A method and system for strengthening the security of horizontal federated learning based on configuration adjustment

Abstract

The present invention discloses a method and system for reinforcing the security of horizontal federated learning based on configuration adjustment, and belongs to the technical field of distributed architecture security reinforcement. By determining the number of clients, local data modalities, and federated learning tasks of the target federated learning system, a set of initial configurations of the target federated learning system that meet the accuracy and computational overhead are generated, including the model architecture applied to the local model and the global model, the client local data distribution, the degree of pre-training of the global model, and the aggregation method; a penetration test of the initial configuration including a simulated attack method with full coverage of vulnerabilities is initiated, and the configuration is adjusted according to the test results until the security requirements are met, the optimal configuration is screened, and the target federated learning system is reinforced with the optimal configuration. The present invention realizes the flexible configuration of the target federated learning system, and can effectively evaluate the reinforcement effect of the configuration results, avoid the risk of privacy leakage in all directions, and improve the security of the target federated learning system.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed architecture security reinforcement, and in particular to a method and system for reinforcing the security of horizontal federated learning based on configuration adjustment. Background Art

[0002] In recent years, with the popularization of the Internet and mobile terminals, data has grown exponentially. Traditional centralized machine learning methods require all data to be concentrated in a computing center for training, which often presents many obstacles in many application scenarios. On the one hand, the traditional centralized machine learning method has huge computing power requirements and communication overhead for data transmission, which can no longer meet current computing needs; at the same time, in most application scenarios such as medical health data and financial transaction data, the data contains sensitive information and cannot be collected and stored centrally due to relevant laws and regulations; and, massive data is scattered in different devices or institutions, making it difficult to collect and conduct centralized learning.

[0003] In order to fully explore the value of data while protecting data privacy, federated learning came into being. The federated learning architecture avoids the centralized collection of raw data by training models locally on participating parties (such as mobile devices and data islands). Each participant uses local data to independently train a local model, and then uploads the model update to the central server. The central server uses an aggregation method to generate a global federated model and sends this update to each participant for the next round of training. In this process, participants do not need to share raw data, and the training task is completed without leaving the local area, which not only fully utilizes the value of data, but also ensures data security and privacy.

[0004] However, the federated learning architecture also faces many security and privacy risks, which can have serious consequences. In terms of security, malicious participants may launch poisoning attacks, that is, provide training data with incorrect labels or noise or maliciously modified model updates, resulting in global model performance degradation or failure to converge; in addition, malicious participants may also implement backdoor attacks, that is, inject specific backdoor triggers when training local models, causing the global model to behave abnormally under specific inputs. In terms of privacy, attackers can analyze the updates of global models or local models, or even maliciously tamper with the global model sent to the participants, and implement information inference attacks to obtain information about members participating in the training, data features, and other information; more seriously, attackers can implement data reconstruction attacks to reconstruct the original training data.

[0005] In order to avoid the risk of privacy leakage, how to strengthen the security of the target federated learning system before it is released and used is a technical problem that needs to be solved urgently in this field. Common security reinforcement methods are achieved by building robust aggregation algorithms or encryption and noise addition. This reinforcement method is highly targeted, has high overhead, lacks effectiveness evaluation, and cannot be flexibly set for different target federated learning systems. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a method and system for reinforcing the security of horizontal federated learning based on configuration adjustment, which realizes flexible configuration of the target federated learning system and can effectively evaluate the reinforcement effect of the configuration results, thereby avoiding the risk of privacy leakage in all aspects and improving the security of the target federated learning system.

[0007] The technical solution adopted by the present invention is as follows:

[0008] In a first aspect, the present invention provides a method for strengthening the security of horizontal federated learning based on configuration adjustment, comprising the following steps:

[0009] (1) Determine the number of clients, local data modality, and federated learning tasks of the target federated learning system;

[0010] (2) Generate a set of target federated learning system initial configurations that meet accuracy and computational overhead, wherein the initial configurations include the model architectures applied to the local model and the global model, the client local data distribution, the global model pre-training degree, and the aggregation method; the generation process of the initial configurations includes:

[0011] According to the local data modality and federated learning tasks, the basic blocks and depth parameters of the model architecture are predefined; in combination with the number of clients, the client local data and server pre-trained data of different distribution types are constructed using simulated data, the simulated client local data meets the data heterogeneity requirements and the local data modality requirements, and the server pre-trained data is used to pre-train the global model to different degrees;

[0012] (3) Initiating a penetration test on the initial configuration, wherein the penetration test includes a simulated attack method that fully covers the vulnerabilities; adjusting the configuration according to the penetration test results until the security requirements are met; selecting the optimal configuration from the configurations that meet the security requirements, and using the optimal configuration to reinforce the target federated learning system.

[0013] Furthermore, the local data modality is any one of an image modality, a table modality and a text modality.

[0014] Furthermore, the client local data distribution in the initial configuration is controlled by a set of hyperparameters, specifically:

[0015] The data distribution within the client and the data segmentation between clients are jointly modeled as data heterogeneity. The data heterogeneity is decomposed into feature skew distribution, quantity skew distribution and label skew distribution. The three types of skew distribution are respectively determined by the feature skew distribution hyperparameters , number skewed distribution hyperparameters and label skew distribution hyperparameters Controlling the degree of skewness, the local data distribution of any client participating in federated learning can be modeled as a combination of one or more of the three skewed distributions, which is represented by three hyperparameters and their values.

