Federal learning backdoor attack method based on A2CTA
Through the adversarial adaptive composite triggering backdoor attack method, multiple partial triggers are used to jointly activate the backdoor task and introduce adversarial adaptive losses, solving the problem of insufficient stealth of backdoor attacks in the existing technology, achieving high attack success rate and Improved model reliability.
Patent Information
- Application Number
- CN202411257725.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-09
- Publication Date
- 2025-01-10
AI Technical Summary
The triggering conditions and activation scenarios of the existing federated learning backdoor attack methods are too simple and lack invisibility, which leads to backdoor tasks that may be unintentionally exposed, affecting model reliability.
Adversarial adaptive composite triggered backdoor attack (A2CTA) method is adopted to jointly activate the backdoor task through multiple partial triggers, and introduce adversarial adaptive losses to balance the triggers, preventing the backdoor from activate the steering of the partial triggers and improving stealth.
In multi-backdoor attack scenarios, the A2CTA method can effectively hide triggers, achieve high attack success rate through the combination of triggers of other backdoor tasks, and prevent backdoor activation from steering partial triggers, improving the stealth and reliability of the model.
Smart Images
Figure CN119294476A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of backdoor attack, and in particular, to a federated learning backdoor attack method based on A2CTA. Background Art
[0002] Federated learning (FL) provides a paradigm for preserving the privacy of distributed learning. It allows communication between various data owners without sharing private training datasets. Although federated learning (FL) solves the problem of privacy protection, it encounters the challenge of model reliability. For example, since the data is heterogeneous and isolated across multiple decentralized devices, malicious clients may manipulate their local model parameters to inject backdoor tasks into the global model.
[0003] Backdoor attacks aim to inject backdoor tasks into a model without affecting its performance on the main task. After the attack, the attacker can activate the backdoor task of the victim model through a predefined trigger to produce the expected prediction. Recent methods have demonstrated the vulnerability of federated learning (FL) to backdoor attacks. For example, Bagdasaryan et al. proposed a model replacement method to deceive federated learning. The attack was carried out by setting specific pixel values at specific locations in the image as backdoor activation triggers. And the backdoor attack with this trigger mechanism is called Central Backdoor Attack, CBA. Xie et al. introduced distributed backdoor attack (DBA), which exploits distributed trigger injection in FL. Specifically, there are multiple triggers, each of which can activate a different backdoor task. In addition, Zhang et al. applied a method similar to adversarial training to optimize the backdoor trigger. Fang et al. fine-tuned the trigger to maximize the difference between the latent representations of clean and trigger-poked samples. Although these advanced attack methods have achieved high attack performance, their overly simplified trigger conditions and activation scenarios may lack sufficient stealth, which may lead to inadvertent exposure of backdoor tasks.
[0004] Usually, backdoor attacks activate the backdoor task by injecting a single trigger. The activation conditions are divided into two types: full trigger and partial trigger. The former represents the original trigger injected by the attacker, while the latter represents a subset of the former. Even a partial trigger is sufficient to activate the backdoor task. This shows that the trigger settings used by existing methods are relatively simple. Therefore, the focus of this work is to enhance the stealth of backdoor activation. Summary of the invention
[0005] According to the technical problems raised above, a federated learning backdoor attack method based on A2CTA is provided. The present invention proposes an adversarial adaptive compound trigger backdoor attack (A2CTA) on federated learning. Different from the existing work that uses a single activation trigger or uses multiple independent activation triggers, the A2CTA of the present invention uses multiple partial triggers to collaboratively activate the backdoor task. In addition, considering that the trigger size may affect the backdoor activation offset, the present invention introduces an adversarial adaptive loss to balance various triggers and prevent the backdoor activation from shifting to partial triggers.
[0006] The technical means adopted by the present invention are as follows:
[0007] A federated learning backdoor attack method based on A2CTA, including:
[0008] S1. The client receives the global model and trains and uploads the local model.
[0009] S2. Optimize the local model based on the original label and the target label. Samples with partial triggers use the original label, and samples with compound triggers use the target label to calculate different cross entropy losses.
