Federal learning-oriented invisible backdoor attack method, system and equipment

CN119377954APending Publication Date: 2025-01-28CHONGQING UNIVERSITY OF SCIENCE AND TECHNOLOGY +1
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
CN202411440874.9
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-10-16
Publication Date
2025-01-28

AI Technical Summary

Technical Problem

The concealment and customizability of backdoor attacks in federated learning make it face significant challenges in detection and defense, especially during distributed training and model aggregation.

Method used

By creating a attack model, the attacker optimizes back door noise on the malicious client, making it visually not detect and effectively polluting the local model. The attack model is optimized by gradient reduction to ensure that it can be hidden into the backdoor trigger during the federal learning aggregation process to pollute the global model.

Benefits of technology

The invisible backdoor attack that is difficult to detect in the federal learning system can achieve more accurate model control in different attack scenarios, which pose a greater threat to the federal learning system.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN119377954A_ABST
    Figure CN119377954A_ABST
Patent Text Reader

Abstract

The invention provides a federated learning-oriented invisible backdoor attack method, system and equipment, which are suitable for a federated learning scene of n participants (n is greater than or equal to 2), and m participants are attackers (mlt; n / 2). The objective of the invention is to simultaneously realize two effects on a global model: high identification accuracy is maintained for normal samples, and labels specified by attackers are identified for back door samples with high accuracy. The method comprises two stages: firstly, an attacker creates an attack model according to a training task, generates imperceptible disturbance through gradient descent, and gradually improves an attack effect; secondly, in a training stage, an attacker uses a trained attack model to add noise to local data for generating a backdoor sample and polluting a local model; then, the attacker uploads the model parameters of the malicious client to the server, and participates in global model aggregation, thereby polluting the global model. The method has high attack concealment, and a new research thought is provided for defense mechanism design in federal learning.
Need to check novelty before this filing date? Find Prior Art