Defense method and system for federated learning poisoning attacks

Abstract

The present invention relates to the field of information security technology, and to a defense method for federated learning poisoning attacks, including a client obtaining a training image set; the client injecting noise into the training image set to obtain a noisy image set, using the noisy image set to train a client denoising model, and uploading the trained client denoising model to a server; the server injecting noise into a verification image to obtain a noise verification image, inputting the noise verification image into the client denoising model uploaded by the client, and obtaining verification data; screening a list of trusted clients from clients participating in federated learning according to the verification data; aggregating client classification models uploaded by clients in the trusted client list to obtain a global classification model, and distributing the global classification model back to the client. The present invention also proposes a defense system for federated learning poisoning attacks. The present invention can improve the server's ability to judge the credibility of the client model and improve the model's defense capability against poisoning attacks.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a defense method and system for federated learning poisoning attacks. Background Art

[0002] Federated Learning (FL) is an emerging machine learning method. The roles of federated learning include server and client. Client refers to the device or user with local data. The server is the coordination center in federated learning and is responsible for managing the training process of multiple clients. Specifically, the client uses local data to train the model, updates the local model, and uploads the updated model parameters to the server; the server is responsible for initializing the global model, collecting the updated model parameters from the client, performing model aggregation, forming a new global model, and sending the new global model to the client. This distributed learning method can solve the problems of data privacy protection and data security, while reducing the need to transmit data and alleviating the computational burden of the central server. Although the FL framework makes collaborative learning possible, the decentralization of FL makes it vulnerable to poisoning attacks. The server cannot identify whether the model is uploaded by an honest client. A federated graph learning framework is proposed, which protects data privacy while realizing the selection of honest clients by the server.

[0003] Poisoning attacks are a type of attack on machine learning models, where attackers manipulate model behavior or degrade performance by implanting carefully designed malicious samples in training data. This type of attack can be divided into two main categories: clean label poisoning attacks and dirty label poisoning attacks. Clean label poisoning attacks do not change the data labels, but only add malicious samples to make them easily accepted by the model; dirty label poisoning attacks involve tampering with data labels, such as label flipping attacks, which change the labels of one type of samples to another. Dirty label poisoning attacks are relatively simple to implement, and attackers only need to mix the tampered data of the target category with normal data for training. In distributed environments such as federated learning, data poisoning attacks are particularly threatening because attackers may control some of the clients participating in training. Whether it is a clean label or dirty label poisoning attack, the goal is to make the trained model produce results that meet the attacker's expectations, thereby undermining the reliability and security of the model.

[0004] In order to mitigate poisoning attacks on models in federated learning, in the prior art, the server does not directly average the client models when aggregating models uploaded by the clients, but processes the models before aggregating them. However, the above aggregation method has the following problems:

[0005] 1. It is impossible to handle models that use dirty labels to poison attacks. There is no aggregation method that specifically identifies poisoning attacks, and the poisoned model parameters will still be aggregated.

[0006] 2. It is impossible to select honest clients. Existing research uses the server to calculate the cosine similarity or k-means clustering between models uploaded by the client to select the models uploaded by the honest client. However, it is difficult to distinguish the models that use dirty label poisoning attacks by calculating the similarity of the models, and it is impossible to ensure that the aggregated models are honest.

[0007] 3. The server is required to retain some data for verification. In existing studies, the server uses the data stored in the server to verify the uploaded model, or there is an auxiliary data set on the server to train the GAN network to generate data for model verification, but this does not conform to the principles of federated learning. Summary of the invention

[0008] In order to improve the server's ability to judge the credibility of the client model and improve the model's defense against poisoning attacks, a defense method and system for federated learning poisoning attacks are provided.

[0009] In order to achieve the above-mentioned objective of the present invention, the present invention provides a defense method for federated learning poisoning attacks.