[0016] Furthermore, the model architecture in the initial configuration is obtained from a predefined local model library, which contains a series of model basic blocks and their candidate depth values ​​and corresponding classification layers for different federated learning tasks and different data modalities; the model basic blocks of the candidate depths are obtained by looking up the table and splicing the corresponding classification layers to obtain the model architecture.

[0017] Furthermore, the degree of pre-training of the global model in the initial configuration refers to the accuracy of executing the corresponding federated learning task under a given federated learning configuration, and the degree of pre-training is determined by sampling part of the data in the client as a test set.

[0018] Furthermore, the generating of a set of target federated learning system initial configurations that meet accuracy and computational overhead includes:

[0019] (2-1) querying a historical experience configuration table to generate a set of candidate initial configurations, wherein the historical experience configuration table has a recommended configuration range according to the number of clients, local data modality, and federated learning tasks, and randomly generating P groups of values ​​within the recommended configuration range to obtain P candidate initial configurations;

[0020] (2-2) Use the auxiliary test set to test the accuracy and computational overhead of P candidate initial configurations, and eliminate the candidate initial configurations that do not meet the accuracy requirements; after elimination, re-rank the candidate initial configurations;

[0021] (2-3) Eliminate the candidate initial configurations that do not meet the computational overhead from the reordered candidate initial configurations;

[0022] (2-4) The remaining candidate initial configurations serve as a set of initial configurations of the federated learning system that meet the target accuracy and computational overhead.

[0023] Furthermore, the simulated attack mode for penetration testing is determined by establishing a mapping relationship between coordinates and attack mode performance, and the mapping relationship construction method includes:

[0024] Establish a server condition coordinate axis and a client condition coordinate axis to represent the mapping relationship. The three dimensions of the condition coordinate axis represent asset characteristics, capability characteristics, and knowledge characteristics respectively.

[0025] For the server condition axis, the asset feature is a global model; the knowledge feature is divided into SK1 and SK2, where SK1 means knowing the local model update of each client, and SK2 means knowing the update of all clients after aggregation; the capability feature is divided into SC1 and SC2, where SC1 means observing the training process of federated learning, and SC2 means intervening in the training process of federated learning;

[0026] For the client condition axis, the asset features are the client local data and the client model; the knowledge features are divided into CK1 and CK2, where CK1 means knowing the final result of the local model, and CK2 means knowing all the intermediate output results of the local model; the capability features are divided into CC1, CC2 and CC3, where CC1 means that the client only complies with the federated learning training protocol, CC2 means that the client can change the updates it uploads, and CC3 means that the client can change the training process of the model;

[0027] The simulated attack methods are divided into poisoning attacks, backdoor attacks, inference attacks and reconstruction attacks according to their types. Different types of attack methods are obtained, and their positions on the server condition coordinate axis and / or the client condition coordinate axis are determined according to the characteristics of each attack method. Each coordinate point on the two coordinate axes corresponds to at least one attack method, and the attack methods corresponding to all coordinate points on the coordinate axis constitute a simulated attack method that fully covers the vulnerabilities.

[0028] Further, adjusting the configuration according to the penetration test results includes:

[0029] Each attack method corresponds to a preset attack evaluation index, which includes PAI, BSR, ISR, PSNR, and LR. If the attack evaluation index of at least one attack method is greater than the threshold, the configuration is adjusted according to the attack evaluation index result; if the attack evaluation indicators of all attack methods are less than or equal to the threshold, the configuration meets the security requirements.

[0030] Furthermore, the screening of the optimal configuration from the configurations that meet the security requirements includes: comparing the accuracy and computational overhead of the configurations that meet the security requirements, taking the configuration with the highest accuracy as the optimal configuration, and taking the configuration with the lowest computational overhead as the optimal configuration when the accuracy is the same.

[0031] The present invention has the following beneficial effects:

[0032] (1) The present invention strengthens the system security from the perspective of federated learning system configuration. Federated learning system configuration is an essential step before the system is released, and the present invention does not add additional overhead;

[0033] (2) The present invention generates a set of candidate configurations from multiple aspects, including model architecture, client local data distribution, global model pre-training degree, and aggregation method, based on the number of clients, local data modality, and federated learning tasks of the target federated learning system. The initial configuration that meets the requirements is preliminarily screened from the aspects of accuracy and computational overhead. A penetration test is then initiated on the federated learning systems with different configurations using a simulated attack method that covers all vulnerabilities. The configuration is adjusted according to the penetration test results until the security requirements are met. The present invention realizes the flexible configuration of the target federated learning system and can effectively evaluate the reinforcement effect of the configuration results, proving that a small configuration can significantly affect user privacy. The present invention can avoid the risk of privacy leakage in all aspects and improve the security of the target federated learning system. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flow chart of the method for strengthening the security of horizontal federated learning based on configuration adjustment proposed by the present invention;

[0035] Figure 2 This is a schematic diagram of the federated learning framework;

[0036] Figure 3 It is a schematic diagram of the server condition coordinate axis;

[0037] Figure 4 This is a schematic diagram of the client conditional coordinate axis;

[0038] Figure 5 Schematic diagram of the pre-training degree of the global model. DETAILED DESCRIPTION

[0039] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0040] The accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0041] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps may be decomposed, while some steps may be combined or partially combined, so the actual execution order may change according to the actual situation.

