A method and device for defending against poisoning attacks based on federated learning

Abstract

This specification discloses a method and apparatus for defending against poisoning attacks based on federated learning, comprising: a central server randomly selecting clients to participate in training from all clients participating in federated learning, and synchronizing a global model with the clients participating in training as an initial global model; the clients participating in training performing local training on the initial global model to obtain the upload gradients of normal clients; the central server extracting features from long-term historical gradients to obtain score index sorting to remove malicious clients from the clients participating in training, obtaining candidate clients; the central server performing model aggregation based on the candidate clients, the clients participating in training, and the upload gradients, and updating the model parameters of the global model, the updated global model serving as a new round of initial global model, iterating until a preset number of iterations is reached to obtain a trained global model.

Description

Technical Field

[0001] This specification relates to the fields of computer technology and image classification technology, and in particular to a method and device for defending against poisoning attacks based on federated learning. Background Technology

[0002] Poisoning attack defense technology is a defense method in which servers identify abnormal updates from malicious attackers and delete or weight them according to aggregation rules.

[0003] Traditional defense techniques can identify some anomalous updates affected by poisoning attacks, but they still face problems such as insufficient utilization of historical data and unmet privacy requirements. With technological advancements, historical gradient techniques and distance-based defense techniques have emerged to address the shortcomings of traditional methods. Historical gradient techniques, as a crucial deep learning technique, can effectively capture long-term dependencies and information flows in historical data. Applying this technique to traditional defense techniques can improve their detection effectiveness and defense capabilities. However, historical gradient techniques cannot defend against attacks across long-term historical dimensions; in each round, the server only identifies client updates based on the current round's data. While long and short historical gradient techniques can address these issues, collecting long-term data may lead to unmet privacy requirements and necessitates new technologies for comprehensive analysis of historical gradient characteristics. Distance-based defense techniques are a simple and fast defense method that calculates the distance or similarity between uploaded model parameters or gradients. Through these distance and similarity calculations, updates with the greatest distance and least similarity are deleted or weighted. Currently, this technology is primarily represented by Krum. However, distance-based defense technologies cannot defend against long-term attacks and do not make sufficient use of historical data, which leads to the failure to identify certain long-standing malicious behaviors in a timely manner and poses a risk of privacy leaks.

[0004] Based on this, this specification provides a method and device for defending against poisoning attacks based on federated learning. Summary of the Invention

[0005] This specification provides a method and apparatus for defending against poisoning attacks based on federated learning, addressing the following technical problems: Historical gradient techniques cannot defend against attacks over long historical dimensions, as the server only identifies client updates based on the current round's data in each round. While long and short historical gradient techniques can solve these problems, collecting long-term data may result in unmet privacy requirements, and new technologies are needed to fully analyze the characteristics of historical gradients. Distance-based defense techniques cannot defend against long-term attacks and do not adequately utilize historical data, leading to the failure to promptly identify certain long-standing malicious behaviors and posing a risk of privacy leakage.

[0006] To solve the above-mentioned technical problems, the embodiments in this specification are implemented as follows:

[0007] This specification provides an embodiment of a poisoning attack defense method based on federated learning. The poisoning attack defense method is implemented jointly by a client and a central server, and includes:

[0008] The central server randomly selects clients to participate in training from all clients participating in federated learning, and synchronizes the global model with the clients participating in training as the initial global model;

[0009] The client participating in the training performs local training on the initial global model to obtain the upload gradient of the normal client among the clients participating in the training;

[0010] The central server extracts features from the long-term historical gradients to obtain a score index ranking. The score index ranking is used to remove malicious clients from the clients participating in the training and obtain candidate clients. The long-term historical gradients are obtained based on the uploaded gradients.

[0011] The central server aggregates models based on the candidate clients, the clients participating in training, and the uploaded gradients, and updates the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense.

[0012] This specification also provides a poisoning attack defense device based on federated learning, which is implemented through a client and a central server. The federated learning-based poisoning attack defense device includes:

[0013] The initialization module involves the central server randomly selecting clients to participate in training from all clients participating in federated learning, and synchronizing the global model with the clients participating in training as the initial global model.

