Model integrity detection method based on Bloom filter in trusted execution environment

Abstract

According to the method, the trusted execution environment (TEE) and the Bloom filter technology are utilized, and the model integrity detection method based on the Bloom filter in the trusted execution environment is constructed. According to the method, the advantages of the TEE in the aspects of safety, isolation and data privacy protection are fully utilized, and whether the client participating in federated learning promises to really train all rounds or not is quickly checked by using the Bloom filter, so that the purpose of model integrity detection is achieved. According to the invention, the consumption of computing resources and storage space can be reduced while the risk of data leakage is effectively avoided.

Description

Technical Field

[0001] The present invention relates to a model training integrity detection method in federated learning, and in particular to a free-rider attack detection method, which utilizes a trusted execution environment (TEE) and Bloom filter technology. Background Art

[0002] Federated learning technology has broad application prospects and provides new possibilities and opportunities for data applications in various fields (finance, medical care, insurance, etc.), but it also brings new risks and challenges. Federated learning systems are generally considered to be open systems (especially in cross-device federated learning), which allow dynamic entry and exit of training devices, resulting in the possibility of various internal attackers in the system. On the other hand, since the original training data is invisible, attackers can arbitrarily manipulate training data and local model updates to achieve the attack goal of destroying or misleading the global model. In addition, since the overall training data distribution is non-independently and identically distributed (Non-IID: Non-Independently and Identically Distributed), local model update detection methods often find it difficult to effectively identify malicious local model updates, which in turn causes malicious local models to contaminate the global model through the server-side model aggregation process. Therefore, the forgery and manipulation of local model updates is a common and serious attack, which has attracted widespread attention in the academic community.

[0003] Free-rider attack is a common local model manipulation attack. It means that since the local model training process is completed locally in the federation members, some "lazy" or "selfish" federation members do not faithfully follow the predetermined protocol of the federated learning framework to complete the local training process, but submit fabricated false model gradients, intending to "free ride" to profit without contributing real data or consuming local computing resources. This not only destroys the fairness among federation members, but also reduces the training efficiency of the federation model and affects the accuracy improvement of the global model.

[0004] We emphasize that free-rider attackers are often not "malicious" but "selfish". Their purpose is usually not to disrupt federated training, but to gain something for nothing (or to obtain excess returns). Their forged local model updates are often more "mild" and difficult to identify than the poisoned local updates forged by malicious attackers. For example, a free-rider may repeatedly submit the model update of the previous round of training or add a small perturbation to it to forge a new update, or reduce the number of local training rounds. Therefore, the common methods for detecting abnormal local model updates are not effective in detecting free-rider attacks. Such methods focus on eliminating or weakening "abnormal" local updates. For example, Auror resists model poisoning in collaborative learning by clustering the model updates of federated members and removing outliers; MultiKrum achieves model convergence by discarding outliers of the average gradient of federated members in the presence of Byzantine participants. These defense strategies often easily miss "mild" free-rider models.

[0005] In essence, no matter how the local update is forged, the free-rider attack achieves its attack purpose by destroying the integrity of local model training. However, the aforementioned methods cannot verify the integrity of local model training, that is, they cannot guarantee that the federated members have indeed made contributions to the global model improvement in accordance with the agreement (faithfully completed the local training). Therefore, it is necessary to find a set of efficient verification methods for the integrity of federated model training. Using a trusted execution environment (TEE) based on secure hardware is a feasible idea. TEE is a technology that provides an independent and protected operating environment for security-sensitive programs by isolating hardware and software. It has been widely used in various privacy protection or security enhancement applications. The basic idea of ​​using TEE for model integrity check is as follows: each federated training end holds a pair of keys with the server, and the key used for decryption on the server is stored in the TEE and can only be accessed in the TEE. After the local training of the federated training end is completed, the local training results and the encrypted original training data are uploaded to the server for training integrity check. The server will use the key to decrypt the original training data in the TEE and perform local training in the TEE repeatedly. After completion, the training results will be compared with the results presented by the federated training end. If the two results are consistent, the training integrity check passes; otherwise, it fails, which means that the local training process on the federated training end is illegal, and the corresponding local training updates will be discarded. Since the original training data and the training execution process are stored and completed in the TEE throughout the process, their confidentiality can be guaranteed. However, when performing the above operations on the server side, a large amount of computing resources and storage space are required, which may lead to performance bottlenecks and data storage challenges. Summary of the invention

[0006] The purpose of the present invention is to provide a federated learning model training integrity detection framework with low computational overhead and storage space saving.

