Covert backdoor attack methods, equipment, and products for vertical federated learning

Abstract

This invention discloses a covert backdoor attack method, device, and product for vertical federated learning. The method analyzes two attack modes: input space and latent space, and studies the risk of an attacker embedding a backdoor into a vertical federated learning model without directly intervening in global data or labels. The input space attack replaces some input samples and injects triggers during the training of the vertical federated learning model, causing the top-level model to learn the association between the backdoor trigger and the target label, thereby guiding the top-level model to misclassify samples with triggers during the inference phase. The latent space attack directly affects the feature embedding space of the local model during the training of the vertical federated learning model, using optimization strategies to adjust the embedding vectors to generate a specific backdoor response in the top-level model. This invention lays a solid foundation for the design and optimization of defense mechanisms and promotes the security improvement of VFL technology.

Description

Technical Field

[0001] The present invention belongs to the technical field of machine learning and data privacy protection, and relates to a covert backdoor attack method, device and product, and in particular to a covert backdoor attack method, device and product for vertical federated learning (VFL). Background Art

[0002] In recent years, as countries increasingly prioritize user data security and privacy, stricter controls have been implemented on data collection and use. This has made it difficult to share raw data between organizations, leading to the creation of data silos and severely hindering the widespread adoption of machine learning. To address this issue, the concept of federated learning (FL) has emerged. It allows multiple participants to collaboratively train a global model without sharing raw data. FL is primarily categorized into two types: horizontal federated learning (HFL) and vertical federated learning (VFL).

[0003] While backdoor attacks in horizontal federated learning have been extensively studied and demonstrated high success rates and stealth, research on backdoor attacks in vertical federated learning is relatively limited and has had limited success. Attackers in VFL architectures face unique challenges. For example, they only have access to the local model and some features, without access to the global model or labeled data, making attacks more difficult to execute. Some current research relies on training surrogate models to implement backdoor attacks, but the effectiveness of these surrogate models is easily affected by the VFL model structure. Furthermore, current research has insufficiently considered the stealthiness of attacks, resulting in many methods performing poorly in evading defenses and being easily detected. This is because some methods simply constrain the norm of the backdoor triggers and fail to fully adapt to the dynamic changes in the embedding distribution during model training, resulting in insufficient attack stealth. Furthermore, some backdoor attack methods lack robustness against different embedding aggregation methods or defense strategies, making it difficult to achieve consistent results across different application scenarios.

[0004] In summary, current research on backdoor attacks in vertical federated learning still has certain limitations, especially in terms of improving the concealment and robustness of attacks, which urgently needs further exploration and improvement. Summary of the Invention

[0005] The purpose of the present invention is to study the problem of backdoor attacks in vertical federated learning (VFL). In response to the shortcomings of existing backdoor attack technologies, the present invention proposes two backdoor attack methods: a sample replacement attack based on the input space and an embedding optimization attack based on the latent space. These methods cleverly utilize the gradient information in the training process and significantly improve the effectiveness, stealth, and robustness of the attack by optimizing the backdoor triggers or latent embeddings. In addition, the present invention also creatively proposes a new indicator for measuring the stealth of backdoor attacks in VFL, providing a powerful tool for evaluating and improving backdoor attack technologies.

[0006] The method of the present invention adopts the following technical solutions: a covert backdoor attack method for vertical federated learning, analyzing two attack modes, input space and latent space, and studying the risk of attackers embedding backdoors into vertical federated learning models without directly interfering with global data or labels;

[0007] The input space attack replaces some input samples and injects triggers, causing the top-level model to learn the association between the backdoor triggers and the target labels, thereby causing the top-level model to misclassify samples with triggers during the inference phase.

[0008] In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses optimization strategies to adjust the embedding vectors to generate specific backdoor responses in the top model.

[0009] Preferably, the input space attack is specifically implemented by the following steps:

[0010] Step A1: Select target samples;

[0011] The attacker obtains a small number of target class samples, which should be classified as the target class under normal circumstances;

[0012] Step A2: Sample replacement and trigger injection;

[0013] Set the local input of the target category sample to be The attacker will Replace with randomly selected samples of other categories And inject trigger T:

[0014]

[0015] Where M is the trigger mask, ⊙ represents the Hadamard product, θ adv 、f adv () are the parameters and model structure of the attacker’s local model, Embedded representation uploaded by the attacker.