[0010] Defense methods for federated learning poisoning attacks include:

[0011] The client obtains the training image set;

[0012] The client injects noise into the training image set to obtain a noisy image set, uses the noisy image set to train the client denoising model, and uploads the trained client denoising model to the server;

[0013] The server injects noise into the verification image to obtain a noise verification image, and inputs the noise verification image into the client denoising model uploaded by the client to obtain verification data;

[0014] Filter out trusted clients from clients participating in federated learning based on verification data to obtain a list of trusted clients;

[0015] Aggregate the client classification models uploaded by the clients in the trusted client list to obtain a global classification model, and distribute the global classification model back to the clients.

[0016] Optionally, the client injects noise into the training image set to obtain a noisy image set, uses the noisy image set to train a client denoising model, and uploads the trained client denoising model to the server, including:

[0017] The client gradually adds Gaussian noise to the images in the training image set through T iterations to obtain a noisy image set;

[0018] Construct the network structure of the client denoising model;

[0019] The network of the client denoising model is trained using the noisy image set, and in each training, the loss function of the client denoising model is determined according to the output result of the client denoising model;

[0020] Optimize the network parameters of the client denoising model according to the loss function to obtain the denoising steps and optimized denoising model parameters;

[0021] Upload the denoising steps and optimized denoising model parameters to the server.

[0022] Optionally, the verification data includes a verification feature value and a reference tag value corresponding to the verification feature value.

[0023] The trusted clients are screened out from the clients participating in the federated learning according to the verification data to obtain a trusted client list, including:

[0024] The server generates a verification model for the client based on the model parameters of the classification model uploaded by the client, inputs the verification feature value into the verification model, and the verification model outputs the predicted label value of the verification feature value;

[0025] Determine the classification accuracy of the verification model based on the predicted label value and the reference label value corresponding to the verification feature value;

[0026] Compare the classification accuracy value of the verification model with the accuracy reference threshold, and if the classification accuracy value of the verification model is greater than the accuracy reference threshold, record the client corresponding to the verification model as a trusted client;

[0027] Filter out all trusted clients from the clients participating in federated learning and obtain a list of trusted clients.

[0028] Optionally, the classification accuracy is calculated as Where i is the index of the client participating in federated learning; j is the index of the verification data generated by client i, and m is the total number of verification data generated by client i; x i,j represents the verification feature value of the j-th verification data generated by client i, Represents the server-side verification model, y i,j represents the reference label value of the j-th verification data generated by client i; It means that if the condition inside the brackets is true, then the output is 1, if the condition inside the brackets is false, then the output is 0.

[0029] Optionally, the method further includes: determining whether there is an abnormality in the client participating in the federated learning:

[0030] Calculate the similarity between the verification data corresponding to each client and the verification data corresponding to all clients participating in the federated learning except each client, and record it as the first similarity;

[0031] The abnormal clients are screened out according to the first similarity.

[0032] Optionally, the method further comprises:

[0033] Remove the abnormal clients from the original client list participating in federated learning, and obtain a new client list participating in federated learning;

[0034] The trusted clients are re-screened from the new client list to obtain a trusted client list.

[0035] Optionally, a data set consisting of verification data generated by the client is recorded as a verification data set;

[0036] The step of calculating the first similarity includes:

[0037] Calculate the feature average and label average of the client's verification data based on the verification data set corresponding to the client;

[0038] The average feature and label cosine similarity between each pair of clients participating in federated learning is calculated based on the average value of the client's label; for each pair of clients (i, k), i≠k, the expression of the average feature and label cosine similarity is:

[0039]

[0040] is the average value of the labels of client i, is the average value of the labels of client k, ∥.∥2 represents the second norm;

[0041] Calculate the average inter-client similarity of each client participating in federated learning to obtain a first similarity;

[0042] The calculation formula for average client-to-client similarity is:

[0043] Where N is the total number of clients participating in federated learning.

[0044] Optionally, screening out abnormal clients according to the first similarity includes:

[0045] The average client similarity avg_cos_sim corresponding to each client i Compare with the preset similarity reference threshold and convert the average client similarity avg_cos_sim iClients with similarity values ​​less than the reference threshold are marked as abnormal clients.

