Privacy-preserving gradient poisoning attack defense methods, programs, devices, and storage media based on logarithmic secret sharing.

Abstract

This invention belongs to the field of federated learning security defense technology, specifically relating to a method, program, device, and storage medium for defending against privacy gradient poisoning attacks based on logarithmic secret sharing. Based on secret sharing technology, this invention enables the similarity calculation of encrypted gradients to be performed on resource-constrained edge servers. This allows for the completion of similarity calculations of encrypted parameters on resource-constrained edge servers, thereby identifying malicious models to defend against privacy gradient poisoning attacks. By weakening these malicious models through similarity, the robustness of the global model aggregation process is enhanced, improving the security and model performance of federated learning.

Description

Technical Field

[0001] This invention belongs to the field of federated learning security defense technology, specifically involving a method, program, device, and storage medium for defending against privacy gradient poisoning attacks based on logarithmic secret sharing. Background Technology

[0002] Federated learning, based on multi-party collaborative model training, aims to protect data privacy. However, it cannot guarantee sufficient privacy protection. During the communication and updating of training parameters in federated learning, some model information may be leaked. Deeper information during model iteration may be leaked by third-party attackers, malicious parties, or central servers, thus federated learning cannot meet the requirement of preventing model information leakage. To ensure model privacy, encryption techniques are typically used to protect model parameters. However, privacy-preserving federated learning increases the difficulty of defending against poisoning attacks because most defense strategies target plaintext model parameters. Homomorphic encryption applied to federated learning can provide strong privacy protection and can be combined with defense strategies used on plaintext parameters, but it also requires significant computational resources, making it difficult to use in resource-constrained environments. Summary of the Invention

[0003] The purpose of this invention is to provide a method, program, device, and storage medium for defending against privacy gradient poisoning attacks based on logarithmic secret sharing. This method can perform similarity calculation of privacy gradients in resource-constrained edge federated learning, thereby identifying malicious models to defend against privacy gradient poisoning attacks.

[0004] A privacy gradient poisoning attack defense method based on logarithmic secret sharing includes the following steps:

[0005] (1) During the initialization phase of federated learning, the central server c2 initializes the model and distributes it to all users;

[0006] (2) In the t-th round of federated learning, each user u i Stochastic gradient descent is used to minimize the loss function, thus obtaining the local gradient. Calculate the symbol matrix The gradient, which is converted to absolute value, is obtained by logarithmic transformation using a logarithmic function.

[0007]

[0008] Each user u i The logarithmic gradient To perform secret sharing, based on the secret element x i Generate secrets s i And break it down into secret pieces. i1 and si2 , the secret fragments i1 Send the secret fragment s to the central server c1. i2 and symbol matrix Send to the central server c2;

[0009] (3) For each secret fragment s, the central server c2 i2 Summing yields the secret share s. i2+i2 Central server c1 for each secret fragment s i1 Summing yields the secret share s. i1+i1 ;

[0010] s i1+i1 =s i1 +s i1

[0011] s i2+i2 =s i2 +s i2

[0012] Central server c1 requests each user u from central server c2 i secret share i2+i2 Using secret shares i1+i1 and s i2+i2 Reconstructing the Secret (s) i ) 2 , for (s i ) 2 Sum the elements in the array and check if the result equals 1; if it does not equal 1, then determine if user u is the correct user. i This is a malicious client;

[0013] For user u whose check result is equal to 1 i The central server c2 is based on the symbol matrix. Compared with the previous round of federated learning users u i Transmitted symbol matrix Calculate user u i The cosine similarity (SecCos) between the gradient of the previous federated learning round and the gradient of the current federated learning round. i If SecCos i If the value is greater than the threshold, then user u is determined to be... i It is a malicious client; otherwise, user u is determined to be malicious. i A benign client;

[0014] (4) During the secure aggregation phase, the central server c1 collects the secret fragments s from all benign clients. i1 The summation is performed, and the result is transmitted to the central server c2; the central server c2 then processes the secret fragments s from all benign clients. i2The summation is performed and added to the result transmitted from the central server c1 to obtain the secret share of the sum of secrets of all benign clients. Then, the secret share is decrypted to obtain the gradient sum of all benign clients.

[0015] Furthermore, the user u i The cosine similarity (SecCos) between the gradient of the previous federated learning round and the gradient of the current federated learning round. i The calculation method is as follows:

[0016]

[0017] A computer device / apparatus / system includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-described privacy gradient poisoning attack defense method based on logarithmic secret sharing.