[0007] In order to achieve the above object, the technical solution of the present invention is to provide a model integrity detection method based on Bloom filter in a trusted execution environment, characterized in that it includes the following steps:

[0008] Step 1: Release the task:

[0009] In cases where cross-border collaboration is needed to train models, ensure data confidentiality, or process large data sets, the task initiator publishes a federated learning project that clearly specifies the required algorithms, incentives, and technical requirements;

[0010] Step 2: User Registration:

[0011] Users who have data that meets the requirements of the federated learning project and supports a trusted execution environment register their information according to the technical specifications of the federated learning project to join the federated learning project;

[0012] Step 3: Select participants for training:

[0013] In each round of federated learning, several registered users are randomly selected as participants to participate in the training;

[0014] Step 4: Selected participants undergo local training:

[0015] The selected participants train on the latest global model using local datasets outside of a secure isolated environment according to the configured hyperparameters;

[0016] Step 5: Create a Bloom filter and submit:

[0017] After completing local training, participants first create a Bloom filter, clearly define the required false positive rate, and select the appropriate bit array size and number of hash functions to meet the false positive rate requirement; next, participants hash the model parameters of each round and store these hashed results in the Bloom filter; finally, the current Bloom filter is submitted to the secure isolation environment and becomes a commitment for subsequent data verification and query operations;

[0018] Step 6: Check the commitment:

[0019] Randomly generate a series of rounds for testing in a secure isolation environment and verify whether these rounds exist in the Bloom filter;

[0020] Step 7: Check whether the model parameters before and after are consistent:

[0021] The rounds that have passed the verification will be retrained using the data set used in the current round, and the training results will be checked to see if they are consistent with the original model parameters for the next round;

[0022] Step 8. Generate proof and submit:

[0023] If the verification results of the previous and subsequent model parameters are consistent through step 7, the secure isolation environment returns the gradient of the current participant P in the tth round. and the generated proof σ P , then participant P submits the proof to the server;

[0024] Step 9: Verify the proof and aggregate the model:

[0025] The server receives the proof submitted by participant P and verifies whether participant P has honestly performed the training process through the algorithm shown in the following formula. If the return value is True, the server issues a task reward to participant P and aggregates the gradient parameters submitted by P. If the return value is False, it means that participant P is likely not to have honestly performed the training completely:

[0026]

[0027] In formula (7), Verify() represents the proof function, pk TEE represents a private key, DNN() represents deep learning training, Represents the global model gradient parameter at the beginning of the tth round.

[0028] Preferably, the task initiator allows participants to audit the algorithm.

[0029] Preferably, in step 5, the number k of common hash functions and the size m of the bit array are calculated using the following formula:

[0030]

[0031] Where n is the total number of local training rounds of the participant, and p is the required misclassification rate.

[0032] The present invention makes full use of the advantages of TEE in terms of security, isolation and data privacy protection, and uses Bloom filters to quickly check whether the clients participating in federated learning have committed to training all rounds truthfully, so as to achieve the purpose of model integrity detection. The present invention can effectively avoid the risk of data leakage while reducing the consumption of computing resources and storage space. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is the model integrity check process within TEE;

[0034] Figure 2 Training integrity check results for federated learning models;

[0035] Figure 3 is the time spent by Bloom filters with three different misclassification rates (0.001, 0.003, and 0.01) at different decimation rounds after 5000 rounds of local training of the Lenet5 model;

[0036] Figure 4 is the time taken by Bloom filters with three different misclassification rates (0.001, 0.003, and 0.01) at different decimation rounds after 5000 rounds of local training of the CNN model;