[0046] Optionally, the similarity reference threshold is μ-kσ, where μ is avg_cos_sim i The mean of , σ is avg_cos_sim i The standard deviation of , k is the threshold parameter.

[0047] In order to solve the above problems, the present invention also provides a system for a defense method for federated learning poisoning attacks, the system comprising:

[0048] Server, and

[0049] At least one client that communicates with the server.

[0050] In summary, this application includes the following beneficial technical effects:

[0051] The solution of this patent significantly improves the system's ability to resist poisoning attacks through a multi-level defense mechanism. First, the client trains the denoising model locally and only shares the model parameters of the client's denoising model with the server instead of the original training images, which reduces the risk of direct data tampering; secondly, the server uses the verification data generated by the denoising model for verification, which can effectively detect models that use dirty labels for poisoning attacks; screening out trusted clients for classification model aggregation can effectively reduce invalid communications and calculations with unreliable clients, optimize resource allocation, and improve the efficiency of a single training. It can improve the security of the system by reducing potential poisoning attacks and errors;

[0052] By analyzing the similarity and classification accuracy of the verification data generated by the client denoising model, the server system can more accurately identify honest clients. This multi-dimensional evaluation method can not only deal with known attack patterns, but also has the potential to discover new attacks and improve the model's defense capabilities against poisoning attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A flowchart of a method for defending against poisoning attacks in federated learning provided by an embodiment of the present invention;

[0054] Figure 2 A framework flow chart of a defense solution for federated learning poisoning attacks provided by an embodiment of the present invention;

[0055] Figure 3 A system structure diagram of a U-Net network provided in one embodiment of the present invention;

[0056] Figure 4A schematic diagram of a module of a defense system for federated learning poisoning attacks provided by an embodiment of the present invention.

[0057] Figure numerals: 11, server; 12, client.

[0058] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0059] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0060] In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0061] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0062] The roles of federated learning usually include a server and one or more clients. Usually, the number of clients is set to multiple to improve the efficiency of model training. A client refers to a device or user with a local image. Each client stores a portion of training data, which usually does not leave the client device. The main task of the client is to download the model parameters and training program of the current global model from the server, and then use the local image to train the model parameters of the assigned sub-model, and upload the training results to the server. Each client performs model training locally without sending the training data to the central server, thereby protecting the privacy of the data.

[0063] The server is the coordination center in federated learning, responsible for managing the training process of multiple clients. The main task of the server is to collect model updates from various clients, aggregate them, and generate a new global model.

[0064] The global model that needs to be trained through federated learning may be an image classification model or an object recognition model. In this embodiment, the global model to be trained on the server side is an image classification model.

[0065] Reference Figure 1 FIG. 1 is a flow chart of a method for defending against a federated learning poisoning attack provided by an embodiment of the present invention. In this embodiment, the method for defending against a federated learning poisoning attack includes:

[0066] S1. The client obtains a training image set.

[0067] The training image set includes several local images; the local images include input samples and reference labels corresponding to the input samples. The input samples can be satellite images, security monitoring images, or driving images collected by a driving recorder, etc. This embodiment does not limit the image types of local images.

[0068] S2. The client injects noise into the training image set to obtain a noisy image set, and uses the noisy image set to train the client denoising model, and uploads the trained client denoising model to the server.

[0069] Reference Figure 2 , the specific steps of S2 include:

[0070] S21. Gaussian noise is gradually added to the local images in the training image set through T iterations to obtain noisy images, and the data set consisting of the noisy images is recorded as a noisy image set.

