Method for protecting privacy and preventing backdoor attack in federated learning

Abstract

The invention discloses a method for protecting privacy and preventing backdoor attack in federal learning. Specifically, the method comprises the following steps: 1) a client negotiates a key with a server; 2) the client uses private data to train a generator and encrypts and uploads the data to a server; (3) the client adds disturbance to the private data set to obtain a smooth data set, and a classifier is trained on the smooth data set; 4) the server receives the uploaded generator, decrypts and aggregates the generator to obtain a global generator, and the global generator generates a pseudo data set; 5) after the client receives the pseudo data set, inputting samples in the pseudo data set into the classifier to obtain a corresponding prediction result, and sending a final result to the server; 6) voting the received classification result by the server, and correcting the label of the pseudo data set, and 7) training the global model by using the modified training data.The scheme has robustness to backdoor attack while keeping the privacy of the model.

Description

Technical Field

[0001] The present invention proposes a method for protecting privacy and preventing backdoor attacks in federated learning, which belongs to the technical field of attack prevention. Background Art

[0002] With the rapid growth of data and the rapid development of computer technology, machine learning has become a key technology that can effectively solve complex problems and obtain valuable information. However, traditional centralized learning methods require centralized storage and processing of data, which increases the risk of data leakage and abuse, as well as privacy issues, especially for sensitive information such as medical and financial data. To solve these problems, federated learning proposes a new approach.

[0003] The advantage of federated learning over traditional centralized learning is that the global model can be jointly trained across multiple decentralized devices without sharing data samples. This approach ensures that the global model can learn the characteristics of all user data, further improving the model performance and generalization ability of machine learning, while effectively reducing the risk of privacy leakage. Federated learning is used in many fields, including text prediction, healthcare data analysis, and financial services. Although federated learning has significant advantages over traditional centralized learning in terms of privacy protection, many studies have shown that federated learning faces a series of security and privacy challenges in practical deployment. Summary of the invention

[0004] The present invention provides a method for protecting privacy and preventing backdoor attacks in federated learning, so as to solve the problems of privacy leakage and backdoor attacks in the process of federated learning. The present invention proposes a provable federated learning framework based on random smoothing and double trapdoor homomorphic encryption (CPFL). It ensures certifiable robustness against backdoor attacks while protecting data privacy during training. The technical scheme adopted is as follows.

[0005] Before starting the interaction, a key center is required. According to the double trapdoor homomorphic encryption protocol, the key center generates public and private keys (pk, sk). After the key is split (sk), and , and distribute them to the server and client respectively.

[0006] The client first uses the local private dataset to train the generator according to the following formula:

[0007] in (z) represents the input noise variable, represents a generator, Represents the parameters of the generator. represents the discriminator, Represents the parameters of the discriminator.

[0008] Before client k uploads the parameters of the local generator, Encrypt using public key pk to generate , upon receiving After that, k ∈ {1, 2,..., K}, the server performs the secure summation process:

[0009] Server uses private key exist Perform partial decryption on , and ( , ) is sent to the client, and the client uses the private key Partial decryption ,get , the client obtains the decryption through the whole decryption process , the client needs to Upload to the server, the server receives And get the final aggregation result:

[0010] in represents the global generator, k represents the number of clients, Represents the generator uploaded by the kth server; the server uses the global generator to generate pseudo data and sends the pseudo data back to the client.

[0011] The server uses the global generator to generate pseudo data and sends the pseudo data back to the client.

[0012] The client obtains a smoothed data set by adding disturbances to the original data set, and trains a smoothed classifier on the smoothed data set. The smoothed classifier training is obtained by the following formula:

[0013] in is the learning rate, is the batch size, The cross entropy loss for model training.

[0014] After receiving the globally released fake data set, the client inputs the sample x in the fake data set into the smoothing classifier, obtains the corresponding prediction result, and sends the final result to the server. The prediction result is obtained by the following formula:

[0015] in represents the random noise stored by the client, Represents a smoothing classifier The weight of .

