Privacy gradient poisoning attack defense method based on logarithmic secret sharing, program, device and storage medium

Abstract

The invention belongs to the technical field of federated learning security defense, and particularly relates to a privacy gradient poisoning attack defense method based on logarithmic secret sharing, a program, equipment and a storage medium. On the basis of a secret sharing technology, similarity calculation can be carried out on the ciphertext gradient at a resource-limited edge server end, similarity calculation of encryption parameters can be completed in the resource-limited edge server, then malicious models are recognized to defend privacy gradient poisoning attacks, the malicious models are weakened through the similarity, and the privacy gradient poisoning attacks can be prevented. The robustness of the global model aggregation process is enhanced, and the security and model performance of federal learning are improved.

Description

Technical Field

[0001] The present invention belongs to the field of federated learning security defense technology, and specifically relates to a privacy gradient poisoning attack defense method, program, device and storage medium based on logarithmic secret sharing. Background Art

[0002] Federated learning is based on a multi-party collaborative training model and aims to protect data privacy. However, federated learning cannot guarantee sufficient privacy protection capabilities. In the process of communicating and updating the training parameters of federated learning, some model information may be leaked. In-depth information in these model iterations may be leaked by third-party attackers, malicious participants, or central servers, so federated learning cannot meet the needs of preventing model information leakage. In order to ensure the privacy of the model, model parameters are usually protected by encryption technology. However, privacy-preserving FL increases the difficulty of defending against poisoning attacks because most defense strategies are monitoring strategies for plaintext model parameters. Homomorphic encryption technology applied to FL can provide strong privacy protection and can also be combined with the defense strategies used on plaintext parameters, but it also requires a lot of computing resources, which is difficult to use in resource-limited environments. Summary of the invention

[0003] The purpose of the present invention is to provide a privacy gradient poisoning attack defense method, program, device and storage medium based on logarithmic secret sharing, which can complete the similarity calculation of privacy gradients in resource-constrained edge federated learning, and then identify malicious models to defend against privacy gradient poisoning attacks.

[0004] The privacy gradient poisoning attack defense method based on logarithmic secret sharing includes the following steps:

[0005] (1) In the initialization phase of federated learning, the central server c 2 Initialize the model and distribute it to all users;

[0006] (2) In the tth round of federated learning, each user u i Use the stochastic gradient descent method to minimize the loss function and obtain the local gradient Compute symbolic matrix The absolute value of the gradient is logarithmized by the logarithmic function to obtain

[0007]

[0008] Each user u i The logarithmic gradient Perform secret sharing based on the secret element x i Generate secrets i , and split it into secret pieces i1and i2 , the secret fragments i1 Send to the central server c 1 , the secret fragments i2 and symbol matrix Send to the central server c 2 ;

[0009] (3) Central Server c 2 For each secret fragment s i2 Sum and get the secret share s i2+i2 ; Central server c 1 For each secret fragment s i1 Sum and get the secret share s i1+i1 ;

[0010] s i1+i1 =s i1 +s i1

[0011] s i2+i2 =s i2 +s i2

[0012] Central Server c 1 To the central server c 2 Request each user u i Secret Shares i2+i2 , using the secret share s i1+i1 and i2+i2 Reconstruction Secret(s i ) 2 , for (s i ) 2 Sum the elements in and check whether the result is equal to 1; if not, user u is determined to be i For malicious clients;

[0013] For user u whose check result is equal to 1 i , central server c 2 According to the symbol matrix With the previous round of federated learning user u i Transmitted symbol matrix Calculate user u i The cosine similarity SecCos between the gradient of the previous round of federated learning and the gradient of the current round of federated learning i , if SecCos i If it is greater than the threshold, then user u is judged i is a malicious client; otherwise, it is determined that user u i For benign clients;

[0014] (4) In the security aggregation stage, the central server c1 Secret shards for all benign clients i1 Sum the data and transmit the result to the central server c 2 ; Central server c 2 Secret shards for all benign clients i2 The sum is calculated and the central server c 1 The transmitted results are added together to obtain the secret share of the sum of the secrets of all benign clients, and then the secret share is decrypted to obtain the sum of the gradients of all user benign clients.

[0015] Furthermore, the user u i The cosine similarity SecCos between the gradient of the previous round of federated learning and the gradient of the current round of federated learning i The calculation method is:

[0016]

[0017] A computer device / equipment / system comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned privacy gradient poisoning attack defense method based on logarithmic secret sharing.

