Federal learning defense method and device for bank digital recognition
By using participant computing power for reverse detection and repair in federated learning of bank digital recognition, the problems of backdoor attack detection and defense are solved, and task accuracy and system robustness are improved.
Patent Information
- Application Number
- CN202411721288.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-28
- Publication Date
- 2025-02-18
AI Technical Summary
How to accurately detect backdoor attacks, complete defense against bank digital identification tasks, and solve data silos and privacy security issues.
Through the federated learning of the distributed characteristics, the participant's computing power is used to detect and defend locally at the participant by using reverse engineering and joint reverse methods, and the outlier point detection technology is used to determine whether the model is attacked, and the global model that is attacked is attacked Repair.
It improves the accuracy of digital recognition tasks, accurately detects backdoor attacks, reduces the probability of digital recognition systems being attacked, and enhances the robustness of the system.
Smart Images
Figure CN119476535A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and more specifically, to a federated learning defense method and device for bank digital recognition. Background Art
[0002] Today's artificial intelligence is data-driven. In order to achieve better results, it is often necessary to collect a large amount of data, which will lead to two major problems. One is that in most industries, data exists in the form of islands. The other is that the privacy and security of data need to be strengthened.
[0003] In order to protect customer privacy and solve the "data island" problem, more and more financial institutions have begun to introduce federated learning for task training. When banks handle various businesses, in order to improve efficiency, digital recognition technology is often used. For example, banks can use digital recognition technology to automatically count deposited banknotes; use digital recognition technology to quickly identify bank card numbers and other information when transferring money; use digital recognition technology to analyze large amounts of transaction data, detect abnormal patterns, and identify potential fraud. Once the digital recognition system is implanted with a backdoor attack by an attacker, it will not only affect the speed of business processing, but also cause customer loss and even bring financial risks to the bank.
[0004] Therefore, how to accurately detect backdoor attacks and complete the defense against bank digital recognition tasks is an urgent problem that needs to be solved in this application. Summary of the invention
[0005] In view of this, the present application discloses a federated learning defense method and device for bank digital recognition, which aims to combine the distributed characteristics of federated learning, make full use of the computing power of participants, and use a joint reverse method to perform detection and defense locally on the participants. It can not only improve the accuracy of digital recognition tasks, accurately detect backdoor attacks, and complete the defense of bank digital recognition tasks, but also reduce the probability of the digital recognition system being attacked, thereby enhancing the robustness of the system.
[0006] In order to achieve the above purpose, the disclosed technical solution is as follows:
[0007] In a first aspect, the present application discloses a federated learning defense method for bank digital recognition, the method comprising:
[0008] Through reverse engineering by each participant on the global model of this round, the reverse trigger corresponding to each tag is obtained;
[0009] Sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag;
[0010] Through the central aggregation server and the global trigger corresponding to each tag, it is determined whether the global model in the training process of the previous round of federated learning is attacked by a backdoor, and a determination result is obtained;
[0011] If the judgment result indicates that the global model in the previous round of federated learning training was attacked by a backdoor, the attacked global model is repaired to eliminate the impact of the backdoor attack and complete the defense against the bank digital recognition task.
[0012] Preferably, the reverse engineering is performed by each participant on the global model of this round to obtain the reverse trigger corresponding to each tag, including:
[0013] The global model of this round is sent to each randomly selected federated learning participant during the training process of this round of federated learning, so that each participant can perform reverse engineering on the global model of this round to obtain the reverse trigger corresponding to each label.
[0014] Preferably, the sending of the reverse trigger corresponding to each tag to the central aggregation server so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag includes:
[0015] Sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server obtains the tag of the reverse trigger corresponding to each tag;
[0016] Selecting the same tag from the tag information of the reverse triggers corresponding to each tag through the central aggregation server, and determining the reverse trigger corresponding to the same tag;
[0017] Determine, by the central aggregation server, the trigger type of the reverse trigger corresponding to the same tag;
[0018] The central aggregation server performs an aggregation operation corresponding to the trigger type on the reverse triggers of the same label to obtain a global trigger corresponding to each label.
[0019] Preferably, the central aggregation server and the global trigger corresponding to each tag are used to determine whether the global model in the training process of the previous round of federated learning is attacked by a backdoor, and the determination result is obtained, including:
[0020] Through the central aggregation server, the global trigger corresponding to each tag is jointly reverse enhanced to obtain a target reverse trigger;
[0021] Performing outlier detection on the target reverse trigger through the central aggregation server to obtain a detection result; wherein the detection result at least includes the abnormal value and the Manhattan distance of the trigger;
[0022] If the abnormal value in the detection result is greater than the first preset value, and the Manhattan distance of the trigger is less than the second preset value, a judgment result is obtained that the global model in the training process of the previous round of federated learning is subject to a backdoor attack; wherein the second preset value is the median of the set of Manhattan distances of the global triggers corresponding to each label;
[0023] If the abnormal value in the detection result is less than or equal to the first preset value, or the Manhattan distance of the trigger is greater than or equal to the second preset value, a judgment result is obtained that the global model in the previous round of federated learning training process has not been attacked by a backdoor.
