.

[0067] Step 112: Point b receives the random number a_num, concatenates a_num, b_num, and the model parameters generated at the end of this round of training, and obtains concatenated parameter p1.

[0068] Step 113: Node b uses the concatenation parameter p1 as the input parameter of the VDF function calculation, and performs VDF calculation together with the calculation parameter ep sent by the aggregation node. After the calculation is completed, the calculation result y and the proof v are obtained.

[0069] Step 114: Node b sends the trained model parameters, VDF calculation result y and proof v, random number b_num, and timestamp b_t to the aggregation node.

[0070] Step 115: The aggregation node uses the current time, a_t uploaded by node a, the network delay threshold net_t, and the VDF time parameter vdf_tt to perform time verification on node b. If it passes, proceed to step 116, otherwise, proceed to step 119.

[0071] Step 116: Concatenate the random number a_num uploaded by node a, the b_num uploaded by node b, and the model parameters submitted by node b to obtain the verification parameter p2.

[0072] Step 117: Use the verification parameter p2, the verification parameter vp retained in the Initialize process, and the proof v and result y uploaded by node b to perform VDF verification. If the VDF verification passes, proceed to step 118, otherwise proceed to step 119.

[0073] Step 118 : Allow the model parameters submitted by node b to participate in model aggregation, and go to step 120 .

[0074] Step 119: an alarm is issued to node a, and the model parameters submitted by node b are not allowed to participate in model aggregation.

[0075] Step 120 : If the aggregation model reaches the training target, then the process ends; otherwise, the process goes to step 104 .

[0076] In this embodiment, the VDF calculation process is time-consuming and cannot be shortened, but the verification process is fast. At the same time, a cross-validation method for upstream and downstream nodes is designed to effectively prevent malicious programs from disrupting or even controlling the overall training effect by illegally tampering with the model parameters submitted by the nodes. This ensures that even if the node communication process is monitored or even intercepted and tampered with, the federated learning can still ensure the security and stability of the overall process.

[0077] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0078] like Figure 5 As shown, the following is an embodiment of the federated learning attack prevention system provided by the embodiment of the present disclosure. The system and the federated learning attack prevention method of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the federated learning attack prevention system, please refer to the embodiment of the above-mentioned federated learning attack prevention method.

[0079] A federated learning attack prevention system includes: an initialization module 1, a federated modeling module 2, an aggregation node verification module 3 and a model aggregation module 4.

[0080] Initialization module 1 is used to synchronize the clocks of participating nodes through the aggregation node, set the network delay threshold, VDF time parameters and security parameters, obtain public parameters through the initialization function, and send relevant calculation parameters to participating nodes.

[0081] The federated modeling module 2 is used to randomly generate a cross-validation graph through an aggregation node, and send the model and the address of the preceding node to the target node; the target node performs local model training, uses the current model parameters, the random numbers generated by the target node and the preceding node to perform VDF calculations, and generates training and calculation result information and submits it to the aggregation node for verification.

[0082] Aggregation node verification module 3 is used to perform time verification and VDF verification on the training and calculation result information through the aggregation node, and decide whether to accept the model parameters to participate in the aggregation according to the verification results.

[0083] The model aggregation module 4 is used to aggregate the model parameters submitted by the verified nodes using a weighted average algorithm through the aggregation nodes to form a new global model.

[0084] In a specific implementation, the model aggregation module 4 is used to aggregate the model parameters submitted by the verified nodes using a weighted average algorithm through the aggregation nodes to form a new global model after both the time verification and the VDF verification are successful.

[0085] Furthermore, the system also includes: an alarm module 5, which is used to issue an alarm through the aggregation node and refuse the corresponding node to participate in model aggregation when the time verification or VDF verification fails.

[0086] The federated learning attack prevention system provided in this embodiment utilizes the advantages of the VDF calculation process being time-consuming and unable to be shortened, but the verification process being fast, and designs a cross-verification method for upstream and downstream nodes at the same time, thereby effectively preventing malicious programs from disrupting or even controlling the overall training effect by illegally tampering with the model parameters submitted by the nodes, so that even if the federated learning is monitored or even intercepted and tampered with during the node communication process, the security and stability of the overall process can be guaranteed.

[0087] Figure 6 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0088] The federated learning attack prevention method provided in the embodiment of the present application can be applied to electronic devices. It can be understood by those skilled in the art that the electronic device structure involved in the embodiment of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or less components than shown, or combine certain components, or arrange different components. In an embodiment of the present invention, the electronic device includes but is not limited to a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present application described and / or required herein.