[0018] A computer-readable storage medium stores a computer program / instruction thereon, which, when executed by a processor, implements the steps of the above-mentioned privacy gradient poisoning attack defense method based on logarithmic secret sharing.

[0019] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned privacy gradient poisoning attack defense method based on logarithmic secret sharing.

[0020] The beneficial effects of the present invention are:

[0021] Based on secret sharing technology, the present invention proposes a privacy gradient poisoning attack defense method based on logarithmic secret sharing, so that the ciphertext gradient can be similarly calculated on the resource-constrained edge server. The present invention can complete the similarity calculation of encryption parameters in the resource-constrained edge server, and then identify malicious models to defend against privacy gradient poisoning attacks, weaken these malicious models through similarity, enhance the robustness of the global model aggregation process, and improve the security and model performance of federated learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a framework diagram of the present invention.

[0023] Figure 2 It is a scheme diagram for secure and robust aggregation.

[0024] Figure 3 This is a comparison chart of the experimental accuracy of the present invention and the classic aggregation method under different attacks under the condition of uniform data distribution.

[0025] Figure 4 This is a comparison chart of the experimental accuracy of the present invention and the classic aggregation method under different attacks under the condition of uneven data distribution.

[0026] Figure 5 This is a comparison chart of the accuracy of the present invention and the existing defense solutions.

[0027] Figure 6 This is a comparison chart between the computational overhead of the present invention and homomorphic encryption. DETAILED DESCRIPTION

[0028] The present invention is further described below in conjunction with the accompanying drawings.

[0029] This paper analyzes the privacy protection method and proposes a privacy gradient poisoning attack defense method based on logarithmic secret sharing based on secret sharing technology. It can complete the similarity calculation of privacy gradients in resource-constrained edge federated learning, and then identify malicious models to defend against privacy gradient poisoning attacks. This paper can detect malicious gradients uploaded by the client in federated learning under encrypted conditions.

[0030] The privacy gradient poisoning attack defense method based on logarithmic secret sharing includes the following steps:

[0031] 1) Initialization: In the initialization phase of federated learning, the central server c 2 Initialize the model and distribute it to all users;

[0032] 2) Local training: In the tth round of federated learning, each user u i Use the stochastic gradient descent (SGD) method to minimize the loss function and obtain the local gradient In order to facilitate the logarithmization of the gradient while maintaining the ability to reconstruct its original form, a two-step process is implemented: First, the symbolic matrix recording the gradient is Then, the absolute value of the gradient is logarithmized by the logarithmic function to obtain

[0033]

[0034] 3) Secret sharing: First, each user u i The logarithmic gradient Perform (t,n) secret sharing, based on the secret element x i Generate secrets i , and split it into secret pieces i1 andi2 , the secret fragments i1 Send to the central server c 1 , the secret fragments i2 and symbol matrix Send to the central server c 2 ;

[0035] y(x)=w+a 1 x+a 2 x 2 +......+a t-1 x t-1

[0036] Where y(x) is the polynomial function of secret sharing;

[0037] 4) Poisoning attack detection: Central server c 2 For each secret fragment s i2 Sum and get the secret share s i2+i2 ; Central server c 1 For each secret fragment s i1 Sum and get the secret share s i1+i1 ;

[0038] s i1+i1 =s i1 +s i1

[0039] s i2+i2 =s i2 +s i2

[0040] Central Server c 1 To the central server c 2 Request each user u i Secret Shares i2+i2 , using the secret share s i1+i1 and i2+i2 Reconstruction Secret(s i ) 2 , for (s i ) 2 Sum the elements in and check whether the result is equal to 1; if not, user u is determined to be i is a malicious client; due to the additive homomorphic property of secret sharing, the reconstructed secret is actually (x i ) 2 :

[0041]

[0042] During the normalized evaluation process, the gradients submitted by the user are not decrypted. Instead, the reconstructed secret represents the square of the absolute value of the user’s gradient, thus protecting the user’s privacy. 2 Will s i2 Transfer to c 1 When the central server c 1 You can get i2 , but this does not compromise user privacy. In addition, even if the central server c 1 Use s i1 and i2 To decrypt i ,Due to the lack of gradient sign information, only the absolute value of the gradient can be revealed.,Therefore, this mechanism effectively protects the user's true gradient information,,because the actual gradient value is still protected.