[0016] Where M is the trigger mask and ⊙ represents the Hadamard product.

[0017] As a preferred option, further trigger optimization is performed;

[0018] During training, the attacker receives gradient information from the active party through the model it controls. This gradient information reflects the top-level model's response to the current input. Using the received gradient information, the attacker optimizes the trigger to improve the effectiveness of the attack. The optimization formula is as follows:

[0019]

[0020] in, is the gradient received from the active party, ||T|| 2 is the two-norm regularization term of the trigger, and y and λ are adjustment coefficients.

[0021] Preferably, the latent space attack is specifically implemented by the following steps:

[0022] Step B1: The attacker randomly selects target category samples to initialize the malicious embedding V;

[0023] Step B2: For each round, the attacker generates an embedding representation using its own local model;

[0024] Step B3: Replace every D with V target The embedded representation of the sample, D target Target category samples held by the attacker;

[0025] Step B4: The attacker uploads the embed to the active party;

[0026] Step B5: The attacker receives the gradient returned by the active party;

[0027] Step B6: Accumulate each D target The gradient of the sample and take the mean;

[0028] Step B7: Calculate the deviation loss L dev , the task loss L calculated by the active party ori and the final loss L all ;

[0029] Step B8: Update the malicious embedding V and vertical federated learning model parameters.

[0030] Preferably, in step B7:

[0031]

[0032] L all =γ·L ori +λ·L dev ;

[0033] Among them, γ and λ are adjustment coefficients; θ adv 、f adv () are the sample inputs mastered by the attacker, the parameters of the attacker’s local model, and the model structure respectively.

[0034] As a preferred approach, a concealment index is used to measure the concealment of backdoor attacks in vertical federated learning;

[0035] The concealment index is:

[0036]

[0037] Among them, D p is a dataset with a backdoor trigger, represents the attacker’s embedding, y is the true label, represents the embedding of normal samples, To predict the label, The prediction is Sample embedding of is the sample input controlled by the attacker, s and z both represent the embeddings in the corresponding set, and E[||s||2] represents the mean of the embedding norm.

[0038] The technical solution adopted by the device of the present invention is: a covert backdoor attack device for vertical federated learning, including a memory, a processor and a computer program stored on the memory and runnable on the processor, and when the processor executes the program, it implements the covert backdoor attack method for vertical federated learning.

[0039] The technical solution adopted by the product of the present invention is: a covert backdoor attack product for vertical federated learning, including a computer program, which implements the covert backdoor attack method for vertical federated learning when executed by a processor.

[0040] Compared with the prior art, the beneficial effects of the present invention include:

[0041] (1) This paper proposes a framework for assessing the potential risk of backdoor attacks in vertical federated learning (VFL). It implements and optimizes backdoor attacks within the VFL architecture. By deeply analyzing both input and latent space attack modes, this framework investigates the risk of attackers embedding backdoors into the model without directly interfering with global data or labels. This framework lays a solid foundation for the design and optimization of defense mechanisms, and promotes the security of VFL technology.

[0042] (2) This paper proposes an input-space attack that combines sample replacement and data poisoning techniques. In this mode, the attacker does not need to directly access or tamper with global data labels. Instead, by embedding carefully designed backdoor triggers into the local dataset, the attacker indirectly guides the top-level model to mistakenly associate these specific data samples with misleading labels. The core of this strategy lies in the fine-grained optimization of the input-space backdoor triggers and the introduction of a regularization strategy, aiming to enhance the attack effect while maximizing the stealth of the attack and preventing it from being easily identified by defense mechanisms.

[0043] (3) This paper proposes a latent space attack that focuses on tampering with the model's feature space representation. The attacker directly acts on the feature embedding space of their local model and uses optimization strategies to carefully adjust the embedding vectors to establish a strong correlation with the target class. This process also includes in-depth optimization of malicious embeddings and clever application of bias loss to cope with dynamic changes in the embedding distribution, ensuring that the attack remains efficient and covert in the complex and changing VFL environment.

