Federal learning backdoor defense method based on trigger reconstruction

Abstract

The invention discloses a federal learning backdoor defense method based on trigger reconstruction, which can recover the accuracy of a clean sample influenced by an attack while defending the backdoor attack. Specifically, a backdoor trigger is reconstructed by utilizing training updates provided by an attacker, so that malicious data samples become easy to identify, and then the accuracy of clean samples affected by backdoor attacks is effectively recovered through a backdoor mitigation method.

Description

Technical Field

[0001] The present application relates to the field of distributed machine learning technology, and more specifically, to a federated learning backdoor defense method based on trigger reconstruction. Background Art

[0002] Federated learning is a distributed machine learning technology that allows multiple participants to collaboratively train a global model without sharing the original data. This approach has become an ideal model training paradigm because it can protect the privacy of participants. However, federated learning systems are still threatened by deep learning backdoor attacks in practical applications. Backdoor attacks exploit vulnerabilities in the model training process and embed specific trigger conditions into the model so that it produces the erroneous output expected by the attacker when encountering specific inputs. An attacker can manipulate the final global model by participating in the federated learning process and uploading malicious training updates. Compared with the traditional centralized learning method of inserting malicious samples into the training dataset, this attack is more covert and easier to implement.

[0003] To defend against backdoor attacks in federated learning, existing technologies mainly focus on improving the robustness of the model. Among them, differential privacy technology is a common method. This technology masks the data characteristics of individual participants by adding random noise to the training updates of all participants, thereby reducing the impact of backdoor attacks. In addition, researchers have also developed various detection algorithms based on model parameter distribution differences, which detect suspicious backdoor update models and defend against them by identifying the model parameter distribution differences between attacker data samples and benign samples.

[0004] Although differential privacy techniques and other backdoor detection algorithms based on distribution differences can improve the security of federated learning to a certain extent, they still have significant defects. First, while differential privacy protects privacy by introducing random noise, it also inevitably affects the training updates from benign participants. This leads to reduced model accuracy and the need to collect more data samples to make up for this loss. In addition, since the data samples of different participants in federated learning are usually non-independent and identically distributed, the effectiveness of traditional backdoor detection algorithms based on model parameter differences in dealing with such situations is limited, and it is difficult to accurately distinguish backdoor attacks from benign updates, making it impossible to confidently identify and defend against potential attacks.

[0005] In general, the problems with existing technologies are: 1) Defense methods based on differential privacy affect model accuracy: Differential privacy technology protects privacy while masking data features by introducing random noise, but this noise also affects the training updates of benign participants, resulting in a decrease in model accuracy and the need to collect more data to make up for the loss; 2) Backdoors are difficult to distinguish from benign model parameter updates in non-independent and identically distributed data scenarios: Since the data samples of different participants in federated learning are usually non-independent and identically distributed, traditional backdoor detection algorithms based on model parameter differences are difficult to effectively distinguish between malicious backdoors and benign updates in this case, limiting the accuracy and defense effect of the algorithm. Summary of the invention

[0006] In order to solve the above technical problems, the present application is proposed. An embodiment of the present application provides a federated learning backdoor defense method based on trigger reconstruction, which can restore the accuracy of clean samples affected by the attack while resisting backdoor attacks. Specifically, the method reconstructs the backdoor trigger by utilizing the training update (i.e., the updated gradient) provided by the attacker, so that the malicious data sample becomes easy to identify (for example, it is easy to be identified by the human eye). Subsequently, the accuracy of the clean samples affected by the backdoor attack is effectively restored through the backdoor mitigation method.

[0007] According to one aspect of the present application, a federated learning backdoor defense method based on trigger reconstruction is provided, which includes: S1, preliminary reconstruction of potential backdoor triggers; S2, using enhanced algorithms to assist trigger reconstruction; S3, trigger-based backdoor mitigation measures, backdoor trigger reconstruction and introduction of adversarial deletion.

[0008] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, the step S1 is used to: use the local model G local The average gradient Reconstructing the backdoor trigger:

[0009]

[0010] in, is a training sample of a malicious client, y * is the original label of the malicious sample, is the function that minimizes the gradient loss, It is the loss function of the malicious sample on the global model. The gradient of the malicious sample can be calculated through the loss function of the malicious sample and the global model parameters.