[0043] The server uses the cosine similarity between the previous round gradient and the current round gradient to detect potential poisoning updates. A low similarity score indicates a possible poisoning attack because it suggests an abnormal shift in the gradient direction. For user u with a check result equal to 1 i , central server c 2 According to the symbol matrix With the previous round of federated learning user u i Transmitted symbol matrix Calculate user u i The cosine similarity SecCos between the gradient of the previous round of federated learning and the gradient of the current round of federated learning i , if SecCos i If it is greater than the threshold, then user u is judged i is a malicious client; otherwise, it is determined that user u i For benign clients;

[0044] On the central server c j In the i The secret share of the gradient in the previous round of federated learning is expressed as The secret share of the current round gradient is expressed as and The secret share is calculated as where x j Is server c j unique coefficients. Since the gradient is logarithmic, the reconstructed secret corresponds to the product In the context of secret sharing encryption, the cosine similarity between gradients is calculated as shown in the formula.

[0045]

[0046] in, Represents user u iof The interpolation polynomial of Represents user u i of The interpolation polynomial of is The interpolation polynomial of .

[0047] 5) Secure and robust aggregation: In the secure aggregation stage, the central server c 1 Secret shards for all benign clients i1 The sum is calculated and the result is transmitted to the central server c responsible for the final aggregation of all users 2 ; Using the characteristics of secret sharing, the central server c 2 Secret shards for all benign clients i2 The sum is calculated and the central server c 1 The transmitted results are added together to obtain the secret share of the sum of the secrets of all benign clients, and then the secret share is decrypted to obtain the sum of the gradients of all user benign clients.

[0048]

[0049] Privacy-preserving federated learning uses encryption technology to protect model parameters. Although it ensures the privacy of participants, it increases the difficulty of defending against poisoning attacks. This is because most defense strategies are based on the similarity calculation of plaintext model parameters. Defense solutions based on homomorphic encryption can complete this calculation to achieve defense. However, it requires more computing resources, which will bring huge computing overhead and is difficult to deploy in resource-constrained edge environments.

[0050] Based on secret sharing technology, the present invention proposes a privacy gradient poisoning attack defense method based on logarithmic secret sharing, so that the ciphertext gradient can be similarly calculated on the resource-constrained edge server. The present invention can complete the similarity calculation of encryption parameters in the resource-constrained edge server, and then identify malicious models. Through similarity, these malicious models are weakened, the robustness of the global model aggregation process is enhanced, and the security and model performance of federated learning are improved.

[0051] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A privacy gradient poisoning attack defense method based on logarithmic secret sharing, characterized in that: The following steps are involved: (1) In the initialization phase of federated learning, the central server c2 initializes the model and distributes it to all users; (2) In the tth round of federated learning, each user u i Use the stochastic gradient descent method to minimize the loss function and obtain the local gradient Compute symbolic matrix The absolute value of the gradient is logarithmized by the logarithmic function to obtain Each user u i The logarithmic gradient Perform secret sharing based on the secret element x i Generate secrets i , and split it into secret pieces i1 and i2 , the secret fragments i1 Send to the central server c1, the secret fragment s i2 and symbol matrix Send to the central server c2; (3) The central server c2 generates a secret fragment s for each i2 Sum and get the secret share s i2+i2 ; Central server c1 for each secret fragment s i1 Sum and get the secret share s i1+i1 ; s i1+i1 =s i1 +s i1 s i2+i2 =s i2 +s i2 The central server c1 requests the central server c2 to send the i Secret Shares i2+i2 , using the secret share s i1+i1 and i2+i2 Reconstruction Secret(s i ) 2 , for (s i ) 2 Sum the elements in and check whether the result is equal to 1; If it is not equal to 1, then user u is judged i For malicious clients; For user u whose check result is equal to 1 i , the central server c2 according to the symbol matrix With the previous round of federated learning user u i Transmitted symbol matrix Calculate user u i The cosine similarity SecCos between the gradient of the previous round of federated learning and the gradient of the current round of federated learning i , if SecCos i If it is greater than the threshold, then user u is judged i is a malicious client; otherwise, it is determined that user u i For benign clients; (4) In the security aggregation phase, the central server c1 sends secret fragments s to all benign clients. i1 The sum is calculated and the result is transmitted to the central server c2; the central server c2 has the secret fragments S of all benign clients. i2 The sum is calculated and added to the result transmitted by the central server c1 to obtain the secret share of the sum of the secrets of all benign clients. The secret share is then decrypted to obtain the sum of the gradients of all user benign clients.

2. The privacy gradient poisoning attack defense method based on logarithmic secret sharing according to claim 1 is characterized in that: The user u i The cosine similarity SecCos between the gradient of the previous round of federated learning and the gradient of the current round of federated learning i The calculation method is:

3. A computer device / equipment / system comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 2.

4. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

5. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

Images