[0044] (4) This paper designs a VFL backdoor stealth metric that provides a scientific basis for evaluating the stealth of backdoor attacks by quantifying the difference in consistency between attack embeddings and normal embeddings. This metric not only helps attackers conduct accurate risk assessments before launching an attack, but also enables them to dynamically adjust their strategies during the attack, ensuring that the attack achieves the desired destructive effect without being detected by the detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The technical solution of the present invention is further illustrated below using embodiments and specific implementation methods. In addition, some drawings are also used in the process of illustrating the technical solution. For those skilled in the art, other drawings and the intention of the present invention can be obtained based on these drawings without making any creative efforts.

[0046] Figure 1 This is a schematic diagram of a vertical federated learning scenario in an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of the potential risk principle of backdoor attacks according to an embodiment of the present invention;

[0048] Figure 3 This is a comparison chart of attack effects under the model clipping defense method in the experiment of an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0050] This paper focuses on the potential risks of backdoor attacks in the Vertical Federated Learning (VFL) environment and constructs a comprehensive research framework. This framework not only deeply analyzes the potential threats of backdoor attacks in the VFL architecture, but also innovatively proposes two attack strategies: a sample replacement attack based on the input space and an embedding optimization attack based on the latent space. Through these two methods, this paper achieves effective backdoor implantation in the VFL top-level model while ensuring the high stealth and robustness of the attack. In addition, we also design a stealth metric to evaluate the stealthiness of backdoor attacks in VFL.

[0051] Please see Figure 1 and Figure 2 This embodiment provides a covert backdoor attack method for vertical federated learning. It analyzes two attack modes, input space and latent space, and studies the risk of attackers embedding backdoors into vertical federated learning models without directly interfering with global data or labels.

[0052] The input space attack replaces some input samples and injects triggers, causing the top-level model (the classification model controlled by the active party) to learn the association between the backdoor triggers and the target label, thereby causing the top-level model to misclassify samples with triggers during the inference phase.

[0053] In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses optimization strategies to adjust the embedding vectors to generate specific backdoor responses in the top model.

[0054] This paper proposes a VFL-oriented backdoor attack potential risk research framework for analyzing and evaluating potential backdoor attack risks in VFL. In the VFL architecture, multiple participants jointly hold different feature subsets of the same batch of samples, of which only one participant (usually called the active party) has the sample label information. The other participants (usually called the passive parties) are responsible for extracting local feature embeddings of the samples through their local models and transmitting these embeddings to the active party for global model training and prediction.

[0055] Given the unique architecture of VFL, attackers have the opportunity to exploit local features and models under their control to launch backdoor attacks on top-level models without alerting other participants. To address this challenge, the research framework of this paper deeply explores the potential paths of backdoor attacks. The overall framework is as follows: Figure 1 shown.

[0056] In one embodiment, the present invention proposes an input-space attack via sample replacement (IASR) method for the input domain in VFL. This method replaces some input samples and injects triggers, enabling the top-level model to learn the association between the backdoor triggers and the target label. This leads the top-level model to misclassify samples with triggers during the inference phase. The specific implementation steps are as follows.

[0057] Select target samples: Assume that the attacker has a small number of samples of the target category, which should be classified as the target category under normal circumstances. This assumption is reasonable because the attacker can use its local features to classify samples and obtain a small number of target category samples.

[0058] Sample replacement and trigger injection: During the training process, the attacker selects a sample of the target category, replaces its local input with a sample of another category, and injects a trigger into the replaced input. The attacker replaces it with randomly selected samples of other categories And inject trigger T:

[0059]

[0060] Where M is the trigger mask, ⊙ represents the Hadamard product, θ adv 、f adv () are the parameters and model structure of the attacker’s local model, Embedded representation uploaded by the attacker.

[0061] Trigger optimization: In order to improve the effectiveness of the attack, the attacker optimizes the trigger during the training process. During the training process, the attacker receives gradient information from the active party through the model it controls. These gradient information reflects the response of the top-level model to the current input. Using the received gradient information, the attacker optimizes the trigger to improve the effectiveness of the attack. The optimization process usually involves minimizing a loss function that measures the extent to which samples with triggers are misclassified as target categories. At the same time, in order to maintain the stealth of the attack, the attacker introduces a regularization term to limit the amplitude of the trigger to prevent it from causing excessive changes in the input space. The optimization formula is as follows:

[0062]

[0063] in, is the gradient received from the active party, ||T||2 is the two-norm regularization term of the trigger, and y and λ are adjustment coefficients.

