Model poisoning attack detection method in federated learning scene

Abstract

The invention discloses a model poisoning attack detection method in a federated learning scene. The method comprises the following steps: S1, constructing a federated learning framework comprising an anomaly detection module based on VAE-iForest and an adaptive weight updating module; s2, dividing independent identically distributed data and non-independent identically distributed data by adopting a Dirichlet method; s3, training a VAE detection model and an iForest detection model by using the root data set in a VAE-iForest-based anomaly detection module, and performing anomaly detection on model parameter data uploaded by a client through the trained model to obtain a detection result; s4, performing performance comparison according to the detection result, calculating to obtain a weighted abnormal score, punishing the weight of the malicious client by the final detection result, and increasing the probability that the benign client is selected; and S5, dynamically adjusting the weight according to the anomaly detection effect of each model, and updating the global model for the next round of training.

Description

Technical Field

[0001] The present invention relates to the field of federated learning technology, and in particular to a model poisoning attack detection method in a federated learning scenario. Background Art

[0002] Federated learning allows multiple clients to jointly train a model while protecting data privacy. Unlike traditional centralized machine learning, the advantage of federated learning is that the original data does not need to leave the device for transmission. The client only needs to transmit the model parameters. Therefore, federated learning plays an important role in the fields of healthcare and financial services. However, in the federated learning framework, there are poisoning attacks by malicious clients, which is to mislead the model to incorrect prediction results by tampering with local data samples or model parameters, thereby affecting the performance of the global model. In order to prevent poisoning attacks and improve the robustness of federated learning, the article [McMahan HB, Moore E, Ramage D, et al. Federated learning of deep networks using model averaging [J]. arxiv preprint arxiv: 1602.05629, 2016, 2 (2).] adopts the federated averaging algorithm to aggregate by weighted averaging. The influence of outliers or malicious samples in the aggregation process will be partially offset. However, in practical applications, the data sets held by the participants in federated learning are not independent and equally distributed. This aggregation method is difficult to completely eliminate the impact of malicious updates. In order to further enhance the robustness of the federated learning framework, model anomaly detection has become a core issue in enhancing the defense capabilities of the federated learning framework.

[0003] Federated learning strengthens data privacy protection by allowing clients to share only model parameters rather than raw data. Despite this, the framework still faces poisoning attacks from malicious clients. Depending on the target of poisoning, poisoning attacks can be divided into two main types: data poisoning and model poisoning [Qiu Xiaohui, Yang Bo, Zhao Mengchen, et al. Research on security defense and privacy protection technology of federated learning [J]. Journal of Computer Applications, 2022, 39(11): 3220-3231. DOI: 10.19734 / j.issn.1001-3695.2022.03.0164.]: Data poisoning is when the attacker modifies or adds malicious samples to cause the model to make incorrect predictions; model poisoning is when the attacker modifies the locally trained model instead of directly modifying the sample itself. This type of attack is more covert because the sample does not appear to be abnormal, which in turn affects the accuracy of the global model. Although existing studies have proposed a variety of data cleaning and anomaly detection techniques to deal with data poisoning attacks, improving data quality and reliability, thereby enhancing model performance, these methods mainly target data-level anomalies and are not applicable to model-level poisoning attacks. In order to solve model poisoning attacks, many studies have performed cluster analysis on uploaded model parameters and then changed the aggregation rules based on the difference in the distance between benign and malignant parameter vectors.For example, the article [P. Blanchard, R. Guerraoui, J. Stainer et al., "Machine learning with adversaries: Byzantine tolerant gradient descent," in Advances in Neural Information Processing Systems, 2017, pp. 119-129.] proposed the Krum aggregation method, which calculates the sum of the distances between each participant and other participants and selects the model with the smallest distance sum as the aggregation result; the article [Xie C, Koyejo O, Gupta I. Generalized Byzantine-tolerant SGD [J]. 2018. DOI: 10.48550 / arXiv.1802.10116.] proposed a median-based aggregation rule, which collects the model parameters of the participants, and for each parameter, calculates the median of the values ​​of all participants on the parameter, and uses the calculated median as the final aggregation result; the article [E. M. Hamdi, R. Guerraoui, and S. Rouault, "The hidden vulnerabilities of distributed learning in Byzantium," in International Conference on Machine Learning, 2018, pp.3521–3530.] proposed Bulyan by combining Krum and median aggregation rules to further improve the robustness of the model; the article [Chen Yudong, Su Lili, Xu Jiaming. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent[]. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 2017, 1(2): 1-25] proposed GeoMed (geometric median) method to generate a global model based on the gradient average of the geometric median. The above method uses statistical characteristics to infer gradient characteristics to obtain global parameters. When the user data distribution is the same, this defense strategy has a good effect. However, when the model parameter differences between users increase significantly, a single statistical characteristic may not accurately represent the global parameter, resulting in a significant reduction in the defense effect of these robust aggregation methods.

