Hidden backdoor attack method, device and product facing vertical federated learning

Abstract

The invention discloses a vertical federated learning-oriented hidden backdoor attack method, device and product, and the method comprises the steps: analyzing two attack modes of an input space and a potential space, and researching the risk that an attacker embeds a backdoor into a vertical federated learning model under the condition that global data or labels are not directly intervened; the input space attack is characterized in that in a vertical federation learning model training process, part of input samples are replaced and a trigger is injected, so that a top-layer model learns association between a backdoor trigger and a target label, and the top-layer model is guided to carry out error classification on the samples with the trigger in a reasoning stage; according to the potential space attack, an attacker directly acts on a feature embedding space of a local model of the attacker in the training process of the vertical federated learning model, and an embedding vector is adjusted by utilizing an optimization strategy so as to generate a specific backdoor response in a top layer model. According to the method, a solid foundation is laid for design and optimization of a defense mechanism, and security improvement of the VFL technology is promoted.

Description

Technical Field

[0001] The present invention belongs to the technical field of machine learning and data privacy protection, and relates to a covert backdoor attack method, device and product, and in particular to a covert backdoor attack method, device and product for vertical federated learning (VFL). Background Art

[0002] In recent years, as countries attach importance to user data security and privacy, strict control has been imposed on the collection and use of data. This makes it difficult to share raw data between different organizations, which in turn forms data silos, seriously hindering the widespread application of machine learning technology. In order to solve this problem, the concept of Federated Learning (FL) came into being, which allows multiple participants to collaboratively train a global model without sharing raw data. FL is mainly divided into two types: horizontal federated learning (HFL) and vertical federated learning (VFL).

[0003] Although backdoor attacks have been widely studied in horizontal federated learning and have shown high success rates and concealment, there are relatively few studies on backdoor attacks in vertical federated learning, and the results are limited. Attackers face unique challenges in the VFL architecture. For example, attackers can only access their local models and some features, and cannot obtain global models or label data, which makes the attack more difficult to implement. At present, some studies rely on training alternative models to implement backdoor attacks, but the effect of alternative models is easily affected by the VFL model structure. In addition, current research does not consider the concealment of attacks enough, and many methods perform poorly when evading defense measures and are easily detected. This is because some methods only simply constrain the norm of the backdoor trigger and fail to fully adapt to the dynamic changes of the embedding distribution during the model training process, resulting in insufficient concealment of the attack. At the same time, there are some backdoor attack methods that are not robust enough when facing different embedding aggregation methods or defense strategies, and it is difficult to achieve consistent results in different application scenarios.

[0004] In summary, the current research on backdoor attacks in vertical federated learning still has certain limitations, especially in terms of improving the concealment and robustness of attacks, which urgently needs further exploration and improvement. Summary of the invention

[0005] The purpose of the present invention is to study the backdoor attack problem in vertical federated learning (VFL). In view of the shortcomings of existing backdoor attack technologies, the present invention proposes two backdoor attack methods: a sample replacement attack based on the input space and an embedding optimization attack based on the latent space. These methods cleverly utilize the gradient information in the training process and significantly improve the effectiveness, concealment and robustness of the attack by optimizing the backdoor triggers or latent embeddings. In addition, the present invention also creatively proposes a new indicator for measuring the concealment of backdoor attacks in VFL, which provides a powerful tool for evaluating and improving backdoor attack technologies.

[0006] The technical solution adopted by the method of the present invention is: a hidden backdoor attack method for vertical federated learning, analyzing two attack modes of input space and latent space, and studying the risk of attackers embedding backdoors into vertical federated learning models without directly intervening in global data or labels;

[0007] The input space attack replaces some input samples and injects triggers, so that the top model learns the association between the backdoor trigger and the target label, thereby guiding the top model to misclassify samples with triggers in the inference stage;

[0008] In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses an optimization strategy to adjust the embedding vector to generate a specific backdoor response in the top model.