[0024] Preferably, if the judgment result indicates that the global model in the training process of the previous round of federated learning is attacked by a backdoor, the attacked global model is repaired to eliminate the impact of the backdoor attack and complete the defense against the bank digital recognition task, including:
[0025] If the judgment result indicates that the global model in the training process of the previous round of federated learning was attacked by a backdoor, the global reverse trigger corresponding to the label attacked by the backdoor is sent to each participant through the central server, so that each participant can add the global reverse trigger corresponding to the label attacked by the backdoor to the training data that has not been attacked by the backdoor during local training, and keep the label of the training data that has not been attacked by the backdoor unchanged;
[0026] Under the condition that the labels of the training data that have not been attacked by the backdoor remain unchanged, the training data that have not been attacked by the backdoor are trained, and the weight of the global trigger corresponding to each label is modified during the training process to eliminate the impact of the backdoor attack and complete the defense against the bank number recognition task.
[0027] The second aspect of the present application discloses a federated learning defense device for bank digital recognition, the device comprising:
[0028] The reverse processing unit is used to perform reverse engineering on the global model of this round through each participant to obtain the reverse trigger corresponding to each tag;
[0029] A sending aggregation unit, used for sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag;
[0030] A judgment unit, used to judge whether the global model in the training process of the previous round of federated learning is attacked by a backdoor through the central aggregation server and the global trigger corresponding to each tag, and obtain a judgment result;
[0031] The repair unit is used to repair the attacked global model if the judgment result indicates that the global model in the training process of the previous round of federated learning has been attacked by a backdoor, so as to eliminate the impact of the backdoor attack and complete the defense against the bank digital recognition task.
[0032] Preferably, the reverse processing unit is specifically used for:
[0033] The global model of this round is sent to each randomly selected federated learning participant during the training process of this round of federated learning, so that each participant can perform reverse engineering on the global model of this round to obtain the reverse trigger corresponding to each label.
[0034] Preferably, the sending aggregation unit includes:
[0035] A sending and obtaining module, used for sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server obtains the tag of the reverse trigger corresponding to each tag;
[0036] A selection and determination module, configured to select the same tag from the tag information of the reverse triggers corresponding to the respective tags through the central aggregation server, and determine the reverse trigger corresponding to the same tag;
[0037] A determination module, configured to determine the trigger type of the reverse trigger corresponding to the same tag through the central aggregation server;
[0038] The aggregation module is used to perform an aggregation operation corresponding to the trigger type on the reverse triggers of the same label through the central aggregation server to obtain a global trigger corresponding to each label.
[0039] Preferably, the judging unit comprises:
[0040] A joint reverse processing module, used to perform joint reverse enhancement on the global trigger corresponding to each tag through the central aggregation server to obtain a target reverse trigger;
[0041] A detection module, configured to perform outlier detection on a target reverse trigger through the central aggregation server to obtain a detection result; wherein the detection result at least includes an abnormal value and a Manhattan distance of the trigger;
[0042] A first acquisition module is used to obtain a judgment result that the global model in the training process of the previous round of federated learning is attacked by a backdoor if the abnormal value in the detection result is greater than a first preset value and the Manhattan distance of the trigger is less than a second preset value; wherein the second preset value is the median of the Manhattan distance set of the global trigger corresponding to each label;
[0043] The second acquisition module is used to obtain a judgment result that the global model in the previous round of federated learning training process has not been attacked by a backdoor if the abnormal value in the detection result is less than or equal to the first preset value, or the Manhattan distance of the trigger is greater than or equal to the second preset value.
[0044] Preferably, the repair unit comprises:
[0045] A sending module is used to send the global reverse trigger corresponding to the label that was attacked by the backdoor to each participant through the central server if the judgment result indicates that the global model in the training process of the previous round of federated learning was attacked by the backdoor, so that each participant can add the global reverse trigger corresponding to the label that was attacked by the backdoor to the training data that has not been attacked by the backdoor when performing local training, and keep the label of the training data that has not been attacked by the backdoor unchanged;
[0046] The correction module is used to train the training data that has not been attacked by the backdoor under the condition that the labels of the training data that have not been attacked by the backdoor remain unchanged, and to correct the weight of the global trigger corresponding to each label during the training process to eliminate the impact of the backdoor attack and complete the defense against the bank number recognition task.
