Backdoor attack method for personalized federal learning based on feature aggregation

Abstract

The invention discloses a backdoor attack method for personalized federal learning based on feature aggregation, and belongs to the technical field of backdoor attack. The size of the designed back door trigger is equal to that of an input image, and each pixel value of the trigger is constrained. According to the design, detection based on image tampering defense can be effectively avoided, so that the backdoor trigger is more difficult to find visually. Secondly, training a backdoor trigger and a backdoor model by adopting an intra-class attack strategy; in the process, a backdoor trigger is trained by using a feature distribution alignment method, so that backdoor data generated by a malicious client is as close as possible to data distribution of other normal clients, and a federated defense mechanism based on model parameter clustering detection is avoided. And finally, all malicious clients cooperatively train a backdoor trigger. Feature aggregation of the backdoor trigger is carried out between malicious clients, data advantages mastered by an attacker are fully utilized, the generalization ability of the backdoor trigger is improved, and the backdoor trigger can still keep effective under wide input conditions.

Description

Technical Field

[0001] The present invention relates to the technical field of backdoor attack, and in particular to a backdoor attack method of personalized federated learning based on feature aggregation. Background Art

[0002] At present, the realization of artificial intelligence technology often relies on the training of deep learning models by collecting data, such as training large models such as ChatGPT. However, in the process of data collection, it is inevitable that the personal privacy of customers will be leaked, and even a serious crisis of trust in artificial intelligence will be triggered. In addition, with the widespread application of machine learning technology in key security fields such as autonomous driving, finance, and medical care, the security requirements of the model are becoming more stringent. Therefore, the security issues of artificial intelligence models based on deep learning have attracted widespread attention from scholars at home and abroad.

[0003] Federated Learning (FL) was proposed to address the risks that may arise when using cross-user and cross-organizational data to train deep learning models. Federated learning allows multiple clients to jointly train neural network models under the coordination of a central server, while ensuring that customer data does not leave the local area. Specifically, each client uses local private data to train a local model, and then uploads the trained model parameters to the central server for parameter aggregation. The central server distributes the aggregated model parameters to each client again and continues local training. This process is repeated until the model's prediction loss on the test data converges. This method not only protects the customer's data privacy, but also enables the global model to learn more data features, thereby promoting the rapid development of federated learning in data privacy-sensitive fields.

[0004] Personalized Federated Learning (pFL) provides a personalized model for each participating client while protecting customer privacy, rather than requiring all clients to use a common global model. An effective solution is to divide the model into a global / shared part (Shared Module, usually a feature extraction module) and a local / private part (Private Module, usually a classifier). The global part is shared among all clients, while the local part is personalized and trained based on user data. This personalized solution not only solves the problem of non-independent and identically distributed (Non-IID) data between clients, but also enhances the independence of models between clients, thereby further improving the degree of privacy protection.

[0005] However, since the central server cannot supervise the training process of the client's local model, this may cause malicious clients (Malicious Client) to disguise themselves as normal clients and embed backdoor features (Backdoor Feature) into the local model, and then upload it to the central server for aggregation. As a result, when the federated learning model is trained, all clients may get a global model containing a backdoor. This type of attack is called a backdoor attack (BackdoorAttack). The attacker embeds the backdoor trigger into the local training set of the malicious client to generate a poisoned model with a backdoor. When this type of model encounters malicious input with an embedded backdoor trigger, it will output the specified category, while normal input can be correctly classified. Therefore, backdoor attacks are extremely concealed, and studying them is crucial to improving the security of federated learning.

[0006] At present, the research on backdoor attacks in federated learning mainly targets traditional federated learning systems, while there are relatively few studies on personalized federated learning. Specifically, in the backdoor attack scenario of traditional federated learning, the model of each client will be fully uploaded to the server for aggregation, and malicious clients can easily pass the backdoor in the local model to the global model, thereby affecting all clients. However, in personalized federated learning, since only part of the models of each client will participate in global aggregation, the model backdoor of the malicious client may be "stranded" locally and cannot be spread to the private models of other clients through global aggregation, thereby limiting the success rate of backdoor attacks on other clients. In addition, the server side may introduce federal defense mechanisms, such as pruning, culling, differential privacy and other technologies, making backdoor attacks on personalized federated learning models more difficult.