[0011] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, the step S1 is used to: iteratively reconstruct Update at each iteration for:

[0012]

[0013] Among them, t is the number of iterations of the preliminary reconstruction algorithm, η is the optimizer of the gradient inversion algorithm, and each iteration is calculated by inputting the gradient loss function Optimize the pixel values ​​of malicious samples.

[0014] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, the step S2 includes: S21, a position-assisted enhancement algorithm for edge triggers, which stops updating pixels that have reached a certain level of certainty, so that the system can concentrate resources to reconstruct the high-uncertainty part of the trigger in subsequent iterations; S22, a time-assisted enhancement algorithm for continuous poisoning triggers, which focuses on the reconstruction of continuous poisoning triggers, collects updates of multiple training iterations of the infected model, regularizes the trigger image with the best recovery effect in the previous iteration, and adds a small disturbance as the initial image for the current iteration gradient inversion.

[0015] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, in step S21, the backdoor sample image to be reconstructed is represented as D i ={m i , n i} i＝1,2,...，N , where i represents the number of iterations of the location-assisted enhancement algorithm, and m i Represents the pixel area corresponding to the original image, n i Indicates the pixel area added as a trigger;

[0016] The pixel area is divided into two different parts, namely Where c and r represent the completed and remaining parts of the trigger pixel area, respectively, ensuring more accurate trigger reconstruction in different pixel areas:

[0017]

[0018] Among them, f loc (·) is the optimization function of edge-triggered reconstruction, is the gradient loss, ε is the amplification factor, and the gradient explosion problem is alleviated by scaling the ratio between the reconstructed gradient and the target gradient, which is defined as τ is the initial L2 norm manually set between the reconstructed gradient and the target gradient at the beginning of the gradient inversion algorithm, and f loc It can be represented as a combination of three blocks: because The pixel values ​​in the region are fixed, so a small part of the r pixel region is successfully restored in each iteration. We denote the restored pixel region as b and adjust the size of the c and r regions. After multiple iterations, the formula will change to:

[0019]

[0020] Continue to run the position-assisted advancement algorithm until r-(i-1)b=0, and fully restore the edge backdoor trigger:

[0021]

[0022] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, the step S22 improves the continuous poisoning trigger reconstruction algorithm f tim The reconstruction effect:

[0023]

[0024] Among them, R GBF (D i ) is a Gaussian bilateral filtering algorithm, j is the number of algorithm runs, and the function min is used to select the image D with the best recovery effect among multiple runs. best :

[0025]

[0026] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, the step S3 includes: S31: the injection process of the backdoor trigger is:

[0027] Attack(x)=m h,w ⊙Δ h,w,c +(1-m h,w )⊙x h,w,c

[0028] Among them, attack Attack(·) indicates that the trigger is applied to the original image x. Parameter Δ represents the trigger image, h, w and c represent the height, width and color channel of the trigger respectively, and mask m controls the strength of the backdoor trigger, and its value ranges from 0 to 1, that is, from no trigger to the trigger completely replacing the original image; S32: After the trigger is injected, the attacker usually pursues two main types of goals; the step S32 includes: S321. Label modification attack: causing the model to misclassify by changing the label of the trigger sample; S322. Decision boundary attack: without modifying the label, the decision boundary of the model is affected by the characteristics of the trigger, resulting in classification errors.

[0029] In the above-mentioned trigger-reconstruction-based federated learning backdoor defense method, in step S321, for label modification attacks, the attack can be mitigated by correcting incorrectly labeled samples and retraining the model.

[0030] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, in step S322, for decision boundary attacks, adjustment is made by scaling coefficient λ, and disturbance is added to degrade the trigger into extensive noise.

[0031] In the above-mentioned federated learning backdoor defense method based on trigger reconstruction, in step S322, the backdoor mitigation loss function is:

[0032]

[0033] Where y is the correct label of the training sample, Trigger(y) is the model's predicted label for the training sample with trigger, and λ is the coefficient used to adjust the impact of the trigger.