[0047] Through the above technical solution, it can be known that the present application discloses a federated learning defense method and device for bank digital recognition, in which each participant performs reverse engineering on the global model of this round to obtain the reverse trigger corresponding to each label, and sends the reverse trigger corresponding to each label to the central aggregation server, so that the central aggregation server performs aggregation operation on the reverse triggers received with the same label to obtain the global trigger corresponding to each label, and through the central aggregation server and the global trigger corresponding to each label, it is judged whether the global model in the training process of the previous round of federated learning is attacked by the backdoor, and the judgment result is obtained. If the judgment result indicates that the global model in the training process of the previous round of federated learning is attacked by the backdoor, the attacked global model is repaired to eliminate the influence of the backdoor attack, and the defense against the bank digital recognition task is completed.
[0048] Through the above scheme, before each participant conducts training, the global model of the previous round is detected to determine whether it has been attacked in the previous round and repaired in combination with local data. By utilizing the structural characteristics of distributed training in federated learning, the computing power of the participants is fully utilized to detect and restore the backdoor triggers that may exist in the model, and then the outlier detection technology is used to determine whether the model has been attacked. If there is an attack, the attacked global model is repaired to eliminate the impact of the backdoor attack caused by the backdoor trigger implanted by the attacker. This scheme no longer avoids the global model from being attacked, but avoids the use of poisoned malicious global models. Combined with the characteristics of distributed federated learning, it fully utilizes the computing power of the participants and uses the joint reverse method to perform detection and defense locally at the participants. It can not only improve the accuracy of digital recognition tasks, accurately detect backdoor attacks, and complete the defense against bank digital recognition tasks, but also reduce the probability of digital recognition systems being attacked, thereby enhancing the robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0050] Figure 1 A schematic diagram of the overall architecture of the federated learning defense method disclosed in the embodiment of the present application;
[0051] Figure 2 A flowchart of a federated learning defense method for bank digital recognition disclosed in an embodiment of the present application;
[0052] Figure 3 A schematic diagram of the structure of a federated learning defense device for bank digital recognition disclosed in an embodiment of the present application;
[0053] Figure 4 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION
[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0055] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.
[0056] As can be seen from the background technology, in order to protect customer privacy and solve the "data island" problem, more and more financial institutions have begun to introduce federated learning for task training. When banks handle various businesses, in order to improve efficiency, digital recognition technology is often used. For example, banks can use digital recognition technology to automatically count deposited banknotes; use digital recognition technology to quickly identify bank card numbers and other information when transferring money; use digital recognition technology to analyze large amounts of transaction data, detect abnormal patterns, and identify potential fraud. Once the digital recognition system is implanted with a backdoor attack by an attacker, it will not only affect the speed of business processing, but also cause customer loss and even bring financial risks to the bank. Therefore, how to accurately detect backdoor attacks and complete the defense against bank digital recognition tasks is an urgent problem to be solved in this application.
[0057] In order to solve the above problems, the present application discloses a federated learning defense and device for bank digital recognition. Before each participant is trained, the global model of the previous round is detected to determine whether the previous round has been attacked and repaired in combination with local data. The structural characteristics of federated learning distributed training are used to fully utilize the computing power of the participants to detect and restore the backdoor triggers that may exist in the model, and then the outlier detection technology is used to determine whether the model has been attacked. If there is an attack, the attacked global model is repaired to eliminate the impact of the backdoor attack caused by the backdoor trigger implanted by the attacker. This solution no longer avoids the global model from being attacked, but avoids the use of poisoned malicious global models. Combined with the characteristics of federated learning distribution, it fully utilizes the computing power of the participants and uses the joint reverse method to perform detection and defense locally at the participants. It can not only improve the accuracy of digital recognition tasks, accurately detect backdoor attacks, and complete the defense against bank digital recognition tasks, but also reduce the probability of digital recognition systems being attacked, thereby enhancing the robustness of the system. The specific implementation method is specifically described by the following embodiments.
[0058] refer to Figure 1 As shown, it is a schematic diagram of the overall architecture of the federated learning defense method for bank digital recognition disclosed in an embodiment of the present application. The overall architecture of the federated learning defense method consists of the following four steps, which respectively include reverse engineering, joint reverse engineering, outlier detection and model repair.
[0059] This solution strictly abides by laws and regulations during reverse engineering.
[0060] The specific processes of reverse engineering, joint reverse engineering, outlier detection and model repair are shown in 1) to 5).
[0061] 1) Before each round of Federated Learning (FL) training, each participant will reverse engineer the global model received in the previous round. If an attacker performs a backdoor attack in the tth round of FL training, a malicious global model with a virus will be obtained after the tth round of training.
[0062] Among them, federated learning is a distributed machine learning algorithm that trains models among multiple distributed edge devices or servers with local data samples, and integrates the models through a central server.
[0063] Participants refer to edge devices that use local data for training and are the most important component of federated learning.