[0010] S3, optimize the gradient distance by adjusting the sample loss caused by different triggers through an adaptive algorithm;
[0011] S4. Calculate the global loss of the corresponding client using A2CTA;
[0012] S5. Calculate the gradient of the local model through the global loss and update the local model;
[0013] S6. Calculate the gradient difference and upload the gradient difference to the server after the local training is completed.
[0014] Furthermore, step S1 specifically includes:
[0015] S11. In the tth round of communication, the server calls the current global model and distributes it to each client;
[0016] S12. After receiving the global model, the client uses local data to train the model and obtains the local model that has completed this round of training.
[0017] Furthermore, step S12 specifically includes:
[0018] S121. For each local update of the malicious client, in the local dataset D i Divide k batches for training, denoted as B k ;
[0019] S122. Add triggers to the data in the batch according to the poisoning rate p to obtain poisonous data with triggers, denoted as as follows:
[0020]
[0021] Furthermore, step S2 includes: in each batch of iteration, four losses are calculated, including the clean main task loss L clean , the loss of backdoor malicious tasks L backdoor , in order to offset some triggers δ A Contribution to adversarial learning loss L advA and to offset part of the trigger δ B Contribution to adversarial learning loss L advB , specifically including:
[0022] S21. Calculate the clean main task loss L clean ,as follows:
[0023]
[0024] Among them, x i represents the i-th sample; f θ represents the output of the neural network; x represents the sample with iteration; y represents the category to which the sample belongs;
[0025] S22. Calculate the loss L of the backdoor malicious task backdoor ,as follows:
[0026]
[0027] in, Indicates a compound trigger δ AB Input; Indicates the type of backdoor attack;
[0028] S23, calculate to offset part of the trigger δ A Contribution to adversarial learning loss L advA ,as follows:
[0029]
[0030] S24, calculate to offset part of the trigger δ A Contribution to adversarial learning loss L advB ,as follows:
[0031]
[0032] Further, step S3 specifically includes:
[0033] S31. Calculate the attack success rates AsrA of trigger TriggerA and AsrB of trigger TriggerB based on the local dataset, and input λ adv = 0.4, ε = 0.05;
[0034] S32. Calculate the adaptive coefficients λ1 and λ2 by judging the magnitudes of AsrA and AsrB, i.e.:
[0035] If AsrA > AsrB, the calculation formulas for the adaptive coefficients λ1 and λ2 are as follows:
[0036] λ1 = min(1 - ε, max(ε, λ1 + ε))
[0037] λ2 = min(1 - ε, max(ε, λ2 - ε))
[0038] If AsrA < AsrB, the calculation formulas for the adaptive coefficients λ1 and λ2 are as follows:
[0039] λ1 = min(1 - ε, max(ε, λ1 - ε))
[0040] λ2 = min(1 - ε, max(ε, λ2 + ε))
[0041] S33. Multiply the adaptive coefficients λ1 and λ2 by the total adversarial control parameter λ adv , as follows:
[0042] λ1 = λ1λ adv
[0043] λ2 = λ2λ adv .
[0044] Furthermore, step S4 specifically includes:
[0045] Use A2CTA to calculate the global loss L of the corresponding client total , as follows:
[0046]
[0047] where η, λ c , λ b all represent the input hyperparameters.
[0048] Furthermore, step S5 specifically includes:
[0049] Calculate the gradient of the local model through the global loss as follows:
[0050]
[0051] Among them, θ t represents the parameters of the global model; γ i represents the learning rate; Represents the calculated model update gradient.
[0052] Further, step S6 specifically includes:
[0053] The calculated gradient difference Δ t+1 ,as follows:
[0054]
[0055] Compared with the prior art, the present invention has the following advantages:
[0056] 1. The present invention provides a federated learning backdoor attack method based on A2CTA. In a multi-backdoor attack, the trigger can be hidden in the trigger of other backdoor tasks, and the trigger of the attack method of the present invention is obtained by combining the triggers of other backdoor tasks. In the attack of two backdoor tasks and the attack of three backdoor tasks, a high attack success rate can be achieved.