[0018] A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the above-described privacy gradient poisoning attack defense method based on logarithmic secret sharing.

[0019] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the above-described privacy gradient poisoning attack defense method based on logarithmic secret sharing.

[0020] The beneficial effects of this invention are as follows:

[0021] This invention proposes a privacy gradient poisoning attack defense method based on secret sharing technology, enabling similarity calculation of encrypted gradients on resource-constrained edge servers. This invention allows for the calculation of encrypted parameter similarity on resource-constrained edge servers, thereby identifying malicious models to defend against privacy gradient poisoning attacks. By weakening these malicious models through similarity, it enhances the robustness of the global model aggregation process and improves the security and model performance of federated learning. Attached Figure Description

[0022] Figure 1 This is a framework diagram of the present invention.

[0023] Figure 2 This is a schematic diagram of a secure and robust aggregation scheme.

[0024] Figure 3 This is a comparison chart of the experimental accuracy of the present invention and the classic aggregation method under different attacks, provided that the data is evenly distributed.

[0025] Figure 4 This is a comparison chart of the experimental accuracy of the present invention and the classic aggregation method under different attacks under the condition of uneven data distribution.

[0026] Figure 5 This is a comparison chart of the accuracy of the present invention and existing defense solutions.

[0027] Figure 6 This is a comparison chart of the computational overhead of the present invention and homomorphic encryption. Detailed Implementation

[0028] The present invention will now be further described with reference to the accompanying drawings.

[0029] This invention analyzes privacy protection methods and proposes a privacy gradient poisoning attack defense method based on secret sharing technology. This method can perform privacy gradient similarity calculations in resource-constrained edge federated learning, thereby identifying malicious models to defend against privacy gradient poisoning attacks. This invention can detect malicious gradients uploaded by clients under encrypted conditions in federated learning.

[0030] A privacy gradient poisoning attack defense method based on logarithmic secret sharing includes the following steps:

[0031] 1) Initialization: In the initialization phase of federated learning, the central server c2 initializes the model and distributes it to all users;

[0032] 2) Local training: In the t-th round of federated learning, each user u i The stochastic gradient descent (SGD) method is used to minimize the loss function and obtain the local gradient. To facilitate logarithmic operations on the gradient while preserving the ability to reconstruct its original form, a two-step process was implemented: First, according to the sign matrix recording the gradient... Subsequently, the absolute gradient is logarithmically transformed using a logarithmic function to obtain...

[0033]

[0034] 3) Secret sharing: First, each user u i The logarithmic gradient Perform (t,n) secret sharing based on the secret element x i Generate secrets s i And break it down into secret pieces. i1 and s i2 , the secret fragments i1 Send the secret fragment s to the central server c1. i2 and symbol matrix Send to the central server c2;

[0035] y(x)=w+a1x+a2x 2+......+a t-1 x t-1

[0036] Where y(x) is a secret-shared polynomial function;

[0037] 4) Poisoning attack detection: The central server c2 detects each secret fragment s. i2 Summing yields the secret share s. i2+i2 Central server c1 for each secret fragment s i1 Summing yields the secret share s. i1+i1 ;

[0038] s i1+i1 =s i1 +s i1

[0039] s i2+i2 =s i2 +s i2

[0040] Central server c1 requests each user u from central server c2 i secret share i2+i2 Using secret shares i1+i1 and s i2+i2 Reconstructing the Secret (s) i ) 2 , for (s i ) 2 Sum the elements in the array and check if the result equals 1; if it does not equal 1, then determine if user u is the correct user. i For malicious clients; due to the additive homomorphic property of secret sharing, the secret of this reconstruction is actually (x i ) 2 :

[0041]

[0042] During the normalization evaluation process, the gradients submitted by users are not decrypted. Instead, the secret of the reconstruction represents the square of the absolute value of the user's gradient, thus protecting user privacy. When the central server c2 sends s i2 When transmitting to c1, although the central server c1 can obtain s i2 However, this does not compromise user privacy. Furthermore, even if the central server c1 uses s i1 and s i2 To decrypt s i Because of the lack of gradient sign information, only the absolute value of the gradient can be revealed. Therefore, this mechanism effectively protects the user's true gradient information, as the actual gradient value is still protected.