[0007] Therefore, in order to solve the shortcomings of existing backdoor attack technologies for federated learning systems, it is urgent to study and explore backdoor attack methods for personalized federated learning systems, which will help reveal the potential deficiencies of current personalized federated learning systems in terms of security. In view of this, the present invention proposes a backdoor attack method for personalized federated learning based on feature aggregation. Summary of the invention

[0008] The purpose of the present invention is to propose a backdoor attack method based on personalized federated learning of feature aggregation to solve the problems raised in the background technology. The present invention is particularly suitable for image classification tasks, fully considers the characteristics of global models and local models in personalized federated learning, and generates effective backdoor triggers through cooperation between multiple malicious clients. When facing the federal defense mechanism, the present invention effectively improves the concealment of the attack by constraining the backdoor trigger and aligning the feature distribution of the backdoor sample and the clean sample during the training process of the backdoor trigger.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] A backdoor attack method for personalized federated learning based on feature aggregation, including the following contents:

[0011] (1) Design backdoor trigger:

[0012] The size of the backdoor trigger is designed to be equal to the size of the input image, and each pixel value of the trigger is constrained to be below the preset threshold, specifically:

[0013] ||δ l || ∞ <∈,l∈{1,2,…,L}

[0014] Among them, δ l represents the backdoor trigger; ∈ represents the preset threshold; L represents the number of categories of images in the training set; ||·|| ∞ Indicates l ∞ norm, requiring that the value of each pixel of the backdoor trigger is less than a preset threshold ∈; the threshold ∈ is set to a minimum value to ensure that when a backdoor trigger that meets this condition is added to a clean image to construct a backdoor image, it can evade defense detection based on the image tampering algorithm;

[0015] (2) Training backdoor trigger:

[0016] An intra-class attack strategy is proposed to train the designed backdoor trigger. Assuming that the malicious client m has a clean dataset D m , clean the dataset D m The federated classification model is expressed as:

[0017] F m ={w m ,f m}

[0018] Among them, F m represents the federated classification model; w m represents the shared feature extraction module; f m Represents a private classifier module;

[0019] Preferably, the training objective of the backdoor trigger is to solve the following optimization problem:

[0020]

[0021] Among them, △ represents the restricted set of backdoor triggers; L CE represents the classification loss function; L KLrepresents the feature distribution alignment loss function; (x l,m ,y l,m ) represents the training sample, which comes from the lth class of the clean data set; the federated classification model F m When the training is close to convergence, the sample (x l,m ,y l,m ) is used to train the backdoor trigger δ of the lth class l ; Each category l corresponds to a backdoor trigger, and its training goal is to minimize L CE and L KL The value of .

[0022] Preferably, the classification loss function L CE The cross entropy loss function is used, which includes the following: Backdoor trigger δ l,m The label and input image x l,m Label y l,m Keeping it consistent, by shrinking the classification loss function L CE Make the backdoor trigger δ l,m The characteristics of point to class l; through δ l,m is added to reduce the classification loss. When the training converges, δ l Learn the features of class l, which dominate the classification of the model;

[0023] When the backdoor trigger is added to any image to form a backdoor sample, the federated classification model F m The sample is identified as class l to successfully implement the backdoor attack.

[0024] Preferably, the feature distribution alignment loss function L KL The KL divergence loss function is used to align the feature distribution of backdoor samples and clean samples; under the personalized federated learning architecture, each client shares the feature extraction module w m , mapping clean samples and backdoor samples into the same feature space; when training the backdoor trigger, the malicious client aligns the backdoor sample x l,m +δ l,m With clean sample x l,m The feature distribution of the malicious client is made consistent with the original clean data distribution. Through the above strategy, when the malicious client subsequently trains the backdoor model, the distance between the feature extraction module parameters of the malicious client and the backdoor model and the feature extraction module parameters of the clean client is reduced, thereby reducing the risk of being detected under the federal defense mechanism.

[0025] Preferably, in order to enhance the generalization of the backdoor trigger, the classification loss function L CE Model F m The classifier module f mNoise is added to the model parameters to simulate the classifier decision boundary of other clean clients, avoiding the backdoor trigger from overfitting the local classifier of the malicious client and improving its attack effect on other clients. The formula of the updated optimization problem is expressed as follows:

[0026]

[0027] Among them, F' m ={w m ,f m +σ};

[0028] The gradient descent method is used to solve the above optimization problem. The solution steps and formulas are as follows:

[0029] 1) Malicious client initializes backdoor sample:

[0030]

[0031] Among them, x l,m represents a clean sample on malicious client m, is the backdoor trigger of the tth iteration, which is randomly initialized at the beginning;

[0032] 2) Gradient calculation and backdoor trigger update:

[0033] In each iteration, the loss function L is calculated CE +L KL Backdoor trigger The gradient of , and perform gradient update:

[0034]

[0035] Among them, g t is the gradient in the tth iteration, initialized to 0; μ represents the attenuation factor in the gradient accumulation process; α t represents the learning rate, which gradually decays according to the learning rate strategy;

[0036] During the optimization process, the backdoor trigger is truncated to ensure that the constraints are met To ensure that the value of each pixel does not exceed the preset threshold.