[0014] The local training module allows the participating clients to perform local training on the initial global model to obtain the upload gradients of normal clients among the participating clients.

[0015] The filtering module, wherein the central server extracts features from the long-term historical gradients to obtain a score index ranking, the score index ranking is used to remove malicious clients from the clients participating in training to obtain candidate clients, and the long-term historical gradients are obtained based on the uploaded gradients;

[0016] The iteration module involves the central server aggregating models based on the candidate clients, the clients participating in training, and the uploaded gradients, and updating the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense.

[0017] The federated learning-based poisoning attack defense method provided in this specification is implemented jointly by a client and a central server. The central server randomly selects clients to participate in training from all clients participating in federated learning and synchronizes the global model with the participating clients as the initial global model. The participating clients perform local training on the initial global model to obtain the upload gradients of normal clients among the participating clients. The central server extracts features from the long-term historical gradients to obtain a score index ranking. The score index ranking is used to remove malicious clients among the participating clients to obtain candidate clients. The long-term historical gradients are obtained based on the upload gradients. The central server performs model aggregation based on the candidate clients, the participating clients, and the upload gradients, and updates the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense, which can achieve better training results, less impact from attacks, more accurate detection results of malicious clients, and can realize malicious update identification while protecting privacy requirements. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic diagram of a system architecture for a poisoning attack defense method based on federated learning, provided for embodiments of this specification;

[0020] Figure 2 A flowchart illustrating a poisoning attack defense method based on federated learning, provided as an embodiment of this specification;

[0021] Figure 3 A flowchart illustrating the perturbation principle of short-term historical gradients provided in the embodiments of this specification;

[0022] Figure 4 A flowchart illustrating the perturbation principle of long-term historical gradients provided for embodiments of this specification;

[0023] Figure 5 A framework diagram of a poisoning attack defense method based on federated learning provided for embodiments of this specification;

[0024] Figure 6 This is a schematic diagram of a poisoning attack defense device based on federated learning, provided as an embodiment of this specification. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0026] Figure 1 This diagram illustrates a system architecture for a poisoning attack defense method based on federated learning, as provided in the embodiments of this specification. Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0027] Terminal devices 101, 102, and 103 interact with server 105 via network 104 to receive or send messages, etc. Various client applications can be installed on terminal devices 101, 102, and 103, such as specialized programs for implementing poisoning attack defense methods based on federated learning.

[0028] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various dedicated or general-purpose electronic devices, including but not limited to smartphones, tablets, laptops, and desktop computers. When terminal devices 101, 102, and 103 are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services) or as a single software program or software module.

[0029] Server 105 can be a server that provides various services, such as a backend server that provides services to client applications installed on terminal devices 101, 102, and 103. For example, the server can perform federated learning-based poisoning attack defense so that the federated learning-based poisoning attack defense results can be displayed on terminal device servers 101, 102, and 103.

[0030] Server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services), or as a single software program or software module.

[0031] Figure 2 This is a flowchart illustrating a federated learning-based poisoning attack defense method provided in an embodiment of this specification. From a programming perspective, the executor of the process can be a program hosted on an application server or application terminal. It is understood that this method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. Figure 2 As shown, this federated learning-based poisoning attack defense method is applied to the server side, i.e., the central server. This federated learning-based poisoning attack defense method includes:

[0032] Step S201: The central server randomly selects clients to participate in training from all clients participating in federated learning, and synchronizes the global model with the clients participating in training as the initial global model.

[0033] Clients participating in training, or federated learning, are devices or nodes that perform local computing tasks on the network and collaborate with a central server to jointly train machine learning models.

[0034] In the embodiments of this specification, the clients participating in training are a subset N(i) randomly selected by the server from all clients in each round of federated learning. Simultaneously, the server synchronizes the global model with the participating clients. In specific embodiments, the number of all clients is no less than 50, and the proportion of clients randomly selected as a subset is 10%-30%. In one embodiment of this specification, 20% of all clients are selected as a subset. This subset may consist of benign or malicious clients. Because of the existence of malicious clients, poisoning attack defense is necessary.

[0035] In a federated learning framework, the global model is the central model that clients collaboratively train. This central model is managed by the server, and its main function is to share learning results among various clients, thereby achieving joint optimization of the model without directly exchanging local client data.

