Back door attack method of federated learning based on back door structure disassembly
By disassembling and assigning the federated learning backdoor structure to different attackers, the problem of high computing power consumption in the existing technology is solved, and more efficient backdoor attacks are achieved, which can effectively bypass the FoolsGold defense algorithm.
Patent Information
- Application Number
- CN202411214749.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-30
- Publication Date
- 2025-02-11
AI Technical Summary
The existing federated learning backdoor attack algorithm consumes several times of computing power and time when building multiple backdoor structures, resulting in inefficiency.
By disassembling and assigning the backdoor structure to different attackers, the similarity of the attacker's uploaded parameters is reduced, thereby effectively bypassing the FoolsGold defense algorithm during the model aggregation stage.
It reduces computing power consumption and improves the response speed of malicious attackers. It only needs to build a backdoor structure to overcome the FoolsGold defense algorithm, which significantly improves the efficiency of backdoor attacks.
Smart Images
Figure CN119416863A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of federated learning security, and in particular refers to a backdoor attack method of federated learning based on backdoor structure disassembly. Background Art
[0002] 1. Federated Learning Process
[0003] Federated learning is a distributed model training framework that is greatly affected by the data distribution of participants. According to the data distribution of participants, it can be divided into two categories: iid (independent and identically distributed) and non-iid (non-independent and identically distributed). This invention is mainly aimed at non-iid federated learning.
[0004] Federated stochastic gradient descent is the most common non-iid federated learning model update algorithm. The overall process is as follows: Figure 1 As shown in the figure, the tth round of federated learning training is taken as an example, which includes the following stages:
[0005] (1) In the preparation phase, the central server selects participants for this round of training. The selected participants download the global model G through the central server. t .
[0006] (2) Participant training phase: Participants train according to their local dataset (x i ,y i ) and the global model G t , construct the loss landscape of the participants as the calculation gradient parameter The reference standard, after the model converges, the gradient parameter is obtained
[0007] (3) Parameter upload phase: Participants upload the model’s gradient update parameters to the central server.
[0008] (4) In the model aggregation phase, the central server generates gradient parameters based on the gradient parameters uploaded by the participants. For the global model G of round t t Update and get the global model G of the t+1th round t+1 , the update process is shown in formula (1):
[0009]
[0010] Among them, G t+1 is the global model of the t+1th round, G t is the global model downloaded by the participant from the central server in the preparation phase of round t, η t represents the learning rate of the global model in round t, m represents the number of selected participants, (x i ,yi ) represent the training data set and corresponding label of participant i, represents the gradient parameters calculated by the participants according to their respective loss landscapes.
[0011] The loss landscape changes during the federated learning update process as follows Figure 2 As shown in Figure 1, it is proposed that there are 3 honest participants participating in this round of training. The green, blue, and red parameters represent the calculated gradient parameters of the honest participants according to their respective loss landscapes. And upload these gradient parameters to the central server to update the global model G t , the global model G t →G t+1 →G t+2 Represents the updating process of the global model.
[0012] In summary, non-iid federated learning has the following characteristics:
[0013] (1) Participant local dataset (x i ,y i ) have large differences;
[0014] (2) Model gradient parameters uploaded by participants Similarity is low;
[0015] These characteristics have a significant impact on the design of non-iid federated learning security algorithms.
[0016] 2. Federated Learning Defense Algorithm
[0017] Participants in federated learning may be malicious participants. Malicious participants interfere with the aggregation process of the global model through backdoor attack algorithms. To avoid interference with the global model caused by malicious participants, non-iid federated learning uses various algorithms to monitor backdoor attacks during model training, usually using defense algorithms such as FoolsGold.
[0018] The algorithm assumes that there are multiple malicious attackers in each round of federated learning training, and these malicious attackers share a set of backdoor structures. Based on the above theory, it is determined that there is a higher similarity between malicious attackers than honest participants. Figure 5 shown.
[0019] There are honest participants 1, 2 and malicious attackers 3, 4. The model parameters uploaded by malicious attackers 3 and 4 and The similarity between them is high, and the loss landscapes are basically the same; the model parameters uploaded by honest participants 1 and 2 and The similarity between them is low. Based on this feature, the main process of filtering out attackers in the model aggregation stage is as follows:
[0020] (1) In the model aggregation phase, the central server aggregates the model parameters uploaded by the participants. Before, the cosine distance is used to calculate the similarity cs of the model parameters uploaded by each participant ij , the similarity calculation between participants i and j is shown in formula (2), where is the cumulative amount of gradient parameters uploaded by participant i up to the tth training cycle.