[0016] The server votes on the received classification results. For each sample, it traverses all classifiers and records the number of predictions for each category. Find the two categories with the most predictions and record them as , In order to obtain the local smoothing classifier for generating samples We first compute the empirical majority vote as an unbiased estimate of the classification. , The number of predictions is recorded as , The specific formula is as follows:

[0017] in Represents the noise variable sampled by the client. (y|x, ): represents the given input x and the generated sample When , the output is the probability estimate of y. represents the kth local smoothing classifier. + :Indicates that in the test sample Add noise After the input. {k: ( + , )=y}: represents the set of all k values ​​that make the output of the classifier equal to y. N is the number of classifiers.

[0018] The specific process is as follows: Add noise: For each test sample , adding different noises . Classifier evaluation: Each noise-processed sample is predicted by multiple local classifiers. Majority voting: Count the number of times all classifiers predict y and get the proportion of predictions y. Unbiased estimation: Take the proportion as an unbiased estimate of the true category of the sample.

[0019] In addition, given the error tolerance of α, , As a parameter, a total of N samples, calculate the corresponding confidence space and , the specific formula is as follows: = -z

[0020] where Z is the critical value of the standard normal distribution, associated with the confidence level (1−α). Computation and same.

[0021] get and Afterwards, according to and To calculate the corresponding robust radius, the specific formula is as follows:

[0022] Where σ represents the standard deviation of the noise. γ is a parameter used to adjust the scale.

[0023] is the inverse normal cumulative distribution function, which is used to convert probability values ​​to corresponding normally distributed values. and Represents the confidence boundary of the two highest prediction categories. In the present invention, the robust radius R is used to evaluate the robustness of the model to backdoor attacks. When R exceeds the set threshold δ, it is considered that there is no impact of backdoor attacks.

[0024] The data set that is not affected by the backdoor attack is screened out according to the robust radius, and the server uses this data set as a training set to train the global model. The formula is as follows:

[0025] here, represents the learning rate, represents the batch size, Represents the training cross entropy loss of the model.

[0026] Compared with the prior art, the advantages of the present invention are: deploying GAN on the local client and aggregating the generator on the server to protect local privacy and improve the generalization ability of the global model. In order to mitigate privacy leakage during communication, we use double trapdoor homomorphic encryption to combat potential privacy attacks. At the same time, a robust radius is introduced. As long as the backdoor trigger size is within the authentication radius, the aggregated local model output is consistent with the output of the clean model. This ensures the robustness of the global model against backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 The following is the overall flow chart.

[0029] Figure 2 This is the client flow chart.

[0030] Figure 3 Client server interaction diagram. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0032] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

[0033] First, some concepts in this specification are introduced.

[0034] Robustness of Federated Learning,Due to the decentralized nature of federated learning, it is difficult for the central server to detect the,trustworthiness of each participant, and therefore it is vulnerable to various malicious,attacks such as backdoor attacks.,In order to eliminate the influence of malicious attackers on the global model during,the training process, various robustness methods have been proposed.

[0035] Privacy protection of federated learning: In addition to security attacks such as backdoor attacks, federated learning is also affected by a series of privacy threats. In traditional federated learning, although the client's data remains in the local area, many studies have shown that attackers can infer private information through the model parameters uploaded by the client, which may lead to data leakage.

[0036] Scenario 1: Multiple hospitals collaborate to train a machine learning model to predict the risk of a certain disease. Each hospital has its own patient data and does not want to share it with other hospitals to protect patient privacy. In this scenario, we regard the hospital as a client in federated learning, uploading data to the server to train the model.

[0037] First, data preparation is carried out, and each hospital locally saves patients' medical records and diagnosis results.

[0038] In order to protect the security of data upload, the client and the server need a key center. After the double trapdoor homomorphic encryption protocol KeyGen(K), KC generates the public key and private key (PK, SK). After obtaining KeySplit(sk), we will get and Afterwards, they are distributed to the server and client respectively.

[0039] The operation process of each client is as follows Figure 2 As shown in Figure 1, the client first uses its own local private data to train a generator. The purpose of training the generator is to protect its own private data. After each client has trained its local generator, it encrypts it with the key issued by the key center and then uploads it to the server. Before the client k uploads the parameters of the local generator, Encrypt using public key pk to generate Upon receiving After that, k ∈ {1,2,..., K}, the server performs the secure summation process:

[0040] Server uses private key exist Perform partial decryption on , and Sent to the client. The client uses the private key Partial decryption ,get The client obtains the decryption through the whole decryption process. The client needs to Upload to the server, the server receives And obtain the final aggregation result.