[0036] In the embodiments of this specification, the global model is a model for classifying image data, and / or text data, and / or data. In practical applications, the types of data processed by the global model are all broadly defined. For example, image data also includes data that can be converted into images, image data also includes data that can be converted into images, and text data also includes data that can be converted into text. For example, video image data can be converted into multiple image data.

[0037] After the central server synchronizes the global model with the clients participating in the training, this global model is used as the initial model for subsequent iterations.

[0038] Step S203: The client participating in the training performs local training on the initial global model to obtain the upload gradient of the normal client among the clients participating in the training.

[0039] The participating clients perform local training on the initial global model to obtain the upload gradients of normal clients among the participating clients, specifically including:

[0040] The client participating in the training uses local data to perform local training on the initial global model, using cross-entropy as the loss function, with the goal of minimizing the parameters w of the initial global model, to complete the local training.

[0041] Based on the initial global model that has completed local training, the upload gradient of the normal client among the clients participating in the training is obtained;

[0042] The expression for the upload gradient is:

[0043]

[0044] in,

[0045] Let be the upload gradient of the i-th client in the t-th round;

[0046] w t Let be the model parameters of the client participating in the training in round t;

[0047] x represents the actual data of the client participating in the training;

[0048] y represents the label data of the client participating in the training;

[0049] h w () represents the prediction function of the model participating in the training;

[0050] h i,w (x) represents the prediction output made by the model participating in the training on client i based on the input data x and the current model parameters w;

[0051] l represents the loss function.

[0052] In the embodiments of this specification, the long-term historical gradient can be generated in a central server, or it can be uploaded to the central server after being generated by the clients participating in training. Specifically, the long-term historical gradient is obtained based on the uploaded gradient, and includes:

[0053] The client participating in the training performs gradient aggregation on the uploaded gradient and the sliding window size of the client's short-term historical gradient to obtain the client's short-term historical gradient. The formula for calculating the short-term historical gradient is as follows:

[0054]

[0055] in,

[0056] This represents the short-term historical gradient of the i-th client participating in the training;

[0057] S represents the sliding window size of the short-term historical gradient;

[0058] E represents the local training round;

[0059] t represents the current training round;

[0060] k represents the kth training iteration of the sliding window for short-term historical gradients;

[0061] The client participating in the training perturbs the short-term historical gradient and filters and scales the perturbation parameters to meet differential privacy requirements, thereby updating the short-term historical gradient and obtaining the updated short-term historical gradient.

[0062] The central server obtains the long-term historical gradient based on the received updated short-term historical gradient; or

[0063] The client participating in the training performs gradient aggregation based on the uploaded gradient and the sliding window size of the client's long-term historical gradient to obtain the client's long-term historical gradient. The long-term historical gradient is uploaded to the central server. The calculation formula for the long-term historical gradient is:

[0064]

[0065] in,

[0066] This represents the long-term historical gradient of the i-th client participating in the training;

[0067] This represents the uploaded gradient of the i-th client participating in training;

[0068] This represents the upload gradient of the i-th client participating in training during the j-th training epoch of the long-term sliding window;

[0069] L is the sliding window size for the long-term historical gradient;

[0070] j represents the j-th training epoch of the sliding window of the long-term historical gradient.

[0071] The label 'y' is used to identify or label the data. The specific content of the label 'y' varies depending on the training data. In one embodiment of this specification, when the training data is the MNIST dataset, the label 'y' is a value between 0 and 9, indicating the true value of the handwritten digit represented by the image. When the training data is the CIFAR-10 dataset, the label represents ten categories, specifically including: airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck.

[0072] Malicious clients employ different attack methods depending on the type of attack they are launching; for example, model attacks directly modify the uploaded gradient. Data poisoning attacks modify the label y so that it does not match the actual data x, thereby affecting the gradient obtained during training.

[0073] In this specification, short-term historical gradient refers to gradient information from the most recent iterations. Long-term historical gradient refers to gradient information considering a longer time span. In specific embodiments, the determination of long-term and short-term historical gradients can be determined according to the business scenario and is not limited here.