[0071] In this embodiment, noise is gradually added to the local image based on the forward diffusion process of the diffusion model; given the initial local image samples D0~q(D), q(D) is a probability distribution of the training image set on D, Gaussian noise is gradually added through T iterations to obtain a series of noisy samples D1, D2, ..., D T , the final noisy sample D T Each step of the operation here can be regarded as the process of transition from the current data distribution to the Gaussian noise distribution. In this embodiment, this process can be regarded as a Markov chain, in which each step is conditionally independent and gradually approaches the Gaussian noise distribution, gradually converting the sample D t-1 Transformed to a noisier sample D t , the transition of each step can be expressed as a conditional probability distribution:

[0072]

[0073] q(D t |D t-1 ) indicates that in sample D t-1Generate sample D with the probability of having been generated t The probability distribution of t ∈(0,1) is a hyperparameter, β t is the noise ratio at time step t, controlling the noise size at each step, and I is the unit matrix. The purpose of the unit matrix is ​​to ensure that the noise is isotropic. The entire forward process can be expressed as the product of these conditional probabilities:

[0074]

[0075] T represents the number of iterations, D 1:T Under the condition that sample D0 data is generated, forward propagation is performed from sample D1 to sample D t An overall probability of .

[0076] At each step, D is calculated by the following formula t The generation process can be written as:

[0077] in is the Gaussian noise added at this step. As the time step t increases, β t Gradually increase until sample D t Close to perfect Gaussian noise.

[0078] Cumulative noise calculation definition α t =1-β t and s is the time step value index, and D can be obtained t The closed-form solution for D0 is:

[0079] in

[0080] When T→∞, if Then x T will converge to a standard Gaussian distribution,

[0081] β t The choice of is usually cosine scheduling, which provides a nonlinear change at time step t. Compared with linear scheduling, cosine scheduling becomes slower at the beginning and end of scheduling, which makes the scheduling process smoother and avoids drastic changes in parameters, thus contributing to the stability of the model.

[0082]

[0083] Among them, β min is the lower limit of the hyperparameter, β max is the upper limit of the hyperparameter; in this embodiment, β minThe value of is 0.0001, β max The value of is 0.02.

[0084] Through the above-mentioned noise adding process, the original data distribution q(D0) is gradually converted into noise close to the standard Gaussian distribution.

[0085] By gradually adding Gaussian noise through T iterations, the privacy of users can be effectively protected. Due to the randomness of the noise, even if the attacker obtains part of the data, the original data cannot be easily restored, thereby increasing the security of the data. In addition, gradually adding Gaussian noise can simulate the uncertainty of data in practical applications and help the model better generalize to unseen data. This method increases the robustness of the model during the training process, enabling it to better cope with various input changes. Furthermore, by adding noise in a step-by-step iterative manner, the distribution of the data can be gradually adjusted, thereby reducing the computing resources required for each iteration. This method is particularly effective when processing large-scale data and can significantly reduce computing costs.

[0086] S22, construct the network structure of the client denoising model;

[0087] Reference Figure 3 In this embodiment, the client denoising model uses a U-Net network, and the timestamp t is position-encoded and added to the noisy image.

[0088] Specifically, the steps of constructing the network structure of the client denoising model include:

[0089] S221, calculating time code;

[0090] Given a time step t, the temporal embedding PE(t) is defined as:

[0091]

[0092] Where i is the dimension index of the embedding vector, d model is the dimension of the embedding.

[0093] S222, construct UnetBlock unit;

[0094] Each UnetBlock unit can be expressed as:

[0095] UB(x)=Activation(Conv2(Activation(Conv1(LN(x))))+R(x))

[0096] Among them, LN is layer normalization, Conv1 and Conv2 are 3x3 convolutions, Activation is the ReLU activation function, and R(x) is the residual connection, which can be an identity mapping or a 1x1 convolution.

[0097] S223, build an encoder. The encoder path can be expressed as a downsampling operation on the UnetBlock unit; the encoder output expression is

[0098] e i =Down(UB i (e i-1 +PE i (t)))

[0099] Among them, e i is the output of the i-th layer encoder, Down is the downsampling operation (convolution with stride = 2), UB i Indicates the index of the UnetBlock unit, e i-1 is the output of the i-1th layer encoder, PE i (t) is the projection of the temporal embedding at the i-th layer.

[0100] S224. Construct the middle layer, which can be expressed as:

[0101] m=UB mid (e n +PE mid (t))

[0102] Where n is the last layer of the encoder, UB mid Represents the middle layer UnetBlock unit, PE mid (t) is the projection of the temporal embedding in the middle layer.