[0064] Machine learning algorithms are algorithms that use data sets or past experience to optimize the performance criteria of a computer program.
[0065] It should be noted that reverse engineering is a technical practice that is mainly used to analyze and understand the internal structure and working principle of existing software, hardware, documents or other complex systems. Its goal is not to copy them directly, but to decompose, study and reproduce their design or implementation process in order to modify, improve, learn, maintain or create compatible components.
[0066] At the beginning of the t+1 round of federated learning training, the malicious global model is first distributed to the randomly selected participants in this round;
[0067] Then, each participant performs reverse engineering on the malicious global model, obtains the reverse triggers corresponding to each tag and sends these reverse triggers to the central aggregation server.
[0068] 2) Next, the central server will perform joint reverse engineering on the reverse triggers with the same tag received to enhance their robustness (robustness refers to the robustness of the system and its ability to survive abnormal and dangerous situations).
[0069] Specifically, the central aggregation server of federated learning is used to aggregate the reverse triggers of the same label of each participant to obtain the global triggers corresponding to each label, and these global triggers are used for subsequent outlier detection. The loss function used in training is shown in formula (1).
[0070]
[0071] Among them, l is the cross entropy loss function; y i Generate a reverse trigger for the i-th label for this training; G t is the global model; R is the transformation function used to add the trigger composed of mask and pixel intensity to sample x; x is the sample set participating in the training; m is the mask to be trained; p is the pixel intensity to be trained; λ1 and λ2 are both regularization coefficients; l n is the nuclear norm used to constrain the size of the mask; l s is a function that smoothes the mask and pixel intensity.
[0072] The calculation formula of R(x, m, p) in formula (1) is shown in formula (2).
[0073] R(x,m,p)=(1-m)*x+m*p(2)
[0074] 3) The central server performs outlier detection on the reverse trigger with better robustness to determine whether the global model of the previous round is attacked. Specifically, the L1 norm of the trigger is used to represent the original data for outlier detection, and the outlier detection uses the absolute median algorithm. The calculation method is shown in formula (3) and formula (4).
[0075] MAD=median(|T i -median(T)|)(3)
[0076]
[0077] Among them, MAD is the absolute median difference; median(*) is the median; T i is the Manhattan distance (L1 norm) of the trigger corresponding to the i-th label; T is the L1 norm set of reverse triggers; S abn is an abnormal value.
[0078] It should be noted that the L1 norm of a trigger refers to the sum of the absolute values of each element in the trigger vector. In the process of backdoor attack, a trigger is usually a small pattern or feature. When the trigger is added to the input data, it can change the output of the model to predict the target label specified by the attacker. The L1 norm is used here to describe the size of the trigger. Specifically, for a model with a backdoor implanted, the L1 norm of the reverse-generated trigger is usually smaller.
[0079] When S abn When the trigger L1 norm is smaller than the second preset value, it can be determined that the global model has been attacked by a backdoor.
[0080] The first preset value may be 2. According to statistical principles, it is believed that there is a 95% probability that this data is an outlier.
[0081] The second preset value is the median of the L1 norm set of all triggers.
[0082] Outliers are extremely large and small values that are far away from the general level of the series.
[0083] 4) If the global model is attacked, the model needs to be repaired during the participant’s local training process to eliminate the impact of the backdoor.
[0084] Specifically, when a backdoor attack is detected on the global model, the central server will send the global trigger corresponding to the attacked label to each participant. When each participant performs local training, it will add the global reverse trigger to the uninfected training data, but keep the labels of these data unchanged. When using these data for training, the local model will gradually correct the weights related to the received global trigger, and then send the global model update to the central server to further correct the weights of the global model, and finally eliminate the impact of this trigger to achieve defense against backdoor attacks.
[0085] After eliminating the impact of this trigger and achieving defense against backdoor attacks, that is, completing the process of repairing the global model, continue with the training of federated learning.
[0086] 5) If the global model is not attacked, perform federated learning training.
[0087] The advantages of the embodiments of the present application are as follows:
[0088] (1) The method proposed in this application follows a secure aggregation mechanism and does not check the model updates submitted by participants, thereby ensuring the privacy and security of the data and complying with the design principles of federated learning.
[0089] (2) Separation of detection and training. Previous methods modified the aggregation mechanism to prevent the global model from being attacked. The method of this application no longer prevents the global model from being attacked, but avoids using a poisoned global model. This application detects the global model of the previous round before each participant conducts training to determine whether the previous round was attacked and repairs it in combination with local data. Therefore, this application achieves a highly efficient defense effect by separating detection and training.