[0074] To further understand short-term and long-term historical gradients, the principles of each will be explained below.

[0075] Figure 3 The flowchart illustrates the perturbation principle of short-term historical gradients provided in the embodiments of this specification. The principle of short-term historical gradients is as follows: (1) Collect short-term historical gradients: Short-term historical gradients are collected from a series of weight matrices. These weight matrices are W1, W2, ..., W...k These represent the model parameters at different time points. (2) Calculate the difference value: Calculate the gradient difference between two adjacent weight matrices, these difference values ​​g1, g2, ..., g k-1 This reflects the changes in model parameters over time. (3) Re-organize gradients into patches: Based on the gradient difference values ​​obtained in the previous step, reorganize them into patch structures. Each patch in the patch structure represents the changes in model parameters in a certain aspect. (4) Perturbation: Finally, by applying perturbation to these patch structures, differential privacy protection of gradients is achieved. The perturbed gradients can be used for subsequent model training while protecting the privacy of the original data.

[0076] Figure 4 A flowchart illustrating the perturbation principle of long-term historical gradients provided for embodiments of this specification. Figure 4 As shown, Start: The process begins. Dataset: The dataset used for training. Gradients of t-th round: Calculates the gradients g1, g2, ..., g of the current round t. n Dynamic smoothing: This process dynamically smooths these gradients to generate long-term historical gradients. Rectified convolutional feature maps: Corrects the convolutional feature maps. Flattened gradients: Flattens the corrected feature maps to obtain the flattened gradients. Random sampling: Randomly samples these flattened gradients. Singular Value Decomposition (SVD): Performs Singular Value Decomposition (SVD) on the sampled gradients to obtain the left singular vector matrix U, the right singular vector matrix V, and the singular values. Calculate scores: Calculates scores based on the singular values ​​and the centered data. Filter malicious clients by scores: Uses these scores to filter malicious clients.

[0077] In the embodiments of this specification, based on accelerating model convergence through short-term historical gradient aggregation, the randomness of single-round local gradient values ​​can be eliminated by utilizing the multi-round smoothing characteristics of short-term historical gradients, which helps the model converge to the expected stable state.

[0078] In the embodiments of this specification, the client participating in training perturbs the short-term historical gradient and filters and scales the perturbation parameters to meet differential privacy requirements, thereby updating the short-term historical gradient and obtaining the updated short-term historical gradient, specifically including:

[0079] A random Laplace noise matrix B with a mean of 0 and a standard deviation of σ is generated as the perturbation.

[0080] If the weight difference matrix of the short-term historical gradient is less than the preset threshold for each dimension, the perturbation is added to the short-term historical gradient as a candidate short-term historical gradient. The candidate short-term historical gradient is then pruned using a differential privacy method that employs gradient depersonalization to ensure that the gradient norm of the candidate short-term historical gradient is less than the upper limit of gradient pruning C, thereby updating the short-term historical gradient and obtaining the updated short-term historical gradient. The preset threshold for each dimension is half of the standard deviation.

[0081] If the weight difference matrix of the short-term historical gradient is greater than or equal to the preset threshold for each dimension, then the gradient depersonalization differential privacy method is used to prune the short-term historical gradient to ensure that the gradient norm of the short-term historical gradient is less than the upper limit value C of the gradient pruning, thereby updating the short-term historical gradient as the updated short-term historical gradient.

[0082] In the embodiments described in this specification, the standard deviation σ is inversely proportional to the privacy budget ε. The privacy budget ε is determined before training. As a hyperparameter, the privacy budget ε is related to the sensitivity of the database and the accuracy requirements of the model. The determination of the privacy budget ε depends on the user's concern for privacy. If a higher level of privacy protection is desired, a smaller privacy budget ε will be chosen, which will lead to more noise and thus reduce the accuracy of the model. The privacy budget ε is determined by the dataset and the model itself, and is determined by parameter tuning in specific applications.

[0083] In the embodiments of this specification, gradient depersonalization with differential privacy is a method that combines gradient depersonalization with differential privacy to protect data privacy. To prevent the gradient norm (size) from exceeding a predetermined upper limit C for gradient clipping, it needs to be scaled down proportionally so that the gradient norm does not exceed the upper limit C.