[0041] Through this design, the present invention ensures that data can be completely decrypted only through the joint cooperation of the server and the client, thereby enhancing data security and privacy protection. The server aggregates the generators uploaded by each hospital to generate a global generator. The global generator is used to generate a pseudo data set for training the global model.

[0042] The client adds disturbances to the original data set to obtain a smoothed data set, and trains a local classifier based on the smoothed data set. After the classifier is trained, the fake data sent by the server is predicted by the classifier, and the predicted results are sent to the server. Assume that there are some malicious clients among these clients, and the malicious user adds a backdoor to the data they upload. If the server uses this data directly, the model that is finally trained will be one with a backdoor. Malicious users can attack the model through triggers based on the pre-set backdoor.

[0043] In order to prevent malicious clients from uploading poisoned data, the present invention designs a method to verify whether the data is poisoned based on the robust radius. The server votes on the received classification results. For each sample, all classifiers are traversed and the number of predictions for each category is recorded. The two categories with the most predictions are found and recorded as , In order to obtain the local smoothing classifier for generating samples We first compute the empirical majority vote as an unbiased estimate of the classification. , The number of predictions is recorded as , The specific formula is as follows:

[0044] First, add noise to each test sample. , adding different noises . Secondly, evaluate the classifier: each sample after noise processing is predicted by multiple local classifiers. Then perform majority voting: count the number of times all classifiers predict y, and get the proportion of predictions y. Finally, make an unbiased estimate: use the proportion as an unbiased estimate of the true category of the sample.

[0045] In calculating , After that, the server will calculate the confidence space based on the set fault tolerance rate. and , the specific formula is as follows: = -z

[0046] In the confidence space and After that, the server will and To calculate the robust radius, the specific formula is as follows:

[0047] If R exceeds the set threshold δ, it is considered that there is no backdoor attack. The server will add the data to the data set. On the contrary, if R is less than the set threshold δ, the server will determine that the data may be poisoned and discard it.

[0048] Finally, when all samples have gone through the above process, the server will obtain a data set D, and finally, the server will use this data set to train the final model.

[0049] Scenario 2: Federated learning in financial services.

[0050] Several banks want to work together to develop a credit scoring model to improve their ability to assess the credit risk of potential customers. Directly sharing customer data would bring privacy and compliance risks.

[0051] The problems faced in this federated learning scenario include: privacy requirements, customer financial data is very sensitive and cannot be shared. Security threats, the need to prevent malicious banks from uploading model updates with backdoors.

[0052] In this federated learning environment, the specific steps are as follows.

[0053] Step 1: Data preparation: Each bank locally stores customers’ transaction records, loan information, and historical credit scores.

[0054] Step 2: Local model training: Each bank generates fake data locally using GAN to train local generators and discriminators. The local data is processed using a smoothing classifier to enhance the robustness of the model.

[0055] Step 3: Model update encryption, after local training is completed, the bank encrypts the updated model parameters using two-trapdoor homomorphic encryption and uploads the encrypted parameters to the central server.

[0056] Step 4: Global model aggregation: The server aggregates the generators uploaded by each bank to generate a global generator. The global generator is used to generate a pseudo dataset for training the global credit scoring model.

[0057] Step 5: Authentication and attack protection: The server votes on the model results uploaded by each bank, calculates the robustness radius, and ensures the model's ability to protect against backdoor attacks.

[0058] If the robustness radius is larger than the size of the backdoor trigger, the model is considered safe.

[0059] Step 6: Model deployment: the certified global model is sent to each bank for local credit scoring.

[0060] The model trained according to the above steps has the following effects.

[0061] Privacy protection: Customer data is always stored locally, and homomorphic encryption is used to protect data during transmission.

[0062] Attack protection: Robustness certification ensures that the global model remains accurate even if there are a large number of participants with malicious updates.

[0063] Improved performance: Banks improved the accuracy and reliability of credit scores by sharing model updates.