[0009] Preferably, the input space attack is specifically implemented by the following steps:

[0010] Step A1: Select target samples;

[0011] The attacker obtains a small number of target class samples, which should be classified as the target class under normal circumstances;

[0012] Step A2: Sample replacement and trigger injection;

[0013] Set the local input of the target category sample to The attacker will Replace with randomly selected samples of other categories And inject trigger T:

[0014]

[0015] Where M is the trigger mask, ⊙ represents the Hadamard product, θ adv 、f adv () are the parameters and model structure of the attacker’s local model, Embedded representation uploaded by the attacker.

[0016] Where M is the trigger mask and ⊙ represents the Hadamard product.

[0017] As a preferred method, further trigger optimization is performed;

[0018] During the training process, the attacker receives gradient information from the active party through the model controlled by it. This gradient information reflects the reaction of the top-level model to the current input. Using the received gradient information, the attacker optimizes the trigger to improve the effectiveness of the attack. The optimization formula is as follows:

[0019]

[0020] in, is the gradient received from the active party, ||T|| 2 is the two-norm regularization term of the trigger, and y and λ are adjustment coefficients.

[0021] Preferably, the latent space attack is specifically implemented by the following steps:

[0022] Step B1: The attacker randomly selects target category samples to initialize malicious embedding V;

[0023] Step B2: For each round, the attacker generates an embedding representation using his own local model;

[0024] Step B3: Replace every D with V target The embedded representation of the sample, D target The target category samples held by the attacker;

[0025] Step B4: The attacker uploads the embedding to the active party;

[0026] Step B5: The attacker receives the gradient returned by the active party;

[0027] Step B6: Accumulate each D target The gradient of the sample and take the mean;

[0028] Step B7: Calculate the deviation loss L dev , the task loss L calculated by the active party ori and the final loss L all ;

[0029] Step B8: Update the malicious embedding V and vertical federated learning model parameters.

[0030] Preferably, in step B7:

[0031]

[0032] L all =γ·L ori +λ·L dev ;

[0033] Among them, γ and λ are adjustment coefficients; θ adv 、f adv () are the sample inputs mastered by the attacker, the parameters of the attacker’s local model and the model structure respectively.

[0034] As a preferred method, a concealment index is used to measure the concealment of backdoor attacks in vertical federated learning;

[0035] The concealment index is:

[0036]

[0037] Among them, D p is a dataset with a backdoor trigger, represents the embedding of the attacker, y is the true label, represents the embedding of normal samples, To predict the label, It is predicted to be Sample embedding of is the sample input controlled by the attacker, s and z both represent the embeddings in the corresponding sets, and E[||s||2] represents the mean of the embedding norm.

[0038] The technical solution adopted by the device of the present invention is: a covert backdoor attack device for vertical federated learning, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the covert backdoor attack method for vertical federated learning when executing the program.

[0039] The technical solution adopted by the product of the present invention is: a covert backdoor attack product for vertical federated learning, including a computer program, which implements the covert backdoor attack method for vertical federated learning when executed by a processor.

[0040] Compared with the prior art, the beneficial effects of the present invention include:

[0041] (1) This paper proposes a framework for evaluating the potential risk of backdoor attacks in vertical federated learning (VFL), and implements and optimizes backdoor attacks under the vertical federated learning (VFL) architecture. This framework deeply analyzes the two attack modes of input space and latent space, and studies the risk of attackers embedding backdoors into the model without directly intervening in global data or labels. It lays a solid foundation for the design and optimization of defense mechanisms and promotes the security improvement of VFL technology.

[0042] (2) This paper proposes an input space attack that combines sample replacement and data poisoning techniques. In this mode, the attacker does not need to directly access or tamper with the global data labels. Instead, the attacker embeds carefully designed backdoor triggers into the local data set to indirectly guide the top-level model to mistakenly associate these specific data samples with misleading labels. The core of this strategy lies in the fine optimization of the input space backdoor triggers and the introduction of regularization strategies, aiming to maximize the concealment of the attack while enhancing the attack effect and avoiding easy identification by the defense mechanism.

[0043] (3) This paper proposes a latent space attack that focuses on the tampering of the model feature space representation. The attacker directly acts on the feature embedding space of his local model and uses optimization strategies to carefully adjust the embedding vector to establish a strong correlation with the target category. This process also includes in-depth optimization of malicious embeddings and clever application of bias loss to cope with the dynamic changes in the embedding distribution, ensuring that the attack remains efficient and hidden in the complex and changing VFL environment.