[0084] The formula for calculating the upper limit value C of gradient clipping is:

[0085]

[0086] in,

[0087] This represents the gradient of the i-th client participating in the training;

[0088] express The L2 norm;

[0089] This represents the gradient of the i-th client participating in training after pruning.

[0090] In a specific embodiment, The gradient will not change and no clipping is needed; when When the gradient is scaled, the scaling factor is 1. In the embodiments described in this specification, the formula for calculating the weight difference matrix of the short-term historical gradient is as follows:

[0091]

[0092] in,

[0093] W * The weight difference matrix represents the short-term historical gradient;

[0094] This represents the short-term historical gradient of the i-th client in round t;

[0095] Let represent the short-term historical gradient of the i-th client in round t-1.

[0096] In the embodiments of this specification, determining whether to add the perturbation to the short-term historical gradient based on a preset threshold for each dimension of the weight difference matrix of the short-term historical gradient specifically includes:

[0097] If the weight difference matrix of the short-term historical gradient is less than the preset threshold for each dimension, then the perturbation is added to the short-term historical gradient, where the preset threshold for each dimension is half of the standard deviation.

[0098] In the embodiments described in this specification, the threshold |γ| for each dimension, i.e., each layer of the model, is preset. However, in general, the threshold |γ| for each dimension is determined by the model itself.

[0099] When W * When the value is less than |γ|, the weight difference of the current dimension changes relatively little with training. If there is a malicious attack, it may be hidden in these model parameter kernels that are not affected by training. To reduce the long-term impact of such attacks, perturbations are added to them. In this case, they are added to the short-term historical gradient.

[0100] This specification's embodiments perturb the short-term historical gradients of the local model training on benign clients, and minimize the loss of local benign tasks by using a judgment matrix to maintain the performance of benign tasks. Furthermore, by perturbing the kernel of the Hessian matrix, it prevents attack influences from being hidden in the historical gradients of benign devices, thus mitigating the impact of malicious attacks.

[0101] Step S205: The central server extracts features from the long-term historical gradients to obtain a score index ranking. The score index ranking is used to remove malicious clients from the clients participating in training and obtain candidate clients. The long-term historical gradients are obtained based on the uploaded gradients.

[0102] In this embodiment of the specification, the central server extracts features from long-term historical gradients to obtain a score index ranking. This score index ranking is used to remove malicious clients from the clients participating in training and obtain candidate clients, specifically including:

[0103] The central server performs singular value decomposition on the long-term historical gradient to extract features and obtain a score sorting index.

[0104] Based on the score sorting index, malicious clients are removed from the clients participating in the training to obtain the candidate clients.

[0105] In this embodiment of the specification, the central server performs singular value decomposition on the long-term historical gradient to extract features in order to obtain a score ranking index, specifically including:

[0106] The central server obtains the average value of the long-term historical gradient after it has been expanded by dimension.

[0107] The difference between the average value and the average value of all clients participating in the training is used as the centering gradient for each client participating in the training.

[0108] Singular value decomposition is performed on the centered gradient to obtain the right singular matrix;

[0109] Based on the centered gradient, the average value, and the right singular matrix, the outlier score is obtained;

[0110] The outlier values ​​are sorted in descending order to obtain the score sorting index.

[0111] In the embodiments of this specification, the formula for calculating the outlier score is as follows:

[0112] in,

[0113] Score(i) represents the outlier value of the i-th client;

[0114] This represents the long-term historical gradient of the i-th client;

[0115] μ represents the average value of the long-term historical gradient after expansion along the dimension;

[0116] v represents a right singular matrix.

[0117] In this embodiment of the specification, the step of removing malicious clients from the clients participating in the training based on the score sorting index to obtain the candidate clients specifically includes:

[0118] Based on the score sorting index, a preset proportion is determined as malicious clients among the clients participating in the training;

[0119] From the clients participating in the training, the malicious clients are removed to obtain the candidate clients.

[0120] In a specific embodiment, the average value of the uploaded client N(i) after being flattened by dimension is first calculated based on its long-term historical gradient.