[0064] In one embodiment, in a vertical federated learning (VFL) environment, when an attacker can directly access and modify locally generated local embeddings, the present invention proposes a latent-space attack via Embedding Optimization (LAEO)-based backdoor attack method. Compared with input domain-based attacks, the LAEO method is more covert and effective because it operates directly in the model's latent space, which can more accurately influence the decision boundary of the top-level model. The specific implementation steps are as follows.

[0065] The specific implementation includes the following steps:

[0066] Step B1: The attacker randomly selects target category samples to initialize the malicious embedding V;

[0067] Step B2: For each round, the attacker generates an embedding representation using its own local model (bottom-level model);

[0068] Step B3: Replace every D with V target Feature embedding of the sample, D target Target category samples held by the attacker;

[0069] Step B4: The attacker uploads the embed to the active party;

[0070] Step B5: The attacker receives the gradient returned by the active party;

[0071] Step B6: Accumulate each D target The gradient of the sample and take the mean;

[0072] Step B7: Calculate the deviation loss L dev , the active party calculates the task loss L ori and the final loss L all ;

[0073] Step B8: Update the malicious embedding V and vertical federated learning model parameters.

[0074] The attacker replaces the local embedding of the target category sample with the malicious embedding V, guiding the top-level model to learn the association between the malicious embedding and the target category during training.

[0075] The attacker receives gradient information from the active party. These gradient information reflects the top model’s response to the malicious embedding and is the key to optimizing the malicious embedding. The attacker optimizes the malicious embedding V through the received gradient information. In order to ensure the concealment of the malicious embedding during training, the attacker introduces the deviation loss L dev The loss function measures the malicious embedding and the target category sample set D held by the attacker. targetThe distance in the latent space. By minimizing this distance, the attacker can ensure that the malicious embedding does not deviate significantly from the distribution of the normal embedding, thereby increasing the stealth of the attack. Deviation loss:

[0076]

[0077] Among them, D target is the target category sample set held by the attacker. The final loss function L all It consists of two parts: original task loss and deviation loss:

[0078] L all =γ·L ori +λ·L dev ,

[0079] Among them L ori is the task loss calculated for the active party, γ and λ are adjustment coefficients; θ adv 、f adv () are the sample inputs controlled by the attacker, the parameters of the attacker’s local model, and the model structure, respectively. Through this optimization method, malicious embeddings can guide the top-level model to make incorrect classification decisions without significantly deviating from the normal embedding distribution.

[0080] In one embodiment, in a vertical federated learning (VFL) environment, the stealthiness of a backdoor attack is crucial to its success. To quantitatively assess this stealth, we propose a new stealth metric that comprehensively considers both the source consistency between the attacker's embedding and the normal embedding, and the target consistency between the attacker's embedding and the target class embedding.

[0081] Source consistency measures the distance between the embedding of the backdoor attack and the embedding of normal samples of the same category. This indicator reflects the similarity between the attacker's embedding and the normal embedding in the latent space, that is, whether the attacker's embedding is close enough to the normal embedding distribution to avoid being identified as anomaly by the detection mechanism. Target consistency measures the distance between the attacked embedding and the embedding of normal samples of the target category in the top model. This indicator reflects the closeness of the attacker's embedding to the target category embedding in the latent space, that is, whether the attacker's embedding can effectively guide the top model to classify samples with triggers as the target category. The calculation formula of the concealment index is:

[0082]

[0083] Among them, D p is a dataset with a backdoor trigger, represents the attacker’s embedding, y is the true label, represents the embedding of normal samples, To predict the label, The prediction is The sample embedding of . is the sample input controlled by the attacker, s and z both represent the embeddings in the corresponding set, and E[||s||2] represents the mean of the embedding norm.

[0084] By calculating the stealth index (AS), we can quantitatively assess the stealth level of backdoor attacks in VFL. A smaller AS value indicates that the attacker's embedding is closer to the normal embedding distribution and conforms to the top-level model knowledge. Consequently, the stealth is higher and the attack is more difficult to detect. This provides an important reference for defenders to design and implement more effective defense strategies against backdoor attacks.