[0037] During the training process, the feature distribution alignment method is used to make the backdoor data generated by the malicious client as close as possible to the data distribution of other normal clients, thus circumventing the federation defense mechanism based on model parameter clustering detection.

[0038] (3) Aggregate backdoor trigger features:

[0039] After training the backdoor trigger of a single malicious client, the malicious clients communicate with each other and perform feature aggregation on the backdoor triggers they have trained. The specific function is expressed as:

[0040]

[0041] Among them, n m represents the number of samples used by the mth malicious client to train the backdoor trigger; n represents the total number of training samples of all malicious clients;

[0042] Based on the above content, feature aggregation is performed on each category of backdoor triggers one by one, making full use of the training data of all malicious clients to improve the generalization of backdoor triggers;

[0043] (4) Training the backdoor model:

[0044] After the backdoor trigger training is completed, the malicious client inserts the trained backdoor trigger into the training dataset and trains the model with the backdoor trigger until the federated training is completed.

[0045] Preferably, for the training of the backdoor model, the training objectives of the backdoor model of the malicious client m are as follows:

[0046]

[0047] When there are only clean samples, both the shared feature extraction module and the private classifier module are updated; when the backdoor samples are fed, only the parameters of the shared feature extraction module are updated;

[0048] The training objective for cleaning client k is as follows:

[0049]

[0050] In each round of federated learning, the aggregation process of the feature extraction module is as follows:

[0051]

[0052] Among them, w r represents the global feature aggregation module obtained after the rth round of aggregation; S r represents the set of clients selected by the server to participate in the aggregation in round r; p k Represents the aggregate weight of each client model.

[0053] Compared with the prior art, the present invention provides a backdoor attack method based on personalized federated learning of feature aggregation, which has the following beneficial effects:

[0054] (1) Enhanced backdoor concealment: This invention effectively circumvents detection based on image tampering defense by designing a backdoor trigger with the same size as the input image and constraining each pixel value of the trigger. This design ensures that the backdoor trigger is difficult to detect under human observation, thereby greatly improving its concealment.

[0055] (2) Backdoor robustness: This paper adopts the intra-class attack strategy to train the backdoor trigger and shortens the distribution distance between the backdoor data and the clean data through the feature distribution alignment technology. This strategy makes the model parameters of the backdoor model closer to those of other clean clients, successfully circumventing the federation defense measures based on model clustering detection.

[0056] (3) Improved backdoor generalization capability: During the backdoor trigger training process, the present invention introduces noise into the classifier parameters of the malicious client to simulate the classifier decision boundary of other clean clients. The present invention effectively improves the generalization capability of the backdoor trigger, so that it can still maintain the effectiveness of the attack when facing different data sets and models.

[0057] (4) Enhanced attack effect: The present invention fully utilizes the data advantage of the attacker by performing feature aggregation of the backdoor trigger among multiple malicious clients, and further improves the generalization ability of the backdoor trigger. Feature aggregation enables the backdoor trigger to maintain its attack effect under various input conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is an overall flow chart of the backdoor attack method of personalized federated learning based on feature aggregation proposed in Example 1 of the present invention;

[0059] Figure 2 This is a schematic diagram of the design of the backdoor trigger mentioned in Example 1 of the present invention;

[0060] Figure 3 This is a schematic diagram of the training process in the case where a malicious client exists in the federated learning framework mentioned in Example 1 of the present invention. DETAILED DESCRIPTION

[0061] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0062] Embodiment 1:

[0063] This paper proposes a backdoor attack method based on personalized federated learning based on feature aggregation. The attack process is as follows: Figure 1 As shown; specifically including the following steps:

[0064] Step 1: In this step, assume that there are 100 clients and the classification model of each client is ResNet18. The model parameters are initialized using the Kaiming initialization method proposed by He Kaiming, an expert in the field of computer vision, to better adapt to the training of deep neural networks.