[0004] In this case, anomaly detection becomes a more effective strategy. The article [Zhao L, Hu S, WangQ, et al. Shielding Collaborative Learning: Mitigating Poisoning Attacks through Client-Side Detection [J]. 2019.] designed a client-side implementation of anomaly detection. Their key idea is to implement client cross-validation. Each update is evaluated locally on the client, and then the evaluation results and model are sent to the central server. The server adjusts the update weights based on the evaluation results. Since the task of anomaly detection is delegated to the client, if a large number of clients collude, it may still lead to poor model convergence. The article [Xia Q, Tao Z, Li Q. Defenses Against Byzantine Attacks in Distributed Deep Neural Networks [J]. IEEE Transactions on Network Science and Engineering, 2021 (8-3). DOI: 10.1109 / TNSE.2020.3035112.] proposed the FABA fast aggregation algorithm, which deletes outliers in the uploaded gradients and then realizes the global aggregation of model gradients; the article [Shejwalkar V, Houmansadr A. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning [C] / / NDSS. 2021.] designed a divide and conquer (Dnc) method to defend against poisoning. This method combines singular value decomposition and spectral analysis to find the most influential outliers and delete them. The core of the Dnc method is that when the malicious model parameters deviate, the poisoning update has the most impact on the global model; the article [Li S, Cheng Y, Liu Y, et al. Abnor mal Client Behavior Detection in Federated Learning[J].2019.DOI:10.48550 / arXi v.1910.09933.] proposed an anomaly detection method based on autoencoder, which assigns a credit score to each client. The score is calculated based on the anomaly score generated by the anomaly detection model. If the anomaly score is greater than the set threshold, the credit score of the corresponding client is set to zero, and the model parameters uploaded by the client are considered abnormal.However, it is difficult for autoencoders to learn the potential representation of data, and there is a lack of continuity of samples in the latent space. In order to solve the above problems, the article [Li S, Cheng Y, Wang W, et al. Learning to detect malicious clients for robust federated learning [J]. arXiv preprint arXiv: 2002.00211, 2020.] proposed a variational autoencoder based on the autoencoder. First, the variational autoencoder model is trained, and the abnormal score of the uploaded model parameter update is calculated through the trained model. The model parameters greater than the threshold are judged as abnormal updates and the model is removed to complete the global aggregation of this round. The article [Gu Z, Yang Y. Detecting malicious model updates from federated learning on conditional variational autoencoder [C] / / 2021 IEEE international parallel and distributed processing symposiu m (IPDPS). IEEE, 2021: 671-680.] further considers the differences in each round of updates on this basis, and uses conditional variational autoencoder (CVAE) to incorporate time information. However, as the task model gradually converges during training, the update differences between adjacent rounds gradually decrease, so it is not appropriate to use time information as a label to distinguish updates in different rounds. Immediately afterwards, the article [Gu Z, He L, Li P, et al. FREPD: A Ro bust Federated Learning Framework on Variational Autoencoder [J]. Comput. Sys t. Sci. Eng. 2021, 39 (3): 307-320.] proposed the Federated Reconstruction Error Probability Distribution (FREPD), which uses the VAE model to calculate the updated reconstruction error, uses the distribution function to estimate the probability of invisible reconstruction errors, and judges whether it is a normal update based on the probability. The article [Zhang Renbin, Cui Yuhang, Zhang Zishi. Federated learning anomaly update detection algorithm based on β-VAE [J]. Computer Application Research, 2024, 41(08): 2496-2501. DOI: 10.19734 / j.issn.1001-3695.2023.11.0553.] proposed a federated learning anomaly update detection algorithm based on β-VAE, which effectively identified and excluded abnormal updates through real-time training and dynamic threshold detection, thereby enhancing the performance of anomaly detection.The above methods improve the anomaly detection capability in federated learning from different angles, and strengthen the recognition of abnormal updates and the robustness of the global model.

[0005] At present, the defense methods of the federated learning framework against malicious client poisoning attacks are mainly divided into two main types: robust aggregation methods and anomaly detection. However, in actual applications, due to the diversity of client data distribution, the trained model parameters may produce significant differences and thus affect the model judgment. In addition, a single model may encounter performance bottlenecks during anomaly detection, resulting in reduced detection accuracy and insufficient robustness. Summary of the invention

[0006] The purpose of the present invention is to provide a model poisoning attack detection method in a federated learning scenario, the method includes a VAE-iForest anomaly detection module and an adaptive weight update module. The VAE (variational autoencoder) model is trained using a root data set based on the VAE-iForest anomaly detection module. The goal of VAE is to maximize the probability of data reconstruction and minimize the uncertainty of the potential space. On the basis of VAE, the module further integrates the iForest (isolation forest) model. After the training is completed, the model is used to detect the model parameters uploaded by the client; based on the adaptive weight update module, the two models are evaluated and weights are assigned to obtain the final detection results. According to the detection results, the malicious model parameters are eliminated to achieve global aggregation and adjust the weights of malicious clients, so as to solve the problem of insufficient accuracy and poor robustness of the anomaly detection method caused by poisoning attacks by malicious clients with different data distributions.

[0007] The technical solution adopted by the present invention is:

[0008] A method for detecting model poisoning attacks in a federated learning scenario includes the following steps:

[0009] S1: Build a federated learning framework that includes a VAE-iForest-based anomaly detection module and an adaptive weight update module;

[0010] S2: Dirichlet method is used to divide independent and identically distributed data into non-independent and identically distributed data;

[0011] S3: Initialize the global model w 0 Train the client's local data to obtain model parameters;

[0012] S4: In the anomaly detection module based on VAE-iForest (variational autoencoder and isolation forest), the root dataset is used to train the VAE and iForest detection models, and the model parameter data uploaded by the client is used to perform anomaly detection through the trained model to obtain the detection results;

[0013] S5: Compare the performance based on the detection results, calculate the weighted anomaly score, and punish the malicious client weight based on the final detection result to increase the probability of benign clients being selected;

[0014] S6: Dynamically adjust the weights according to the anomaly detection effect of each model and update the global model for the next round of training.