[0021]
[0022] (2) According to the phase cosine similarity cs of each participant ij Evaluate the weight v of the model parameters uploaded by participants when participating in model fusion i , the cosine similarity cs between attackers ij is larger, while the cosine similarity cs between honest participants ij Smaller, resulting in the honest participant weight v i Higher, attacker weight v i The calculation method is shown in formula (3) and (4).
[0023] α i =1-max j (cs i ) (3)
[0024]
[0025] (3) The central server calculates the weight v i Fusion corresponding participants uploaded gradient parameters As shown in formula (5), by giving the attacker a minimum value v i Reduce the attacker's global model G t The total number of participants is m.
[0026]
[0027] Federated Learning Backdoor Attack Algorithm
[0028] In order to overcome the non-iid federated learning defense algorithm, such as the foolsgold defense algorithm, attackers proposed a new federated learning backdoor attack algorithm represented by the DBA (distributed backdoor attack) algorithm.
[0029] The algorithm assumes that there are multiple attackers, such as Figure 4 As shown, these attackers are able to negotiate. These attackers will be the original trigger ( Figure 4 The four white squares in the digital sample on the left) are split and assigned to different attackers, Figure 4 In the federated learning backdoor attack algorithm on the left, the attacker relies on only one trigger (the four white squares in the upper left corner of the picture) to implement the backdoor attack.
[0030] In the DBA backdoor attack algorithm ( Figure 4 On the right side, the original trigger is split into four different triggers (each trigger is a white square distributed in a different position), and the attacker trains the global model G according to different triggers. t , thereby reducing the attacker's ability to upload gradient parameters The cosine similarity of the attacker is used to improve the corresponding parameters of the attacker during model fusion. value, thus overcoming the Foolsgold defense algorithm.
[0031] 3. Deficiencies of Existing Technologies
[0032] The existing federated learning backdoor attack algorithm overcomes the Foolsgold defense algorithm by splitting triggers to build multiple backdoor structures to reduce the attacker similarity and effectively overcome the Foolsgold defense algorithm. However, this method requires several times more computing power and time than conventional federated learning.
[0033] The main reason is that this method requires the construction of multiple backdoor structures. Building backdoor structures requires attackers to perform a large number of model operations based on local data sets and global models. Building multiple backdoors will multiply the number of model operations, thereby increasing computing power consumption and reducing the efficiency of backdoor attacks. Summary of the invention
[0034] The technical problem to be solved by the present invention is to provide a backdoor attack method of federated learning based on backdoor structure disassembly, which reduces computing power consumption and improves the response speed of malicious attackers.
[0035] The present invention provides a backdoor attack method for federated learning based on backdoor structure disassembly, comprising the following steps:
[0036] S1, preparation phase, the attacker sends the global model G from the central server t Download to local;
[0037] S2, before the participant training phase, the attacker decides the backdoor structure distribution based on the misclassified targets;
[0038] S3, the attacker shuts down the global model G t The key neuron set W k The gradient of the neuron node outside the node is switched and used by the local poisoning sample Train the global model G t Generate local poisoning model Local poisoning model The backdoor structure is all concentrated in the key neuron set W k node.
[0039] S4, after getting the local poisoning model Then, the weight set corresponding to the backdoor structure is Split and assign to each attacker, where the total number of attackers is n, and attacker i adjusts the key neuron set W k Corresponding neuron weight attacker i for:
[0040]
[0041] S5, parameter uploading stage, each participant uploads the gradient parameters to the central server;
[0042] S6, model aggregation phase, the central server aggregates the gradient parameters uploaded by each participant, and the global model G t Combine the parameters uploaded by each participant to generate a new global model G t , the key neuron set W of the global model after aggregation k The corresponding part is replaced by the weight set corresponding to the backdoor structure Global Model G t Replaced with local poisoning model
[0043] Step S2 specifically includes: during the poisoned model training process, the global model downloaded by the attacker in the preparation phase is gradually injected with the backdoor during the participant training phase, and the distribution of the backdoor structure in the model is determined in this process.
[0044] Step S3 specifically includes: in the process of injecting the backdoor, the global model firstly processes the input local poisoned sample The predicted value is obtained by analysis, and the loss value is calculated by calculating the difference between the predicted value and the true label. The neurons in the global model are updated according to the calculated loss value. During the update process, each neuron in the model will obtain a corresponding gradient parameter, and the weight of the neuron is updated according to this gradient parameter. The newly generated backdoor structure is randomly distributed at various positions in the global model.
[0045] In step S3, the local poisoning model The formula is:
[0046]
[0047] Step S4 specifically includes the following steps:
[0048] The backdoor structure is transformed to limit the neurons of the k-classified linear classifier layer, and the relevant neuron set is determined as W. k ,The backdoor structure after structural transformation is disassembled and distributed to different attackers.