[0044] (4) The present invention designs a VFL backdoor concealment measurement standard, which provides a scientific basis for evaluating the concealment of backdoor attacks by quantifying the consistency difference between attack embedding and normal embedding. This standard not only helps attackers to conduct accurate risk assessment before launching an attack, but also dynamically adjust strategies during the attack process to ensure that the attack behavior achieves the expected destructive effect without being detected by the detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0046] Figure 1 A schematic diagram of a vertical federated learning scenario in an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of the potential risk principle of backdoor attack in an embodiment of the present invention;

[0048] Figure 3 This is a comparison chart of attack effects under the model clipping defense method in the experiment of an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0050] This paper focuses on the potential risk of backdoor attacks in the Vertical Federated Learning (VFL) environment and constructs a comprehensive research framework. This framework not only deeply analyzes the potential threat of backdoor attacks in the VFL architecture, but also innovatively proposes two attack strategies: sample replacement attack based on input space and embedding optimization attack based on latent space. Through these two methods, this paper realizes the effective backdoor implantation of the VFL top-level model while ensuring the high concealment and robustness of the attack. In addition, we also designed a concealment measurement index to evaluate the concealment of backdoor attacks in VFL.

[0051] Please see Figure 1 and Figure 2 This embodiment provides a hidden backdoor attack method for vertical federated learning, analyzes two attack modes, input space and latent space, and studies the risk of attackers embedding backdoors into vertical federated learning models without directly intervening in global data or labels;

[0052] The input space attack replaces some input samples and injects triggers, so that the top model (the classification model mastered by the active party) learns the association between the backdoor trigger and the target label, thereby guiding the top model to misclassify samples with triggers during the inference phase;

[0053] In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses an optimization strategy to adjust the embedding vector to generate a specific backdoor response in the top model.

[0054] This paper proposes a VFL-oriented backdoor attack potential risk research framework for analyzing and evaluating the potential backdoor attack risks in VFL. In the VFL architecture, multiple participants jointly hold different feature subsets of the same batch of samples, of which only one participant (usually referred to as the active party) has the label information of the samples. The other participants (usually referred to as the passive party) are responsible for extracting the local feature embeddings of the samples through their local models and transmitting these embeddings to the active party for global model training and prediction.

[0055] Given the unique architecture of VFL, attackers have the opportunity to exploit local features and models under their control to launch backdoor attacks on top-level models without alerting other participants. To address this challenge, the research framework of this paper deeply explores the potential paths of backdoor attacks. The overall framework is as follows: Figure 1 shown.

[0056] In one embodiment, the present invention proposes an input-space attack via sample replacement (IASR) method for the input domain in VFL. The method replaces some input samples and injects triggers, so that the top-level model learns the association between the backdoor trigger and the target label, thereby guiding the top-level model to misclassify samples with triggers in the inference stage. The specific implementation steps are as follows.

[0057] Select target samples: Assume that the attacker has a small number of samples of the target category, which should be classified as the target category under normal circumstances. This assumption is reasonable because the attacker can use its local features to classify samples and obtain a small number of target category samples.

[0058] Sample replacement and trigger injection: During the training process, the attacker selects a sample of a target category, replaces its local input with a sample of another category, and injects a trigger into the replaced input. The local input of the target category sample is set to The attacker replaces it with a randomly selected sample of another category. And inject trigger T:

[0059]

[0060] Where M is the trigger mask, ⊙ represents the Hadamard product, θ adv 、f adv () are the parameters and model structure of the attacker’s local model, Embedded representation uploaded by the attacker.