[0103] S23. Train the network of the client denoising model using the noisy image set. In each training, determine the loss function of the client denoising model according to the output result of the client denoising model.

[0104] S225, in this embodiment, the Unet network predicts the noise ∈ y , the loss function can be expressed as:

[0105]

[0106] in is the noisy image at time step t, x0 is the original image, and ∈ is standard Gaussian noise.

[0107] S24. Optimize the network parameters of the client denoising model according to the loss function to obtain the denoising steps and the optimized denoising model parameters;

[0108] Use the noisy image set to train the client denoising model network until the client denoising model converges, and save the parameters θ of the denoising model d and the number of denoising steps T.

[0109] S25, uploading the denoising steps and the optimized denoising model parameters to the server.

[0110] By training the denoising model on the client and only sharing the denoising model parameters with the server, the risk of privacy leakage is effectively reduced. The server generates data similar to the client through the denoising model, which not only protects the original data but also provides necessary information for model verification. In addition, local training and noise injection further enhance the anonymity of the data.

[0111] S3. The server injects noise into the verification image to obtain a noise verification image, and inputs the noise verification image to the client denoising model uploaded by the client to obtain verification data.

[0112] The server obtains the denoising model parameters θ uploaded by the client d After the number of denoising steps T, pure noise is randomly collected, and then the client denoising model is used to generate data similar to the original client. The data similar to the original client is the verification data.

[0113] First, the client trains the denoising model locally and only shares the model parameters instead of the original data, which reduces the risk of data being directly tampered with. Second, the server uses the data generated by the denoising model for verification, which can effectively detect models that use dirty labels for poisoning attacks.

[0114] The verification data includes a verification feature value and a reference label value corresponding to the verification feature value. Each client generates a plurality of verification data to constitute a verification data set of the client.

[0115] Taking client i as an example, the verification data set D corresponding to client i i The expression in, Denotes the validation data set D i The validation eigenvalue matrix in , Denotes the validation data set D i The reference label value matrix in .

[0116] In the specific implementation process, the server starts with pure noise to collect white noise: D T It belongs to the standard Gaussian distribution, the mean of which is 0 and the variance is I.

[0117] For t=T,T-1,...,1, execute:

[0118]

[0119] ∈ pred =UNet(D t,t)

[0120] in, is the additional random noise, D t is the noise data at time step t, where t is the current time; t is a hyperparameter, β t is the noise proportion at time step t; ∈ pred is the prediction noise generated by UNet, which has the same shape as the input image D t same.

[0121] After T steps of iteration, the final result is D0, which is the corresponding new data generated by the server. The generated new data D0 is split into feature matrix X0 and label matrix Y0 to obtain the final verification data.

[0122] By leveraging the denoising model trained on the client, the server is able to generate samples that are highly similar to the original client data. The uniqueness of this approach is that the server only needs to randomly sample noise to generate a large amount of data similar to the original client through the denoising model. This not only solves the problem of lack of local images on the server, but also provides an efficient and accurate method for data simulation. The generated verification data retains the key features and distribution of the original data while preventing the server from directly accessing sensitive information.

[0123] S4. Filter out trusted clients from the clients participating in federated learning based on the verification data to obtain a list of trusted clients.

[0124] Specifically, in this embodiment, the global model to be trained by federated learning is an image classification model, and the trained neural network parameters are uploaded to the server. Step S4 includes:

[0125] S41, constructing a network structure of a classification model of a client;

[0126] S42, optimizing the network parameters of the classification model using the training image set, and uploading the optimized model parameters of the classification model to the server;

[0127] After training the denoising model, the client starts to train the local classification model. The steps of training the local classification model are to build the network structure of the client's classification model, use the training image set to optimize the network parameters of the classification model, and upload the optimized model parameters of the classification model to the server; specifically, a neural network model is built on each client, and the network structure of the classification model is a convolutional neural network (CNN) used for classification.