[0064] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A method for protecting privacy and preventing backdoor attacks in federated learning, characterized in that: Applied to the client and server, before the client and server interact, a key center is required. According to the double trapdoor homomorphic encryption protocol, the key center generates the public key and private key (pk, sk). After the key is split (sk), and , and distribute them to the server and client respectively; The client trains the generator based on the local data set and encrypts the generator and sends it to the server; The client obtains a smoothed dataset by adding noise to the original dataset and training a smoothed classifier on the smoothed dataset; After the client receives the globally published fake dataset, it inputs the samples in the fake dataset into the smoothing classifier to obtain the corresponding prediction results, and sends the final results to the server; The server receives the generators uploaded by the client and aggregates them to obtain the global generator. The global generator generates a pseudo dataset; Authentication reasoning: The server votes on the received classification results, corrects the labels of the pseudo dataset, and calculates the robust radius of the corresponding samples; Training of the global model: The global model is trained using the modified training data.

2. According to claim 1, the client first trains the generator using a local private data set according to the following formula: in (z) represents the input noise variable, represents a generator, Represents the parameters of the generator. represents the discriminator, represents the parameters of the discriminator before the client k uploads the parameters of the local generator, Encrypt using public key pk to generate , upon receiving After that, k ∈ {1, 2,..., K}, the server performs the secure summation process: Server uses private key exist Perform partial decryption on , and ( , ) is sent to the client, and the client uses the private key Partial decryption ,get , the client obtains the decryption through the whole decryption process , the client needs to Upload to the server, the server receives And get the final aggregation result: in represents the global generator, k represents the number of clients, Represents the generator uploaded by the kth server; the server uses the global generator to generate pseudo data and sends the pseudo data back to the client.

3. According to claim 1 and claim 2, the client obtains a smoothed data set by adding disturbance to the original data set, and trains a smoothed classifier on the smoothed data set, and the smoothed classifier training is obtained by the following formula: in is the learning rate, is the batch size, The cross entropy loss for model training; After receiving the globally released fake data set, the client inputs the sample x in the fake data set into the smoothing classifier, obtains the corresponding prediction result, and sends the final result to the server. The prediction formula is as follows: in represents the random noise stored by the client, Represents a smoothing classifier The weight of .

4. According to claim 1 and claim 3, the server votes on the received classification results. For each sample, it traverses all classifiers, records the number of predictions for each category, and finds the two categories with the most predictions, which are recorded as , , in order to obtain the local smoothing classifier to generate samples We first compute the empirical majority vote as an unbiased estimate of the classification, , The number of predictions is recorded as , , the specific formula is as follows: in represents the noise variable sampled by the client, (y|x, ): represents the given input x and the generated sample When , the output is the probability estimate of y, represents the kth local smoothing classifier. + :Indicates that in the test sample Add noise After the input, {k: ( + , )=y}: represents the set of all k values ​​that make the output of the classifier equal to y. N is the number of classifiers; The specific process is as follows: Add noise: For each test sample , adding different noises ; Classifier evaluation: each noise-processed sample is predicted by multiple local classifiers; majority voting: count the number of predictions of y in all classifiers, and get the proportion of predictions of y; unbiased estimation: take the proportion as an unbiased estimate of the true category of the sample; in addition, given the error tolerance of α, , As a parameter, a total of N samples, calculate the corresponding confidence space and , the specific formula is as follows: where Z is the critical value of the standard normal distribution, associated with the confidence level (1−α). Computation and same.

5. According to claim 4, we have and , then according to and To calculate the corresponding robust radius, the specific formula is as follows: Where σ represents the standard deviation of the noise, γ is a parameter used to adjust the scale, is the inverse normal cumulative distribution function, which is used to convert probability values ​​into corresponding normal distribution values; and Represents the confidence boundary of the two highest prediction categories; in the present invention, the robust radius R is used to evaluate the robustness of the model to backdoor attacks; when R exceeds the set threshold δ, it is considered that it is not affected by the backdoor attack.

6. According to claim 1 and claim 5, a data set that is not affected by the backdoor attack is screened out according to the robust radius, and the server uses the data set as a training set to train the global model. The formula is as follows: here, represents the learning rate, represents the batch size, Represents the training cross entropy loss of the model.

Images