[0034] This paper improves the existing reconstruction-based backdoor detection algorithm for non-IID data scenarios, making it more accurately distinguish attacks from benign updates, thereby improving the defense effect of the federated learning system. To this end, two enhancement algorithms are developed: for edge poisoning triggers, a location-assisted enhancement algorithm is proposed, which prioritizes the reconstruction of certain parts of the data samples and helps convergence by adding random values; for continuous poisoning triggers, a time-assisted enhancement algorithm is proposed, which collects gradient updates through multiple training iterations and gradually optimizes the quality of the backdoor trigger image.

[0035] Beneficial technical effects brought by the present invention:

[0036] Excellent model accuracy: The backdoor trigger reconstruction algorithms in the three inventions effectively eliminate backdoor threats while maintaining model accuracy. Compared with traditional security defense methods, these algorithms do not need to introduce differential privacy noise, thus avoiding the adverse effects of noise on model accuracy. At the same time, through the precise reconstruction and effective elimination of backdoor triggers, the overall performance of the model is maintained or further optimized.

[0037] Good federated learning security defense effect: These inventions propose adversarial deletion methods for explicit backdoor triggers, effectively eliminating the threat of backdoor attacks without discarding a large number of benign samples. By combining location and time-assisted enhancement algorithms, these methods can accurately defend against complex backdoor attack types, improving the security of federated learning systems.

[0038] Applicable to complex scenarios with non-independent and identically distributed data: Considering the common non-independent and identically distributed data (Non-IID) problem in federated learning, the backdoor mitigation strategies designed by these inventions are particularly suitable for handling such complex scenarios. Whether it is a model decision boundary attack or a label modification attack, these methods can effectively respond to it, ensuring that the security and accuracy of the model can be guaranteed under different data distribution conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0040] Figure 1 It is a flowchart of a federated learning backdoor defense method based on trigger reconstruction according to an embodiment of the present application.

[0041] Figure 2 A system architecture diagram of a federated learning backdoor defense method based on trigger reconstruction according to an embodiment of the present application DETAILED DESCRIPTION

[0042] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0043] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0044] In addition, in order to better illustrate the present application, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.

[0045] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0046] In the field of smartphones, multiple camera applications have improved model performance by collaboratively training image classification models. When collecting and integrating model updates, the server faces the challenges of uneven data distribution and backdoor attacks, and adopts a federated learning backdoor defense based on trigger reconstruction. This method effectively defends against potential backdoor attacks and ensures the reliability of the federated learning process, so that the model can learn from a variety of data sources while protecting privacy, thereby improving overall performance.

[0047] In the technical solution of the present application, a federated learning backdoor defense method based on trigger reconstruction is proposed. This method uses the backdoor trigger of the training update (i.e., the updated gradient) provided by the attacker to reconstruct malicious data samples. While ensuring the backdoor defense effect, it does not significantly increase the data collection requirements, thereby improving the accuracy of the model.

[0048] The present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods:

[0049] Figure 1 FIG. 1 is a flowchart of a federated learning backdoor defense method based on trigger reconstruction according to an embodiment of the present application. Figure 1 As shown, the federated learning backdoor defense method based on trigger reconstruction according to the embodiment of the present application includes the steps of: S1, preliminary reconstruction of potential backdoor triggers; S2, using enhanced algorithms to assist trigger reconstruction; S3, trigger-based backdoor mitigation measures, introduction of backdoor trigger reconstruction and adversarial deletion.

[0050] In the embodiment of the present application, the step S1 is to preliminarily reconstruct the potential backdoor trigger. It should be understood that at this stage, the average gradient information of the local model is used to preliminarily reconstruct the potential backdoor trigger. Specifically, the average gradient of each local model is first extracted, and the possible backdoor trigger morphology is inverted through this gradient information. This process can provide an initial trigger estimate for subsequent fine reconstruction, laying the foundation for further optimization of the algorithm.