[0042] like Figure 1 As shown, in order to solve the security problem of the target federated learning system, the present invention proposes a horizontal federated learning security reinforcement method based on configuration adjustment, which mainly includes the following steps:

[0043] S1, for the target federated learning system, determine the number of clients, local data modality, and federated learning tasks;

[0044] S2, generating a set of target federated learning system initial configurations that meet accuracy and computational overhead, wherein the initial configurations include model architectures applied to local models and global models, client local data distribution, global model pre-training degree, and aggregation methods; the generation process of the initial configurations includes:

[0045] According to the local data modality and federated learning tasks, the basic blocks and depth parameters of the model architecture are predefined, and the local model and the global model of the target federated learning system adopt the same model architecture; combined with the number of clients of the target federated learning system, the client local data and server pre-training data of different distribution types are constructed using simulated data, and the simulated client local data meets the data heterogeneity requirements and the local data modality requirements, and the server pre-training data is used to pre-train the global model to different degrees;

[0046] S3, initiating a penetration test on a set of target federated learning system initial configurations obtained in step S2 that meet the accuracy and computational overhead requirements, wherein the penetration test includes a simulated attack method that fully covers the vulnerabilities; adjusting the configuration according to the penetration test results until the security requirements are met.

[0047] S4, compares the accuracy and computational overhead of the configurations that meet the security requirements, generates the optimal configuration, and uses the optimal configuration to reinforce the target federated learning system.

[0048] In the above step S1, before the target federated learning system is released, its task type is known, which refers to the task that the target federated learning system wants to complete, such as image classification task, table parsing task, text generation task, etc.; after the task type of the target federated learning system is determined, its corresponding data modality is also known, for example, for image classification task, its data modality should be image modality; for table parsing task, its data modality should be table modality; for text generation task, its data modality should be text modality. The number of clients is pre-defined by the target federated learning system. Assume that there are M clients participating in federated learning, each client represents an institution, and each institution has different local business data. Its local data should meet the local data modality requirements, and they jointly complete the federated learning task. For example, institution A participating in federated learning has feature data of a group of users, institution B has feature data of another group of users, and so on.

[0049] Federated learning tasks generally follow Figure 2 In the framework shown, for a federated learning system with N clients participating, each client uses local data to train a local model, uploads the parameters to the server, updates the global model through model aggregation, and then sends the global model parameters to each client.

[0050] The above-mentioned number of clients, local data modality, and federated learning tasks are personalized attributes of the target federated learning system, which will not be changed during the subsequent security reinforcement process to ensure that the reinforced target federated learning system can still complete its established tasks.

[0051] In the above step S2, configuration is performed from aspects such as the client local data distribution, the architecture of the local model and the global model, and the degree of pre-training of the global model.

[0052] (2-1) Client local data distribution:

[0053] The present invention jointly models the data distribution within the client and the data segmentation between clients as data heterogeneity, which can be specifically decomposed into feature skew distribution, quantity skew distribution and label skew distribution, and each skewness is controlled by a hyperparameter. Under this definition, the data heterogeneity is controlled by the feature skew distribution hyperparameter , number skewed distribution hyperparameters and label skew distribution hyperparameters Together, we decide that the local data distribution of any client participating in federated learning can be modeled as a combination of one or more of the three skews, which is represented by three hyperparameters and their values.

[0054] Specifically, for a sample , which belongs to Client's class, it is marked as ,in , is the number of categories, the value of which is determined by the task type; , is the number of clients; the number of categories each client has is , ,from Random sampling is obtained.

[0055] For categories , Indicates that the data category follows the Dirichlet distribution, and the distribution is determined by the attention parameter control, , The smaller the value, the more uneven the Dirichlet distribution is; here, the attention parameter represents the feature skew distribution hyperparameter; for the client , Indicates that the amount of data held by different clients follows a log-normal distribution, and the distribution is determined by the variance control, , The larger the value, the more uneven the lognormal distribution is; here, the variance represents the number of skewed distribution hyperparameters;

[0056] For Clients have categories of data, It indicates the proportion of the number of data categories held by different clients to the total number of categories, and the data categories in each client are uniformly distributed. The skew is determined by the category ratio control, , The smaller the value, the smaller the number of tags held by each client in the total number of samples, and the higher the degree of skewness; here, the variance represents the label skew distribution hyperparameter;

[0057] The present invention models the data distribution of all clients, including the data distribution within each client and the data partitioning between clients, as the following sampling pattern. For example, for the balanced partitioning of independent and identically distributed data sets, it is modeled as ;

[0058] For heterogeneity of feature skewness, it is modeled as ;

[0059] For heterogeneity with skewed sample size, the model is ;

[0060] For heterogeneity based on label skew, it is modeled as .

[0061] in, represents uniform distribution; Represented by hyperparameters Controlled Dirichlet distribution, used to characterize characteristic skewed distributions; Represented by hyperparameters Lognormal distribution of controls.

[0062] Under the above definition, for any data distribution within and between clients, three hyperparameters can be used And the corresponding sampling method is shown as follows: The features, number and labels are not skewed and can be modeled as: ; ; , .

[0063] Only the feature is skewed, which can be modeled as: ; ; , .

[0064] Only the quantity is skewed, which can be modeled as: ; ; , .

[0065] Only the label skewness can be modeled as: ; ; , .

[0066] The features and quantity are skewed at the same time, which can be modeled as ; ; , .

[0067] Both features and labels are skewed, which can be modeled as ; ; , .

[0068] The number and label are skewed at the same time, which can be modeled as ; ; , .