[0089] The electronic device may include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, buttons, a camera, a display, and a SIM card interface, etc.

[0090] The processor may include one or more processing units, for example, the processor may include a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated into one or more processors.

[0091] The processor can be the nerve center and command center of the electronic device. The controller can generate an operation control signal according to the instruction operation code and timing signal to complete the control of fetching and executing instructions.

[0092] A memory may also be provided in the processor for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. The memory may store instructions or data that the processor has just used or is cyclically used. If the processor needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor, and thus improves system efficiency.

[0093] The external memory interface can be used to connect an external memory card, such as a MicroSD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor through the external memory interface to implement data storage functions. For example, files such as music and videos can be saved in the external memory card.

[0094] The internal memory can be used to store computer executable program codes, which include instructions. The processor executes various functional applications and data processing of the electronic device by running the instructions stored in the internal memory. The internal memory may include a program storage area and a data storage area. The internal memory may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0095] The wireless communication function of an electronic device can be realized through an antenna, a wireless communication module, a modem processor, and a baseband processor.

[0096] The wireless communication module can provide wireless communication solutions for electronic devices, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (IR), etc.

[0097] Electronic devices can implement audio functions, etc. through audio modules, speakers, receivers, microphones, headphone jacks, and application processors.

[0098] Electronic devices can achieve shooting functions through ISP, camera, video codec, GPU, display and application processor.

[0099] Electronic devices can achieve display functions through GPU, display screen and application processor.

[0100] The GPU is a microprocessor for image processing that connects the display screen and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor may include one or more GPUs that execute program instructions to generate or change display information.

[0101] The display screen is used to display images, videos, etc. The display screen includes a display panel.

[0102] The above-mentioned electronic device implements the building federated learning attack prevention method of the present application. The method synchronizes the clocks of each participating node through an aggregation node, sets the network delay threshold, VDF time and security parameters, obtains common parameters through an initialization function and sends the calculation parameters to the participating nodes. Subsequently, the aggregation node randomly generates a cross-validation graph, sends the model and the address of the preceding node to the target node for local training. The target node uses the model parameters and the random numbers generated by itself and the preceding node to perform VDF calculations, and submits the training and calculation results to the aggregation node for verification. After the aggregation node performs time verification and VDF verification, the weighted average algorithm is used to aggregate the verified model parameters to form a new global model. The above-mentioned technical solution achieves the beneficial effect of effectively improving the security of federated learning and the quality of model aggregation through strict verification procedures and weighted average aggregation.

[0103] The storage medium provided in the present application stores a program product that can implement a federated learning attack prevention method.

[0104] The method for preventing federated learning attacks includes: synchronizing the clocks of participating nodes through aggregation nodes, setting network delay thresholds, VDF time parameters and security parameters, obtaining public parameters through initialization functions, and sending relevant calculation parameters to participating nodes; randomly generating cross-validation graphs through aggregation nodes, sending models and predecessor node addresses to target nodes; the target nodes perform local model training, perform VDF calculations using the current model parameters, random numbers generated by the target nodes and predecessor nodes, and generate training and calculation result information and submit it to the aggregation nodes for verification; the aggregation nodes perform time verification and VDF verification on the training and calculation result information, and decide whether to accept the model parameters for aggregation based on the verification results; the aggregation nodes use a weighted average algorithm to aggregate the model parameters submitted by the verified nodes to form a new global model.

[0105] In some possible implementations, the federated learning attack prevention method disclosed herein can be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps described in the above “Exemplary Method” section of this specification according to various exemplary implementations of the present disclosure.

[0106] The storage medium of the present disclosure can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0107] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for preventing attacks by federated learning, characterized in that: include: Synchronize the clocks of participating nodes through the aggregation node, set the network delay threshold, VDF time parameters and security parameters, obtain public parameters through the initialization function, and send relevant calculation parameters to participating nodes; A cross-validation graph is randomly generated by aggregating nodes, and the model and the address of the preceding node are sent to the target node; The target node performs local model training, uses the current model parameters, the target node, and the random numbers generated by the previous node to perform VDF calculations, and generates training and calculation result information and submits it to the aggregation node for verification; The aggregation node verifies the training and calculation result information by time and VDF, and decides whether to accept the model parameters for aggregation based on the verification results; The model parameters submitted by the verified nodes are aggregated using a weighted average algorithm through the aggregation node to form a new global model.