[0057] 2. The present invention provides a federated learning backdoor attack method based on A2CTA, which introduces adversarial adaptive loss to balance various triggers and prevent the backdoor activation from turning to some triggers.
[0058] Based on the above reasons, the present invention can be widely promoted in the fields of backdoor attacks and the like. BRIEF DESCRIPTION OF THE DRAWINGS
[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0060] Figure 1 This is a flow chart of the federated learning backdoor attack method based on A2CTA of the present invention.
[0061] Figure 2 This is the overall attack framework diagram of A2CTA of the present invention.
[0062] Figure 3 The attack performance (without defense) under different data sets provided for the embodiments of the present invention varies with the iteration of communication.
[0063] Figure 4 The embodiment of the present invention provides the change of the number of communication iterations under different defense methods in the cifar10 data set.
[0064] Figure 5 The attack performance of the trigger provided for the embodiment of the present invention under different data sets combined with other backdoor task triggers varies with the iteration of communication.
[0065] Figure 6 The activation effects of some triggers provided in the embodiments of the present invention.
[0066] Figure 7 Activation map without adversarial adaptive loss provided for embodiments of the present invention.
[0067] Figure 8 An activation diagram using the attack method of the present invention is provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0068] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0069] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0070] like Figure 1 As shown, the present invention provides a federated learning backdoor attack method based on A2CTA, comprising:
[0071] S1. The client receives the global model and trains and uploads the local model.
[0072] S2. Optimize the local model based on the original label and the target label. Samples with partial triggers use the original label, and samples with compound triggers use the target label to calculate different cross entropy losses.
[0073] S3, optimize the gradient distance by adjusting the sample loss caused by different triggers through an adaptive algorithm;
[0074] S4. Calculate the global loss of the corresponding client using A2CTA;
[0075] S5. Calculate the gradient of the local model through the global loss and update the local model;
[0076] S6. Calculate the gradient difference and upload the gradient difference to the server after the local training is completed.
[0077] In specific implementation, as a preferred embodiment of the present invention, step S1 specifically includes:
[0078] S11. In the tth round of communication, the server calls the current global model and distributes it to each client;
[0079] S12. After receiving the global model, the client uses local data to train the model and obtains the local model that has completed this round of training.
[0080] In specific implementation, as a preferred embodiment of the present invention, step S12 specifically includes:
[0081] S121. For each local update of the malicious client, in the local dataset D i Divide k batches (data segments) for training, denoted as B k ;
[0082] S122. Add triggers to the data in the batch (data segment) according to the poisoning rate p to obtain poisonous data with triggers, which is recorded as as follows:
[0083]
[0084] In specific implementation, as a preferred embodiment of the present invention, step S2 includes: in each batch (data segment) of each iteration, four losses are calculated, including the clean main task loss L clean , the loss of backdoor malicious tasks L backdoor , in order to offset some triggers δ A Contribution to adversarial learning loss L advA and to offset part of the trigger δ B Contribution to adversarial learning loss L advB , specifically including:
[0085] S21. Calculate the clean main task loss L clean ,as follows:
[0086]
[0087] Among them, x i represents the i-th sample; f θ represents the output of the neural network; x represents the sample with iteration; y represents the category to which the sample belongs;
[0088] S22. Calculate the loss L of the backdoor malicious task backdoor , as follows:
[0089]
[0090] Among them, represents the input with the composite trigger δ AB ; represents the category of the backdoor attack;
[0091] S23. Calculate the loss L of adversarial learning to offset the contribution of part of the trigger δ A , as follows: advA as follows:
[0092]
[0093] S24. Calculate the loss L of adversarial learning to offset the contribution of part of the trigger δ A , as follows: advB as follows:
[0094]
[0095] In specific implementation, as a preferred implementation manner of the present invention, step S3 specifically includes:
[0096] S31. Calculate the attack success rate AsrA of the trigger TriggerA and the attack success rate AsrB of the trigger TriggerB according to the local dataset, and input λ adv = 0.4, ε = 0.05;
[0097] S32. Calculate the adaptive coefficients λ1 and λ2 by judging the magnitudes of AsrA and AsrB, that is:
[0098] If AsrA > AsrB, the calculation formulas for the adaptive coefficients λ1 and λ2 are as follows:
[0099] λ1 = min(1 - ε, max(ε, λ1 + ε))
[0100] λ2 = min(1 - ε, max(ε, λ2 - ε))
[0101] If AsrA < AsrB, the calculation formulas for the adaptive coefficients λ1 and λ2 are as follows:
[0102] λ1=min(1-ε,max(ε,λ1-ε))
[0103] λ2=min(1-ε,max(ε,λ2+ε))
[0104] S33, multiply the adaptive coefficients λ1 and λ2 by the total adversarial control parameter λ adv ,as follows:
[0105] λ1=λ1λ adv
[0106] λ2=λ2λ adv .