[0069] The features, number, and label are skewed at the same time, which can be modeled as ; ; , .

[0070] Through the above analysis, local data heterogeneity is jointly determined by the feature skew distribution hyperparameter, the quantity skew distribution hyperparameter, and the label skew distribution hyperparameter. Once the value is determined, it represents a sampling method from the given data, through which the requirements of a certain local data distribution are met.

[0071] (2-2) Architecture of local model and global model:

[0072] In target federated learning, the local model and the global model adopt the same architecture, which should satisfy the local data modality and federated learning tasks.

[0073] In a specific implementation of the present invention, a local model library is predefined, and the local model library contains model basic blocks for different federated learning tasks and different data modalities. And its common depth value And the corresponding classification layer. It is worth noting that only common depths are listed below, and custom depths can be used in implementation ,For example:

[0074] For classification tasks and image modality data, the basic model block Including MLP, CNN, VGG, LeNet, ResNet and MobileNet. According to the number of features of the input image , different basic blocks are generally selected. For example, for the number of features For image input, all basic blocks can be used; for the number of features For image input, the basic blocks selected include CNN, VGG, LeNet, ResNet and MobileNet; for the number of features For image input, the basic blocks selected include VGG, LeNet, ResNet and MobileNet; for the number of features For image input, the basic blocks selected include VGG, LeNet, ResNet and MobileNet. The commonly used depths of MLP are 3 / 4 / 5; the commonly used depths of CNN are 2 / 3 / 4, and the corresponding classification layers are average pooling layers and two fully connected layers; the commonly used depths of VGG are 9 / 11 / 13 / 16, and the corresponding classification layers are average pooling layers and three fully connected layers; the commonly used depths of LeNet are 2 / 3 / 4, and the corresponding classification layers are average pooling layers and three fully connected layers; the commonly used depths of ResNet are 10 / 18 / 34 / 50, and the corresponding classification layers are average pooling layers and one fully connected layer; the commonly used depths of MobileNet are 3 / 5 / 6, and the corresponding classification layers are two fully connected layers.

[0075] For classification tasks and text modal data, the basic model block Including RNN, Bi-RNN, LSTM, GRU and Transformer. According to the vocabulary size of the input corpus , usually different basic blocks are selected. For example, for the vocabulary size The basic blocks selected include RNN, Bi-RNN, LSTM, GRU and Transformer; for the vocabulary size The basic blocks selected include Bi-RNN, LSTM, GRU and Transformer; for the vocabulary size , the basic blocks selected include LSTM, GRU and Transformer; for the vocabulary size , the selected basic blocks include Transformer. The commonly used depth values ​​of RNN are 3 / 4 / 5, and the corresponding classification layer is one fully connected layer; the commonly used depth values ​​of Bi-RNN are 2 / 3 / 4, and the corresponding classification layer is one fully connected layer; the commonly used depth values ​​of LSTM are 2 / 3 / 4, and the corresponding classification layer is two fully connected layers; the commonly used depth values ​​of GRU are 2 / 3 / 4; the commonly used depth values ​​of Transformer are 2 / 3 / 4, and the corresponding classification layer is two fully connected layers.

[0076] For prediction tasks and text modal data, the basic model block Including LSTM, Transformer, BERT, RoBERTa and GPT. According to the vocabulary size of the input corpus , usually different basic blocks are selected. For example, for the vocabulary size The basic blocks selected include LSTM, Transformer, BERT, RoBERTa and GPT; for the vocabulary size , the basic blocks selected include Transformer, BERT, RoBERTa and GPT; for the vocabulary size , the selected basic blocks include BERT, RoBERTa and GPT; for the vocabulary size , the selected basic blocks include GPT. The commonly used depth values ​​of LSTM are 3 / 4 / 5, and the corresponding classification layer is a fully connected layer; the commonly used depth values ​​of Transformer are 2 / 3 / 4, and the corresponding classification layer is a fully connected layer; the commonly used depth values ​​of BERT are 2 / 3 / 4, and the corresponding classification layer is a fully connected layer; the commonly used depth values ​​of RoBERTa are 2 / 3, and the corresponding classification layer is a fully connected layer; the commonly used depth values ​​of GPT are 2 / 3, and the corresponding classification layer is a fully connected layer.

[0077] For classification tasks and tabular modal data, the basic blocks of the model are Including LR, XGBoost, DT, MLP, TabNet, FCN, SAINT and Transformer. According to the number of features of the tabular data , usually different basic blocks are selected. For example, for the vocabulary size The basic blocks selected include LR, XGBoost, DT and MLP; for the number of features The basic blocks selected include XGBoost, DT, MLP, TabNet, FCN, SAINT and Transformer; for the number of features The basic blocks selected include MLP, TabNet, FCN, SAINT and Transformer; for the number of features The basic blocks selected include TabNet, FCN, SAINT and Transformer; for the number of features The basic blocks used include TabNet, FCN, SAINT and Transformer. The commonly used depth values ​​of XGBoost are 30 / 60 / 100; the commonly used depth values ​​of DT are 3 / 4 / 5; the commonly used depth values ​​of MLP are 3 / 4 / 5; the commonly used depth values ​​of TabNet are 2 / 3 / 4, and the corresponding classification layer is one fully connected layer; the commonly used depth values ​​of FCN are 2 / 3 / 4; the commonly used depth values ​​of SAINT are 2 / 3 / 4, and the corresponding classification layer is one fully connected layer; the commonly used depth values ​​of Transformer are 2 / 3 / 4, and the corresponding classification layer is two fully connected layers.

