Gradient aggregation method for federal learning data poisoning attacks

Abstract

The invention discloses a gradient aggregation method for federated learning data poisoning attacks, and belongs to the technical field of Internet of Vehicles, block chains and federated learning. For a data security problem existing in federated learning in Internet of Vehicles data sharing, a local device filters and dynamically screens a sharing gradient in a block chain network, firstly, the degree of a label deviating from a mean value in the gradient is calculated, and gradient data is filtered according to a set threshold value; and then, the sum of the Euclidean distances between the gradients is calculated as the score of each residual gradient, and the gradients are dynamically screened according to the scores, so that data poisoning attacks represented by label flipping attacks and model poisoning attacks are resisted, and the robustness of the Internet of Vehicles data sharing system is improved.

Description

Technical Field

[0001] The present invention relates to the fields of Internet of Vehicles, blockchain and federated learning, and in particular to a gradient aggregation method for federated learning data poisoning attacks. Background Art

[0002] With the development of autonomous driving technology, the Internet of Vehicles has become a transformative solution for building a safe and efficient urban transportation system. In the Internet of Vehicles, vehicles coordinate with each other by sharing data such as location information and internal system status, which is crucial to improving the perception, decision-making and overall safety of the autonomous driving system. Moreover, data sharing can not only optimize the performance of individual vehicles, but also promote efficient collaboration and continuous improvement of the entire Internet of Vehicles. However, the high degree of openness of the Internet of Vehicles poses a major risk to data security, resulting in a reluctance to share data between vehicles, which seriously hinders the development of the Internet of Vehicles.

[0003] As a privacy-safe machine learning technology, federated learning can ensure that the original data of a vehicle does not leave the vehicle, and only the model is shared between vehicles, thereby protecting user privacy and reducing the need for data transmission, making it commonly used for data sharing in the Internet of Vehicles. However, at this stage, federated learning still faces many challenges. In terms of model security, the instability of the Internet of Vehicles exposes the system to the risk of data poisoning attacks represented by label flipping attacks and model poisoning attacks. These attacks can manipulate local model data or even the model itself, resulting in inaccurate aggregated global models. Attackers can manipulate the data of certain vehicles and inject incorrect road condition information, causing the global model to misjudge the condition of a certain road. In this way, other vehicles that rely on the model may make wrong driving decisions when driving, such as choosing the wrong driving path or misjudging road safety, leading to traffic accidents or congestion. Therefore, solving data security issues is crucial to promoting the development and application of the Internet of Vehicles. Summary of the invention

[0004] The present invention proposes a gradient aggregation method for federated learning data poisoning attacks, which aims to solve the problems raised in the above-mentioned background technology. By performing data filtering and dynamic screening processing on the gradients received from the blockchain network, potential label flipping attacks and model poisoning attacks can be detected and defended.

[0005] The technical solution adopted by this method includes the following steps:

[0006] Step 1: Establish a vehicle network data sharing model, which includes devices with communication and data collection capabilities such as vehicles and roadside units. The devices perform blockchain initialization and generate a genesis block. The devices obtain differential privacy gradients of target data.

[0007] Step 2: Gradient filtering: gradient filtering is performed based on the differential privacy gradient to remove abnormal gradients including data poisoning attacks such as label flipping attacks, and obtain a gradient list;

[0008] Step 3: Dynamic gradient screening: Based on the gradient list, calculate the Euclidean distance difference between gradients, and use the sum of the differences as the basis for scoring. Dynamically screen the gradients according to the preset threshold to remove abnormal gradients caused by model poisoning attacks.

[0009] Step 4: Gradient aggregation and verification, the leader node in the device performs gradient aggregation and broadcasting and generates blocks according to the verification results;

[0010] Step 5: Model synchronization and update. The device updates the local model by downloading new blocks and verifying the global gradient, and then repeats the training until the model converges or the maximum number of training rounds is reached.