[0061] Trigger optimization: In order to improve the effectiveness of the attack, the attacker optimizes the trigger during the training process. During the training process, the attacker receives gradient information from the active party through the model it controls. These gradient information reflects the reaction of the top-level model to the current input. Using the received gradient information, the attacker optimizes the trigger to improve the effectiveness of the attack. The optimization process usually involves minimizing a loss function that measures the extent to which samples with triggers are misclassified as target categories. At the same time, in order to maintain the stealth of the attack, the attacker introduces a regularization term to limit the amplitude of the trigger and prevent it from causing excessive changes in the input space. The optimization formula is as follows:

[0062]

[0063] in, is the gradient received from the active party, ||T||2 is the two-norm regularization term of the trigger, and y and λ are adjustment coefficients.

[0064] In one embodiment, in a vertical federated learning (VFL) environment, when an attacker can directly access and modify its locally generated local embeddings, the present invention proposes a latent space-based backdoor attack method (Latent-space Attack via Embedding Optimization, LAEO). Compared with input domain-based attacks, the LAEO method is more covert and effective because it operates directly in the latent space of the model and can more accurately affect the decision boundary of the top model. The specific implementation steps are as follows.

[0065] The specific implementation includes the following steps:

[0066] Step B1: The attacker randomly selects target category samples to initialize malicious embedding V;

[0067] Step B2: For each round, the attacker generates an embedding representation using his own local model (bottom-level model);

[0068] Step B3: Replace every D with V target Feature embedding of samples, D target The target category samples held by the attacker;

[0069] Step B4: The attacker uploads the embedding to the active party;

[0070] Step B5: The attacker receives the gradient returned by the active party;

[0071] Step B6: Accumulate each D target The gradient of the sample and take the mean;

[0072] Step B7: Calculate the deviation loss L dev , the active party calculates the task loss L ori and the final loss L all ;

[0073] Step B8: Update the malicious embedding V and vertical federated learning model parameters.

[0074] The attacker replaces the local embedding of the target category sample with the malicious embedding V, guiding the top-level model to learn the association between the malicious embedding and the target category during training.

[0075] The attacker receives gradient information from the active party. These gradient information reflects the top model’s response to the malicious embedding and is the key to optimizing the malicious embedding. The attacker optimizes the malicious embedding V through the received gradient information. In order to ensure the concealment of the malicious embedding during the training process, the attacker introduces the deviation loss L dev This loss function measures the malicious embedding and the target category sample set D held by the attacker. targetThe distance in the latent space. By minimizing this distance, the attacker can ensure that the malicious embedding does not deviate significantly from the distribution of the normal embedding, thereby increasing the stealth of the attack. Deviation loss:

[0076]

[0077] Among them, D target is the target category sample set held by the attacker. The final loss function L all It consists of two parts: original task loss and deviation loss:

[0078] L all =γ·L ori +λ·L dev ,

[0079] Where L ori is the task loss calculated by the active party, γ and λ are adjustment coefficients; θ adv 、f adv () are the sample inputs, parameters of the attacker’s local model, and model structure, respectively. Through this optimization method, malicious embeddings can guide the top-level model to make incorrect classification decisions without significantly deviating from the normal embedding distribution.

[0080] In one embodiment, in a vertical federated learning (VFL) environment, the concealment of a backdoor attack is crucial to the success of the attack. In order to quantitatively evaluate this concealment, the present invention proposes a new concealment metric that comprehensively considers the source consistency between the attacker embedding and the normal embedding and the target consistency between the attacker embedding and the target category embedding.

[0081] Source consistency measures the distance between the embedding attacked by the backdoor and the embedding of normal samples of the same category. This indicator reflects the similarity between the attacker's embedding and the normal embedding in the latent space, that is, whether the attacker's embedding is close enough to the normal embedding distribution to avoid being identified as anomalies by the detection mechanism. Target consistency measures the distance between the attacked embedding and the normal sample embedding of the target category in the top model. This indicator reflects the closeness of the attacker's embedding to the target category embedding in the latent space, that is, whether the attacker's embedding can effectively guide the top model to classify samples with triggers as the target category. The calculation formula of the concealment index is:

[0082]

[0083] Among them, D p is a dataset with a backdoor trigger, represents the embedding of the attacker, y is the true label, represents the embedding of normal samples, To predict the label, It is predicted to be The sample embedding of . is the sample input controlled by the attacker, s and z both represent the embeddings in the corresponding sets, and E[||s||2] represents the mean of the embedding norm.