[0078] By selecting basic blocks and their depth values ​​and corresponding output layers from the local model library, an optional model architecture is constructed and applied to the target federated learning model.

[0079] (2-3) Global model pre-training degree and aggregation method:

[0080] The server pre-training data for global model pre-training is generated according to local data modalities and federated learning tasks. The impact of the degree of global model pre-training on the security of the target federated learning system is explored by pre-training the global model to different degrees. The pre-training model refers to the model that the server collects public data for centralized training based on the client data modality and tasks. The pre-training degree is The accuracy of the model in performing the corresponding task under a given federated learning architecture. In this embodiment, the pre-training degree is set Set to any value between (0, 1). The degree of pre-training can be determined by using a small amount of sampled data in the client as a test set, such as Figure 5 As shown in the figure, with continuous training, the accuracy of the model continues to improve, that is, the degree of pre-training continues to improve.

[0081] Aggregation methods Selected from FedAvg, FedSgd, FedAdam, FedProx, FedNova, SCAFFOLD, FedDyn, FedMonitor and FedCnst. FedAvg instructs the client to use local data for multiple rounds of training, and updates the global model after weighted average of the updates uploaded by the client; in FedSgd, the server receives the local random gradient values ​​uploaded by the client, and updates the global model after weighted average; FedAdam treats the updates uploaded by the client as gradient updates, dynamically adjusts the learning rate and peak constraints to aggregate local updates; FedProx introduces additional The regularization term limits the distance between the local model and the global model as the training target of the client; FedNova normalizes and scales the local updates before updating the global model; SCAFFOLD calculates the variance between client updates, estimates the update direction of the server model and the update direction of each client, and then adds drift to the variance that deviates far to correct the direction of the local update; FedDyn adds regularization term constraints to the training target based on the local training performance of the global model and the previous round model; FedMonitor detects category imbalance during training and uses a loss function based on the local category ratio and the global category ratio to constrain the training process; FedCnst uses model contrast learning to compare the representations learned by the current client model, the previous round client model, and the global model to correct the update direction of client training.

[0082] (2-4) Determine a set of configurations with similar accuracy and computational overhead:

[0083] For the convenience of representation, the number of initialized configurations is defined as P, expressed as ,in Indicates the Pth initial configuration; the adjustable part of the initial configuration is determined by 7 parameters, namely: , basic blocks and its depth value , global model pre-training degree And polymerization method thereof ; The non-adjustable parts are the number of clients, local data modality, and federated learning tasks.

[0084] In a specific implementation of the present invention, the initialization configuration is generated by querying a historical experience configuration table, wherein the historical experience configuration table has a recommended configuration range according to the number of clients, the local data mode, and the federated learning task, and randomly generates P groups of values ​​within the recommended configuration range to obtain . The historical experience configuration table is generated based on the historical performance of different configurations and can be set according to the experience of technicians in this field, which will not be described here. If the historical experience configuration table does not fully match the personalized attributes of the target federated learning system (based on the number of clients, local data modality, and federated learning tasks), the closest range value is selected in the order of federated learning tasks, local data modality, and number of clients.

[0085] The above configuration Further preliminary screening based on accuracy and computational overhead to obtain a set of configurations with similar accuracy and computational overhead , the initial screening process is as follows:

[0086] Preset Parameters and , respectively represent the acceptable accuracy approximation and computational cost approximation. Generally The value is 0.1. The value should be less than 10. The smaller the value, the higher the performance approximation of the model in this configuration. Smaller values ​​represent a higher degree of cost approximation of the model in that configuration.

[0087] First, a specific dataset and a specific task are used to test the accuracy of the model architecture in the above P configurations, and the model accuracy is expressed as , the computational cost is expressed as ;

[0088] For configuration ,when When, keep Otherwise, Remove; reorder the remaining configurations as ;

[0089] Further judging the computational overhead, when When, keep Otherwise, Eliminate.

[0090] After the above preliminary screening, the configurations with similar accuracy and computational overhead are finally retained as , Q is the number of configurations remaining after the initial screening.

[0091] In the above step S3, a penetration test is initiated for the above-obtained set of configurations, and the penetration test includes simulated attack methods with full coverage of vulnerabilities, which are divided into four types: poisoning attacks, backdoor attacks, inference attacks and reconstruction attacks; the simulated attack methods with full coverage of vulnerabilities are determined by establishing a mapping relationship between coordinates and attack method performance, and each attack method corresponds to an attack evaluation indicator.

[0092] In this embodiment, a conditional coordinate axis representing the mapping relationship is established, preferably a three-dimensional coordinate axis, where the three dimensions represent asset characteristics, capability characteristics, and knowledge characteristics, respectively. The initiator of each attack method may be a server or a client, and the server conditional coordinate axis is different from the client conditional coordinate axis. The target of the attack is the entire federated learning system, including the client and the server.

[0093] For server condition axes, such as Figure 3 As shown in the figure, the asset feature is a global model; the knowledge feature is divided into SK1 and SK2, where SK1 means knowing the local model update of each client, and SK2 means knowing the update after all clients are aggregated; the capability feature is divided into SC1 and SC2, where SC1 means observing the training process of federated learning, and SC2 means intervening in the training process of federated learning, including changing the model architecture or modifying the global model update sent to the model.