[0015] Furthermore, in S2, the data is divided using the Dirichlet method. For the convenience of explanation, an experimental data set is defined as D, and the number of clients participating in the training is n. in represents the data set of each client, α is the data heterogeneity size, and is divided using the probability density function of the Dirichlet distribution as shown below:

[0016]

[0017] The parameter α is used to control the heterogeneity of each user's data set. A smaller α value will result in more heterogeneity (i.e., the data distribution between users will be more different), while a larger α value will result in a more uniform data distribution. After the data is divided, it will be distributed to the clients participating in the training.

[0018] Furthermore, in S4, the root data set is first used to train the VAE and iForest detection models, and the trained models are used to detect the model parameter data uploaded by the client to obtain the detection results, including the following steps:

[0019] 1-1) Train the VAE model to learn the potential representation of the input data through the encoder and decoder. The steps are as follows:

[0020] Step 1: The encoder maps the original data x into a latent space;

[0021] Step 2: Sample the distribution of the latent variable z from this parameterized distribution through the reparameterization technique, whose parameters are usually the mean μ and the logarithmic variance log(σ 2 ), usually expressed as

[0022] Step 3: The decoder maps the latent variable z back to the data space and tries to reconstruct the input data x'. There is an error between the reconstructed data and the original data. The loss function of the traditional VAE model is as follows:

[0023]

[0024] The first term in the above formula is the reconstruction error, which is used to measure the model's ability to reconstruct the input data. In VAE, the reconstruction loss is usually the negative log-likelihood between the input data and the reconstructed data, as shown below:

[0025]

[0026] p θ (x|z) is the probability distribution parameterized by the decoder, which represents the probability of reconstructing the input data x given the latent variable z, and the expectation is for the posterior distribution The second term in the above formula is KL divergence (relative entropy), which is used to measure the difference between the prior distribution and the posterior distribution in the latent space. The goal of VAE is to make the posterior distribution as close as possible to the prior distribution, thereby ensuring the continuity and smoothness of the latent space. The calculation formula of KL divergence is as follows:

[0027]

[0028] In practical applications, in order to simplify calculations, VAE usually uses parameterized forms of mean and variance to approximate the posterior distribution. To make it also obey the normal distribution, the calculation of KL divergence can be simplified as follows:

[0029]

[0030] Step 4: Due to the non-independent and identically distributed nature of the data, the malicious model parameters will be closely distributed on the edge of the normal model parameters, and even overlap with the normal model parameters. In this case, the marginal normal samples often interfere with the training of the model. In order to enhance the model's ability to identify malicious model parameters, the isolation loss is introduced as a regular term in the VAE loss function to enhance the ability to distinguish malicious model parameters. The loss function is as follows:

[0031]

[0032] This is the outlier function of iForest. As the isolated loss of the total loss function, the isolated loss is obtained by calculating the data after the Encoder part of the VAE model reduces the dimension of the original data.

[0033] 1-2) Training iForest model. Abnormal points (outliers) are usually isolated in the data set, so they can be separated from other data points through fewer partitioning steps. In contrast, normal points require more partitioning steps to be isolated. Based on this principle, Isolation Forest constructs decision trees by randomly selecting features and randomly selecting feature partitioning values ​​to isolate data points. For each data point, the path length (the length from the root node to the leaf node) is calculated through all trees. The anomaly score is calculated based on the path length. The shorter the path length, the easier it is for the data point to be isolated and the higher the anomaly score. The calculation steps are as follows:

[0034] Step 1: Calculate the outlier function It is used to measure whether the data point x is an outlier;

[0035] Step 2: Where E(h(x)) is the expected value of the average path length of data point x in all trees in the forest. For the path length h(x) of a data point x in an isolated tree, if there are n nodes in the tree, the expected value of the path length can be approximated by the following formula:

[0036]

[0037] Where H(i) represents the i-th harmonic number, γ is the Euler constant, which is approximately 0.57721, and H(i) = ln(i) + γ;

[0038] Step 3: c(n) is a normalization constant used to adjust trees of different sizes.

[0039] 1-3) Model parameter detection: The model parameter vector x uploaded by the client is input into the VAE encoder and iForest model for detection. The steps are as follows:

[0040] Step 1: The x input to the VAE encoder is reconstructed into x' through the decoder, and then the reconstruction loss mean square error S is calculated recon =MSE(x,x′), KL divergence and isolated losses

[0041] Step 2: For the update of the abnormal model, use the loss function value as the anomaly score S for the model update ano As shown below:

[0042] S ano =S recon +S KL +S isol

[0043] Step 3: The x input into iForest is used to calculate the anomaly score F for each sample by calculating the anomaly function. score , and then calculate the decision function Deci as follows:

[0044]

[0045] Deci(x)=score_sample(x)-offset_

[0046] score_sample(x) returns the opposite of the anomaly score. offset_ is a threshold for determining anomalies. This value is an internal value that is automatically calculated and adjusted by the model based on the contamination parameter (the proportion of anomalies in the data set, the default is auto). The decision function makes 0 represent the dividing point between normal and abnormal. This method uses a dual model for anomaly detection, so the threshold of the VAE detection model is set to S ano The mean of the anomaly scores. Updates with anomaly scores higher than the threshold are considered abnormal parameters. In iForest model detection, if the decision function Deci has a negative anomaly score, it is judged as an abnormal parameter.

[0047] Furthermore, in step S5, a performance comparison is performed based on the detection results, a weighted anomaly score is calculated, and the weight of the malicious client is penalized by the final detection result to increase the probability of the benign client being selected, including the following steps:

[0048] 2-1) Reconstruct anomaly score E' for each sample in the VAE included in the detection result VAE and the anomaly score S in iForest i ' Forest The normalization of the two is as follows:

[0049]

[0050]

[0051] Then, the performance of the two models is evaluated by the mean and variance. The weight is dynamically adjusted according to the anomaly detection effect of each model. The effect of each model in detecting abnormal samples is evaluated through the value of the mean and variance.