[0037] Figure 5 is the time spent by Bloom filters with three different false positive rates (0.001, 0.003, 0.01) at different decimation rounds after 2000 rounds of local training of the Lenet5 model;

[0038] Figure 6 is the time taken by Bloom filters with three different misclassification rates (0.001, 0.003, and 0.01) at different decimation rounds after 2000 rounds of local training of the CNN model;

[0039] Figure 7 is the actual misclassification rate of the Bloom filter with a misclassification rate of 0.001 at different decimation rounds after 10,000 rounds of local training of the Lenet5 model;

[0040] Figure 8 is the actual misclassification rate of the Bloom filter with a misclassification rate of 0.003 at different decimation rounds after 10,000 rounds of local training of the Lenet5 model;

[0041] Fig. 9 is the actual misclassification rate of the Bloom filter with a misclassification rate of 0.01 at different decimation rounds after 10,000 rounds of local training of the Lenet5 model;

[0042] Fig.10 The actual misclassification rate of the Bloom filter with a misclassification rate of 0.1 at different decimation rounds after 10,000 rounds of local training of the Lenet5 model. DETAILED DESCRIPTION

[0043] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0044] After the federated learning project is launched, participants have the opportunity to conduct a detailed inspection of the algorithm to ensure data security. This step ensures that their data will not be leaked inadvertently. However, this transparency also brings potential risks: if participants can predict which training rounds will be reviewed, they may selectively participate in these rounds to circumvent the system's integrity detection and implement "free-rider attacks". To address this problem, some institutions and research groups have adopted a "submit and commit" mechanism. In this mechanism, when participants submit a hash summary of the model parameters, they also submit a commitment containing the results of all training rounds. This commitment must meet two conditions: First, it must fully contain the results of all training rounds and keep the order of these results unchanged. This ensures that each participant has participated in all training rounds and submitted all results. Second, this commitment should also allow verification of the results of any particular round to prove that the participant did perform the training task completely and correctly.

[0045] An obvious solution is to directly place the results of all training rounds in the secure isolation environment (hereinafter referred to as "enclave") in the TEE for verification, that is, extract two consecutive rounds of hash values ​​inside the enclave and then request the original input model parameters and data of the response to the outside to ensure that the hash value of the output model parameter is consistent with the commitment. However, the performance of this method is closely related to the number of training rounds. When the number of training rounds is too large, the committed information will exceed the memory size limit in the TEE, which will cause the TEE to fail to start or fail to verify the credibility of the TEE.

[0046] In order to improve search efficiency and save memory space, a federated learning integrity detection method disclosed in an embodiment of the present invention uses a Bloom filter to perform commitment verification. Although the Bloom filter has a certain false positive rate, when the total number of training rounds is large enough, since the Bloom filter is actually a group of binary groups, it occupies a small space and has a fast construction time. And the complexity of a Bloom filter search is O(k), k is the number of hash functions in the Bloom filter, the value of k is -lnp / ln2, and p is the value of the false positive rate. It can be seen that the Bloom filter search time depends on the size of the false positive rate, which is a constant value and does not change with the number of local training rounds.

[0047] Specifically, a method for detecting integrity of federated learning disclosed in an embodiment of the present invention comprises the following steps:

[0048] Step 1: The task initiator will publish a federated learning task when multiple parties need to cooperate in model training, protect data privacy, or process large-scale data, and specify the algorithm, reward mechanism, and configuration requirements required for the task in detail. In order to enhance the credibility of the task and ensure the data privacy of federated members, the task initiator allows participating members to review and verify the algorithm. By default, in this federated learning, a central server coordinates.

[0049] Step 2: Users who have data suitable for the task and support TEE register the corresponding information T according to the configuration instructions.

[0050] Step 3: In each round of federated learning, the central server randomly selects several participants for training. A total of 10 rounds of training are conducted. To test this method, 10 normal federated learning members and 1 free-rider attacker are randomly selected each time.