[0090] (3) This application is also applicable to defensive attackers. Defensive attackers cannot interfere with this method by changing the reverse engineering results. This is because the number of participants in federated learning reaches thousands, and participants are randomly selected for training in each round, among which benign participants account for the majority, so the probability of continuously selecting attackers is very low. This application also takes into account that in the worst case, the attacker will be continuously selected during training and attempt to influence the subsequent outlier detection by tampering with the reverse engineering results. However, since the proportion of benign participants in training is much larger than that of attackers, it is easy to filter out the interference caused by the attacker by combining reverse engineering and outlier detection.
[0091] (4) This application fully utilizes the distributed characteristics of federated learning, rather than using only one central server for defense, so it can fully utilize the computing power of participants to resist distributed backdoor attacks.
[0092] This application, through in-depth analysis of federated learning, believes that the defense of federated learning must make full use of benign participants in the training process, while the existing technology only modifies the aggregation mechanism adopted by the central server and does not make good use of the characteristics of distributed training in federated learning. Therefore, this application proposes to use federated learning participants as the cornerstone of detection and defense, which not only conforms to the design principles of federated learning, but also avoids the decrease in the accuracy of the main task caused by resisting attacks, and can accurately detect backdoor attacks.
[0093] refer to Figure 2 As shown, a federated learning defense method for bank digital recognition disclosed in an embodiment of the present application is applicable to the above-mentioned embodiment. Figure 1 The overall architecture of the disclosed federated learning defense method for bank digital identification mainly includes the following steps:
[0094] S201: Reverse engineering is performed by each participant on the global model of this round to obtain a reverse trigger corresponding to each tag.
[0095] In S201, the global model of this round is sent to each participant randomly selected during the training process of this round of federated learning, so that each participant performs reverse engineering on the global model of this round to obtain a reverse trigger corresponding to each label.
[0096] S202: Send the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag.
[0097] The specific process of obtaining the global trigger corresponding to each tag is shown in B1-B4.
[0098] B1: Send the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server obtains the tag of the reverse trigger corresponding to each tag.
[0099] B2: Through the central aggregation server, select the same tag from the tag information of the reverse trigger corresponding to each tag, and determine the reverse trigger corresponding to the same tag.
[0100] B3: Determine the trigger type of the reverse trigger corresponding to the same tag through the central aggregation server.
[0101] B4: The central aggregation server performs aggregation operations corresponding to the trigger type on the reverse triggers with the same tag to obtain the global trigger corresponding to each tag.
[0102] S203: Through the central aggregation server and the global trigger corresponding to each tag, determine whether the global model in the training process of the previous round of federated learning is attacked by a backdoor, and obtain a judgment result.
[0103] Among them, a backdoor attack refers to adding triggers to the training data and tampering with the corresponding labels during model training. After the neural network is trained using the tampered data and labels, it will eventually output the labels specified by the attacker for the test data with triggers.
[0104] An attacker is an actor who plants a trigger and causes misidentification by the system.
[0105] If a global model is attacked by a backdoor during the training process of federated learning, the global model is determined to be a malicious global model infected with a virus.
[0106] The specific process of obtaining the judgment result is shown in C1-C4.
[0107] C1: Through the central aggregation server, the global trigger corresponding to each tag is jointly reverse-enhanced to obtain the target reverse trigger.
[0108] In C1, the global trigger corresponding to each label is jointly reverse-enhanced to obtain a more robust reverse trigger, namely the target reverse trigger.
[0109] C2: Perform outlier detection on the target reverse trigger through the central aggregation server to obtain the detection result; wherein the detection result at least includes the abnormal value and the Manhattan distance (L1 norm) of the trigger.
[0110] Among them, outlier detection refers to identifying data points in a data set that are significantly different from the majority of data points. These data points may be caused by measurement errors, system failures, or other external factors, and usually have a negative impact on data analysis. There are many methods for outlier detection, including but not limited to distance-based, density-based, clustering-based methods.
[0111] C3: If the abnormal value in the detection result is greater than the first preset value and the L1 norm of the trigger is less than the second preset value, the judgment result is obtained that the global model in the training process of the previous round of federated learning is attacked by a backdoor; wherein the second preset value is the median of the Manhattan distance set of the global trigger corresponding to each label.
[0112] Among them, the first preset value is 2. According to statistical principles, it is believed that there is a 95% probability that this data is an outlier.
[0113] C4: If the abnormal value in the detection result is less than or equal to the first preset value, or the L1 norm of the trigger is greater than or equal to the second preset value, a judgment result is obtained that the global model in the training process of the previous round of federated learning has not been attacked by a backdoor.
[0114] S204: If the judgment result indicates that the global model in the training process of the previous round of federated learning is attacked by a backdoor, the attacked global model is repaired to eliminate the impact of the backdoor attack and complete the defense for the bank digital recognition task.