[0128] The training method of the classification model is consistent with the training method of the denoising model. After describing the training steps of the denoising model, those skilled in the art can clearly know the training method of the classification model, which will not be repeated here.

[0129] S41. The server generates a verification model of the client based on the model parameters of the classification model uploaded by the client, inputs the verification feature value into the verification model, and the verification model outputs the predicted label value of the verification feature value.

[0130] S42. Determine the classification accuracy of the verification model according to the predicted label value and the reference label value corresponding to the verification feature value.

[0131] The calculation formula for classification accuracy is: Where i is the index of the client participating in federated learning; j is the index of the verification data generated by client i, and m is the total number of verification data generated by client i; x i,j represents the verification feature value of the j-th verification data generated by client i, Represents the server-side verification model, y i,j represents the reference label value of the j-th verification data generated by client i; It means that if the condition inside the brackets is true, then the output is 1, if the condition inside the brackets is false, then the output is 0.

[0132] S43, comparing the classification accuracy value of the verification model with the accuracy reference threshold, if the classification accuracy value of the verification model is greater than the accuracy reference threshold, recording the client corresponding to the verification model as a trusted client;

[0133] S44. Filter out all trusted clients from the clients participating in federated learning to obtain a list of trusted clients.

[0134] The client trains the denoising model locally and only shares the model parameters instead of the original training data, reducing the risk of direct data tampering. The server uses the data generated by the denoising model for verification. This method can effectively detect models that use dirty labels for poisoning attacks. By analyzing the similarity of the generated data and its performance on the classification model uploaded by the client, the system can more accurately identify honest clients. This multi-dimensional evaluation method can not only deal with known attack patterns, but also has the potential to discover new attacks.

[0135] The use of denoising models in this solution allows the system to adapt to datasets of different sizes and types without making major modifications to the original architecture. Secondly, the multi-dimensional evaluation based on the generated data performed by the server can be easily extended to more evaluation indicators to meet emerging challenges. Furthermore, the dynamic participant screening mechanism allows the system to adjust the participant pool based on real-time performance. This flexibility allows the system to adapt to changes in the number of participants and dynamic changes in behavior.

[0136] The core components of this solution (such as denoising model training, validation data generation, and model evaluation) can be optimized and upgraded independently. This modular design greatly enhances the scalability and adaptability of the system.

[0137] In a preferred implementation of this embodiment, the defense method for federated learning poisoning attacks further includes determining whether there is an abnormality in the client participating in the federated learning, and the specific operation steps are as follows:

[0138] S401, calculating the similarity between the verification data generated by the client and the verification data generated by other clients participating in the federated learning, and recording it as a first similarity;

[0139] The step of calculating the first similarity includes:

[0140] Calculate the feature average and label average of the client's verification data based on the verification data set corresponding to the client;

[0141] The formula for calculating the feature average is:

[0142] The formula for calculating the label average is: where one_hot() is the one-hot encoding of the label.

[0143] The average feature and label cosine similarity between each pair of clients participating in federated learning is calculated based on the average value of the client's label; for each pair of clients (i, k), i and k are positive integers, and i≠k, the expression of the average feature and label cosine similarity is:

[0144]

[0145] is the average value of the labels of client i, is the average value of the labels of client k, ∥.∥2 represents the second norm;

[0146] Calculate the average inter-client similarity of each client participating in federated learning to obtain a first similarity;

[0147] For each client i, the average inter-client similarity avg_cos_sim of client i i The calculation formula is

[0148] Where N is the total number of clients participating in federated learning.

[0149] S402: Screen out abnormal clients according to the similarity of corresponding verification data between clients, and mark the abnormal clients as potential abnormalities.

[0150] The average client similarity avg_cos_sim corresponding to each client i Compare with the preset similarity reference threshold, when the average client similarity avg_cos_sim i When it is less than the similarity reference threshold, it indicates that the verification data corresponding to the client is quite different from other clients participating in federated learning, that is, the average client similarity avg_cos_sim i Clients with a similarity value less than the reference threshold value have potential anomalies; the average similarity between clients avg_cos_sim i Clients with similarity values ​​less than the reference threshold are marked as abnormal clients.