[0011] Step 1 specifically includes the following:

[0012] Establish the Internet of Vehicles data sharing model mentioned above, so that the devices can communicate with each other and share messages. Before participating in data sharing, they must register with the trusted center. During registration, the device creates a pair of private keys and public keys, and generates a unique 256-bit identity based on this. The registration information includes the size of the device data set as well as the public key and identity. The public key and identity are broadcast over the network, enabling all devices in the network to recognize each other and communicate. The trusted center creates a genesis block (the first block in the blockchain) based on the training task, and distributes it to all devices through a secure link to perform model initialization. The genesis block mainly contains the following information: 1) Model initialization parameter w0; 2) pk used by the device for signing; 3) The size of the local data set of the device |D i |; 4) Random number seed seed0, each subsequent round will be based on the random seed seed of the previous round of training t-1 Generate seeds t , used to ensure the randomness when electing the leader node during the consensus phase.

[0013] The device trains the model using a random descent method. The device can calculate the local gradient through the global model parameters in the blockchain, add noise disturbance to the local gradient, and obtain the differential privacy gradient of the target data, which specifically includes the following:

[0014] In round t, the local device passes the global model parameter w in the blockchain i (t-1), the local gradient is calculated, that is,

[0015] In order to protect the data privacy of nodes, Gaussian noise is added to perturb the gradient before exchanging the shared gradient, that is,

[0016]

[0017]

[0018] Among them, N(0,σ 2 I) means the mean is 0 and the variance is σ 2 Gaussian noise. ε is the differential privacy budget, δ is the probability of allowing strict violation of differential privacy, which is generally a small constant.

[0019] The device will perturb the gradient g k (t) is broadcast to the blockchain network. The device and verifier receive the broadcasted gradient and generate a gradient list G = {g1(t),…,g k (t)}, and then filter the received gradient data to remove abnormal gradients including data poisoning attacks such as label flipping attacks, and obtain the gradient list G'={g1(t),…,g k (t)}, step 2 specifically includes the following:

[0020] Label extraction, the device extracts from the gradient list G = {g1(t), ..., g k (t)} to extract all labels and form a label array.

[0021] Tag distribution statistics, calculate the distribution of tags, and determine whether the number of tags is sufficient for filtering. If the number of tags is insufficient (less than 2), return the original data directly.

[0022] Calculate the statistics and calculate the mean μ and standard deviation σ of the labels. The formula is as follows:

[0023]

[0024]

[0025] Among them, x i represents the value of the i-th label, and n represents the total number of labels.

[0026] Deviation calculation, calculate the degree of deviation of each label relative to the mean, recorded as Z-score.

[0027]

[0028] Among them, Z i is the Z-score of the ith label, indicating the degree to which the label deviates from the mean.

[0029] Filter abnormal labels, according to the set threshold, retain the gradient vectors corresponding to labels whose Z-score does not exceed the threshold. Labels whose Z-score exceeds the threshold are regarded as outliers, and their corresponding gradients are filtered out.

[0030] Boundary condition processing, if all tags are filtered, relax the filtering conditions and return the original data to avoid losing all data.

[0031] Return the filtered data, return the filtered gradient list G' = {g1(t), ..., g k (t)}, and gradient screening was performed.

[0032] Gradient dynamic screening, based on the gradient list G' = {g1(t), ..., g k (t)}, calculate the Euclidean distance difference between gradients, and use the sum of the differences as the basis for scoring. Dynamically filter gradients according to the preset threshold to remove abnormal gradients caused by model poisoning attacks. Step 3 specifically includes the following:

[0033] For the received gradient list G'={g1(t),g2(t),...g n (t)}, perform gradient averaging, and obtain

[0034]

[0035] G n (t) and For comparison, if the gradient g n (t) Satisfaction Then include it in the filtered gradient list Then, calculate Medium (g i (t),g j (t)) Gradient vector g i The sum of the squared distances between (t) and the remaining vector O i,j , sort these distances, and return the sum of the smallest k distances as g i (t) score:

[0036] O i,j =||g i (t)-g j (t)|| 2

[0037]