[0121] Next, we calculate the centralization gradient for each client. That is, its difference from the average value of all clients:

[0122]

[0123] Furthermore, the centered gradient is calculated based on the difference between each client's gradient and the average gradient across multiple dimensions. Extract the specificity of its features. Specifically, this involves analyzing the centered gradient. Perform singular value decomposition to obtain left and right singular matrices, where the right singular matrix v represents the specificity of the data. Flip it and align it with μ.

[0124] Finally, based on the specificity of its features, the outlier score Score(i) is calculated as follows. The outlier scores are sorted according to their size, and a score sorting index S(i) is constructed. Malicious clients are then removed based on the score sorting index S(i).

[0125]

[0126] The sorting index is obtained based on scores and represents the correspondence between scores and model parameters. After arranging the score sorting index in descending order, the portion with higher scores in the score sorting index is selected and removed to remove malicious clients. Generally, 10-30% of the higher scores in the score sorting index are selected for removal, preferably 20%.

[0127] Step S207: The central server performs model aggregation based on the candidate clients, the clients participating in training, and the uploaded gradients, and updates the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense.

[0128] In the embodiments described in this specification, the formula for calculating the model parameters of the updated global model is as follows:

[0129]

[0130] in,

[0131] ω t This represents the model parameters of the global model in the t-th round of the federated learning process;

[0132] N(b) represents the set of candidate clients;

[0133] D represents the amount of data from the clients participating in model aggregation;

[0134] Let represent the upload gradient of the i-th candidate client in round t.

[0135] In this embodiment, the parameters of the updated global model are used as the parameters for the next round of model iteration training, i.e., the initialization parameters.

[0136] In the embodiments of this specification, the preset number of iterations depends on the dataset used for global model training and the complexity of the model. In one embodiment of this specification, the MNIST dataset is used as training data, and a simple CNN architecture with two convolutional layers is used as the model, with a preset number of iterations of 100; in another embodiment of this specification, the CIFAR-10 dataset is used as training data, and ResNet18 is used as the model, with a preset number of iterations of 300.

[0137] To further understand the federated learning-based poisoning attack defense method in the embodiments of this specification, it will be described below in conjunction with a specific framework.

[0138] Figure 5 This is a framework diagram of a poisoning attack defense method based on federated learning, provided for embodiments of this specification. Figure 5As shown, the central server synchronizes the global model with the clients participating in the training. The clients then perform multiple rounds of local training based on their local data. Based on these rounds of local training, they obtain the upload gradients of normal clients and further generate short-term historical gradients. These short-term historical gradients are perturbed and then uploaded to the central server. The central server generates long-term historical gradients. Subsequently, the central server uses these long-term historical gradients to remove malicious clients and obtain candidate clients. Based on these candidate clients, the global model is updated, and paper-based training is performed to obtain the trained global model. Alternatively, the long-term historical gradients can also be generated by the clients participating in the training and then uploaded to the central server.

[0139] The federated learning-based poisoning attack defense method provided in this specification is implemented jointly by a client and a central server. The central server randomly selects clients to participate in training from all clients participating in federated learning and synchronizes the global model with the participating clients as the initial global model. The participating clients perform local training on the initial global model to obtain the upload gradients of normal clients among the participating clients. The central server extracts features from the long-term historical gradients to obtain a score index ranking. The score index ranking is used to remove malicious clients among the participating clients to obtain candidate clients. The long-term historical gradients are obtained based on the upload gradients. The central server performs model aggregation based on the candidate clients, the participating clients, and the upload gradients, and updates the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense, which can achieve better training results, less impact from attacks, more accurate detection results of malicious clients, and can realize malicious update identification while protecting privacy requirements.

[0140] The above describes in detail a method for defending against poisoning attacks based on federated learning. Correspondingly, this specification also provides a device for defending against poisoning attacks based on federated learning, such as... Figure 6 As shown. Figure 6 This specification provides a schematic diagram of a poisoning attack defense device based on federated learning, implemented through a client and a central server. The poisoning attack defense device includes:

[0141] Initialization module 601: The central server randomly selects clients to participate in training from all clients participating in federated learning, and synchronizes the global model with the clients participating in training as the initial global model;

[0142] Local training module 603, wherein the client participating in the training performs local training on the initial global model to obtain the upload gradient of the normal client among the clients participating in the training;

[0143] The filtering module 605, the central server extracts features from the long-term historical gradient to obtain a score index ranking, the score index ranking is used to remove malicious clients from the clients participating in training to obtain candidate clients, the long-term historical gradient is obtained based on the uploaded gradient;

[0144] The iteration module 607, the central server performs model aggregation based on the candidate client, the client participating in training and the uploaded gradient, and updates the model parameters of the global model. The updated global model is used as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense.