[0049] The process of the global model replacement algorithm is shown in formula (7). The attacker uses the number of participants n and the learning rate η of the global model to replace t Upload model gradient parameters Make adjustments, is the backdoor structure weight corresponding to the gradient parameter uploaded by the attacker, as shown in formula (8), the total number of attackers is n, η t Represents the learning rate of the global model. Due to the limitation of the backdoor structure, W k For the backdoor structure The decomposition of is equivalent to Dismantle;
[0050]
[0051]
[0052] Will According to formula (9), it is decomposed into:
[0053]
[0054] Will According to the number of attackers, it is divided into etc., and these n items W k , The previous coefficient is adjusted and assigned to the attacker;
[0055]
[0056] attacker i is the corresponding W assigned to attacker i k Neuron weights, when FoolsGold defense performs cosine similarity calculations on the poisoned model parameters uploaded by these attackers, the W of each participant k , The coefficient ratios are not the same.
[0057] In step S6, the aggregated global model W k The corresponding part is replaced by G t Replaced by As shown in equations (12) to (14):
[0058]
[0059]
[0060]
[0061] The beneficial effects of the present invention are as follows: compared with the existing backdoor attack algorithm, the backdoor attack method of federated learning based on backdoor structure disassembly provided by the present invention reduces computing power consumption and improves the response speed of malicious attackers. The existing backdoor attack algorithm needs to overcome the federated learning defense algorithm on the basis of building multiple backdoor structures. The present invention reduces the number of backdoor structures that need to be built by disassembling the backdoor, and only needs to build one backdoor structure to overcome the foolsgold defense algorithm, which effectively reduces the computing power consumption of malicious attackers and improves the efficiency of backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0062] Figure 1 The overall process of federated learning;
[0063] Figure 2 Non-iid federated learning global model update process;
[0064] Figure 3 The update process of the federated learning model mixed with malicious attackers;
[0065] Figure 4 DBA backdoor attack process;
[0066] Figure 5 Select the backdoor structure. DETAILED DESCRIPTION
[0067] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention.
[0068] The backdoor attack method based on federated learning of backdoor structure disassembly provided in the embodiment of the present invention reduces the similarity of parameters uploaded by attackers by disassembling the backdoor structure and distributing it to different attackers. The method in the embodiment of the present invention needs to solve the following two technical problems:
[0069] (1) The backdoor structure is randomly distributed, and the attack algorithm trains the poisoning model through a gradient random algorithm Causes poisoning model The neural network nodes related to the backdoor are randomly distributed, making it difficult to confirm the exact distribution of the backdoor structure.
[0070] (2) Backdoor distribution: After distributing the backdoor structure to each attacker, it is necessary to ensure that the backdoor structure distributed to each attacker has low similarity. If the backdoor structure is only split into multiple parts according to the average neuron weight and then distributed, it cannot effectively reduce the similarity between attackers. Therefore, a backdoor structure distribution algorithm is needed to distribute the backdoor weight to each attacker and ensure that the split backdoor structure is equivalent to the original backdoor after merging in the global model, can be triggered by the trigger in the poisoned sample, and ensure low similarity between attackers.
[0071] In view of the above problems, the technical solutions proposed by the embodiments of the present invention are as follows:
[0072] (1) Random distribution of backdoor structures
[0073] Since the poisoning model is trained by stochastic gradient descent lead to The backdoor structure in the network is usually in a randomly distributed state. From the convolutional layer involving feature extraction to the fully connected layer for feature aggregation, there is a certain correlation with the backdoor structure, making it difficult to confirm the exact distribution of the backdoor structure.
[0074] During the poisoned model training process, the global model downloaded by the attacker in the preparation phase is gradually injected with backdoors during the participant training phase. The distribution of the backdoor structure in the model is determined in this process, as shown in Equation (6).
[0075] In the process of injecting the backdoor, the model first inputs the poisoned sample The predicted value is obtained by analysis, and the loss value is calculated by calculating the difference between the predicted value and the true label. The neurons in the model are updated according to the calculated loss value. During the update process, each neuron in the model will obtain a corresponding gradient parameter, and the weight of the neuron is updated according to this gradient parameter. The newly generated backdoor structure is randomly distributed at various positions in the model.
[0076]
[0077] The goal of this poisoning model training algorithm is to obtain a poisoning model with higher backdoor accuracy, and it does not restrict the distribution of the backdoor structure in the model, which does not meet the requirement of restricting the backdoor structure.