[0085] This embodiment also provides a covert backdoor attack device for vertical federated learning, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the covert backdoor attack method for vertical federated learning is implemented.

[0086] This embodiment also provides a covert backdoor attack product for vertical federated learning, including a computer program, characterized in that when the computer program is executed by a processor, it implements the covert backdoor attack method for vertical federated learning.

[0087] The present invention is further described below through specific experiments.

[0088] This experiment selected three data sets, CIFAR-10, CIFAR-100 and CINIC-10. CIFAR-10 is used as a baseline data set. CIFAR-100 is used to evaluate the effectiveness of the method of the present invention in multi-category scenarios, and CINIC-10 is used to evaluate large data set scenarios. This experiment selected three existing studies as comparison methods: LR-BA, VILLAIN, and SDDP. The default poisoning ratio of CIFAR-10 and CINIC-10 is 1%, and that of CIFAR-100 is 0.1%. The number of known labeled samples is equal to the number of poisoned samples. This experiment used two indicators commonly used in backdoor attacks, the clean sample accuracy BA and the backdoor attack success rate ASR. At the same time, this experiment used the AS defined in the present invention to measure the attack stealth.

[0089] The main experimental results are shown in Table 1 below, where Clean represents the effect when there is no attack.

[0090] Compared to the comparative methods, our approach achieves higher effectiveness and improved stealth. Compared to the static attack method VILLAIN, the dynamic attack methods SDDP, IASR, and LAEO demonstrate superior performance, particularly on CIFAR-100. VILLAIN's effectiveness primarily depends on the size of its trigger relative to the clean embedding. Static triggers require long training times to achieve high magnitudes, which is impractical because the active party will not extend training time without improving model accuracy. Both input-space and latent-space attack methods achieve good attack results. However, latent-space attacks, particularly SDDP and LAEO, demonstrate better stealth because they can directly constrain the uploaded feature embedding data. Among latent-space attack methods, LAEO outperforms SDDP in both attack effectiveness and stealth due to its embedding optimization mechanism with latent constraints. Furthermore, our experiments show that IASR outperforms LR-BA, an input-space attack that generates optimized embeddings for backdoored samples with input-space triggers. Under the more realistic threat model used in this paper, LR-BA performs poorly. Specifically, LR-BA relies on a proxy inference head to emulate the top-level model. However, the top-level model used in this invention is more complex and therefore more challenging. Furthermore, the embedding dimensions shared between different participants in this invention are large, and the generalization performance of the model after LR-BA fine-tuning is poor.

[0091] Table 1

[0092]

[0093] This experiment evaluates attacks with 2, 4, and 8 passive parties. The results are shown in Table 2, where K represents the number of parties. Balanced attack (BA) decreases with increasing K, as a larger K makes learning more difficult for each underlying model. In the scenario with 8 passive parties, LAEO outperforms other methods on almost all metrics, demonstrating its effectiveness in multi-party scenarios. On the CIFAR-10 and CINIC-10 datasets with 8 passive parties, LAEO significantly outperforms IASR, highlighting the advantages of latent space attacks over input space attacks. Furthermore, this experiment observed that VILLAIN exhibits lower BA overall compared to other methods.

[0094] Table 2

[0095]

[0096] Comparison of the effects of attack methods under model clipping defense methods Figure 3As shown in Figure 2, it can be seen that IASR and LAEO are more stable and effective than other methods. The decrease in ASR is accompanied by a decrease in BA, indicating that this defense method is not effective against our attack method.

[0097] Table 3 shows the experimental results of the attack method using the TeCo defense. These results demonstrate that TeCo has low detection accuracy for backdoored samples. This is primarily due to the fact that in vertical federated learning, the active party can only detect the received feature embeddings, which are more sensitive than the sample data. Therefore, clean and backdoored samples exhibit similar performance under varying levels of corruption, rendering TeCo ineffective. Compared to the performance of VILLAIN and SDDP, the proposed method maintains an ASR above 94.5%.

[0098] Table 3

[0099]

[0100] The experimental results of the attack methods under anomaly detection are shown in Table 4. The experimental results show that the lower the AS value of the attack method, the worse the anomaly detection effect and the stronger the attack capability. This proves that the AS indicator proposed in this paper can effectively measure the stealthiness of backdoor attacks.