[0052] 2-2) If the model detects abnormal samples well, then its mean and variance should be clearly separated, and new weights need to be calculated. and

[0053] To ensure that the sum of the weights is 1, the new weights can be normalized and updated as and

[0054] Finally, update the current weight, where α represents the learning rate and w VAE and iForest The initial weights are all 0.5 and updated to w VAE =(1-α)·w VAE +α·w′ VAE and iForest =(1-α)·w iForest +α·w′iForest ;

[0055] 2-3) Calculate the weighted anomaly score T score_weight , if the weighted anomaly score T score_weight If the confidence level is greater than the set confidence level, the client is judged as a malicious client, otherwise it is a benign client. The final detection result is as follows:

[0056] T score_weight =w VAE ·E′ VAE +w iForest ·S i ' Forest

[0057] The weight of malicious clients is reduced according to the final detection result. The initial weight of the client is 1, and the weight is reduced by 1 / 3. The corresponding client selection method is weighted selection. The user with a larger weight has a greater probability of being selected. When the weight value is 0, the probability of the client being selected is also 0, and the client will not be able to participate in training.

[0058] The beneficial effects of adopting the above technical solution are:

[0059] The purpose of the present invention is to provide a model poisoning attack detection method in a federated learning scenario, the method includes a VAE-iForest anomaly detection module and an adaptive weight update module, wherein the VAE-iForest anomaly detection module is based on training a VAE model using a root data set, the goal of VAE is to maximize the reconstruction probability of data and minimize the uncertainty of the latent space, on the basis of VAE, the module further integrates the iForest model, after the training is completed, the model is used to detect the model parameters uploaded by the client; based on the adaptive weight update module, the two models are evaluated and then weights are assigned to obtain the final detection result, and the malicious model parameters are eliminated according to the detection result to achieve global aggregation and adjust the malicious client weight, so as to solve the problem of insufficient accuracy and poor robustness of the anomaly detection method caused by poisoning attacks by malicious clients with different data distributions.

[0060] The model poisoning attack detection method in the federated learning scenario proposed in this paper is used on the public datasets MNIS T, Fashion-MNIST and CIFAR-10. Through experimental analysis, the performance of this method in multiple attack scenarios is 3%-6% higher than that of other defense algorithms on two non-independent and identically distributed data partitions, which proves the anomaly detection ability of this method. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 Framework diagram of the model poisoning attack detection method in the federated learning scenario;

[0062] Figure 2 Dirichlet's data partitioning diagram for different α;

[0063] Figure 3 IID and Non-IID data partition diagram;

[0064] Figure 4 Comparative experimental results of symbol flipping attack;

[0065] Figure 5 The results of the same value attack comparison experiment;

[0066] Figure 6 Noise attack comparison experiment results. DETAILED DESCRIPTION

[0067] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0068] This paper takes the fairness of federated learning as the background and the federated learning architecture as the carrier, and proposes a model poisoning attack detection method in the federated learning scenario. Figure 1 As shown, the following steps are included:

[0069] S1: Build a federated learning framework that includes a VAE-iForest-based anomaly detection module and an adaptive weight update module;

[0070] S2: Dirichlet method is used to divide independent and identically distributed (IID) data and non-independent and identically distributed (Non-IID) data;

[0071] The data is divided using the Dirichlet method. For the convenience of explanation, an experimental data set is defined as D, and the number of clients participating in the training is n. in represents the data set of each client, α is the data heterogeneity size, and is divided using the probability density function of the Dirichlet distribution as shown below:

[0072]

[0073] The parameter α is used to control the heterogeneity of each user's data set. A smaller α value will lead to more heterogeneity (that is, the data distribution differences between users are greater), while a larger α value will lead to a more uniform data distribution. After the data is divided, it is distributed to the clients participating in the training.

[0074] S3: Initialize the global model w 0 Train the client's local data to obtain model parameters;

[0075] S4: In the VAE-iForest-based anomaly detection module, the root dataset is used to train the VAE and iForest detection models. The trained models are used to perform anomaly detection on the model parameter data uploaded by the client to obtain the detection results.

[0076] 1-1) Train the VAE model to learn the potential representation of the input data through the encoder and decoder. The steps are as follows:

[0077] Step 1: The encoder maps the original data x into a latent space;

[0078] Step 2: Sample the distribution of the latent variable z from this parameterized distribution through the reparameterization technique, whose parameters are usually the mean μ and the logarithmic variance log(σ 2 ), usually expressed as

[0079] Step 3: The decoder maps the latent variable z back to the data space and tries to reconstruct the input data x'. There is an error between the reconstructed data and the original data. The loss function of the traditional VAE model is as follows:

[0080]

[0081] The first term is the reconstruction error, which is used to measure the model's ability to reconstruct the input data. In VAE, the reconstruction loss is usually the negative log-likelihood between the input data and the reconstructed data, as shown below:

[0082]

[0083] p θ (x|z) is the probability distribution parameterized by the decoder, which represents the probability of reconstructing the input data x given the latent variable z, and the expectation is for the posterior distribution The second term is KL divergence, which is used to measure the difference between the prior distribution and the posterior distribution in the latent space. The goal of VAE is to make the posterior distribution as close to the prior distribution as possible, thereby ensuring the continuity and smoothness of the latent space. The calculation formula of KL divergence is as follows:

[0084]

[0085] In practical applications, in order to simplify calculations, VAE usually uses parameterized forms of mean and variance to approximate the posterior distribution. To make it also obey the normal distribution, the calculation of KL divergence can be simplified as follows:

[0086]

[0087] Step 4: Due to the non-independent and identically distributed nature of the data, the malicious model parameters are closely distributed on the edge of the normal model parameters, or even overlap with the normal model parameters. In this case, the normal samples on the edge often interfere with the training of the model. In order to enhance the model's ability to identify malicious model parameters, the isolation loss is introduced as a regular term in the VAE loss function to enhance the ability to distinguish malicious model parameters. The loss function is as follows:

[0088]

[0089] This is the outlier function of iForest. As the isolation loss of the total loss function, the isolation loss is obtained by calculating the data after the Encoder part of the VAE model reduces the dimension of the original data.