2. The method for preventing attacks by federated learning according to claim 1, characterized in that: The method further comprises: When time verification or VDF verification fails, an alarm is issued through the aggregation node and the corresponding node is rejected from participating in the model aggregation.

3. The method for preventing attacks by federated learning according to claim 1, characterized in that: The clocks of participating nodes are synchronized through the aggregation node, the network delay threshold, VDF time parameters and security parameters are set, the public parameters are obtained through the initialization function, and the relevant calculation parameters are sent to the participating nodes, including: The aggregation node and each participating node are synchronized through the clock server; Set the network delay threshold net_t through the aggregation node, and set the VDF time parameter vdf_tt and security parameter vdf_s before the task starts; Use Initialize(vdf_tt, vdf_s) function to calculate and obtain the public parameters op=(ep, vp); The calculation parameter ep is sent to each participating node through the aggregation node, and the verification parameter vp is saved.

4. The method for preventing attacks by federated learning according to claim 3, characterized in that: The method of randomly generating a cross-validation graph by aggregating nodes and sending the model and the address of the preceding node to the target node includes: Randomly generate a cross-validation graph by aggregating nodes to ensure that each node has only one upstream node and one downstream node; The model to be trained and the address of the front node a are sent to the target node b through the aggregation node; The target node b is an arbitrary node, and the preceding node a is an upstream node of the target node b.

5. The method for preventing attacks by federated learning according to claim 4, characterized in that: The target node performs local model training, performs VDF calculation using the current model parameters, the target node, and random numbers generated by the preceding node, and generates training and calculation result information and submits it to the aggregation node for verification, including: When the target node b receives the model to be trained and the address of the preceding node a, it generates a random number b_num and performs local model training; After the training is completed, the target node b initiates an encryption request to the front node a, and the front node a records the access time a_t and generates a random number a_num and returns it to the target node b; Through the target node b, the random numbers a_num, b_num and the current model parameters are concatenated into the concatenated parameter p1, and the verifiable delay function VDF is calculated together with the calculation parameter ep to obtain the calculation result y and the proof v; The current model parameters of the target node b, the calculation result y, the proof v, the random number b_num and the timestamp b_t are submitted to the aggregation node.

6. The method for preventing attacks by federated learning according to claim 5, characterized in that: The time verification and VDF verification of the training and calculation result information are performed by the aggregation node, and whether to accept the model parameters to participate in the aggregation is determined according to the verification results, including: Through the aggregation node, the current time T, access time a_t, preset network delay threshold net_t and VDF time parameter vdf_tt are used for time verification to verify whether the time difference diff_t is less than net_t + vdf_tt; where diff_t=T- a_t; If the time verification passes, concatenate the random numbers a_num, b_num and the current model parameters into the verification parameter p2, and use the verification parameter p2, verification parameter vp, calculation result y and proof v to perform VDF verification; If the VDF verification passes, the model parameters of the target node b are accepted to participate in the model aggregation.

7. The method for preventing attacks by federated learning according to claim 6, characterized in that: The aggregating node uses a weighted average algorithm to aggregate the model parameters submitted by the verified nodes to form a new global model, including: Collect the model parameters of all nodes that have passed time verification and VDF verification through the aggregation node; All model parameters are aggregated using a weighted average algorithm; After aggregation is completed, a new global model is formed for use or evaluation.

8. A federated learning attack prevention system, characterized in that: The system adopts the federated learning attack prevention method as claimed in any one of claims 1 to 7; The system comprises: The initialization module is used to synchronize the clocks of participating nodes through the aggregation node, set the network delay threshold, VDF time parameters and security parameters, obtain public parameters through the initialization function, and send relevant calculation parameters to participating nodes; The federated modeling module is used to randomly generate a cross-validation graph through the aggregation node, and send the model and the address of the previous node to the target node; the target node performs local model training, uses the current model parameters, the random numbers generated by the target node and the previous node to perform VDF calculations, and generates training and calculation result information and submits it to the aggregation node for verification; Aggregation node verification module, used to perform time verification and VDF verification on training and calculation result information through aggregation nodes, and decide whether to accept model parameters for aggregation based on the verification results; The model aggregation module is used to aggregate the model parameters submitted by the verified nodes using the weighted average algorithm through the aggregation node to form a new global model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the federated learning attack prevention method as described in any one of claims 1 to 7 are implemented.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the federated learning attack prevention method as described in any one of claims 1 to 7 are implemented.

Images