[0043] The server uses the cosine similarity between the gradient of the previous iteration and the gradient of the current iteration to detect potential poisoning updates. A low similarity score indicates a possible poisoning attack because it suggests an anomalous shift in the gradient direction. For user u, whose check result is equal to 1... i The central server c2 is based on the symbol matrix. Compared with the previous round of federated learning users u i Transmitted symbol matrix Calculate user u i The cosine similarity (SecCos) between the gradient of the previous federated learning round and the gradient of the current federated learning round. i If SecCos i If the value is greater than the threshold, then user u is determined to be... i It is a malicious client; otherwise, user u is determined to be malicious. i A benign client;

[0044] At the central server c j In the middle, user u i The secret share of the previous round of federated learning gradient is represented as The secret share of the current round's gradient is represented as: and The secret share is calculated as where x j It is server C j Unique coefficients. Since the gradient is logarithmic, the secret to reconstruction corresponds to the product. In the context of secret sharing encryption, the cosine similarity between gradients is calculated as shown in the formula.

[0045]

[0046] in, Indicates user u i of The interpolation polynomial, Indicates user u i of The interpolation polynomial, That is The interpolation polynomial.

[0047] 5) Secure and Robust Aggregation: During the secure aggregation phase, using gradients without logarithmic transformation, the central server c1 stores the secret fragments s of all benign clients. i1 The results are summed and transmitted to the central server c2, which is responsible for the final aggregation of all users. Utilizing the secret-sharing feature, the central server c2 stores the secret fragments s from all benign clients. i2The summation is performed and added to the result transmitted from the central server c1 to obtain the secret share of the sum of secrets of all benign clients. Then, the secret share is decrypted to obtain the gradient sum of all benign clients.

[0048]

[0049] Privacy-preserving federated learning uses encryption to protect model parameters, which, while ensuring participant privacy, increases the difficulty of defending against poisoning attacks. This is because most defense strategies target the similarity calculation of plaintext model parameters. Defense schemes based on homomorphic encryption can perform this calculation, but they require significantly more computational resources, resulting in massive computational overhead and making them difficult to deploy in resource-constrained edge environments.

[0050] This invention proposes a privacy gradient poisoning attack defense method based on secret sharing technology, enabling similarity calculation of encrypted gradients on resource-constrained edge servers. This invention can complete the similarity calculation of encrypted parameters on resource-constrained edge servers, thereby identifying malicious models. By weakening these malicious models through similarity, the robustness of the global model aggregation process is enhanced, improving the security and model performance of federated learning.

[0051] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A privacy gradient poisoning attack defense method based on logarithmic secret sharing, characterized in that, Includes the following steps: (1) During the initialization phase of federated learning, the central server c2 initializes the model and distributes it to all users; (2) In the t-th round of federated learning, each user u i Stochastic gradient descent is used to minimize the loss function, thus obtaining the local gradient. Calculate the symbol matrix The gradient, which is converted to absolute value, is obtained by logarithmic transformation using a logarithmic function. Each user u i The logarithmic gradient To perform secret sharing, based on the secret element x i Generate secrets s i And break it down into secret pieces. i1 and s i2 , the secret fragments i1 Send the secret fragment s to the central server c1. i2 and symbol matrix Send to the central server c2; (3) For each secret fragment s, the central server c2 i2 Summing yields the secret share s. i2+i2 Central server c1 for each secret fragment s i1 Summing yields the secret share s. i1+i1 ; s i1+i1 =s i1 +s i1 s i2+i2 =s i2 +s i2 Central server c1 requests each user u from central server c2 i secret share i2+i2 Using secret shares i1+i1 and s i2+i2 Reconstructing the Secret (s) i ) 2 , for (s i ) 2 Sum the elements in the expression and check if the result equals 1. If it is not equal to 1, then determine user u. i This is a malicious client; For user u whose check result is equal to 1 i The central server c2 is based on the symbol matrix. Compared with the previous round of federated learning users u i Transmitted symbol matrix Calculate user u i The cosine similarity (SecCos) between the gradient of the previous federated learning round and the gradient of the current federated learning round. i If SecCos i If the value is greater than the threshold, then user u is determined to be... i It is a malicious client; otherwise, user u is determined to be malicious. i A benign client; (4) During the secure aggregation phase, the central server c1 collects the secret fragments s from all benign clients. i1 The summation is performed, and the result is transmitted to the central server c2; the central server c2 then processes the secret fragments s from all benign clients. i2 The summation is performed and added to the result transmitted from the central server c1 to obtain the secret share of the sum of secrets of all benign clients. Then, the secret share is decrypted to obtain the gradient sum of all benign clients.

2. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method of claim 1.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the method of claim 1.

4. A computer program product, comprising computer instructions, characterized in that: When the computer instructions are executed by the processor, they implement the steps of the method of claim 1.

Images