[0090] 1-2) Training iForest model. Abnormal points (outliers) are usually isolated in the data set, so they can be separated from other data points through fewer partitioning steps. In contrast, normal points require more partitioning steps to be isolated. Based on this principle, Isolation Forest constructs decision trees by randomly selecting features and randomly selecting feature partitioning values ​​to isolate data points. For each data point, the path length (the length from the root node to the leaf node) is calculated through all trees. The anomaly score is calculated based on the path length. The shorter the path length, the easier it is for the data point to be isolated and the higher the anomaly score. The calculation steps are as follows:

[0091] Step 1: Calculate the outlier function, It is used to measure whether the data point x is an outlier;

[0092] Step 2: Where E(h(x)) is the expected value of the average path length of data point x in all trees in the forest. For the path length h(x) of a data point x in an isolated tree, if there are n nodes in the tree, the expected value of the path length can be approximated by the following formula:

[0093]

[0094] Where H(i) represents the i-th harmonic number, γ is the Euler constant, which is approximately 0.57721, and H(i) = ln(i) + γ;

[0095] Step 3: c(n) is a normalization constant used to adjust trees of different sizes.

[0096] 1-3) Model parameter detection: The model parameter vector x uploaded by the client is input into the VAE encoder and iForest model for detection.

[0097] Step 1: The x input to the VAE encoder is reconstructed into x' through the decoder, and then the reconstruction loss mean square error S is calculated recon =MSE(x,x′), KL divergence and isolated losses

[0098] Step 2: For the update of the abnormal model, use the loss function value as the anomaly score S for the model update ano As shown below:

[0099] S ano =S recon +S KL +S isol

[0100] Step 3: The x input into iForest is used to calculate the anomaly score F for each sample by calculating the anomaly function. score , and then calculate the decision function Deci as follows:

[0101]

[0102] Deci(x)=score_sample(x)-offset_

[0103] score_sample(x) returns the opposite of the anomaly score. offset_ is a threshold for determining anomalies. This value is an internal value that is automatically calculated and adjusted by the model based on the contamination parameter (the proportion of anomalies in the data set, the default is auto). The decision function makes 0 represent the dividing point between normal and abnormal. This method uses a dual model for anomaly detection, so the threshold of the VAE detection model is set to S ano The mean of the anomaly scores. Updates with anomaly scores higher than the threshold are considered abnormal parameters. In iForest model detection, if the decision function Deci has a negative anomaly score, it is judged as an abnormal parameter.

[0104] S5: Compare the performance based on the detection results, calculate the weighted anomaly score, and punish the malicious client weight based on the final detection result to increase the probability of benign clients being selected;

[0105] 2-1) Reconstruct anomaly score E' for each sample in the VAE included in the detection result VAE and the anomaly score S in iForest i ' Forest The normalization of the two is as follows:

[0106]

[0107]

[0108] Then, the performance of the two models is evaluated by the mean and variance. The weight is dynamically adjusted according to the anomaly detection effect of each model. The effect of each model in detecting abnormal samples is evaluated through the value of the mean and variance.

[0109] 2-2) If the model detects abnormal samples well, then its mean and variance should be clearly separated, and new weights need to be calculated. and

[0110] To ensure that the sum of the weights is 1, the new weights can be normalized and updated as and

[0111] Finally, update the current weight, where α represents the learning rate and w VAE and iForest The initial weights are all 0.5 and updated to w VAE =(1-α)·w VAE +α·w′ VAE and iForest =(1-α)·w iForest +α·w′ iForest ;

[0112] 2-3) Calculate the weighted anomaly score T score_weight , if the weighted anomaly score T score_weight If the confidence value is greater than the set confidence threshold, the client is judged as a malicious client, otherwise it is a benign client. The final detection result is as follows:

[0113] T score_weight =w VAE ·E′ VAE +w iForest ·S′ iForest

[0114] The weight of malicious clients is reduced according to the final detection result. The initial weight of the client is 1, and the weight is reduced by 1 / 3. The corresponding client selection method is weighted selection. The user with a larger weight has a greater probability of being selected. When the weight value is 0, the probability of the client being selected is also 0, and the client will not be able to participate in training.

[0115] S6: Dynamically adjust the weights according to the anomaly detection effect of each model and update the global model for the next round of training.

[0116] Based on the above steps, the present invention effectively solves the problem that a single model may have limited performance and insufficient robustness in anomaly detection tasks under non-independent and identically distributed data, and proposes a model poisoning attack detection method in a federated learning scenario, which includes an anomaly detection module based on VAE-iForest and an adaptive weight update module. The VAE model is trained using a root data set based on the VAE-iForest anomaly detection module. The goal of VAE is to maximize the probability of data reconstruction and minimize the uncertainty of the latent space. On the basis of VAE, the module further integrates the iForest model. After training, the model is used to detect the model parameters uploaded by the client; based on the adaptive weight update module, the two models are evaluated and weights are assigned to obtain the final detection results. According to the detection results, the malicious model parameters are eliminated to achieve global aggregation and adjust the weights of malicious clients, solving the problem of insufficient accuracy and poor robustness of the anomaly detection method caused by poisoning attacks by malicious clients with different data distributions.