[0151] Calculate avg_cos_sim i The calculation formula of the similarity reference threshold is μ-kσ, where μ is avg_cos_sim i The mean of , σ is avg_cos_sim i The standard deviation of , k is the threshold parameter.

[0152] S403: Remove the abnormal client from the original client list participating in the federated learning, and obtain a new client list participating in the federated learning.

[0153] S405: Re-screen the trusted clients from the new client list to obtain a trusted client list.

[0154] The trusted client finally selected meets two conditions: the classification accuracy value of the verification model corresponding to the client is greater than the accuracy reference threshold, and the client is not an abnormal client. By analyzing the similarity of the generated verification data and the performance on the classification model uploaded by the client, the system can more accurately identify honest clients. Although the multi-dimensional evaluation method increases the computational complexity to a certain extent, it can more accurately identify reliable participants, which not only improves the efficiency of a single training, but also improves the long-term operation efficiency of the entire system by reducing potential attacks and errors. This multi-dimensional evaluation method can not only deal with known attack patterns, but also has the potential to discover new attacks and improve the model's defense capabilities against poisoning attacks.

[0155] S5. Aggregate the client classification models uploaded by the clients in the trusted client list to obtain a global classification model, and distribute the global classification model back to the clients.

[0156] The server-side model aggregation formula is:

[0157]

[0158] Where S represents the number of clients in the trusted client list, φ i is the model parameter of client i in the trusted client list; the aggregated model parameter φ agg Distribute to all clients.

[0159] Reference Figure 4 Based on the same inventive concept, an embodiment of the present invention provides a system based on a defense method for federated learning poisoning attacks.

[0160] A system based on a defense method for federated learning poisoning attacks includes a server 11 and at least one client 12 connected to the server 11 in communication, and the client 12 can be one or more. The client 12 is a local device. After receiving the training image set, the client 12 directly uses the training image set to train the network parameters of the denoising model (or classification model) locally on the client 12, and uploads the trained network parameters of the denoising model of the client 12 (or the network parameters of the client classification model) to the server 11. The server 11 aggregates the classification model parameters uploaded by the trusted clients to obtain the final global model, and returns the model parameters of the global classification model to the client 12. Each client 12 performs model training locally without sending the training data to the server 11, and only needs to share the model parameters with the server, thereby protecting the privacy of the data.

[0161] In some embodiments, the server 11 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and a combination of various control chips.

[0162] The various variations and specific examples of the defense method against federated learning poisoning attacks provided in the above-mentioned embodiments are also applicable to the defense system against federated learning poisoning attacks in the present embodiment. Through the above-mentioned detailed description of the defense method against federated learning poisoning attacks, those skilled in the art can clearly understand the implementation method of the defense system against federated learning poisoning attacks in the present embodiment. For the sake of brevity of the specification, they will not be described in detail here.

[0163] A defense system for poisoning attacks against federated learning may also include a power source (such as a battery) for supplying power to a server or client. Preferably, the power source may be logically connected to at least one server and / or client through a power management device, thereby implementing functions such as charging management, discharging management, and power consumption management through the power management device. The power source may also include any components such as one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, and power status indicators. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0164] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited by this structure.

[0165] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", "an implementation", "a preferred implementation" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0166] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A defense method for federated learning poisoning attacks, characterized in that: The client obtains the training image set; The client injects noise into the training image set to obtain a noisy image set, uses the noisy image set to train the client denoising model, and uploads the trained client denoising model to the server; The server injects noise into the verification image to obtain a noise verification image, and inputs the noise verification image into the client denoising model uploaded by the client to obtain verification data; Filter out trusted clients from clients participating in federated learning based on verification data to obtain a list of trusted clients; Aggregate the client classification models uploaded by the clients in the trusted client list to obtain a global classification model, and distribute the global classification model back to the clients; The verification data includes a verification feature value and a reference label value corresponding to the verification feature value. The trusted clients are screened out from the clients participating in the federated learning according to the verification data to obtain a trusted client list, including: The server generates a verification model for the client based on the model parameters of the classification model uploaded by the client, inputs the verification feature value into the verification model, and the verification model outputs the predicted label value of the verification feature value; Determine the classification accuracy of the verification model based on the predicted label value and the reference label value corresponding to the verification feature value; Compare the classification accuracy value of the verification model with the accuracy reference threshold, and if the classification accuracy value of the verification model is greater than the accuracy reference threshold, record the client corresponding to the verification model as a trusted client; Filter out all trusted clients from the clients participating in federated learning and obtain a list of trusted clients.