[0051] Specifically, in one embodiment of the present application, step S1 is used to: use the local model G local The average gradient of )Reconstruct the backdoor trigger (i.e., the training sample from the malicious client ). Our goal is to minimize the gradient loss function

[0052]

[0053] Among them, y * is the original label of the malicious sample, It is the loss function of the malicious sample on the global model. The gradient of the malicious sample can be calculated through the loss function of the malicious sample and the global model parameters.

[0054] Furthermore, the step S1 is used to iteratively reconstruct Update at each iteration for:

[0055]

[0056] Among them, t is the number of iterations of the preliminary reconstruction algorithm, η is the optimizer of the gradient inversion algorithm, and each iteration is calculated by inputting the gradient loss function Optimize the pixel values ​​of malicious samples.

[0057] In an embodiment of the present application, the step S2 uses an enhancement algorithm to assist in trigger reconstruction. Specifically, in one embodiment of the present application, the step S2 includes: S21, a position-assisted enhancement algorithm for edge triggers, which stops updating pixels that have reached a certain level of certainty, so that the system can concentrate resources on reconstructing the high-uncertainty part of the trigger in subsequent iterations; S22, a time-assisted enhancement algorithm for continuous poisoning triggers, which focuses on the reconstruction of continuous poisoning triggers, collects updates from multiple training iterations of the infected model, regularizes the trigger image with the best recovery effect in the previous iteration, and adds a small disturbance as the initial image for the current iteration gradient inversion.

[0058] Accordingly, in a specific example of the present application, the step S21, the position-assisted enhancement algorithm of the edge trigger, stops updating pixels that have reached a certain level of certainty, so that the system can concentrate resources on reconstructing the high-uncertainty part of the trigger in subsequent iterations. It should be understood that in the position-assisted enhancement algorithm of the edge trigger, during the image processing process, the trigger located at the edge of the image often has a small effect on the gradient norm, which easily leads to the blurred area of ​​the reconstructed image being unable to accurately restore its original trigger. In order to overcome this problem, a position-assisted enhancement algorithm is designed. The algorithm is optimized by using different seeds, and multiple local minima of the trigger image can be observed. Although these local minima can capture some features of the trigger, they will be different from other restored images in details. These reconstructed images usually vary around the core aspects of the original image, with slight differences in details.

[0059] To address this problem, the location-assisted enhancement algorithm stops updating pixels after detecting that they have reached a certain level of certainty, thereby concentrating resources on reconstructing the high-uncertainty parts of the trigger in subsequent iterations. This approach can more accurately reconstruct the blurred areas of the image and improve the overall reconstruction effect.

[0060] Specifically, in step S21, the backdoor sample image to be reconstructed is represented as D i ={m i , n i} i＝1,2,...，N , where i represents the number of iterations of the location-assisted enhancement algorithm, and m i Represents the pixel area corresponding to the original image, n i Indicates the pixel area added as a trigger;

[0061] To further improve the reconstruction effect, the pixel area is divided into two different parts, namely Where c and r represent the completed and remaining parts of the trigger pixel area, respectively, ensuring more accurate trigger reconstruction in different pixel areas:

[0062]

[0063] Among them, f loc (·) is the optimization function of edge-triggered reconstruction, is the gradient loss, ε is the amplification factor, and the gradient explosion problem is alleviated by scaling the ratio between the reconstructed gradient and the target gradient, which is defined as τ is the initial L2 norm manually set between the reconstructed gradient and the target gradient at the beginning of the gradient inversion algorithm, for example, τ = 100. When the gradient inversion algorithm reaches its limit but the trigger image is still not fully formed, the position-assisted enhancement algorithm is used. In order to observe the optimization process of each pixel area, f loc It can be represented as a combination of three blocks: because The pixel values ​​in the region are fixed, so a small part of the r pixel region is successfully restored in each iteration. We denote the restored pixel region as b and adjust the size of the c and r regions. After multiple iterations, the formula will change to:

[0064]

[0065] Continue to run the position-assisted advancement algorithm until r-(i-1)b=0, and fully restore the edge backdoor trigger:

[0066]