[0065] Step 2: Taking the CIFAR-10 dataset as an example, each client has some training samples in a non-IID manner, and the size of the training samples is 3*32*32. During training, the optimizer can choose the classic stochastic gradient descent (SGD), the initial learning rate is set to 0.01, and it decays to 99% of the previous generation every 10 generations. The batch size is set to 64, and a total of 20 epochs are trained.

[0066] Step 3: Upload and aggregate the feature extraction module. After the local model training is completed, the client uploads the shared part (i.e., the feature extraction module) to the server for aggregation. Taking FedAvg (federated average algorithm) as an example, the aggregation formula is:

[0067]

[0068] Among them, w r is the global feature aggregation module obtained after the rth round of aggregation, S r is the set of clients selected by the server to participate in the aggregation in round r, p k Aggregate weight for each client model.

[0069] Step 4: The server sends the aggregated feature extraction module to the client. The server sends the aggregated global feature extraction module to each client to keep the feature extraction modules of the client synchronized for further training.

[0070] Step 5: The malicious client first determines whether the number of iterations reaches the preset poisoning judgment value. If it reaches the preset value, the malicious client will use the federated model to start training the backdoor trigger. The design of the backdoor trigger is as follows: Figure 2 As shown. Taking the CIFAR-10 dataset as an example, since the dataset contains a total of 10 categories, 10 types of backdoor triggers are designed. Epsilon (∈) represents the maximum allowed value of each pixel value in the backdoor trigger. In the figure, the first row (w / o) shows the initialization state of the backdoor trigger, and the second row shows the schematic diagram of the training result.

[0071] The training strategy of the backdoor trigger is as described above, with a total of two loss functions:

[0072]

[0073] F' m={w m ,f m +σ}

[0074] Among them, △ is the restricted set of backdoor triggers. The size of the trigger and the value of a single pixel must be less than the Epsilon value, which is set to 16 / 255 here to find the optimal solution within this range. Training samples (x l,m ,y l,m ) from the clean dataset, in the federated model F m When the training is close to convergence, the sample is used to train the backdoor trigger δ of the lth class l Each category l corresponds to a backdoor trigger, and its training goal is to minimize the values ​​of the above two loss functions.

[0075] The first loss function L CE is the classification loss. Cross Entropy loss (CE) is usually used in image classification tasks, which embodies the core idea of ​​the intra-class attack strategy. Specifically, the backdoor trigger δ l,m The label and input image x l,m Label y l,m is consistent, by reducing L CE The backdoor trigger δ l,m The features point to class l.

[0076] The second loss function L KL The feature distribution of backdoor samples and clean samples is usually aligned using KL divergence (Kullback-Leibler Divergence). Under the personalized federated learning architecture, each client shares the feature extractor w m , which can map clean samples and backdoor samples into the same feature space.

[0077] Considering that the classifiers of each client are private in the personalized federated learning framework, when the malicious client m optimizes the backdoor trigger, the first loss function L CE The optimization of may overfit the client's local classifier f m , resulting in poor generalization of the trained backdoor trigger. In order to enhance the generalization of the backdoor trigger, this paper adds the first loss function L CE Model F m The classifier module f m A certain amount of noise σ is added to the model parameters of to simulate the classifier decision boundary of other clean clients. This can prevent the backdoor trigger from overfitting the local classifier of the malicious client and improve its attack effect on other clients.

[0078] In order to solve the above optimization problem, the present invention adopts the gradient descent method, and its solution steps and formula are as follows:

[0079] The first step is to initialize the backdoor sample with the malicious client:

[0080]

[0081] Among them, x l,m is a clean sample on the malicious client m, is the backdoor trigger of the tth iteration, and the initial initialization is as follows Figure 2 shown.

[0082] The second step is gradient calculation and backdoor trigger update:

[0083] In each iteration, the loss function L is calculated CE +L KL Backdoor trigger The gradient of , and perform gradient update:

[0084]

[0085] Among them, g t is the gradient in the tth iteration, initialized to 0. The attenuation factor in the gradient accumulation process is μ = 1.0, and the learning rate is α 0 = 0.01, which can be gradually decayed according to the learning rate strategy. During the optimization process, the backdoor trigger needs to be truncated to ensure that the constraints are met. To ensure that the value of each pixel does not exceed the preset threshold.