2. The method for defending against poisoning attacks in federated learning as claimed in claim 1, characterized in that: The client injects noise into the training image set to obtain a noisy image set, uses the noisy image set to train a client denoising model, and uploads the trained client denoising model to the server, including: The client gradually adds Gaussian noise to the images in the training image set through T iterations to obtain a noisy image set; Construct the network structure of the client denoising model; The network of the client denoising model is trained using the noisy image set, and in each training, the loss function of the client denoising model is determined according to the output result of the client denoising model; Optimize the network parameters of the client denoising model according to the loss function to obtain the denoising steps and optimized denoising model parameters; Upload the denoising steps and optimized denoising model parameters to the server.

3. The method for defending against poisoning attacks in federated learning as claimed in claim 1, characterized in that: The calculation formula for classification accuracy is: Where i is the index of the client participating in federated learning; j is the index of the verification data generated by client i, m is the total number of verification data generated by client i; x i,j represents the verification feature value of the j-th verification data generated by client i, Represents the server-side verification model, y i,j represents the reference label value of the j-th verification data generated by client i; It means that if the condition inside the brackets is true, then the output is 1, if the condition inside the brackets is false, then the output is 0.

4. The method for defending against federated learning poisoning attacks according to any one of claims 1 to 3, characterized in that: The method further includes: determining whether there is an abnormality in the client participating in the federated learning: Calculate the similarity between the verification data corresponding to each client and the verification data corresponding to all clients participating in the federated learning except each client, and record it as the first similarity; Abnormal clients are screened out based on the first similarity.

5. The method for defending against poisoning attacks in federated learning as claimed in claim 4, characterized in that: The method further comprises: Remove the abnormal clients from the original client list participating in federated learning, and obtain a new client list participating in federated learning; The trusted clients are re-screened from the new client list to obtain a trusted client list.

6. The method for defending against poisoning attacks in federated learning as claimed in claim 4, characterized in that: The data set consisting of the verification data corresponding to the client is recorded as the verification data set; The step of calculating the first similarity includes: Calculate the feature average and label average of the client's verification data based on the verification data set corresponding to the client; The average feature and label cosine similarity between each pair of clients participating in federated learning is calculated based on the average value of the client's label; for each pair of clients (i, k), i≠k, the expression of the average feature and label cosine similarity is: is the average value of the labels of client i, is the average value of the labels of client k, ∥.∥2 represents the second norm; Calculate the average inter-client similarity of each client participating in federated learning to obtain a first similarity; The calculation formula for average client-to-client similarity is: Where N is the total number of clients participating in federated learning.

7. The method for defending against federated learning poisoning attacks as claimed in claim 6, characterized in that: The step of screening out abnormal clients according to the first similarity includes: The average client similarity avg_cos_sim corresponding to each client i Compare with the preset similarity reference threshold and convert the average client similarity avg_cos_sim i Clients with similarity values ​​less than the reference threshold are marked as abnormal clients.

8. The method for defending against poisoning attacks in federated learning as claimed in claim 7, characterized in that: The similarity reference threshold is μ-kσ, where μ is avg_cos_sim i The mean of , σ is avg_cos_sim i The standard deviation of , k is the threshold parameter.

9. A system based on the method for defending against federated learning poisoning attacks according to any one of claims 1 to 8, characterized in that: include: Server, and At least one client that communicates with the server.

Images