[0067] Accordingly, in a specific example of the present application, the step S22, the time-assisted enhancement algorithm of the continuous poisoning trigger, focuses on the reconstruction of the continuous poisoning trigger, by collecting updates of multiple training iterations of the infected model, regularizing the trigger image with the best recovery effect in the previous iteration, and adding a small disturbance as the initial image of the current iteration gradient inversion. It should be understood that the time-assisted enhancement algorithm of the continuous poisoning trigger, in the scenario of continuous poisoning attack, the trigger is mixed with benign image features, so that the gradient change is very small, which makes the application of the gradient inversion algorithm more complicated. In addition, some triggers are composed of irregular pixels, which are easily misdiagnosed as blurred areas in benign images during the gradient recovery process. In this case, it is difficult for traditional reconstruction algorithms to accurately distinguish between triggers and benign image parts, resulting in a decrease in reconstruction accuracy. In order to meet this challenge, a time-assisted enhancement algorithm is designed to focus on the reconstruction of continuous poisoning triggers.

[0068] Since the reconstruction of persistent poisoning triggers requires longer iterations, the algorithm collects updates of the infected model in multiple training iterations, regularizes the trigger image with the best recovery effect in the previous iteration, adds small perturbations, and uses it as the initial image of the current iteration. This can maximize the recovery of persistent poisoning triggers and improve the overall reconstruction effect.

[0069] In addition, during the reconstruction process, the restored image D i There may be blurred and confusing feature areas, making it difficult to distinguish whether these areas are triggers or poorly recovered parts. To solve this problem, the algorithm applies a Gaussian bilateral filter, denoted by R GBF (D i ), Gaussian bilateral filtering is a nonlinear filtering method that combines the advantages of spatial proximity and pixel value similarity, balancing the two to achieve edge-preserving denoising. This method can effectively remove unnecessary noise while maintaining image accuracy, thereby improving the quality of trigger reconstruction.

[0070] Specifically, in step S22, the formula originally used for the reconstruction of the continuous poisoning trigger is redefined to adapt to the application of Gaussian bilateral filtering and the iterative optimization process, thereby further improving the continuous poisoning trigger reconstruction algorithm f tim The reconstruction effect:

[0071]

[0072] Among them, R GBF (D i) is a Gaussian bilateral filtering algorithm. The time-assisted enhancement algorithm is run in multiple consecutive training cycles of federated learning. j is the number of algorithm runs. Each run will generate a high-quality continuous poisoning trigger reconstruction image. The image D with the best recovery effect in multiple runs is selected by function min. best :

[0073]

[0074] In an embodiment of the present application, step S3, the trigger-based backdoor mitigation measures, the introduction of backdoor trigger reconstruction and adversarial deletion. It should be understood that the trigger-based backdoor mitigation measures, in the last step, use the reconstructed backdoor trigger to implement the trigger-based backdoor mitigation measures. The goal of this solution is to effectively adversarially delete explicit backdoor triggers and retain most of the benign models to minimize the negative impact on model performance. An attacker may pursue two main goals after trigger injection: 1. Label modification attack: causing model misclassification by changing the label of the trigger sample. 2. Decision boundary attack: Instead of modifying the label, the decision boundary of the model is affected by the trigger feature, resulting in classification errors.

[0075] Therefore, the mitigation strategy of the present invention is that for label modification attacks, it can be mitigated by correcting the wrongly labeled samples and retraining the model. For decision boundary attacks, this solution proposes to adjust the scaling factor λ and add disturbances to downgrade the impact of the trigger to extensive noise, thereby reducing its negative impact on the model.

[0076] Specifically, in one embodiment of the present application, the step S3 includes: S31: the injection process of the backdoor trigger is:

[0077] Attack(x)=m h,w ⊙Δ h,w,c +(1-m h,w )⊙x h,w,c

[0078] Among them, attack Attack(·) indicates that the trigger is applied to the original image x. Parameter Δ represents the trigger image, h, w and c represent the height, width and color channel of the trigger respectively, and mask m controls the strength of the backdoor trigger, and its value ranges from 0 to 1, that is, from no trigger to the trigger completely replacing the original image; S32: After the trigger is injected, the attacker usually pursues two main types of goals; the step S32 includes: S321. Label modification attack: causing the model to misclassify by changing the label of the trigger sample; S322. Decision boundary attack: without modifying the label, the decision boundary of the model is affected by the characteristics of the trigger, resulting in classification errors.