[0117] Experimental verification of the model data anomaly detection method based on federated learning in this invention:

[0118] 1. Test environment

[0119] Windows 11 system, Intel Core i5-124600KF CPU@3.7GHz and NVIDIA GeF orce RTX3090GPU, the development environment is Python 3.8.10, and the deep learning framework is PyTorch2.1.0 and Torchvision0.16.0.

[0120] 2. Test verification

[0121] Experimental results and analysis on the public datasets MNIST, Fashion-MNIST and CIFAR-10.

[0122] (1) Dataset description

[0123] This section uses MNIST, Fashion-MNIST, and CIFAR-10 datasets as experimental datasets. MNIST is a widely used handwritten digit recognition dataset, containing 60,000 training samples and 10,000 test samples. Each sample is a 28x28 pixel grayscale image representing a number between 0 and 9. Fashion-MNIST focuses on the classification of clothing images and contains 70,000 28x28 grayscale images in 10 categories, with 7,000 images in each category. These categories include T-shirts, pants, shoes, dresses, coats, shirts, hats, scarves, skirts, and bags. CIFAR-10 is a color image dataset for object recognition, consisting of 60,000 32x32 pixel images divided into 10 categories, with 6,000 images in each category, 50,000 of which are used for training and 10,000 for testing.

[0124] Table 1 Dataset information table

[0125]

[0126] (2) Model parameters

[0127] This experiment simulates a typical federated learning framework, with 1 server and 100 clients. In each round of communication, 30 clients are randomly selected to participate in learning and training, of which a certain number of clients are malicious attackers. Each client uses the SGD (stochastic gradient descent) optimizer with a learning rate of 0.01 and trains for 10 rounds. For the MNSIT dataset, two 5x5 convolutional layers, two 2x2 pooling layers, and two fully connected layers are used. For the Fashion-MNIST dataset, two 3x3 convolutional layers, two 2x2 pooling layers, and two fully connected layers are used. For the CIFAR-10 dataset, three 5x5 convolutional layers, three 2x2 pooling layers, and two fully connected layers are used.

[0128] (3) Analysis of comparative experimental results

[0129] In order to verify the anomaly detection effectiveness and robustness of the model poisoning attack detection method (VAE-iForest) in the federated learning scenario, the accuracy is compared with the classic federated learning algorithms FedAvg, Krum, Fedvae, Fedcvae and β-VAE. FedAvg is a classic federated learning algorithm. It trains the model on multiple local devices and then uploads the local model parameters to the server. The server calculates the weighted average of all model parameters and broadcasts this average back to all local devices. Krum is a Byzantine fault-tolerant algorithm based on Euclidean distance. The Krum algorithm can resist a certain number of Byzantine attackers and ensure the robustness of the global model by performing special sorting and selection of the local model weights of the participants after each round of training. It can ensure that it can still converge in distributed machine learning when there are Byzantine faults. Fedvae is a federated learning framework detection algorithm based on VAE. VAE is a generative model that can learn the potential representation of data to reconstruct data. If the reconstruction anomaly score is greater than the set threshold, it is judged as an abnormal update and will be removed from this round of iteration. Fedcvae is an extension of Fedvae, combined with the conditional variational autoencoder (CVAE). CVAE also introduces conditional variables based on the input data, so that the generative model can generate data under specific conditions. Fedcvae uses conditional variables to further improve model performance through distributed training of the CVAE model. β-VAE is a new federated learning abnormal update detection algorithm, where β is a hyperparameter greater than 1, which constrains the model's learning of latent variables, effectively identifies and excludes abnormal updates through real-time training and dynamic threshold detection, and enhances the robustness of the federated learning system in the face of poisoning attacks. The experimental results are shown below in the scenarios of sign flipping attack, same value attack, and noise attack.

[0130] Sign flip attack: The malicious client flips the sign of the local model parameters before uploading them to the central server, thereby affecting the final aggregated global model. The ω k are the actual model parameters trained locally, In this experiment, it is -1, ω' kis the parameter of the malicious model after flipping. By observing the experimental results shown in Table 2, it can be seen that in the case of sign flipping attack, the accuracy of the VAE-iForest algorithm proposed in this paper is improved to different levels compared with other methods in two data partitioning situations of MNIST, Fashion-MNIST and CIFAR-10 datasets. When the number of malicious clients is large, the Krum algorithm selects those models with small differences from other local models for aggregation, which helps to maintain the robustness of the overall model. On the Fashion-MNIST and CIFAR-10 datasets, the accuracy of anomaly detection of the Fedvae and Fedvcae models is not stable enough. Although the Fedvae method maps the original data to the latent space and reconstructs the data, it does not fully consider the complexity of the dataset. Fedvcae introduces time information as an additional condition on the basis of the Fedvae model, aiming to enable the model to capture more data patterns. Nevertheless, over-reliance on time information may reduce the model's attention to the quality of the reconstruction of the original data, thereby affecting the accuracy of the anomaly score. The β-VAE method enables the anomaly detection model to learn more features that are beneficial to normal data through an instant training method.