[0051] Step 4: Build a threat model. Our threat model selects data tampering attack, that is, the free-rider attacker only submits the gradient update of a part of the local data, and uses this small part of the training results to forge the results of all training rounds.

[0052] Step 5: The selected participants perform 20 rounds of local dataset training based on the latest global model outside the secure isolation environment (enclave) according to the configured hyperparameters.

[0053] Step 6: After completing local training, participants will hash the model parameters of each round, as shown in formula (1).

[0054] h i+1 = hash(DNN(θ i ,D i )) (1)

[0055] In formula (1), DNN() represents deep learning training, θ i represents the model parameters of the i-th round, D i represents the data set used for the i-th round of training, hash() represents the hash operation on the obtained data, i+1 Represents the hash summary of the model parameters at round i+1.

[0056] Step 7: When a participant creates a Bloom filter, they first explicitly specify the desired false positive rate p. Then, the number of hash functions k can be calculated using the following formula (2). At the same time, the size of the bit array m can be calculated using the following formula (3). Formula (2) and formula (3) help ensure that the Bloom filter works at the desired false positive rate and has a sufficient bit array size.

[0057]

[0058]

[0059] In formula (3), n is the total number of local training rounds of the participant.

[0060] Step 8: The results of each round of model parameter hashing are hashed through multiple hash functions. Each hash function maps the data to multiple positions in the bit array and sets the bits at these positions to 1, indicating that the data exists. Finally, the Bloom filter is submitted as a commitment to the enclave. The calculation formula is shown in formula (4).

[0061] Bloom Filter(h1,h2...,h R )(4)

[0062] In formula (4), R represents the total number of local training rounds.

[0063] Step 9: A series of rounds for verification are randomly generated in the enclave, and the calculation formula is shown in formula (5).

[0064] generate random(r1,r2...,r q )(5)

[0065] In formula (5), r i represents the round drawn, and q represents the total number of drawn rounds.

[0066] Step 10: Verify whether the round extracted in step 9 exists in the Bloom filter. The Bloom filter will perform the following operations: First, perform the same hash processing on the round to be verified, using the same number and method of hash functions as when creating the Bloom filter; then, the Bloom filter will check whether the bits associated with these hash results in the bit array are all set to 1: if all relevant bits are 1, the Bloom filter determines that the round may exist; if any bit is 0, the Bloom filter will determine that the round does not exist.

[0067] Step 11: The round that has passed the verification will be retrained using the data set used in the next round, and the training results will be checked to see if they are consistent with the original model parameters of the next round. The calculation formula is shown in formula (6).

[0068] Check_equal(θ ri+1 ,DNN(θ ri ,D ri ))(6)

[0069] In formula (6), Check_equal() indicates a function confirmation for checking whether they are consistent.

[0070] Step 12: If the verification results of the previous and next model parameters are consistent, the enclave returns the gradient of participant P in this round and the generated proof σ P , then participant P submits this proof to the server.

[0071] Step 13: The server receives the proof submitted by participant P and uses formula (7) to verify whether participant P has honestly executed the training process: If the return value is True, the server issues a task reward to participant P and aggregates the gradient parameters submitted by P; If the return value is False, it means that participant P is likely not to have honestly and completely executed the training.

[0072]

[0073] In formula (7), Verify() represents the proof function, pk TEE Represents the private key, Represents the global model gradient parameter at the beginning of the tth round.

[0074] In summary, the algorithm pseudo code is shown in Table I, and its steps are:

[0075] (1) In the tth round, the enclave externally calls GetSeed() to obtain the random seed (see line 21 of Table I). When generating the seed, the hash summary h0 of the current global model parameters needs to be bound to Seed (see lines 3-4 of Table I). This is to ensure that the client uses the latest round of global model.

[0076] (2) Local training starts outside the enclave. R is the total number of local training rounds. During the training process, the hash summary of the model parameters of each round of training results is saved (see rows 22-25 of Table I).

[0077] (3) Outside the enclave, the hash summary of the model parameters of all local training results of all rounds is placed in the Bloom filter (see Table I, rows 26-28).

[0078] (4) Initiate proof inside the enclave.