[0086] Backdoor trigger feature aggregation: After training the backdoor trigger of a single malicious client, the malicious clients communicate with each other and perform feature aggregation on the backdoor triggers they have trained:

[0087]

[0088] Among them, n m It represents the number of samples used by the mth malicious client to train the backdoor trigger, and n is the total number of training samples of all malicious clients. It should be noted that all clients will train L = 10 categories of backdoor triggers, and feature aggregation is performed on each category one by one to make full use of the training data of all malicious clients and improve the generalization of the backdoor trigger.

[0089] Step 6: Backdoor model training. After the backdoor trigger training is completed, the malicious client inserts it into the training data set to train the model with the backdoor until the federation training is completed. The backdoor model training objectives of the malicious client m are as follows:

[0090]

[0091] When there are only clean samples, both the shared feature extraction module and the private classifier module are updated; when the backdoor samples are fed, only the parameters of the shared feature extraction module are updated. The reason for this design is that only the shared feature extraction module can pass the backdoor information to other clients, thereby expanding the impact range of the backdoor attack.

[0092] The training objective of the cleaning client c is as follows:

[0093]

[0094] In each round of federated learning, the aggregation process of the feature extraction module is as follows:

[0095]

[0096] Among them, w r is the global feature aggregation module obtained after the rth round of aggregation, S r is the set of clients selected by the server to participate in the aggregation in round r, p k Aggregate weight for each client model.

[0097] After the malicious client successfully implants the backdoor trigger into the training data, the entire training framework of personalized federated learning is as follows: Figure 3 As shown in the figure. At this time, the clients marked with shadows are malicious clients. These malicious clients adjust local data and model parameters during local training to make the model learn specific backdoor features. When these malicious clients upload the feature extraction module with backdoors to the server for aggregation, these backdoor information will gradually spread to the global feature aggregation model. When the number of federated communications reaches the preset value, the iteration stops, and each client saves its own model parameters for subsequent reasoning.

[0098] In summary, the technical solution of the present invention effectively solves the shortcomings of existing federated learning backdoor attacks in the face of personalized federated learning and federated defense detection algorithms by introducing a series of innovative measures. Specifically, by constraining the maximum value of the backdoor trigger, it is ensured that it is visually imperceptible; by aligning the feature distribution of backdoor samples and clean samples, the possibility of attack detection is reduced; by simulating the classifier decision boundary of unknown clients, the generalization of the backdoor trigger is improved. These improvements have successfully increased the success rate of backdoor attacks on personalized federated learning models.

[0099] It is worth noting that the example of the CIFAR10 data set in this article is only used as a preferred embodiment of the present invention, and the purpose is to explain the technical details and advantages of the present invention, and does not limit the scope of application of the present invention in any form. The general principles defined in the present invention can be applied to other scenarios and examples without departing from its spirit or scope. Therefore, according to the technical essence of the present invention, any simple modifications, equivalent changes and modifications made to the above examples should be regarded as extensions of the present invention and fall within the scope of protection of the technical solution of the present invention.

Claims

1. A backdoor attack method based on personalized federated learning of feature aggregation, characterized in that: It includes the following: (1) Design backdoor trigger: The size of the backdoor trigger is designed to be equal to the size of the input image, and each pixel value of the trigger is constrained to be below the preset threshold, specifically: ||d l || ∞ <∈,l∈{1,2,…,L} Among them, δ l represents the backdoor trigger; ∈ represents the preset threshold; L represents the number of categories of images in the training set; ||·|| ∞ Indicates l ∞ norm, requiring that the value of each pixel of the backdoor trigger is less than a preset threshold ∈; the threshold ∈ is set to a minimum value to ensure that when a backdoor trigger that meets this condition is added to a clean image to construct a backdoor image, it can evade defense detection based on the image tampering algorithm; (2) Training backdoor trigger: An intra-class attack strategy is proposed to train the designed backdoor trigger. Assuming that the malicious client m has a clean dataset D m , clean the dataset D m The federated classification model is expressed as: F m ={w m ,f m } Among them, F m represents the federated classification model; w m represents the shared feature extraction module; f m Represents a private classifier module; During the training process, the feature distribution alignment method is used to make the backdoor data generated by the malicious client as close as possible to the data distribution of other normal clients, thus circumventing the federation defense mechanism based on model parameter clustering detection; (3) Aggregate backdoor trigger features: After training the backdoor trigger of a single malicious client, the malicious clients communicate with each other and perform feature aggregation on the backdoor triggers they have trained. The specific function is expressed as: Among them, n m represents the number of samples used by the mth malicious client to train the backdoor trigger; n represents the total number of training samples of all malicious clients; Based on the above content, feature aggregation is performed on each category of backdoor triggers one by one, making full use of the training data of all malicious clients to improve the generalization of backdoor triggers; (4) Training the backdoor model: After the backdoor trigger training is completed, the malicious client inserts the trained backdoor trigger into the training dataset and trains the model with the backdoor trigger until the federated training is completed.