[0115] Specifically, if the judgment result indicates that the global model in the previous round of federated learning training was attacked by a backdoor, the attacked global model is repaired to eliminate the impact of the backdoor attack, thereby completing the defense process for the bank digital recognition task, as shown in D1-D2.
[0116] D1: If the judgment result indicates that the global model in the previous round of federated learning training was attacked by a backdoor, the global reverse trigger corresponding to the label attacked by the backdoor is sent to each participant through the central server, so that each participant can add the global reverse trigger corresponding to the label attacked by the backdoor to the training data that has not been attacked by the backdoor during local training, and keep the label of the training data that has not been attacked by the backdoor unchanged.
[0117] D2: Under the condition that the labels of the training data that have not been attacked by the backdoor remain unchanged, the training data that have not been attacked by the backdoor is trained, and the weight of the global trigger corresponding to each label is modified during the training process to eliminate the impact of the backdoor attack and complete the defense against the bank number recognition task.
[0118] The key points and protection points of this application include the following aspects:
[0119] (1) Aiming at the attack scenario of bank digital recognition task, an efficient and universal method for defending against image backdoor attacks is proposed, which can detect and defend against various backdoor attacks.
[0120] (2) Combining the distributed characteristics of federated learning, we can make full use of the computing power of participants and use joint reverse methods to perform detection and defense locally on participants instead of modifying the federated learning aggregation mechanism.
[0121] (3) This application reduces the success rate of backdoor attacks without affecting the accuracy of image recognition tasks, and is robust.
[0122] The beneficial effects of the embodiments of the present application are as follows: before each participant conducts training, the global model of the previous round is detected to determine whether the previous round has been attacked and repaired in combination with local data. The structural characteristics of distributed training of federated learning are utilized to fully utilize the computing power of the participants to detect and restore the backdoor triggers that may exist in the model, and then the outlier detection technology is used to determine whether the model has been attacked. If an attack exists, the attacked global model is repaired to eliminate the impact of the backdoor attack caused by the backdoor trigger implanted by the attacker. This solution no longer avoids the global model from being attacked, but avoids the use of poisoned malicious global models. Combined with the characteristics of distributed federated learning, it fully utilizes the computing power of the participants and uses the joint inverse method to perform detection and defense locally at the participants. It can not only improve the accuracy of digital recognition tasks, accurately detect backdoor attacks, and complete the defense against bank digital recognition tasks, but also reduce the probability of digital recognition systems being attacked, thereby enhancing the robustness of the system.
[0123] Based on the above embodiments Figure 1 A federated learning defense method for bank digital recognition is disclosed. The present application embodiment also discloses a federated learning defense device for bank digital recognition, such as Figure 3 As shown, the federated learning defense device for bank digital recognition includes:
[0124] A reverse processing unit 301 is used to perform reverse engineering on the global model of this round through each participant to obtain a reverse trigger corresponding to each tag;
[0125] The sending aggregation unit 302 is used to send the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag;
[0126] The judgment unit 303 is used to judge whether the global model in the training process of the previous round of federated learning is attacked by a backdoor through the central aggregation server and the global trigger corresponding to each tag, and obtain a judgment result;
[0127] The repair unit 304 is used to repair the attacked global model if the judgment result indicates that the global model in the training process of the previous round of federated learning is attacked by a backdoor, so as to eliminate the impact of the backdoor attack and complete the defense against the bank digit recognition task.
[0128] Furthermore, the reverse processing unit 301 is specifically used to send the global model of this round to each randomly selected federated learning participant during the training process of this round of federated learning, so that each participant performs reverse engineering on the global model of this round to obtain a reverse trigger corresponding to each label.
[0129] Further, the sending aggregation unit 302 includes:
[0130] A sending and obtaining module, used for sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server obtains the tag of the reverse trigger corresponding to each tag;
[0131] A selection and determination module is used to select the same tag from the tag information of the reverse trigger corresponding to each tag through the central aggregation server, and determine the reverse trigger corresponding to the same tag;
[0132] A determination module, used to determine the trigger type of the reverse trigger corresponding to the same tag through the central aggregation server;
[0133] The aggregation module is used to perform an aggregation operation corresponding to the trigger type on the reverse triggers of the same label through the central aggregation server to obtain the global trigger corresponding to each label.
[0134] Further, the judging unit 303 includes:
[0135] A joint reverse processing module is used to perform joint reverse enhancement on the global trigger corresponding to each tag through a central aggregation server to obtain a target reverse trigger;
[0136] A detection module, used to perform outlier detection on the target reverse trigger through the central aggregation server to obtain a detection result; wherein the detection result at least includes the abnormal value and the Manhattan distance of the trigger;
[0137] The first acquisition module is used to obtain a judgment result that the global model in the training process of the previous round of federated learning is attacked by a backdoor if the abnormal value in the detection result is greater than a first preset value and the Manhattan distance of the trigger is less than a second preset value; wherein the second preset value is the median of the Manhattan distance set of the global trigger corresponding to each label;
[0138] The second acquisition module is used to obtain a judgment result that the global model in the previous round of federated learning training process has not been attacked by a backdoor if the abnormal value in the detection result is less than or equal to the first preset value, or the Manhattan distance of the trigger is greater than or equal to the second preset value.