[0084] By calculating the concealment index AS, the concealment level of backdoor attacks in VFL can be quantitatively evaluated. The smaller the AS value, the closer the attacker's embedding is to the normal embedding distribution and conforms to the top-level model knowledge. Therefore, the higher the concealment, the more difficult the attack is to detect. This provides an important reference for defenders to design and implement more effective defense strategies to deal with backdoor attacks.

[0085] This embodiment also provides a hidden backdoor attack device for vertical federated learning, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the hidden backdoor attack method for vertical federated learning is implemented.

[0086] This embodiment also provides a covert backdoor attack product for vertical federated learning, including a computer program, characterized in that when the computer program is executed by a processor, the covert backdoor attack method for vertical federated learning is implemented.

[0087] The present invention is further described below through specific experiments.

[0088] This experiment selected three data sets, CIFAR-10, CIFAR-100 and CINIC-10. CIFAR-10 is used as a baseline data set. CIFAR-100 is used to evaluate the effect of the method of the present invention in multi-category scenarios, and CINIC-10 is used to evaluate large data set scenarios. This experiment selected three existing studies as comparison methods: LR-BA, VILLAIN, and SDDP. The default poisoning ratio of CIFAR-10 and CINIC-10 is 1%, and that of CIFAR-100 is 0.1%. The number of known labeled samples is equal to the number of poisoned samples. This experiment used two indicators commonly used in backdoor attacks, the clean sample accuracy BA and the backdoor attack success rate ASR. At the same time, this experiment uses the AS defined in the present invention to measure the attack concealment.

[0089] The main experimental results are shown in Table 1 below, where Clean represents the effect when there is no attack.

[0090] Compared with the comparison methods, the proposed method achieves higher effectiveness and improved concealment. Compared with the static attack method VILLAIN, the dynamic attack methods SDDP, IASR and LAEO show superior performance, especially on CIFAR-100. The effectiveness of VILLAIN mainly depends on the size of its trigger relative to the clean embedding. Static triggers require a long training time to achieve high amplitudes, which is impractical because the active party will not extend the training time if the model accuracy cannot be improved. Both input space and latent space attack methods are able to achieve good attack results. However, latent space attacks, especially SDDP and LAEO, show better concealment because they can directly constrain the uploaded feature embedding data. Among the latent space attack methods, LAEO outperforms SDDP in both attack effectiveness and concealment due to its embedding optimization mechanism with hidden constraints. In addition, it can be observed that IASR outperforms LR-BA, which is an input space attack that can generate optimized embeddings for backdoor samples with input space triggers. Under the more realistic threat model used in the present invention, the performance of LR-BA is not ideal. Specifically, LR-BA relies on a proxy inference head to simulate the top model. However, the top-level model used in the present invention is more complex and therefore more challenging. At the same time, the embedding dimension shared between different participants in the present invention is large, and the generalization performance of the model after LR-BA fine-tuning is poor.

[0091] Table 1

[0092]

[0093] This experiment evaluates the attack in the case of 2, 4, and 8 passive parties, and the experimental results are shown in Table 2, where K represents the number of participants. BA decreases as K increases, because the larger K is, the more difficult it is for each underlying model to learn. In the scenario with 8 passive participants, LAEO outperforms other methods in almost all metrics, indicating the effectiveness of LAEO in multi-party scenarios. On the CIFAR-10 and CINIC-10 datasets with 8 passive participants, LAEO significantly outperforms IASR, highlighting the advantage of latent space attacks over input space attacks. In addition, this experiment observes that VILLAIN exhibits lower BA overall compared to other methods.

[0094] Table 2

[0095]

[0096] Comparison of the effects of attack methods under model clipping defense methods Figure 3As shown in the figure, it can be seen that IASR and LAEO are more stable and have better attack effects than other methods. The decrease of ASR is accompanied by the decrease of BA, which shows that this defense method is not effective against our attack method.