[0101] Table 4

[0102]

[0103] It should be understood that the embodiments described above are only some of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention may be arbitrarily combined with each other to form a feasible technical solution. Such combination is not restricted by the order of steps and / or structural composition mode, but must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is mutually inconsistent or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0104] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A covert backdoor attack method for vertical federated learning, characterized by: We analyze two attack modes, input space and latent space, and study the risk of attackers embedding backdoors into vertical federated learning models without directly interfering with global data or labels. The input space attack replaces some input samples and injects triggers, causing the top-level model to learn the association between the backdoor triggers and the target labels, thereby causing the top-level model to misclassify samples with triggers during the inference phase. In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses optimization strategies to adjust the embedding vectors to generate specific backdoor responses in the top model. The input space attack is specifically implemented by the following steps: Step A1: Select target samples; The attacker obtains a small number of target class samples, which should be classified as the target class under normal circumstances; Step A2: Sample replacement and trigger injection; Set the local input of the target category sample to be The attacker will Replace with randomly selected samples of other categories And inject trigger T: Where M is the trigger mask, ⊙ represents the Hadamard product, θ adv 、f adv () are the parameters and model structure of the attacker’s local model, Embedded representation uploaded by the attacker.

2. The covert backdoor attack method for vertical federated learning according to claim 1 is characterized in that: Further optimize triggers; The attacker receives gradient information from the active party through the model it controls. This gradient information reflects the top-level model's response to the current input. Using the received gradient information, the attacker optimizes the trigger to improve the effectiveness of the attack. The optimization formula is as follows: in, is the gradient received from the active party, ||T||2 is the two-norm regularization term of the trigger, and γ and λ are adjustment coefficients.

3. A covert backdoor attack method for vertical federated learning, characterized by: We analyze two attack modes, input space and latent space, and study the risk of attackers embedding backdoors into vertical federated learning models without directly interfering with global data or labels. The input space attack replaces some input samples and injects triggers, causing the top-level model to learn the association between the backdoor triggers and the target labels, thereby causing the top-level model to misclassify samples with triggers during the inference phase. In the latent space attack, the attacker directly acts on the feature embedding space of its local model and uses optimization strategies to adjust the embedding vectors to generate specific backdoor responses in the top model. The latent space attack is specifically implemented by the following steps: Step B1: The attacker randomly selects target category samples to initialize the malicious embedding V; Step B2: For each round, the attacker generates an embedding representation using its own local model; Step B3: Replace every D with V target The embedded representation of the sample, D target Target category samples held by the attacker; Step B4: The attacker uploads the embed to the active party; Step B5: The attacker receives the gradient returned by the active party; Step B6: Accumulate each D target The gradient of the sample's embedding representation is averaged; Step B7: Calculate the deviation loss L dev , the task loss L calculated by the active party ori and the final loss L all ; Step B8: Update the malicious embedding V and vertical federated learning model parameters.

4. The covert backdoor attack method for vertical federated learning according to claim 3 is characterized in that: In step B7: L all =γ·L ori +λ·L dec ; Among them, y and θ are adjustment coefficients; θ adv 、f adv () are the sample inputs mastered by the attacker, the parameters of the attacker’s local model, and the model structure respectively.

5. The covert backdoor attack method for vertical federated learning according to any one of claims 1 to 4, characterized in that: Use stealth metrics to measure the stealth of backdoor attacks in vertical federated learning; The concealment index is: Among them, D p is a dataset with a backdoor trigger, represents the attacker’s embedding, y is the true label, represents the embedding of normal samples, To predict the label, The prediction is Sample embedding of is the sample input controlled by the attacker, s and z both represent the embeddings in the corresponding set, and E[||s||2] represents the mean of the embedding norm.

6. A covert backdoor attack device for vertical federated learning, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the hidden backdoor attack method for vertical federated learning as described in any one of claims 1 to 5 is implemented.

7. A covert backdoor attack product for vertical federated learning, comprising a computer program, characterized in that: When the computer program is executed by a processor, the hidden backdoor attack method for vertical federated learning as described in any one of claims 1 to 5 is implemented.

Images