[0107] In specific implementation, as a preferred embodiment of the present invention, step S4 specifically includes:
[0108] Use A2CTA to calculate the global loss L of the corresponding client total ,as follows:
[0109]
[0110] Among them, η, λ c , b They all represent input hyperparameters.
[0111] In specific implementation, as a preferred embodiment of the present invention, step S5 specifically includes:
[0112] Calculate the gradient of the local model through the global loss as follows:
[0113]
[0114] Among them, θ t represents the parameters of the global model; γ i represents the learning rate; Represents the calculated model update gradient.
[0115] In specific implementation, as a preferred embodiment of the present invention, step S6 specifically includes:
[0116] The calculated gradient difference Δ t+1 ,as follows:
[0117]
[0118] Example
[0119] Dataset
[0120] In this example, A2CTA is evaluated on three widely used benchmark datasets: CIFAR-10, CIFAR-100, and TinyImageNet. The CIFAR-10 dataset contains 50,000 training images and 10,000 test images, which are evenly distributed in 10 classes, and the size of each image is 32×32 pixels. The CIFAR-100 dataset is a subset of the Tiny Images dataset and consists of 60,000 32×32 color images. The 100 classes in CIFAR-100 are divided into 20 super classes. There are 600 images in each class. Each image comes with a "fine" label (the class it belongs to) and a "coarse" label (the super class it belongs to). Each class has 500 training images and 100 test images. The Tiny-ImageNet dataset contains 10,000 images of 200 classes (500 per class), reduced to 64×64 color images. Each class has 500 training images, 50 validation images, and 50 testing images.
[0121] Experimental setup
[0122] In federated learning, the number of clients N=20 is set, and the clients train local models for 2 epochs. In each communication round, the server randomly selects S=10 clients' local model update gradients to aggregate the global model update gradients. The FL training process is performed for epoch=200. The model architectures are LeNet and ResNet18 respectively. LeNet is used to train CIFAR-10, and CIFAT-100 and Tiny-ImageNet are used to train ResNet18. We use Dirichlet sampling to construct Non-iid. It has a parameter α to control the level of non-iid, and α is set to 0.5.
[0123] Experimental Evaluation
[0124] In this embodiment, the main task accuracy (Acc) and attack success rate (Asr) are used to measure the attack performance of the backdoor attack method. Asr represents the accuracy of being classified as a backdoor target label after using an input with a backdoor trigger. The method of the present invention needs to measure the Asr of multiple triggers. Therefore, Asr in the present invention represents the use of a composite trigger, and AsrA represents the use of a trigger δ A , AsrB indicates the use of trigger δ B .
[0125] Evaluation results
[0126] The attack performance (without defense) under different data sets varies with the iteration of communication as follows: Figure 3 The performance of different datasets and defense methods is shown in Table 1.
[0127] Table 1 Defense performance under different datasets and defense methods
[0128]
[0129] like Figure 4 As shown, this embodiment also measures the changes in the number of communication iterations under different defense methods under the cifar10 dataset; in the attack method of the present invention, the trigger can be hidden in the trigger of other backdoor tasks in the multi-backdoor attack, and the trigger of the attack method proposed by the present invention is obtained by combining the triggers of other backdoor tasks. In the attack of two backdoor tasks and the attack of three backdoor tasks, as shown in FIG. Figure 5 As shown, a high attack success rate can be achieved.