[0079] (5) The enclave randomly checks the q rounds that need to be checked and calls ParaReq(r i ) to return the rth i After checking the commitment, obtain the training data for this round and perform training. Check the hash summary of the training result with the value of the first round. i +1 round of hash digests are consistent. After consistency, calculate the final gradient value in local training and generate proof δ (see Table I, rows 6-18).

[0080] Table I Algorithm Pseudocode

[0081]

[0082] The verification process of the present invention is as follows:

[0083] Table II: Time required for a Bloom filter search when training locally for 10,000 rounds

[0084] False positive rate 0.003 0.001 0.01 0.1 Find time / milliseconds 0.003799987 0.003600502 0.002999997 0.002498341

[0085] Table II shows the time required for a Bloom filter search during 10,000 rounds of local training. It can be clearly seen from this table that the time required for each search is very short, indicating that the Bloom filter search speed is very fast.

[0086] Figure 3 , Figure 4 , Figure 5 , Figure 6 This is the Bloom filter search time with different error rates under different training models and different training rounds. From the figure, we can see that the lower the error rate, the higher the required search time, but it is still at the millisecond level.

[0087] Figure 7 , Figure 8 , Fig. 9 , Fig.10 This is the actual misjudgment rate of Bloom filters with different misjudgment rates at different extraction rounds after 10,000 rounds of local training of the Lenet5 model. It can be seen from the figure that the actual value is close to the theoretical value.

Claims

1. A model integrity detection method based on Bloom filter in a trusted execution environment, characterized in that: The following steps are involved: Step 1: Release the task: In cases where cross-border collaboration is needed to train models, ensure data confidentiality, or process large data sets, the task initiator publishes a federated learning project that clearly specifies the required algorithms, incentives, and technical requirements; Step 2: User registration: Users who have data that meets the requirements of the federated learning project and supports a trusted execution environment register their information according to the technical specifications of the federated learning project to join the federated learning project; Step 3: Select participants for training: In each round of federated learning, several registered users are randomly selected as participants to participate in the training; Step 4: Selected participants undergo local training: The selected participants train on the latest global model using local datasets outside of a secure isolated environment according to the configured hyperparameters; Step 5: Create a Bloom filter and submit: After completing local training, participants first create a Bloom filter, clearly define the required false positive rate, and select the appropriate bit array size and number of hash functions to meet the false positive rate requirement; next, participants hash the model parameters of each round and store these hashed results in the Bloom filter; finally, the current Bloom filter is submitted to the secure isolation environment and becomes a commitment for subsequent data verification and query operations; Step 6: Check the commitment: Randomly generate a series of rounds for testing in a secure isolation environment and verify whether these rounds exist in the Bloom filter; Step 7: Check whether the model parameters before and after are consistent: The rounds that have passed the verification will be retrained using the data set used in the current round, and the training results will be checked to see if they are consistent with the original model parameters for the next round; Step 8. Generate proof and submit: If the verification results of the previous and subsequent model parameters are consistent through step 7, the secure isolation environment returns the gradient of the current participant P in the tth round. and the generated proof σ P , then participant P submits the proof to the server; Step 9: Verify the proof and aggregate the model: The server receives the proof submitted by participant P and verifies whether participant P has honestly performed the training process through the algorithm shown in the following formula. If the return value is True, the server issues a task reward to participant P and aggregates the gradient parameters submitted by P. If the return value is False, it means that participant P is likely not to have honestly performed the training completely: Where Verify() represents the proof function, pk TEE represents a private key, DNN() represents deep learning training, Represents the global model gradient parameter at the beginning of the tth round.

2. A model integrity detection method based on Bloom filter in a trusted execution environment as claimed in claim 1, characterized in that: The task initiator allows participants to audit the algorithm.

3. The model integrity detection method based on Bloom filter in a trusted execution environment as claimed in claim 1, characterized in that: In step 5, the number of common hash functions k and the size of the bit array m are calculated using the following formula: Where n is the total number of local training rounds of the participant, and p is the required misclassification rate.

Images