[0131] Table 2 Comparative experimental results of symbol flipping attack

[0132]

[0133] Same-value attack: malicious clients set local model parameters to the same value before uploading to the central server, thereby affecting the final aggregated global model. The ω k are the actual model parameters trained locally, In this experiment, it is -1, ω' k is the malicious model parameter after the same value. By observing the experimental results shown in Table 3, it can be seen that the algorithm in this paper obtains fast convergence speed and accuracy. The accuracy of the Krum algorithm on the CIFA R-10 dataset is 18% and 11%, which is mainly due to the influence of the same value attack. Under this attack, the malicious client deliberately sets the model parameters to zero, causing the geometric center of the model update to deviate from its true position. This deviation makes the parameters of the normal model appear more similar to some extent, thereby misleading the Krum algorithm to tend to select those tampered malicious models as candidates for the global model. Fedva e and Fedcvae also have unsatisfactory accuracy on the Fashion-MNIST and CIFAR-10 datasets, also because the model parameters are maliciously set to zero. This attack causes the model to mistakenly identify abnormal updates as normal updates during anomaly detection. If this situation continues to occur, the parameters of the global model may eventually be tampered with to zero, making the model lose the ability to conduct effective global training.

[0134] Table 3. Experimental results of the same value attack comparison

[0135]

[0136] Noise attack, malicious clients inject Gaussian noise into local model parameters before uploading to the central server, interfering with the final performance of the model. The ω k are the actual model parameters trained locally, In this experiment, it is -1, ω' k is the malicious model parameter after adding noise. By observing the experimental results shown in Table 4, we can see that in the case of noise attack, the performance of the autoencoder algorithm is similar. The algorithm in this paper achieves faster convergence speed and higher accuracy. The Krum algorithm does not perform well on the CIFAR-10 dataset. This is because malicious nodes continue to upload model parameters with noise information. In the early stage, the Krum algorithm can filter out most of the malicious updates through its screening mechanism to maintain the stability of the model. However, as the noise accumulates, the model may gradually deviate from the optimal solution, making it impossible for the algorithm to effectively filter out good updates, which ultimately leads to a sharp drop in model performance.

[0137] Table 4 Noise attack comparison experimental results

[0138]

[0139]

[0140] In summary, the VAE-iForest algorithm proposed in this paper has more advantages than FedAvg, Krum, Fedvae, Fedcvae and β-VAE in the case of malicious client poisoning attacks and different Non-IID (non-independent and identically distributed) partitions. VAE-iForest trains the VAE model and the iForest model, and can more accurately judge the abnormality of the model in the anomaly detection stage, while solving the problem of possible poisoning attacks by clients under heterogeneous data.

[0141] 3. Conclusion

[0142] In view of the problem that poisoning attacks launched by malicious clients with different data distributions lead to low accuracy of traditional federated models, this paper proposes a model poisoning attack detection method in the federated learning scenario. The method includes two modules: based on the VAE-iForest anomaly detection module, the initial global model is trained using the root data set to obtain the model parameter set and construct the training data set to train the VAE and iForest models, and anomaly detection is performed on the model parameters uploaded by the client; based on the adaptive weight update module, the model weight is determined according to the performance evaluation of the detection result, and the anomaly score is calculated by the adaptive model weight to determine the final detection result, punish the weight of the malicious poisoning client, reduce the probability of being selected to participate in the training, and achieve global aggregation. Experimental results show that on the Dirichle-partitioned MNIST, Fashion-MNIST and CIFAR-10 datasets, the VAE-iForest method can effectively detect the malicious client that launches the poisoning attack compared with the Fedvae, Fedcvae, and β-VAE methods, while improving the accuracy and robustness of the model.

[0143] The above examples of the present invention are described in detail, but the contents are only preferred embodiments of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A method for detecting model poisoning attacks in a federated learning scenario, characterized in that: Ensure that the global model trained by the federated framework is not interfered by malicious data and optimize the accuracy and robustness of the model, including the following steps: S1: Build a federated learning framework that includes a VAE-iForest-based anomaly detection module and an adaptive weight update module; S2: Dirichlet method is used to divide independent and identically distributed data into non-independent and identically distributed data; S3: Initialize the global model w 0 Train the client's local data to obtain model parameters; S4: In the VAE-iForest-based anomaly detection module, the root dataset is used to train the VAE and iForest detection models, and the trained models are used to perform anomaly detection on the model parameter data uploaded by the client to obtain the detection results; S5: Compare the performance based on the detection results, calculate the weighted anomaly score, and punish the malicious client weight based on the final detection result to increase the probability of benign clients being selected; S6: Dynamically adjust the weights according to the anomaly detection effect of each model and update the global model for the next round of training.

2. According to a method for detecting model poisoning attacks in a federated learning scenario according to claim 1, it is characterized by: In step S2, the data is divided using the Dirichlet method, as described below. An experimental data set is defined as D, and the number of clients participating in the training is n. in represents the data set of each client, α is the data heterogeneity size, and is divided using the probability density function of the Dirichlet distribution as shown below: The parameter α is used to control the heterogeneity of each user's data set. A smaller α value will lead to more heterogeneity, that is, the data distribution differences between users will be greater, while a larger α value will lead to a more uniform data distribution. After the data is divided, it is distributed to the clients participating in the training.