[0038] Among them, O i,j The smaller the value, the closer the gradients between participants i and j are. i,jThe larger the value, the more dissimilar the gradients between participants i and j are. i Express the complaint List i (t) The sum of the distances to the previous j-1 is g i (t) score. SC i Sort from low to high. If kj < 1-th, select the first th vector and perform weighted average to get the global gradient. Where k = m + n, m is the total number of vehicles in the network, n is the total number of roadside units, D v represents the sum of the sizes of m vehicle datasets, D r Represents the sum of the sizes of n roadside unit datasets, with the dataset size as the weight value w i , j represents the total number of vehicles in the weighted average gradient aggregation, j<m:

[0039]

[0040]

[0041]

[0042]

[0043]

[0044] Among them, when k'≤th, θ=1 / k', otherwise θ=1 / th

[0045] Step 4 specifically includes the following:

[0046] After receiving the data, the verifier first verifies the legitimacy of the signature to prevent attackers from tampering with the data. If the signature is legitimate, the reliability of the gradient is further verified and whether there is a malicious update. Based on the random seed, a leader node is selected from the verifier, and the remaining nodes form a verification committee. The leader node is responsible for calculating the global gradient and generating a new block; the verification committee verifies and votes on the legitimacy of the new block, and the verified block will be broadcast and synchronized to the blockchain ledger.

[0047] Participants will aggregate their own gradient g k (t) Gradient aggregated and broadcasted by the leader node Compare them, if they are consistent, send g to the leader node vote =1, otherwise send g vote = 0. When the leader node receives more than 1 / 3 of the positive votes, it packages the gradient out of the block. The participants then update their own gradients to enter a new round of training.

[0048] Step 5 specifically includes the following:

[0049] Each participant conducts blockchain consensus based on the local models sent by other participants and calculates the model parameters for the next round to update to the latest model, i.e.

[0050]

[0051] Among them, γ is the learning rate, g k (t) is the local privacy gradient of participant k in round t.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] The method of the present invention first extracts all labels from the gradient list for the gradient received from the blockchain network, forms a label array and performs label distribution statistics. Then, the degree of label deviation from the mean is calculated. i , according to the set threshold, the gradient data is filtered to effectively resist the label flipping attack in data sharing. Finally, the sum of the Euclidean distances between the gradients is calculated as the score of the gradient, and the gradients are dynamically screened according to the score to detect and defend against potential model poisoning attacks, improve the robustness and security of the system, and thus solve the data security problem in the data sharing of the Internet of Vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a step diagram of the present invention.

[0055] Figure 2 This is a diagram of the vehicle networking data sharing model of the present invention. DETAILED DESCRIPTION

[0056] In order to clarify the technical problems, technical solutions, implementation processes and performance demonstrations, the present invention is further described in detail below in conjunction with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings do not have to be drawn to scale unless otherwise specified.

[0057] This embodiment proposes a gradient aggregation method for federated learning data poisoning attack, including the following steps:

[0058] Step 1: Establishing a vehicle networking data sharing model, the vehicle networking data sharing model includes devices with communication and data collection capabilities such as vehicles and roadside units, the devices perform blockchain initialization and generate a genesis block, and the devices obtain differential privacy gradients of target data;

[0059] Step 2: Gradient filtering: gradient filtering is performed based on the differential privacy gradient to remove abnormal gradients including data poisoning attacks such as label flipping attacks, and obtain a gradient list;

[0060] Step 3: Dynamic gradient screening: Based on the gradient list, calculate the Euclidean distance difference between gradients, and use the sum of the differences as the basis for scoring. Dynamically screen the gradients according to the preset threshold to remove abnormal gradients caused by model poisoning attacks.

[0061] Step 4: Gradient aggregation and verification, the leader node in the device performs gradient aggregation and broadcasting and generates blocks according to the verification results;

[0062] Step 5: Model synchronization and update. The device updates the local model by downloading new blocks and verifying the global gradient, and then repeats the training until the model converges or the maximum number of training rounds is reached.