[0078] In order to restrict the backdoor structure, the poisoning model training algorithm needs to be adjusted. It is proposed to restrict the backdoor structure to the neurons related to a certain type of output of the linear classifier layer (proposed to be the kth type), and all neurons connected to the kth type output are named W. k . Remove W from the model k The gradient switches of neurons other than some are turned off. In this case, the model is trained except for W kThe weights of neurons outside the W will not change, and the backdoor structure can be limited to W k middle.
[0079] (2) Backdoor Distribution
[0080] The backdoor structure is transformed to limit the neurons of the k-classified linear classifier layer, and the relevant neuron set is determined as W. k ,The backdoor structure after structural transformation is disassembled and distributed to different attackers.
[0081] The process of the model replacement algorithm is shown in formula (7). The attacker uses the total number of participants m and the learning rate η of the global model t Upload model gradient parameters Make adjustments, is the backdoor structure weight corresponding to the gradient parameter uploaded by the attacker, as shown in formula (8). Due to the limitation of the backdoor structure in W k For the backdoor structure The decomposition of is equivalent to Disassemble.
[0082]
[0083]
[0084] The FoolsGold defense algorithm performs similarity detection on the parameters uploaded by participants, and identifies participants with high similarity as attackers and excludes them. The split structures maintain a low similarity. k , The coefficient ratios of are different. Assuming the number of attackers is n, Disassemble according to formula (9).
[0085]
[0086] Will According to the number of attackers, it is divided into In order to effectively reduce the similarity between attackers, these n items W k , The coefficients before are adjusted and distributed to the attacker, as shown in formula (14).
[0087]
[0088] attacker i is the corresponding W assigned to attacker i kNeuron weights, when FoolsGold defense performs cosine similarity calculations on the poisoned model parameters uploaded by these attackers, the W of each participant k , The coefficient ratios are not the same, so the cosine similarity between attackers is low, which can effectively avoid filtering by FoolsGold defense.
[0089] The backdoor attack method of federated learning based on backdoor structure disassembly provided in an embodiment of the present invention comprises the following steps:
[0090] S1, preparation phase, the attacker sends the global model G from the central server t Download to local computer.
[0091] S2, before the participant training phase, the attacker determines the backdoor structure distribution based on the misclassified target. For example, if the misclassified target is the k-th label, it is located in the fully connected layer and similar output layer of the model. The black weight represents the global model G t Normal weights of the fully connected layer. The red weights represent the nodes distributed in the backdoor structure. The backdoor structure is called W k .
[0092] S3, the attacker shuts down the global model G t Middle W k Gradient switches for neurons outside the node and training using local poisoning samples Train the global model G t Generate poisoning model Poisoning Model The backdoor structure is all concentrated in W k node.
[0093]
[0094] S4, after getting the local poisoning model Then, the weight set corresponding to the backdoor structure is Split and distribute to each attacker, attacker i adjusts W k The corresponding weights are adjusted to
[0095] S5, parameter uploading phase, each participant uploads the gradient parameters to the central server.
[0096] S6, model aggregation phase, the central server aggregates the gradient parameters uploaded by each participant, and the global model G t Combine the parameters uploaded by each participant to generate a new global model G t , the global model after aggregation W k The corresponding part is replaced by G tReplaced by As shown in equations (12) to (14).
[0097]
[0098]
[0099]
[0100] The meanings of the parameters involved in the embodiments of the present invention are shown in Table 1.
[0101] Table 1 Main symbol comparison table
[0102]
[0103]
[0104] Example
[0105] Implementation environment: The specific configuration is GPU model NVIDIA GeForce RTX 3060, operating system 64-bit Windows 11 Professional Edition, and video memory 6023M. The algorithm is designed using Python as the programming language.
[0106] Experimental Dataset: This example uses CIFAR-10, a small image dataset for identifying common objects. It contains 60,000 32x32 color images, which are divided into 10 different categories, with 6,000 images in each category. The dataset is divided into 50,000 training images and 10,000 test images.
[0107] Data Distribution,This experiment will only be conducted in a non-iid federated learning,scenario. The CIFAR-10 dataset will be split according to the Dirichlet,distribution and randomly assigned to each participant.,The amount of data in the participants’ local datasets varies, but there is no,restriction on the types of samples assigned to the participants.
[0108] Federated learning architecture: This example simulates 1 central server and 50 participant computing nodes. The central server randomly selects 10 participants to participate in the training in the preparation stage of each round of federated learning. Since the attack cycle of the data poisoning backdoor attack algorithm is relatively long, this experiment lasts for 60 training cycles. At the same time, in order to ensure the normal testing of backdoor attack-related performance, the attacker will only perform backdoor attacks during the backdoor attack cycle, and participate in federated learning as an honest participant in the rest of the time.