2. According to claim 1, a backdoor attack method based on personalized federated learning of feature aggregation is characterized in that: The training objective of the backdoor trigger is to solve the following optimization problem: Where △ represents the restricted set of backdoor triggers; L CE represents the classification loss function; L KL represents the feature distribution alignment loss function; (x l,m ,y l,m ) represents the training sample, which comes from the lth class of the clean data set; the federated classification model F m When the training is close to convergence, the sample (x l,m ,y l,m ) is used to train the backdoor trigger δ of the lth class l ; Each category l corresponds to a backdoor trigger, and its training goal is to minimize L CE and L KL The value of .

3. According to claim 2, a backdoor attack method of personalized federated learning based on feature aggregation is characterized in that: The classification loss function L CE The cross entropy loss function is used, which includes the following: Backdoor trigger δ l,m The label and input image x l,m Label y l,m Keeping it consistent, by shrinking the classification loss function L CE Make the backdoor trigger δ l,m The characteristics of point to class l; through δ l,m is added to reduce the classification loss. When the training converges, δ l Learn the features of class l, which dominate the classification of the model; When the backdoor trigger is added to any image to form a backdoor sample, the federated classification model F m The sample is identified as class l to successfully implement the backdoor attack.

4. According to claim 3, a backdoor attack method based on personalized federated learning of feature aggregation is characterized in that: The feature distribution alignment loss function L KL The KL divergence loss function is used to align the feature distribution of backdoor samples and clean samples; under the personalized federated learning architecture, each client shares the feature extraction module w m , mapping clean samples and backdoor samples into the same feature space; When training the backdoor trigger, the malicious client aligns the backdoor sample x l,m +δ l,m With clean sample x l,m The feature distribution of the malicious client is made consistent with the original clean data distribution. Through the above strategy, when the malicious client subsequently trains the backdoor model, the distance between the feature extraction module parameters of the malicious client and the backdoor model and the feature extraction module parameters of the clean client is reduced, thereby reducing the risk of being detected under the federal defense mechanism.

5. According to claim 4, a backdoor attack method based on personalized federated learning of feature aggregation is characterized in that: In order to enhance the generalization of the backdoor trigger, the classification loss function L CE Model F m The classifier module f m Noise is added to the model parameters to simulate the classifier decision boundary of other clean clients, avoiding the backdoor trigger from overfitting the local classifier of the malicious client and improving its attack effect on other clients. The formula of the updated optimization problem is expressed as follows: Among them, F' m ={w m ,f m +σ}; The gradient descent method is used to solve the above optimization problem. The solution steps and formulas are as follows: 1) Malicious client initializes backdoor sample: Among them, x l,m represents a clean sample on malicious client m, is the backdoor trigger of the tth iteration, which is randomly initialized at the beginning; 2) Gradient calculation and backdoor trigger update: In each iteration, the loss function L is calculated CE +L KL Backdoor trigger The gradient of , and perform gradient update: Among them, g t is the gradient in the tth iteration, initialized to 0; μ represents the attenuation factor in the gradient accumulation process; α t represents the learning rate, which gradually decays according to the learning rate strategy; During the optimization process, the backdoor trigger is truncated to ensure that the constraints are met To ensure that the value of each pixel does not exceed the preset threshold.

6. According to claim 1, a backdoor attack method based on personalized federated learning of feature aggregation is characterized in that: For the training of the backdoor model, the training objectives of the backdoor model of the malicious client m are as follows: When there are only clean samples, both the shared feature extraction module and the private classifier module are updated; when the backdoor samples are fed, only the parameters of the shared feature extraction module are updated; The training objective for cleaning client k is as follows: In each round of federated learning, the aggregation process of the feature extraction module is as follows: Among them, w r represents the global feature aggregation module obtained after the rth round of aggregation; S r represents the set of clients selected by the server to participate in the aggregation in round r; p k Represents the aggregate weight of each client model.

Images