[0097] The experimental results of the attack method under the TeCo defense method are shown in Table 3. The experimental results show that TeCo has low detection accuracy for backdoor samples. The main reason is that the active party in vertical federated learning can only detect the received feature embedding, and the feature embedding is more sensitive than the sample data. Therefore, under different degrees of damage, clean samples and backdoor samples will show similar performance, making TeCo invalid. Compared with the effects of VILLAIN and SDDP, the ASR of the method of the present invention remains above 94.5%.

[0098] Table 3

[0099]

[0100] The experimental results of the attack method under anomaly detection are shown in Table 4. The experimental results show that the lower the AS value of the attack method, the worse the anomaly detection effect and the stronger the attack capability. This proves that the AS index proposed in the present invention can effectively measure the concealment of backdoor attacks.

[0101] Table 4

[0102]

[0103] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0104] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A covert backdoor attack method for vertical federated learning, characterized by: We analyze the two attack modes, input space and latent space, and study the risk of attackers embedding backdoors into vertical federated learning models without directly intervening in global data or labels. The input space attack replaces some input samples and injects triggers, so that the top model learns the association between the backdoor trigger and the target label, thereby guiding the top model to misclassify samples with triggers in the inference stage; In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses an optimization strategy to adjust the embedding vector to generate a specific backdoor response in the top model.

2. The hidden backdoor attack method for vertical federated learning according to claim 1 is characterized in that: The input space attack is specifically implemented by the following steps: Step A1: Select target samples; The attacker obtains a small number of target class samples, which should be classified as the target class under normal circumstances; Step A2: Sample replacement and trigger injection; Set the local input of the target category sample to The attacker will Replace with randomly selected samples of other categories And inject trigger T: Where M is the trigger mask, ⊙ represents the Hadamard product, θ adv 、f adv () are the parameters and model structure of the attacker’s local model, Embedded representation uploaded by the attacker.

3. The covert backdoor attack method for vertical federated learning according to claim 2 is characterized in that: Further optimize triggers; The attacker receives gradient information from the active party through the model under its control. This gradient information reflects the reaction of the top-level model to the current input. Using the received gradient information, the attacker optimizes the trigger to improve the effectiveness of the attack. The optimization formula is as follows: in, is the gradient received from the active party, ||T||2 is the two-norm regularization term of the trigger, and γ and λ are the adjustment coefficients.

4. The hidden backdoor attack method for vertical federated learning according to claim 1 is characterized in that: The potential space attack is specifically implemented by the following steps: Step B1: The attacker randomly selects target category samples to initialize malicious embedding V; Step B2: For each round, the attacker generates an embedding representation using his own local model; Step B3: Replace every D with V target The embedded representation of the sample, D target The target category samples held by the attacker; Step B4: The attacker uploads the embedding to the active party; Step B5: The attacker receives the gradient returned by the active party; Step B6: Accumulate each D target The gradient of the sample’s embedding representation is averaged; Step B7: Calculate the deviation loss L dev , the task loss L calculated by the active party ori and the final loss L all ; Step B8: Update the malicious embedding V and vertical federated learning model parameters.

5. The hidden backdoor attack method for vertical federated learning according to claim 4 is characterized in that: In step B7: L all =γ·L ori +λ·L dev ; Among them, γ and λ are adjustment coefficients; θ adv 、f adv () are the sample inputs controlled by the attacker, the parameters of the attacker’s local model and the model structure respectively.

6. The covert backdoor attack method for vertical federated learning according to any one of claims 1 to 5, characterized in that: Use the concealment index to measure the concealment of backdoor attacks in vertical federated learning; The concealment index is: Among them, D p is a dataset with a backdoor trigger, represents the attacker’s embedding, y is the true label, represents the embedding of normal samples, To predict the label, It is predicted to be Sample embedding of is the sample input controlled by the attacker, s and z both represent the embeddings in the corresponding sets, and E[||s||2] represents the mean of the embedding norm.

7. A concealed backdoor attack device for vertical federated learning, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the hidden backdoor attack method for vertical federated learning as described in any one of claims 1 to 6.

8. A covert backdoor attack product for vertical federated learning, comprising a computer program, characterized in that: When the computer program is executed by a processor, the hidden backdoor attack method for vertical federated learning as described in any one of claims 1 to 6 is implemented.

Images