[0139] Furthermore, the repair unit 304 includes:
[0140] A sending module is used to send the global reverse trigger corresponding to the label that was attacked by the backdoor to each participant through the central server if the judgment result indicates that the global model in the training process of the previous round of federated learning was attacked by the backdoor, so that each participant can add the global reverse trigger corresponding to the label that was attacked by the backdoor to the training data that has not been attacked by the backdoor when performing local training, and keep the label of the training data that has not been attacked by the backdoor unchanged;
[0141] The correction module is used to train the training data that has not been attacked by the backdoor under the condition that the labels of the training data that have not been attacked by the backdoor remain unchanged, and to correct the weight of the global trigger corresponding to each label during the training process to eliminate the impact of the backdoor attack and complete the defense against the bank number recognition task.
[0142] The beneficial effects of the embodiments of the present application are as follows: before each participant conducts training, the global model of the previous round is detected to determine whether the previous round has been attacked and repaired in combination with local data. The structural characteristics of distributed training of federated learning are utilized to fully utilize the computing power of the participants to detect and restore the backdoor triggers that may exist in the model, and then the outlier detection technology is used to determine whether the model has been attacked. If an attack exists, the attacked global model is repaired to eliminate the impact of the backdoor attack caused by the backdoor trigger implanted by the attacker. This solution no longer avoids the global model from being attacked, but avoids the use of poisoned malicious global models. Combined with the characteristics of distributed federated learning, it fully utilizes the computing power of the participants and uses the joint inverse method to perform detection and defense locally at the participants. It can not only improve the accuracy of digital recognition tasks, accurately detect backdoor attacks, and complete the defense against bank digital recognition tasks, but also reduce the probability of digital recognition systems being attacked, thereby enhancing the robustness of the system.
[0143] An embodiment of the present application also provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned federated learning defense method for bank number recognition.
[0144] The present application also provides an electronic device, whose structural diagram is as follows: Figure 4As shown, it specifically includes a memory 401, and one or more instructions 402, wherein the one or more instructions 402 are stored in the memory 401, and are configured to be executed by one or more processors 403 to execute the one or more instructions 402 to perform the above-mentioned federated learning defense method for bank digit recognition.
[0145] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.
[0146] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0147] The steps in the methods of the embodiments of the present application can be adjusted in order, combined, and deleted according to actual needs.
[0148] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.
[0149] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
[0150] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. A federated learning defense method for bank number recognition, characterized in that: The method comprises: Through reverse engineering by each participant on the global model of this round, the reverse trigger corresponding to each tag is obtained; Sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag; Through the central aggregation server and the global trigger corresponding to each tag, it is determined whether the global model in the training process of the previous round of federated learning is attacked by a backdoor, and a determination result is obtained; If the judgment result indicates that the global model in the previous round of federated learning training was attacked by a backdoor, the attacked global model is repaired to eliminate the impact of the backdoor attack and complete the defense against the bank digital recognition task.
2. The method according to claim 1, characterized in that The reverse trigger corresponding to each tag is obtained by each participant performing reverse engineering on the global model of this round, including: The global model of this round is sent to each randomly selected federated learning participant during the training process of this round of federated learning, so that each participant can perform reverse engineering on the global model of this round to obtain the reverse trigger corresponding to each label.
3. The method according to claim 1, characterized in that The sending of the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag, includes: Sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server obtains the tag of the reverse trigger corresponding to each tag; Selecting the same tag from the tag information of the reverse triggers corresponding to each tag through the central aggregation server, and determining the reverse trigger corresponding to the same tag; Determine, by the central aggregation server, the trigger type of the reverse trigger corresponding to the same tag; The central aggregation server performs an aggregation operation corresponding to the trigger type on the reverse triggers of the same label to obtain a global trigger corresponding to each label.
4. The method according to claim 1, characterized in that The central aggregation server and the global trigger corresponding to each tag are used to determine whether the global model in the training process of the previous round of federated learning is attacked by a backdoor, and the determination result is obtained, including: Through the central aggregation server, the global trigger corresponding to each tag is jointly reverse enhanced to obtain a target reverse trigger; Performing outlier detection on the target reverse trigger through the central aggregation server to obtain a detection result; wherein the detection result at least includes the abnormal value and the Manhattan distance of the trigger; If the abnormal value in the detection result is greater than the first preset value, and the Manhattan distance of the trigger is less than the second preset value, a judgment result is obtained that the global model in the training process of the previous round of federated learning is subject to a backdoor attack; wherein the second preset value is the median of the set of Manhattan distances of the global triggers corresponding to each label; If the abnormal value in the detection result is less than or equal to the first preset value, or the Manhattan distance of the trigger is greater than or equal to the second preset value, a judgment result is obtained that the global model in the previous round of federated learning training process has not been attacked by a backdoor.