[0094] For client-side conditional axes, such as Figure 4 As shown, the asset features are data and client models, and the knowledge features are divided into CK1 and CK2, where CK1 means knowing the final result of the local model, and CK2 means knowing all intermediate output results of the local model; the capability features are divided into CC1, CC2 and CC3, where CC1 means that the client only complies with the federated learning training protocol, CC2 means that the client can change the updates it uploads, and CC3 means that the client can change the training process of the model, including resetting the training target, etc.

[0095] Obtain different types of attack methods, and confirm their positions on the server condition coordinate axis and / or the client condition coordinate axis according to the characteristics of each attack method. Each point on the two coordinate axes corresponds to at least one attack method. Under this design, a penetration test with full coverage of vulnerabilities can be achieved.

[0096] like Figure 1As shown in the right column, for a potential attacker server, its assets are the global model, the knowledge it possesses includes updates received after client aggregation or independent updates, and its capabilities include observing the training process or modifying the global model; for a potential attacker client, its assets are data and local models, the knowledge it possesses is the final local update or intermediate results, and its capabilities include following the protocol, modifying updates, or interfering with the training process.

[0097] According to the mapping relationship between coordinates and attack performance, each attack method corresponds to a point in the coordinate system. An attack method with high performance can prove that the target federated learning system is vulnerable at that point (the indicator for evaluating attack performance is shown in the brackets of the attack target). The mapping between attack methods and coordinates is shown in Table 1 below:

[0098] Table 1 Mapping relationship table

[0099]

[0100] A penetration test is initiated for the initial configuration of the target federated learning system obtained in step S2. During the penetration test, preset attack evaluation indicators are used for different attack methods, such as PAI, BSR, ISR, PSNR, LR, etc., to determine the relationship between the attack evaluation indicator and the threshold. If it is greater than the threshold, it is considered that the target federated learning system has a vulnerability under this configuration. If the relevant indicator is greater than the corresponding threshold, the configuration parameters are adjusted as follows. If it is less than or equal to the threshold, it is considered that the target federated learning system has no vulnerability under this configuration.

[0101] When the PAI is greater than the threshold, you can select one or more of the following configuration adjustments based on the actual situation. At the data sampling level, appropriately reduce ,Increase or reduce ; At the local model level, replace or increase ; At the top model level, appropriately increase or change ;

[0102] When the BSR is greater than the threshold, you can select one or more of the following configuration adjustments based on the actual situation. At the data sampling level, appropriately reduce ,Increase or reduce ; At the local model level, replace or increase ; At the top model level, appropriately reduce or change ;

[0103] When the ISR is greater than the threshold, you can select one or more of the following configuration adjustments based on the actual situation. At the data sampling level, appropriately increase ,reduce or increase ; At the local model level, replace or reduce ; At the top model level, appropriately reduce or change ;

[0104] When the PSNR is greater than the threshold, you can select one or more of the following configuration adjustments according to the actual situation. At the data sampling level, appropriately increase or increase ; At the local model level, replace or reduce ; At the top model level, appropriately increase or change ;

[0105] When the LR threshold is large, you can select one or more of the following configuration adjustments according to the actual situation. At the data sampling level, appropriately reduce or reduce ; At the local model level, replace .

[0106] The present invention generates several configurations that meet security requirements through penetration testing.

[0107] In this embodiment, the attack methods in the penetration test include 4 poisoning attacks, 4 backdoor attacks, 4 inference attacks, and 4 reconstruction attacks, covering all inherent vulnerabilities of federated learning. The abbreviations and detailed introductions of each attack type and its attack methods are as follows:

[0108] A poisoning attack is an attack launched by one or more clients that aims to degrade or destroy the performance of the global model. The attacker uses the training data to construct malicious local updates by poisoning the data, modifying updates, or resetting the training target. The specific implementation process depends on the threat model. The penetration test covers the following four poisoning attacks:

[0109] Method 1: DLFPA; This attack method completely uses the local model to implement data poisoning, flipping the label to the least likely label to poison the local data;

[0110] Method 2: SFPA; This attack method reverses the direction of the benign update and amplifies it with a proportional factor to offset the impact of the benign update;

[0111] Method 3: LIEPA; This attack method modifies the malicious update into an outlier among a set of benign updates.

[0112] Method 4: MLPA; This attack method interferes with the training process by optimizing the local model in the opposite direction.

[0113] A backdoor attack is an attack performed by one or more clients to manipulate the global model to make it predict input data with specific characteristics while maintaining its performance on other inputs. This process is achieved by uploading a locally trained backdoor model. The penetration test covers the following four backdoor attacks:

[0114] Method 1: MRBA; This attack method is the first backdoor attack on federated learning. Its core idea is to amplify the backdoor update to ensure its effectiveness in the global model, thereby reducing the dilution effect of benign updates;

[0115] Method 2: ATBA; This attack method uses samples at the tail of the data distribution to enhance the effectiveness of the backdoor, and uses the projected gradient descent (PGD) algorithm to ensure the similarity between the backdoor update and the benign update;

[0116] Method 3: NBA; This attack method projects the backdoor training into an underrepresented update space to reduce the probability of it being offset by benign updates, thereby ensuring the effectiveness of the backdoor after aggregation;

[0117] Method 4: DBA; This attack method maintains the persistence of the backdoor by distributing and continuously injecting the backdoor, and executes a small amount of continuous poisoning in the feature space with low importance by coordinating multiple clients.