[0063] Step 1 specifically includes the following:

[0064] Establish the Internet of Vehicles data sharing model mentioned above, so that the devices can communicate with each other and share messages. Before participating in data sharing, they must register with the trusted center. During registration, the device creates a pair of private keys and public keys, and generates a unique 256-bit identity based on this. The registration information includes the size of the device data set as well as the public key and identity. The public key and identity are broadcast over the network, enabling all devices in the network to recognize each other and communicate. The trusted center creates a genesis block (the first block in the blockchain) based on the training task, and distributes it to all devices through a secure link to perform model initialization. The genesis block mainly contains the following information: 1) Model initialization parameter w0; 2) pk used by the device for signing; 3) The size of the local data set of the device |D i |; 4) Random number seed seed0, each subsequent round will be based on the random seed seed of the previous round of training t-1 Generate seeds t , used to ensure the randomness when electing the leader node during the consensus phase.

[0065] The device trains the model using a random descent method. The device can calculate the local gradient through the global model parameters in the blockchain, add noise disturbance to the local gradient, and obtain the differential privacy gradient of the target data, which specifically includes the following:

[0066] In round t, the local device passes the global model parameter w in the blockchain i (t-1), the local gradient is calculated, that is,

[0067] In order to protect the data privacy of nodes, Gaussian noise is added to perturb the gradient before exchanging the shared gradient, that is,

[0068]

[0069]

[0070] Among them, N(0,σ 2 I) means the mean is 0 and the variance is σ 2 Gaussian noise. ε is the differential privacy budget, δ is the probability of allowing strict violation of differential privacy, which is generally a small constant.

[0071] The device will perturb the gradient g k (t) is broadcast to the blockchain network. The device and verifier receive the broadcasted gradient and generate a gradient list G = {g1(t),...,g k (t)}, and then filter the received gradient data to remove abnormal gradients including data poisoning attacks such as label flipping attacks, and obtain the gradient list G'={g1(t),...,g k (t)}, step 2 specifically includes the following:

[0072] Label extraction, the device extracts from the gradient list G = {g1(t), ..., g k (t)} to extract all labels and form a label array.

[0073] Tag distribution statistics, calculate the distribution of tags, and determine whether the number of tags is sufficient for filtering. If the number of tags is insufficient (less than 2), return the original data directly.

[0074] Calculate the statistics and calculate the mean μ and standard deviation σ of the labels. The formula is as follows:

[0075]

[0076]

[0077] Among them, x i represents the value of the i-th label, and n represents the total number of labels.

[0078] Deviation calculation, calculate the degree of deviation of each label relative to the mean, recorded as Z-score.

[0079]

[0080] Among them, Z i is the Z-score of the ith label, indicating the degree to which the label deviates from the mean.

[0081] Filter abnormal labels, according to the set threshold, retain the gradient vectors corresponding to labels whose Z-score does not exceed the threshold. Labels whose Z-score exceeds the threshold are regarded as outliers, and their corresponding gradients are filtered out.

[0082] Boundary condition processing, if all tags are filtered, relax the filtering conditions and return the original data to avoid losing all data.

[0083] Return the filtered data, return the filtered gradient list G' = {g1(t),...,g k (t)}, and gradient screening was performed.

[0084] Gradient dynamic screening, based on the gradient list G' = {g1(t), ..., g k (t)}, calculate the Euclidean distance difference between gradients, and use the sum of the differences as the basis for scoring. Dynamically filter gradients according to the preset threshold to remove abnormal gradients caused by model poisoning attacks. Step 3 specifically includes the following:

[0085] For the received gradient list G' = {g1(t), g2(t), ... g n (t)}, perform gradient averaging, and obtain

[0086]

[0087] G n (t) and For comparison, if the gradient g n (t) Satisfaction Then include it in the filtered gradient list Then, calculate Medium (g i (t),g j (t)) Gradient vector g i The sum of the squared distances between (t) and the remaining vector O i,j , sort these distances, and return the sum of the smallest k distances as g i (t) score:

[0088] O i,j =||g i (t)-g j (t)|| 2

[0089]

[0090] Among them, O i,j The smaller the value, the closer the gradients between participants i and j are. i,jThe larger the value, the more dissimilar the gradients between participants i and j are. i Express the complaint List i (t) The sum of the distances to the previous j-1 is g i (t) score. SC i Sort from low to high. If kj < 1-th, select the first th vector and perform weighted average to get the global gradient. Where k = m + n, m is the total number of vehicles in the network, n is the total number of roadside units, D v represents the sum of the sizes of m vehicle datasets, D r Represents the sum of the sizes of n roadside unit datasets, with the dataset size as the weight value w i , j represents the total number of vehicles in the weighted average gradient aggregation, j<m:

[0091]

[0092]

[0093]

[0094]

[0095]

[0096] Among them, when k'≤th, θ=1 / k', otherwise θ=1 / th

[0097] Step 4 specifically includes the following:

[0098] After receiving the data, the verifier first verifies the legitimacy of the signature to prevent attackers from tampering with the data. If the signature is legitimate, the reliability of the gradient is further verified and whether there is a malicious update. Based on the random seed, a leader node is selected from the verifier, and the remaining nodes form a verification committee. The leader node is responsible for calculating the global gradient and generating a new block; the verification committee verifies and votes on the legitimacy of the new block, and the verified block will be broadcast and synchronized to the blockchain ledger.

[0099] Participants will aggregate their own gradient g k (t) Gradient aggregated and broadcasted by the leader node Compare them, if they are consistent, send g to the leader node vote =1, otherwise send g vote = 0. When the leader node receives more than 1 / 3 of the positive votes, it packages the gradient out of the block. The participants then update their own gradients to enter a new round of training.

[0100] Step 5 specifically includes the following:

[0101] Each participant conducts blockchain consensus based on the local models sent by other participants and calculates the model parameters for the next round to update to the latest model, i.e.

[0102]

[0103] Among them, γ is the learning rate, g k (t) is the local privacy gradient of participant k in round t.

[0104] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A gradient aggregation method for federated learning data poisoning attack, characterized in that: The method comprises the following steps: Step 1: Obtain the differential privacy gradient of the target data; Step 2: Gradient filtering: gradient filtering is performed based on the differential privacy gradient to remove abnormal gradients including data poisoning attacks such as label flipping attacks, and obtain a gradient list; Step 3: Dynamic gradient screening: Based on the gradient list, calculate the Euclidean distance difference between gradients, and use the sum of the differences as the basis for scoring. Dynamically screen the gradients according to the preset threshold to remove abnormal gradients caused by model poisoning attacks.

2. The gradient aggregation method for federated learning data poisoning attack according to claim 1, characterized in that: The random descent method is used to train the model according to the target data, and Gaussian noise is added before sharing the local gradient to achieve differential privacy. The local gradient is calculated based on the global parameters of the blockchain, and the perturbed gradient is broadcast to the blockchain network, which is verified by other nodes and the local gradient list is updated.

3. The gradient aggregation method for federated learning data poisoning attack according to claim 1, characterized in that: Gradient filtering is performed based on the differential privacy gradient to remove abnormal gradients including data poisoning attacks such as label flipping attacks to obtain a gradient list; all labels are extracted from the gradient list to form a label array, the distribution of the labels is calculated, and it is determined whether the number of labels is sufficient for filtering. If the number of labels is insufficient (less than 2), the original data is returned; according to the mean and standard deviation of the labels, the degree of deviation of the labels relative to the mean is obtained; the gradient vectors corresponding to the labels whose deviation does not exceed the preset threshold are retained, and the labels whose deviation exceeds the threshold are regarded as abnormal, and the gradients are filtered to finally obtain a filtered gradient list.

4. The gradient aggregation method for federated learning data poisoning attack according to claim 1, characterized in that: Based on the filtered gradient list, the Euclidean distance differences between the gradients are calculated, and the sum of the differences is used as the gradient score. The gradients are dynamically screened according to a preset threshold to remove abnormal gradients caused by model poisoning attacks; the average value of the filtered gradient list is calculated as the threshold for dynamic screening; the Euclidean distance differences between each gradient in the filtered gradient list and other gradients are calculated, and the sum of the differences is used as the score of the gradient; Sort the gradient scores and select the gradients with scores greater than the threshold for weighted average gradient aggregation.

5. The gradient aggregation method for federated learning data poisoning attack as claimed in claim 4, characterized in that: The weighted average gradient aggregation uses the proportion of the data set size of each device participating in the federated learning to the total data set size as a weight value.

Images