[0109] Federated learning model: ResNet-18 (Residual Network 18) is selected as the global model, with a total of about 11.17 million parameters. The main feature of ResNet is its residual structure, which makes it easier to train deep models. ResNet has achieved good performance in multiple image classification tasks. The model contains a 7x7 convolution input layer, four residual block sequences, a global average pooling layer, and a fully connected layer.
[0110] Experiments were conducted based on the above experimental environment to verify that the present invention can effectively overcome the Foolsgold defense algorithm.
[0111] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.
Claims
1. A backdoor attack method for federated learning based on backdoor structure disassembly, characterized by: The following steps are involved: S1: In the preparation stage of round t of federated learning, the attacker sends the global model G from the central server to t Download to local; S2, before the participant training phase, the attacker decides the backdoor structure distribution based on the misclassified targets; S3, the attacker shuts down the global model G t The key neuron set W k The gradient of the neuron node outside the node is switched and used by the local poisoning sample Train the global model G t Generate local poisoning model Local poisoning model The backdoor structure is all concentrated in the key neuron set W k node; S4, after getting the local poisoning model Then, the weight set corresponding to the backdoor structure is Split and distribute to each attacker, each attacker adjusts the key neuron set W according to his own sequence number i k Corresponding neuron weight attacker i for: Where n represents the total number of participating attackers; S5, parameter uploading stage, each participant uploads the gradient parameters to the central server; S6, model aggregation phase, the central server aggregates the gradient parameters uploaded by each participant, and the global model G t Combine the parameters uploaded by each participant to generate a new global model G t+1 , as the global model of the t+1th round of federated learning training, the key neuron set W of the aggregated global model k The corresponding part is replaced by the set corresponding to the backdoor structure Global Model G t+1 Replaced with local poisoning model 2. The backdoor attack method of federated learning based on backdoor structure disassembly according to claim 1 is characterized in that: Step S2 specifically includes: during the poisoned model training process, the attacker prepares the global model G t Backdoors are gradually injected into participants during the training phase, and the distribution of backdoor structures in the model is determined in this process.
3. The backdoor attack method of federated learning based on backdoor structure disassembly according to claim 1 is characterized in that: Step S3 specifically includes: in the process of injecting the backdoor, the global model firstly processes the input local poisoned sample The predicted value is obtained by analysis, and the loss value is calculated by calculating the difference between the predicted value and the true label. The neurons in the global model are updated according to the calculated loss value. During the update process, each neuron in the model will obtain a corresponding gradient parameter, and the weight of the neuron is updated according to this gradient parameter. The newly generated backdoor structure is randomly distributed at various positions in the global model.
4. The backdoor attack method of federated learning based on backdoor structure disassembly according to claim 1 or 3 is characterized in that: In step S3, the attacker with serial number i locally poisons the model The formula is: in, Represents the poisoned samples and corresponding labels of malicious attackers; η t represents the learning rate of the global model, represents the gradient parameter; n represents the total number of participating attackers.
5. The backdoor attack method of federated learning based on backdoor structure disassembly according to claim 1 is characterized in that: Step S4 The specific steps include: The backdoor structure is restricted to the neurons in the linear classifier layer through backdoor structure transformation, and the relevant neuron set is determined as W k ,The backdoor structure after structural transformation is disassembled and assigned to different attackers; The process of the global model replacement algorithm is shown in formula (7). The attacker needs to replace the global model according to the total number of participants m and the learning rate η of the global model. t Upload model gradient parameters Make adjustments, The backdoor structure weight corresponding to the sum of all attacker uploaded gradient parameters is shown in formula (8). Due to the limitation of the backdoor structure, the backdoor is only distributed in the key neuron set W. k In the example, the attacker has a backdoor structure The decomposition of is equivalent to Dismantle; Will According to formula (9), it is decomposed into: Will According to the number of attackers, it is divided into etc., and these n items W k , The previous coefficient is adjusted and assigned to the attacker; attacker i is the corresponding W assigned to the attacker with serial number i k Neuron weights, when FoolsGold defense performs cosine similarity calculations on the poisoned model parameters uploaded by these attackers, the W of each participant k , The coefficient proportions are not the same; Among them, G t+1 represents the global model at round t+1, and n represents the number of participants.
6. The backdoor attack method of federated learning based on backdoor structure disassembly according to claim 5 is characterized in that: In step S6, the model parameters uploaded by the honest participants are negligible compared to the attackers, and the aggregated global model G t+1 Middle W k The corresponding part is replaced by Lead to G t+1 Equivalent to As shown in equations (12) to (14):