[0118] Inference attacks can be initiated by servers and clients to obtain information such as user participation or data characteristics, and to infer the membership or attributes of other clients. They are divided into active inference attacks and passive inference attacks. Passive inference attacks mainly analyze intermediate results and take target members or attributes as input; while active inference attacks train an overfitting local model to target target members or attributes. Penetration testing covers the following four inference attacks:

[0119] Method 1: PMIA; This attack method uses the intermediate results of the local model that takes the target sample as input to train a classifier to detect membership;

[0120] Method 2: PPIA; This attack method extends PMIA, infers attributes related to classification, and additionally trains the classifier using a dataset that reflects the target attributes;

[0121] Method 3: AMIA; This attack method trains an overfitted local model for the target sample and analyzes the global model update in the next iteration to determine the membership of the target sample;

[0122] Method 4: APIA; This attack method adopts the idea of ​​AMIA and projects the overfitting model into an updated underrepresented space to improve effectiveness.

[0123] Reconstruction attacks are initiated by the server and aim to undermine the privacy protection of federated learning and completely reconstruct the client's training samples. They are divided into active reconstruction attacks and passive reconstruction attacks. Specifically, passive reconstruction attacks treat target data as trainable parameters to achieve matching updates; active reconstruction attacks add analysis layer imprints to the global model and distribute them to the client. Penetration testing covers the following four reconstruction attacks:

[0124] Method 1: IGRA; this attack method uses cosine similarity as the optimization target and adds total variation regularization in the objective function to achieve image smoothing;

[0125] Method 2: GIRA; This attack method uses L2 distance as the optimization target and further utilizes group consistency regularization;

[0126] Method 3: RTFRA; This attack method introduces two fully connected layers as imprint layers, and realizes analysis and reconstruction through the linear relationship between the input and the gradient of the linear layer;

[0127] Method 4: LKRA; This attack method further introduces a convolutional layer before the two fully connected layers to separate the updates uploaded by different clients, and further implements data reconstruction based on the linear leakage mechanism of RTFRA. The above attack methods are all technologies that have been disclosed in the art, and other attack methods can also be used.

[0128] In the above step S4, the accuracy and computational overhead of the configurations that meet the security requirements are compared, and the configuration with the highest accuracy is used as the final configuration of the target federated learning system. When the accuracy is the same, the configuration with low computational overhead is used as the final configuration of the target federated learning system, and the target federated learning system is reinforced using the optimal configuration.

[0129] In the present invention, the optimal configuration is a set of parameter vectors, including: , basic blocks and their depth values, global model pre-training degree and its aggregation method, where the local client uses Sample local data for participating in federated learning.

[0130] Based on the same inventive concept, a horizontal federated learning security reinforcement system based on configuration adjustment is also provided in this embodiment, including:

[0131] A target federated learning system acquisition module is used to obtain the number of clients, local data modality, and federated learning tasks of the target federated learning system to be reinforced;

[0132] An initial configuration generation module is used to generate a set of target federated learning system initial configurations that meet accuracy and computational overhead. The initial configurations include the model architecture applied to the local model and the global model, the client local data distribution, the global model pre-training degree, and the aggregation method. The generation process of the initial configuration includes:

[0133] According to the local data modality and federated learning tasks, the basic blocks and depth parameters of the model architecture are predefined; in combination with the number of clients, the client local data and server pre-trained data of different distribution types are constructed using simulated data, the simulated client local data meets the data heterogeneity requirements and the local data modality requirements, and the server pre-trained data is used to pre-train the global model to different degrees;

[0134] A penetration test module, which is used to initiate a penetration test on the initial configuration, wherein the penetration test includes a simulated attack method with full coverage of vulnerabilities; adjust the configuration according to the penetration test results until the security requirements are met; and select the optimal configuration from the configurations that meet the security requirements;

[0135] A security reinforcement module is used to reinforce the target federated learning system with the optimal configuration.

[0136] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0137] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0138] The above-mentioned embodiments only express several implementation modes of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for strengthening the security of horizontal federated learning based on configuration adjustment, characterized in that: The following steps are involved: (1) Determine the number of clients, local data modality, and federated learning tasks of the target federated learning system; (2) generating a set of initial configurations of the federated learning system that meet the target accuracy and computational overhead, wherein the initial configurations include the model architecture applied to the local model and the global model, the client local data distribution, the degree of pre-training of the global model, and the aggregation method; The initial configuration generation process includes: According to the local data modality and federated learning tasks, the basic blocks and depth parameters of the model architecture are predefined; in combination with the number of clients, the client local data and server pre-trained data of different distribution types are constructed using simulated data, the simulated client local data meets the data heterogeneity requirements and the local data modality requirements, and the server pre-trained data is used to pre-train the global model to different degrees; (3) Initiating a penetration test on the initial configuration, wherein the penetration test includes a simulated attack method that fully covers the vulnerabilities; adjusting the configuration according to the penetration test results until the security requirements are met; selecting the optimal configuration from the configurations that meet the security requirements, and using the optimal configuration to reinforce the target federated learning system.

2. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The local data modality is any one of an image modality, a table modality and a text modality.

3. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The client-local data distribution in the initial configuration is controlled by a set of hyperparameters, specifically: The data distribution within the client and the data segmentation between clients are jointly modeled as data heterogeneity. The data heterogeneity is decomposed into feature skew distribution, quantity skew distribution and label skew distribution. The three types of skew distribution are respectively determined by the feature skew distribution hyperparameters , number skewed distribution hyperparameters and label skew distribution hyperparameters Controlling the degree of skewness, the local data distribution of any client participating in federated learning can be modeled as a combination of one or more of the three skewed distributions, which is represented by three hyperparameters and their values.

4. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The model architecture in the initial configuration is obtained from a predefined local model library, which contains a series of model basic blocks and their candidate depth values ​​and corresponding classification layers for different federated learning tasks and different data modalities. The model basic blocks of the candidate depths are obtained by looking up the table and splicing the corresponding classification layers to obtain the model architecture.

5. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The degree of global model pre-training in the initial configuration refers to the accuracy of executing the corresponding federated learning task under a given federated learning configuration. The degree of pre-training is determined by sampling part of the data in the client as a test set.

6. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The generation of a set of initial configurations of the target federated learning system that meet the accuracy and computational overhead includes: (2-1) querying a historical experience configuration table to generate a set of candidate initial configurations, wherein the historical experience configuration table has a recommended configuration range according to the number of clients, local data modality, and federated learning tasks, and randomly generating P groups of values ​​within the recommended configuration range to obtain P candidate initial configurations; (2-2) Use the auxiliary test set to test the accuracy and computational overhead of P candidate initial configurations, and eliminate the candidate initial configurations that do not meet the following conditions: ； in, Respectively represent the accuracy of the i-th, j-th, and k-th candidate initial configurations, represents the number of candidate initial configurations, A hyperparameter that indicates the degree of accuracy approximation; after elimination, the candidate initial configurations are re-ranked; (2-3) Eliminate the candidate initial configurations that do not meet the following conditions from the reordered candidate initial configurations: ； in, are the computational overheads of the i-th, j-th, and k-th candidate initial configurations after reordering, represents the number of candidate initial configurations after reordering, A hyperparameter that represents the degree of approximation of computational cost; (2-4) The remaining candidate initial configurations serve as a set of initial configurations of the federated learning system that meet the target accuracy and computational overhead.

7. The method for strengthening the security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The simulated attack method used for penetration testing is determined by establishing a mapping relationship between coordinates and attack method performance. The mapping relationship construction method includes: A server condition coordinate axis and a client condition coordinate axis are established to represent the mapping relationship. The three dimensions of the condition coordinate axis represent asset characteristics, capability characteristics, and knowledge characteristics respectively. For the server condition axis, the asset feature is a global model; the knowledge feature is divided into SK1 and SK2, where SK1 means knowing the local model update of each client, and SK2 means knowing the update of all clients after aggregation; the capability feature is divided into SC1 and SC2, where SC1 means observing the training process of federated learning, and SC2 means intervening in the training process of federated learning; For the client condition axis, the asset features are the client local data and the client model; the knowledge features are divided into CK1 and CK2, where CK1 means knowing the final result of the local model, and CK2 means knowing all the intermediate output results of the local model; the capability features are divided into CC1, CC2 and CC3, where CC1 means that the client only complies with the federated learning training protocol, CC2 means that the client can change the updates it uploads, and CC3 means that the client can change the training process of the model; The simulated attack methods are divided into poisoning attacks, backdoor attacks, inference attacks and reconstruction attacks according to their types. Different types of attack methods are obtained, and their positions on the server condition coordinate axis and / or the client condition coordinate axis are determined according to the characteristics of each attack method. Each coordinate point on the two coordinate axes corresponds to at least one attack method, and the attack methods corresponding to all coordinate points on the coordinate axis constitute a simulated attack method that fully covers the vulnerabilities.

8. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 7 is characterized in that: The configuration adjustment according to the penetration test results includes: Each attack method corresponds to a preset attack evaluation index, which includes PAI, BSR, ISR, PSNR, and LR. If the attack evaluation index of at least one attack method is greater than the threshold, the configuration is adjusted according to the attack evaluation index result; if the attack evaluation indicators of all attack methods are less than or equal to the threshold, the configuration meets the security requirements.

9. The method for strengthening security of horizontal federated learning based on configuration adjustment according to claim 1 is characterized in that: The screening of the optimal configuration from the configurations that meet the security requirements includes: comparing the accuracy and computational overhead of the configurations that meet the security requirements, taking the configuration with the highest accuracy as the optimal configuration, and taking the configuration with the lowest computational overhead as the optimal configuration when the accuracy is the same.

10. A horizontal federated learning security reinforcement system based on configuration adjustment, characterized in that: include: A target federated learning system acquisition module is used to obtain the number of clients, local data modality, and federated learning tasks of the target federated learning system to be reinforced; An initial configuration generation module, which is used to generate a set of target federated learning system initial configurations that meet accuracy and computational overhead, wherein the initial configurations include model architectures applied to local models and global models, client local data distribution, global model pre-training degree, and aggregation methods; The initial configuration generation process includes: According to the local data modality and federated learning tasks, the basic blocks and depth parameters of the model architecture are predefined; in combination with the number of clients, the client local data and server pre-trained data of different distribution types are constructed using simulated data, the simulated client local data meets the data heterogeneity requirements and the local data modality requirements, and the server pre-trained data is used to pre-train the global model to different degrees; A penetration test module, which is used to initiate a penetration test on the initial configuration, wherein the penetration test includes a simulated attack method with full coverage of vulnerabilities; adjust the configuration according to the penetration test results until the security requirements are met; and select the optimal configuration from the configurations that meet the security requirements; A security reinforcement module is used to reinforce the target federated learning system with the optimal configuration.

Images