[0145] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0146] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for apparatus, electronic devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0147] The apparatus, electronic device, and non-volatile computer storage medium and method provided in the embodiments of this specification are corresponding. Therefore, the apparatus, electronic device, and non-volatile computer storage medium also have similar beneficial technical effects as the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the corresponding apparatus, electronic device, and non-volatile computer storage medium will not be repeated here.

[0148] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0149] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside on local and remote computer storage media, including storage devices.

[0150] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0151] The above description is merely an embodiment of this specification and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A poisoning attack defense method based on federated learning, characterized in that, The method for preventing poisoning attacks is implemented jointly by the client and the central server, and includes: The central server randomly selects clients to participate in training from all clients participating in federated learning, and synchronizes the global model with the clients participating in training as the initial global model; The client participating in the training performs local training on the initial global model to obtain the upload gradient of the normal client among the clients participating in the training; The central server extracts features from the long-term historical gradients to obtain a score index ranking. This score index ranking is used to remove malicious clients from the clients participating in training and obtain candidate clients. Specifically, the central server performs singular value decomposition on the long-term historical gradients to extract features and obtain a score ranking index. The long-term historical gradients are obtained based on the uploaded gradients. Specifically, the central server obtains the average value of the long-term historical gradients after dimensional expansion; the difference between the average value and the average value of all clients participating in training is used as the centered gradient of each client participating in training; singular value decomposition is performed on the centered gradient to obtain a right singular matrix; based on the centered gradient, the average value, and the right singular matrix, outlier scores are obtained; the outlier scores are sorted from largest to smallest to obtain the score ranking index; based on the score ranking index, malicious clients are removed from the clients participating in training to obtain the candidate clients. The central server aggregates models based on the candidate clients, the clients participating in training, and the uploaded gradients, and updates the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense.

2. The poisoning attack defense method as described in claim 1, characterized in that, The participating clients perform local training on the initial global model to obtain the upload gradients of normal clients among the participating clients, specifically including: The client participating in the training uses local data to perform local training on the initial global model, using cross-entropy as the loss function, with the goal of minimizing the parameters w of the initial global model, to complete the local training. Based on the initial global model that has completed local training, the upload gradient of the normal client among the clients participating in the training is obtained; The expression for the upload gradient is: in, Let be the upload gradient of the i-th client in the t-th round; w t Let be the model parameters of the client participating in the training in round t; x represents the actual data of the client participating in the training; y represents the label data of the client participating in the training; h w () represents the prediction function of the model participating in the training; h i,w (x) represents the prediction output made by the model participating in the training on client i based on the input data x and the current model parameters w; l represents the loss function.

3. The poisoning attack defense method as described in claim 1, characterized in that, The long-term historical gradient is obtained based on the uploaded gradient, and specifically includes: The client participating in the training performs gradient aggregation on the uploaded gradient and the sliding window size of the client's short-term historical gradient to obtain the client's short-term historical gradient. The formula for calculating the short-term historical gradient is as follows: in, This represents the short-term historical gradient of the i-th client participating in the training; S represents the sliding window size of the short-term historical gradient; E represents the local training round; t represents the current training round; k represents the kth training iteration of the sliding window for short-term historical gradients; The client participating in the training perturbs the short-term historical gradient and filters and scales the perturbation parameters to meet differential privacy requirements, thereby updating the short-term historical gradient and obtaining the updated short-term historical gradient. The central server obtains the long-term historical gradient based on the received updated short-term historical gradient; or The client participating in the training performs gradient aggregation based on the uploaded gradient and the sliding window size of the client's long-term historical gradient to obtain the client's long-term historical gradient. The long-term historical gradient is uploaded to the central server. The calculation formula for the long-term historical gradient is: in, This represents the long-term historical gradient of the i-th client participating in the training; This represents the uploaded gradient of the i-th client participating in training; This represents the upload gradient of the i-th client participating in training during the j-th training epoch of the long-term sliding window; L is the sliding window size for the long-term historical gradient; j represents the j-th training epoch of the sliding window of the long-term historical gradient.