3. According to a method for detecting model poisoning attacks in a federated learning scenario according to claim 1, it is characterized by: In step S4, the root data set is first used to train the VAE and iForest detection models, and the trained models are used to detect the model parameter data uploaded by the client to obtain the detection results, including the following steps: 1-1) Train the VAE model to learn the potential representation of the input data through the encoder and decoder. The steps are as follows: Step 1: The encoder maps the original data x into a latent space; Step 2: Sample the distribution of the latent variable z from this parameterized distribution through the reparameterization technique, whose parameters are usually the mean μ and the logarithmic variance log(σ 2 ), usually expressed as Step 3: The decoder maps the latent variable z back to the data space and tries to reconstruct the input data x'. There is an error between the reconstructed data and the original data. The loss function of the traditional VAE model is as follows: The first term is the reconstruction error, which is used to measure the model's ability to reconstruct the input data. In VAE, the reconstruction loss is usually the negative log-likelihood between the input data and the reconstructed data, as shown below: p θ (x|z) is the probability distribution parameterized by the decoder, which represents the probability of reconstructing the input data x given the latent variable z, and the expectation is for the posterior distribution The second term is the KL divergence, which is used to measure the difference between the prior distribution and the posterior distribution in the latent space. The goal of VAE is to make the posterior distribution as close as possible to the prior distribution, thereby ensuring the continuity and smoothness of the latent space. The calculation formula of KL divergence is as follows: In practical applications, to simplify calculations, VAE uses a parameterized form of mean and variance to approximate the posterior distribution To make it also obey the normal distribution, the calculation of KL divergence can be simplified as follows: Step 4: The non-independent and identically distributed nature of the data makes the malicious model parameters closely distributed on the edge of the normal model parameters, or even overlap with the normal model parameters. In this case, the normal samples on the edge will interfere with the training of the model. To enhance the model's ability to identify malicious model parameters, we introduce isolation loss as a regular term in the VAE loss function to enhance the ability to identify malicious model parameters. The loss function is as follows: This is the outlier function of iForest. As the isolated loss of the total loss function, the isolated loss is obtained by calculating the data after the Encoder part of the VAE model reduces the dimension of the original data. 1-2) Train the iForest model. Abnormal points, i.e. outliers, are usually isolated in the data set. Therefore, they can be separated from other data points through fewer partitioning steps. In contrast, normal points require more partitioning steps to be isolated. Based on this principle, the Isolation Forest constructs a decision tree by randomly selecting features and randomly selecting the partitioning values ​​of features, thereby isolating data points. For each data point, the path length is calculated through all trees, i.e. the length from the root node to the leaf node. The anomaly score is calculated based on the path length. The shorter the path length, the easier it is for the data point to be isolated and the higher the anomaly score. The calculation steps are as follows: Step 1: Calculate the outlier function, It is used to measure whether the data point x is an outlier; Step 2: Where E(h(x)) is the expected value of the average path length of data point x in all trees in the forest. For the path length h(x) of a data point x in an isolated tree, if there are n nodes in the tree, the expected value of the path length can be approximated by the following formula: Where H(i) represents the i-th harmonic number, γ is the Euler constant, which is approximately 0.57721, and H(i) = ln(i) + γ; Step 3: c(n) is a normalization constant used to adjust trees of different sizes. 1-3) Model parameter detection: The model parameter vector x uploaded by the client is input into the VAE encoder and iForest model for detection. The calculation steps are as follows: Step 1: The x input to the VAE encoder is reconstructed into x' through the decoder, and then the reconstruction loss mean square error S is calculated recon =MSE(x,x), KL divergence and isolated losses Step 2: For the update of the abnormal model, use the loss function value as the anomaly score S for the model update ano As shown below: S ano =S recon +S KL +S isol ; Step 3: The x input into iForest is used to calculate the anomaly score F for each sample by calculating the anomaly function. score , and then calculate the decision function Deci as follows: Deci(x)=score_sample(x)-offset_; score_sample(x) returns the opposite of the anomaly score. offset_ is a threshold for determining anomalies. This value is an internal value that is automatically calculated and adjusted by the model based on the contamination parameter (the proportion of anomalies in the data set, the default is auto). The decision function makes 0 represent the dividing point between normal and abnormal. This method uses a dual model for anomaly detection, so the threshold of the VAE detection model is set to S ano The mean of the anomaly scores. Updates with anomaly scores higher than the threshold are considered abnormal parameters. In iForest model detection, if the decision function Deci has a negative anomaly score, it is judged as an abnormal parameter.

4. According to a method for detecting model poisoning attacks in a federated learning scenario according to claim 1, it is characterized in that: In step S5, a performance comparison is performed based on the detection results, a weighted anomaly score is calculated, and the weight of the malicious client is penalized by the final detection result to increase the probability of the benign client being selected, including the following steps: 2-1) Reconstruct anomaly score E' for each sample in the VAE included in the detection result VAE and the anomaly score S in iForest i ' Forest The normalization of the two is as follows: Then, the performance of the two models is evaluated by the mean and variance. The weight is dynamically adjusted according to the anomaly detection effect of each model. The effect of each model in detecting abnormal samples is evaluated through the value of the mean and variance. 2-2) If the model detects abnormal samples well, then its mean and variance should be clearly separated, and new weights need to be calculated. and To ensure that the sum of the weights is 1, the new weights can be normalized and updated as and Finally, update the current weight, where α represents the learning rate of 0.01, w VAE and iForest The initial weights are all 0.5 and updated to w VAE =(1-α)·w VAE +αw′ VAE and iForest =(1-α)·w iForest +α·w′ iForest ; 2-3) Calculate the weighted anomaly score T score_weight , if the weighted anomaly score T score_weight If the confidence value is greater than the set confidence threshold, the client is judged as a malicious client, otherwise it is a benign client. The final detection result is as follows: T score_weight =w VAE ·E′ VAE +w iForest ·S i ′ Forest The weight of malicious clients is reduced according to the final detection result. The initial weight of the client is 1, and the weight is reduced by 1 / 3. The corresponding client selection method is weighted selection. The user with a larger weight has a greater probability of being selected. When the weight value is 0, the probability of the client being selected is also 0, and the client will not be able to participate in training.

Images