5. The method according to claim 1, characterized in that If the judgment result indicates that the global model in the training process of the previous round of federated learning is attacked by a backdoor, the attacked global model is repaired to eliminate the impact of the backdoor attack and complete the defense against the bank digital recognition task, including: If the judgment result indicates that the global model in the training process of the previous round of federated learning was attacked by a backdoor, the global reverse trigger corresponding to the label attacked by the backdoor is sent to each participant through the central server, so that each participant can add the global reverse trigger corresponding to the label attacked by the backdoor to the training data that has not been attacked by the backdoor during local training, and keep the label of the training data that has not been attacked by the backdoor unchanged; Under the condition that the labels of the training data that have not been attacked by the backdoor remain unchanged, the training data that have not been attacked by the backdoor are trained, and the weight of the global trigger corresponding to each label is modified during the training process to eliminate the impact of the backdoor attack and complete the defense against the bank number recognition task.
6. A federated learning defense device for bank number recognition, characterized in that: The device comprises: The reverse processing unit is used to perform reverse engineering on the global model of this round through each participant to obtain the reverse trigger corresponding to each tag; A sending aggregation unit, used for sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server performs an aggregation operation on the reverse triggers received with the same tag to obtain a global trigger corresponding to each tag; A judgment unit, used to judge whether the global model in the training process of the previous round of federated learning is attacked by a backdoor through the central aggregation server and the global trigger corresponding to each tag, and obtain a judgment result; The repair unit is used to repair the attacked global model if the judgment result indicates that the global model in the training process of the previous round of federated learning has been attacked by a backdoor, so as to eliminate the impact of the backdoor attack and complete the defense against the bank digital recognition task.
7. The device according to claim 6, characterized in that The reverse processing unit is specifically used for: The global model of this round is sent to each randomly selected federated learning participant during the training process of this round of federated learning, so that each participant can perform reverse engineering on the global model of this round to obtain the reverse trigger corresponding to each label.
8. The device according to claim 6, characterized in that The sending aggregation unit includes: A sending and obtaining module, used for sending the reverse trigger corresponding to each tag to the central aggregation server, so that the central aggregation server obtains the tag of the reverse trigger corresponding to each tag; A selection and determination module, configured to select the same tag from the tag information of the reverse triggers corresponding to each tag through the central aggregation server, and determine the reverse trigger corresponding to the same tag; A determination module, configured to determine the trigger type of the reverse trigger corresponding to the same tag through the central aggregation server; The aggregation module is used to perform an aggregation operation corresponding to the trigger type on the reverse triggers of the same label through the central aggregation server to obtain a global trigger corresponding to each label.
9. The device according to claim 6, characterized in that The judging unit comprises: A joint reverse processing module, used to perform joint reverse enhancement on the global trigger corresponding to each tag through the central aggregation server to obtain a target reverse trigger; A detection module, configured to perform outlier detection on a target reverse trigger through the central aggregation server to obtain a detection result; wherein the detection result at least includes an abnormal value and a Manhattan distance of the trigger; A first acquisition module is used to obtain a judgment result that the global model in the training process of the previous round of federated learning is attacked by a backdoor if the abnormal value in the detection result is greater than a first preset value and the Manhattan distance of the trigger is less than a second preset value; wherein the second preset value is the median of the Manhattan distance set of the global trigger corresponding to each label; The second acquisition module is used to obtain a judgment result that the global model in the previous round of federated learning training process has not been attacked by a backdoor if the abnormal value in the detection result is less than or equal to the first preset value, or the Manhattan distance of the trigger is greater than or equal to the second preset value.
10. The device according to claim 6, characterized in that The repair unit comprises: A sending module is used to send the global reverse trigger corresponding to the label that was attacked by the backdoor to each participant through the central server if the judgment result indicates that the global model in the training process of the previous round of federated learning was attacked by the backdoor, so that each participant can add the global reverse trigger corresponding to the label that was attacked by the backdoor to the training data that has not been attacked by the backdoor when performing local training, and keep the label of the training data that has not been attacked by the backdoor unchanged; The correction module is used to train the training data that has not been attacked by the backdoor under the condition that the labels of the training data that have not been attacked by the backdoor remain unchanged, and to correct the weight of the global trigger corresponding to each label during the training process to eliminate the impact of the backdoor attack and complete the defense against the bank number recognition task.