[0079] Further, in step S321, for label modification attacks, the attack can be mitigated by correcting the wrongly labeled samples and retraining the model. Further, in step S322, for decision boundary attacks, the attack can be adjusted by scaling the coefficient λ and adding disturbances to degrade the trigger into extensive noise.

[0080] Accordingly, in step S322, the backdoor mitigation loss function is:

[0081]

[0082] Where y is the correct label of the training sample, Trigger(y) is the model's predicted label for the training sample with the trigger, and λ is the coefficient used to adjust the impact of the trigger. The effect of the trigger is effectively eliminated by optimizing the similarity of correctly classified samples with and without the trigger. When the accuracy of the triggered samples in all categories matches the distribution of the non-triggered samples, the effect of the trigger is almost eliminated.

[0083] Once the trigger is effectively eliminated, the gradients from the infected client will be used together with the benign data provided by normal users to update the global model. This approach ensures the integrity and security of the model while maintaining good classification performance.

[0084] In summary, the trigger-reconstructed federated learning backdoor defense method based on the embodiment of the present application is intended to effectively resist backdoor attacks while maintaining high model accuracy and not significantly increasing data collection requirements. The method uses the backdoor triggers in the training updates provided by the attacker to reconstruct malicious data samples so that these samples are easy to identify. In order to improve the defense effect in non-independent and identically distributed data scenarios. Accurately distinguish between backdoor and benign model parameters in non-independent and identically distributed data scenarios. The present invention improves the existing reconstruction-based backdoor detection algorithm for non-independent and identically distributed data scenarios, so that it can more accurately distinguish between backdoor attack updates and benign updates, thereby improving the backdoor defense effect of the federated learning system.

[0085] further, Figure 2 : is a system architecture diagram of a federated learning backdoor defense method based on trigger reconstruction according to an embodiment of the present application. Figure 2As shown, according to the federated learning backdoor defense method based on trigger reconstruction in the embodiment of the present application, the backdoor attack exploits the loopholes in the model training process and embeds specific trigger conditions into the model, so that it produces the erroneous output expected by the attacker when encountering specific inputs. The attacker can manipulate the final global model by participating in the federated learning process and uploading malicious training updates. In order to resist backdoor attacks in federated learning while restoring the accuracy of clean samples affected by the attack, first, the training updates (i.e., updated gradients) provided by the attacker are used to reconstruct the backdoor trigger, so that the malicious data samples become easy to identify (for example, easily recognizable by the human eye). Preliminary reconstruction of potential backdoor triggers, using the average gradient information of the local model to preliminarily reconstruct potential backdoor triggers. For non-independent and identically distributed data scenarios, the existing reconstruction-based backdoor detection algorithm is improved to more accurately distinguish attacks from benign updates, thereby improving the defense effect of the federated learning system. To this end, two enhancement algorithms were developed: for edge poisoning triggers, a location-assisted enhancement algorithm was proposed, which prioritizes the reconstruction of certain parts of the data samples and helps convergence by adding random values; for persistent poisoning triggers, a time-assisted enhancement algorithm was proposed, which collects gradient updates through multiple training iterations and gradually optimizes the quality of the backdoor trigger image. Subsequently, the accuracy of clean samples affected by the backdoor attack is effectively restored through the backdoor mitigation method. Once the trigger is effectively cleared, the gradients from the infected client will be used together with the benign data provided by normal users to update the global model, ensuring the integrity and security of the model while maintaining good classification performance.

[0086] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A federated learning backdoor defense method based on trigger reconstruction, characterized in that: include: S1, preliminary reconstruction of potential backdoor triggers; S2, using enhanced algorithms to assist trigger reconstruction; S3, trigger-based backdoor mitigation measures, the introduction of backdoor trigger reconstruction and adversarial deletion.

2. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 1 is characterized in that: The step S1 is used to: use the local model G local The average gradient Reconstructing the backdoor trigger: in, is a training sample of a malicious client, y * is the original label of the malicious sample, is the function that minimizes the gradient loss, It is the loss function of the malicious sample on the global model. The gradient of the malicious sample can be calculated through the loss function of the malicious sample and the global model parameters.

3. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 2 is characterized in that: The step S1 is used to iteratively reconstruct Update at each iteration for: Among them, t is the number of iterations of the preliminary reconstruction algorithm, η is the optimizer of the gradient inversion algorithm, and each iteration is calculated by inputting the gradient loss function Optimize the pixel values ​​of malicious samples.

4. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 3 is characterized in that: The step S2 includes: S21, the position-assisted enhancement algorithm for edge triggers, stops updating pixels that have reached a certain level of certainty, allowing the system to focus resources on reconstructing the high-uncertainty part of the trigger in subsequent iterations; S22, the time-assisted enhancement algorithm for persistent poisoning triggers, focuses on the reconstruction of persistent poisoning triggers by collecting updates from multiple training iterations of the infected model, regularizing the trigger image with the best recovery effect in the previous iteration, and adding a small perturbation as the initial image for gradient inversion in the current iteration.

5. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 4 is characterized in that: In step S21, the backdoor sample image to be reconstructed is represented as D i ={m i , n i } i＝1,2,...，N , where i represents the number of iterations of the location-assisted enhancement algorithm, and m i Represents the pixel area corresponding to the original image, n i Indicates the pixel area added as a trigger; The pixel area is divided into two different parts, namely Where c and r represent the completed and remaining parts of the trigger pixel area, respectively, ensuring more accurate trigger reconstruction in different pixel areas: Among them, f loc (·) is the optimization function of edge-triggered reconstruction, is the gradient loss, ε is the amplification factor, and the gradient explosion problem is alleviated by scaling the ratio between the reconstructed gradient and the target gradient, which is defined as τ is the initial L2 norm manually set between the reconstructed gradient and the target gradient at the beginning of the gradient inversion algorithm, and f loc It can be represented as a combination of three blocks: because The pixel values ​​in the region are fixed, so a small part of the r pixel region is successfully restored in each iteration. We denote the restored pixel region as b and adjust the size of the c and r regions. After multiple iterations, the formula will change to: Continue to run the position-assisted advancement algorithm until r-(i-1)b=0, and fully restore the edge backdoor trigger:

6. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 5 is characterized in that: The step S22 is to improve the continuous poisoning trigger reconstruction algorithm f tim The reconstruction effect: Among them, R GBF (D i ) is a Gaussian bilateral filtering algorithm, j is the number of algorithm runs, and the function min is used to select the image D with the best recovery effect among multiple runs. best :

7. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 6 is characterized in that: The step S3 comprises: S31: The injection process of the backdoor trigger is: Attack(x)=m h,w ⊙Δ h,w,c +(1-m h,w )⊙x h,w,c Among them, Attack(·) indicates that the trigger is applied to the original image x. The parameter Δ represents the trigger image, h, w and c represent the height, width and color channel of the trigger respectively, and the mask m controls the strength of the backdoor trigger, and its value ranges from 0 to 1, that is, from no trigger to the trigger completely replacing the original image; S32: After trigger injection, attackers usually pursue two main types of goals; The step S32 comprises: S321. Label modification attack: Change the label of the triggering sample to cause the model to misclassify; S322. Decision boundary attack: Instead of modifying the label, the decision boundary of the model is affected by the characteristics of the trigger, resulting in classification errors.

8. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 7 is characterized in that: In step S321, label modification attacks can be mitigated by correcting incorrectly labeled samples and retraining the model.

9. The method for federated learning backdoor defense based on trigger reconstruction according to claim 8 is characterized in that: In step S322, for decision boundary attack, adjustment is made by scaling factor λ, and disturbance is added to degrade the trigger into extensive noise.

10. The method for backdoor defense of federated learning based on trigger reconstruction according to claim 9 is characterized in that: In step S322, the backdoor mitigation loss function is: Where y is the correct label of the training sample, Trigger(y) is the model's predicted label for the training sample with trigger, and λ is the coefficient used to adjust the impact of the trigger.

Images