4. The poison attack defense method as described in claim 3, characterized in that, The client participating in the training perturbs the short-term historical gradient and filters and scales the perturbation parameters to meet the differential privacy requirements, thereby updating the short-term historical gradient and obtaining the updated short-term historical gradient. Specifically, this includes: randomly generating a Laplacian noise matrix B as a perturbation based on a mean of 0 and a standard deviation of σ. If the weight difference matrix of the short-term historical gradient is less than the preset threshold for each dimension, the perturbation is added to the short-term historical gradient as a candidate short-term historical gradient. The candidate short-term historical gradient is then pruned using a differential privacy method that employs gradient depersonalization to ensure that the gradient norm of the candidate short-term historical gradient is less than the upper limit of gradient pruning C, thereby updating the short-term historical gradient and obtaining the updated short-term historical gradient. The preset threshold for each dimension is half of the standard deviation. If the weight difference matrix of the short-term historical gradient is greater than or equal to the preset threshold for each dimension, then the gradient depersonalization differential privacy method is used to prune the short-term historical gradient to ensure that the gradient norm of the short-term historical gradient is less than the upper limit value C of the gradient pruning, thereby updating the short-term historical gradient as the updated short-term historical gradient.

5. The poisoning attack defense method as described in claim 1, characterized in that, The formula for calculating the outlier score is as follows: in, Score(i) represents the outlier value of the i-th client; This represents the long-term historical gradient of the i-th client; μ represents the average value of the long-term historical gradient after expansion along the dimension; v represents a right singular matrix.

6. The poison attack defense method as described in claim 1, characterized in that, The step of removing malicious clients from the clients participating in training based on the score sorting index to obtain the candidate clients specifically includes: Based on the score sorting index, a preset proportion is determined as malicious clients among the clients participating in the training; From the clients participating in the training, the malicious clients are removed to obtain the candidate clients.

7. The poison attack defense method as described in claim 1, characterized in that, The formula for calculating the model parameters of the updated global model is as follows: in, ω t This represents the model parameters of the global model in the t-th round of the federated learning process; N(b) represents the set of candidate clients; D represents the amount of data from the clients participating in model aggregation; Let represent the upload gradient of the i-th candidate client in round t.

8. A poisoning attack defense device based on federated learning, characterized in that, The poisoning attack defense device is implemented through a combination of a client and a central server. The poisoning attack defense device based on federated learning includes: The initialization module involves the central server randomly selecting clients to participate in training from all clients participating in federated learning, and synchronizing the global model with the clients participating in training as the initial global model. The local training module allows the participating clients to perform local training on the initial global model to obtain the upload gradients of normal clients among the participating clients. The filtering module, wherein the central server extracts features from the long-term historical gradients to obtain a score index ranking, and the score index ranking is used to remove malicious clients from the clients participating in training to obtain candidate clients, specifically includes: the central server performing singular value decomposition on the long-term historical gradients to extract features to obtain a score ranking index, wherein the long-term historical gradients are obtained based on the uploaded gradients, specifically including: the central server obtaining the average value of the long-term historical gradients after dimensional expansion; taking the difference between the average value and the average value of all clients participating in training as the centered gradient of each client participating in training; performing singular value decomposition on the centered gradient to obtain a right singular matrix; obtaining outlier scores based on the centered gradient, the average value, and the right singular matrix; sorting the outlier scores from largest to smallest to obtain the score ranking index; and removing malicious clients from the clients participating in training based on the score ranking index to obtain the candidate clients. The iteration module involves the central server aggregating models based on the candidate clients, the clients participating in training, and the uploaded gradients, and updating the model parameters of the global model. The updated global model serves as the initial global model for a new round of iterations until a preset number of iterations is reached to obtain a trained global model. The trained global model is used for poisoning attack defense.

Images