[0130] When the adversarial loss proposed by the method of the present invention is not used for attack, some triggers still have activation effects, which will enable the model to activate by focusing on some triggers when activating the backdoor task, such as Figure 6 In addition, the embodiment of the present invention also visualizes the activation map, as shown in Figure 7 , Figure 8 shown. Figure 7 is the activation map without adversarial adaptive loss, Figure 8 It is the activation diagram using the attack method of the present invention. It can be found that the backdoor task will be activated when and only when the two triggers appear at the same time.
[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A federated learning backdoor attack method based on A2CTA, characterized in that: Including: S1. The client receives the global model and trains and uploads the local model. S2. Optimize the local model according to the original label and the target label. Samples with partial triggers use the original label, and samples with composite triggers use the target label to calculate different cross-entropy losses. S3. Adjust the sample losses of different triggers through an adaptive algorithm to optimize the gradient distance. S4. Use A2CTA to calculate the global loss corresponding to the client. S5. Calculate the gradient of the local model through the global loss and update the local model. S6. Calculate the gradient difference and upload the gradient difference to the server after the local training is completed.
2. According to claim 1, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S1 specifically includes: S11. In the t-th round of communication, the server calls the current global model and distributes it to each client. S12. After receiving the global model, the client uses the local data to train the model and obtains the local model completed in this round of training.
3. According to claim 2, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S12 specifically includes: S121. For each local update of the malicious client, in the local dataset D i Divide k batches for training, denoted as B k ; S122. Add triggers to the data in the batch according to the poisoning rate p to obtain poisonous data with triggers, denoted as as follows:
4. According to claim 1, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S2 includes: in each iteration batch In the above example, four losses are calculated, including the clean main task loss L clean , the loss of backdoor malicious tasks L backdoor , in order to offset some triggers δ A Contribution to adversarial learning loss L advA and to offset part of the trigger δ B Contribution to adversarial learning loss L advB , specifically including: S21. Calculate the clean main task loss L clean ,as follows: Among them, x i represents the i-th sample; f θ Represents the output of the neural network; x represents the sample with iteration; y represents the category to which the sample belongs; S22. Calculate the loss L of the backdoor malicious task backdoor ,as follows: in, Indicates a compound trigger δ AB Input; Indicates the type of backdoor attack; S23, calculate to offset part of the trigger δ A Contribution to adversarial learning loss L advA ,as follows: S24, calculate to offset part of the trigger δ A Contribution to adversarial learning loss L advB ,as follows:
5. According to claim 1, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S3 specifically includes: S31. Calculate the attack success rate AsrA of trigger TriggerA and the attack success rate AsrB of TriggerB according to the local data set, and input λ adv =0.4, ε=0.05; S32. Calculate the adaptive coefficients λ1 and λ2 by judging the magnitudes of AsrA and AsrB, that is: If AsrA > AsrB, the calculation formulas for the adaptive coefficients λ1 and λ2 are as follows: λ1 = min(1 - ε, max(ε, λ1 + ε)) λ2 = min(1 - ε, max(ε, λ2 - ε)) If AsrA < AsrB, the calculation formulas for the adaptive coefficients λ1 and λ2 are as follows: λ1 = min(1 - ε, max(ε, λ1 - ε)) λ2 = min(1 - ε, max(ε, λ2 + ε)) S33, multiply the adaptive coefficients λ1 and λ2 by the total adversarial control parameter λ adv ,as follows: λ1=λ1λ adv λ2=λ2λ adv 。 6. According to claim 1, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S4 specifically includes: Use A2CTA to calculate the global loss L of the corresponding client total ,as follows: Among them, η, λ c , b They all represent input hyperparameters.
7. According to claim 1, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S5 specifically includes: Calculate the gradient of the local model through the global loss as follows: Among them, θ t represents the parameters of the global model; γ i represents the learning rate; Represents the calculated model update gradient.
8. According to claim 1, a federated learning backdoor attack method based on A2CTA is characterized in that: Step S6 specifically includes: The calculated gradient difference Δ t+1 ,as follows: