Member reasoning attack method and system based on federal self-supervised learning framework
By adopting a member reasoning attack method based on the federated self-supervised learning framework in federated learning, the central server simulates the construction of the client's local model, and inferring the member information of the attacked client, solving the problem of privacy leakage caused by member reasoning attacks in federated learning, realizing the central server as an effective member reasoning attack of the attacker, protecting the privacy and copyright of the data owner.
Patent Information
- Application Number
- CN202411843025.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-13
- Publication Date
- 2025-03-18
AI Technical Summary
In federated learning, member reasoning attacks lead to privacy leakage. The existing technology mainly focuses on attacks between local clients. Research on central servers as attackers has not yet been improved.
The member reasoning attack method based on the federated self-supervised learning framework is adopted. The central server initializes the global model, randomly selects the client to download the local data set for training, uploads the weights for federated average, and updates the global model weights. By simulation, the client-side local model is built as a shadow model, the inference training data set and binary inference classifier are constructed, and the shadow model is used to infer member information of the attacked client.
In the federated comparative learning scenario, the central server is used as the attacker and the local client is the member of the attacker, which verifies the possibility of leakage of local client training member information under the federated self-supervised learning framework, and provides a way to review whether the client training data is personal unauthorized privacy data, so as to protect the data owner data copyright.
Smart Images
Figure CN119647554A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of machine learning, and in particular to a member reasoning attack method and system based on a federated self-supervised learning framework. Background Art
[0002] With the improvement of computer computing power, machine learning has been greatly developed and has been widely used in all walks of life. Therefore, the problem of data islands has come along, and there is a certain demand for data interoperability between various fields. The emergence of federated learning allows users to collaborate in training and learn from each other while ensuring that their privacy information is not leaked to a certain extent. Contrastive learning is a self-supervised learning that can achieve effective training without labeled training data. Therefore, applying contrastive learning to the federated learning framework is closer to real-world application scenarios.
[0003] Federated learning still faces many challenges. One of the more important aspects is the privacy leakage caused by member reasoning attacks. Since there is a certain amount of information exchange between the local model and the central server, as long as the attacker participates in federated learning, he can use this information to attack.
[0004] A scholar proposed a membership inference attack based on supervised federated learning, which can achieve passive membership inference attack without training member samples. The specific implementation is to eavesdrop on the update of the client to the server model to perform membership inference attack. However, this method has certain disadvantages:
[0005] The application scenario of this method is supervised federated learning, but supervised learning requires a lot of manual labels. Real data usually does not have accurate labels, so unsupervised learning is closer to real scenarios. In other words, the application scope of this method is relatively small.
[0006] Another scholar proposed a new method that conducted groundbreaking research on passive and active member inference attacks in federated contrastive learning, confirming the inherent potential for data leakage in federated contrastive learning scenarios. Focusing on the case where the attacker is the client, it points out that overfitting models due to improper parameter selection or highly skewed data distribution between customers may increase the risk of privacy leakage. At the same time, this method has unexplored angles, as follows:
[0007] The membership inference attacks discussed in this method are all based on the clients in the federated self-supervised learning framework, that is, the attacker and the attacked are both clients participating in the training. In real application scenarios, after receiving information from each client, the central server that implements aggregation can also act as an attacker and perform membership inference attacks on each client.
[0008] Currently, no effective solution has been proposed for the problems in the related technologies. Summary of the invention
[0009] In response to the problems in the related technology, the present invention proposes a member reasoning attack method and system based on a federated self-supervised learning framework to overcome the above-mentioned technical problems existing in the existing related technology.
[0010] To this end, the specific technical solution adopted by the present invention is as follows:
[0011] According to one aspect of the present invention, a member reasoning attack method based on a federated self-supervised learning framework is provided, and the member reasoning attack method comprises the following steps:
[0012] S1. The central server initializes the global model and uses the global weight variable to store the weight of the global model; each client downloads the client model based on the global model from the central server and copies the global model weight to each client model;
[0013] S2. The central server randomly selects several clients and downloads the corresponding local data set based on each selected client; trains the client model corresponding to each client based on the local data set, obtains the corresponding client weight, and uploads it to the central server; uses the federated learning algorithm to perform federated averaging on the client weights and updates the global model weights;
[0014] S3, iterate and repeat step S2 for multiple times to obtain the convergence of the global model of the central server, simulate and build the client local model based on the convergence of the global model and the client model parameters uploaded by the client, and use the simulated client local model as the shadow model;
[0015] S4. Construct an inference training data set according to the shadow model, construct a binary inference classifier as an attack model according to the inference training data set, and train the attack model using the inference training data set; and infer member information of the attacked client based on the attack model.
[0016] Optionally, the central server randomly selects several clients, and downloads a corresponding local data set based on each selected client; trains a client model corresponding to each client based on the local data set to obtain a corresponding client weight, and uploads it to the central server; and uses a federated learning algorithm to perform federated averaging on the client weights and update the global model weights, including the following steps:
[0017] S21, the central server initializes the global model parameters and randomly selects clients to participate in training;
[0018] S22, the selected client obtains the client model from the central server, trains the client model using the local data set, and updates the client model parameters using the stochastic gradient descent algorithm; each client sends the updated client model parameters back to the central server;
[0019] S23, the central server performs weighted average aggregation on the received client model parameters;
[0020] S24. The central server sends the client model parameters after weighted average aggregation back to the selected client.
[0021] Optionally, the objective function formula of the federated learning algorithm is:
[0022]
[0023] Where M represents the number of clients participating in the training; w represents the given parameter; f(w) represents the loss function of the given parameter w; f(w * ) represents the minimum value of the loss function; E represents the mean square error function; f(w:x;x∈n) represents the local loss calculated on the nth client participating in the training; x represents the client local data.
[0024] Optionally, the central server performs weighted average aggregation on the received client model parameters, including the following steps:
[0025] S231, selecting a client for federation averaging based on the central server;
[0026] S232: Update the global model parameters according to the ratio of the number of clients to the total number of clients and in combination with the corresponding client model parameters.
[0027] Optionally, the expression of the weighted average aggregation is:
[0028]
[0029] In the formula, w t+1 represents the new global model parameters, t+1 represents the current iteration number; K represents the number of clients participating in the iteration; n k represents the number of samples of client k; N represents the total number of samples of all participating clients; represents the model parameters of client k at the tth iteration.
[0030] Optionally, the multiple iterations and repeated execution of step S2 to obtain the convergence of the global model of the central server, based on the convergence of the global model and using the client model parameters uploaded by the client, simulating and constructing the client local model, and using the simulated client local model as the shadow model include the following steps:
[0031] S31, based on step S2, the global model of the central server converges;
[0032] S32, according to the convergence of the obtained global model, combining the central server's own framework and the received client model parameters, simulate and build the client local model;
[0033] S33. Construct a shadow model according to the model parameters in the client local model finally uploaded by the client.
[0034] Optionally, constructing an inference training data set according to the shadow model, constructing a binary inference classifier as an attack model according to the inference training data set, and training the attack model using the inference training data set; and inferring member information of the attacked client based on the attack model comprises the following steps:
[0035] S41, calculating the similarity score between the shadow model dataset and the client model local dataset, obtaining the member dataset feature vector and marking it;
[0036] S42, based on selecting data that does not participate in the federated contrastive learning process as a set, extracting and marking feature vectors of the non-member data set;
[0037] S43, constructing an inference training data set according to the feature vector of the member data set and the feature vector of the non-member data set, and training the data set to obtain an attack model;
[0038] S44: Input the pre-configured image into the attack model to infer member information of the attacked client.
[0039] Optionally, the expression of the inference training data set is:
[0040]
[0041] Where E represents the inference training dataset; M(x1,h1) represents the return result of model h1 for the input xi; x1 represents the dataset member of the shadow model, x2 represents the dataset member of the attacked model; h1 represents the shadow model, and h2 represents the attacked model.
[0042] Optionally, constructing and training a reasoning training data set according to the feature vector of the member data set and the feature vector of the non-member data set to obtain an attack model comprises the following steps:
[0043] S431, discretize and count the feature vectors of the inference training data set, construct a histogram, and obtain the feature values of the inference training data set;
[0044] S432, traversing the characteristic values of the inference training data set, and calculating the accuracy under each threshold based on the characteristic values, and selecting the threshold that meets the preset requirements;
[0045] S433. In the inference training data set, the feature value of each test sample is compared with the corresponding threshold value, and the test samples belonging to the attacked model are screened according to the comparison result.
[0046] According to another aspect of the present invention, a member reasoning attack system based on a federated self-supervised learning framework is also provided, the member reasoning attack system comprising: an initialization module, a federated learning module, a shadow model training module and a member reasoning attack module;
[0047] The initialization module is used for the central server to initialize the global model and use the global weight variable to store the weight of the global model; each client downloads the client model based on the global model from the central server and copies the global model weight to each client model;
[0048] The federated learning module is used for the central server to randomly select several clients, download the corresponding local data set based on each selected client, train the client model corresponding to each client based on the local data set, obtain the corresponding client weight, and upload it to the central server; use the federated learning algorithm to perform federated averaging on the client weights and update the global model weights; iterate and repeat the client training for multiple times, update the global model weights in the global model, and obtain the global model convergence of the central server;
[0049] A shadow model training module is used to simulate and build a client local model based on the convergence of the global model and the client model parameters uploaded by the client, and use the simulated client local model as the shadow model;
[0050] The member reasoning attack module is used to construct a reasoning training data set according to the shadow model, construct a binary reasoning classifier as an attack model according to the reasoning training data set, and train the attack model using the reasoning training data set; and reason about the member information of the attacked client based on the attack model.
[0051] The beneficial effects of the present invention are:
[0052] 1. The present invention realizes a member reasoning attack with a central server as the attacker and a local client as the attacked in a federated comparative learning scenario. Previous studies have focused on member reasoning attacks by local clients against local clients, which has resulted in incomplete research on the central server as the attacker.
[0053] 2. The present invention focuses on the member reasoning attack initiated by the central server, and effectively verifies the possibility of member information leakage in local client training under the federated self-supervised learning framework. The present invention creatively uses the parameters uploaded by the attacked model for the last time and the central server itself to directly construct the shadow model, omitting the additional shadow model training steps.
[0054] 3. The present invention can provide a central server with a method for reviewing whether the training data of each client is personal unauthorized privacy data, and can be used to review whether the data owner's data is used illegally, thereby protecting the data owner's data copyright. BRIEF DESCRIPTION OF THE DRAWINGS
[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0056] Figure 1 is a flow chart of a member reasoning attack method based on a federated self-supervised learning framework according to an embodiment of the present invention;
[0057] Figure 2 is a principle block diagram of a member reasoning attack system based on a federated self-supervised learning framework according to an embodiment of the present invention;
[0058] Figure 3 is a member reasoning attack schematic diagram of a member reasoning attack method based on a federated self-supervised learning framework according to an embodiment of the present invention;
[0059] Figure 4 This is a result diagram of the attacked client training of a member reasoning attack method based on a federated self-supervised learning framework according to an embodiment of the present invention.
[0060] In the figure:
[0061] 1. Initialization module; 2. Federated learning module; 3. Shadow model training module; 4. Member reasoning attack module. DETAILED DESCRIPTION
[0062] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention and are mainly used to illustrate the embodiments. They can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in the field should be able to understand other possible implementations and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.
[0063] According to an embodiment of the present invention, a member reasoning attack method and system based on a federated self-supervised learning framework are provided.
[0064] The present invention is further described with reference to the accompanying drawings and specific embodiments. Figure 1 , Figure 3 and Figure 4 As shown, according to one embodiment of the present invention, a member reasoning attack method based on a federated self-supervised learning framework is provided, and the member reasoning attack method includes the following steps:
[0065] S1. The central server initializes the global model and uses the global weight variable to store the weight of the global model; each client downloads the client model based on the global model from the central server and copies the global model weight to each client model.
[0066] It should be explained that the present invention takes the central server as the main attacker and the client as the attacked. Figure 3 As shown, this embodiment is a member reasoning attack method based on federated self-supervised learning, using the cifar10 dataset, including each client having a local dataset D i , and initialize a neural network model M i , where i is the client serial number; the server initializes a neural network model M.
[0067] Table 1 Initialized neural network model M i The network model structure
[0068]
[0069]
[0070]
[0071]
[0072] The client in this example is a computer with a certain computing power. For the client numbered i, the local data set D i This is a part of the data in the cifar10 dataset. The model structures of the client and the central server are shown in Table 1.
[0073] The contrastive learning model MoCo is used to initialize the global model of the central server. The client downloads the model M from the central server. In this example, each computer with a local data set obtains information from the central server to initialize the local model.
[0074] In addition, it should be noted that contrastive learning is an unsupervised learning method that extracts meaningful representations from unlabeled data sets by using similarities and dissimilarities. It uses samples to train the model without labeling the samples. Common contrastive learning algorithms include the MoCo algorithm. Contrastive learning has been effectively applied in computer vision, natural language processing and other fields.
[0075] Federated Contrastive Learning: Federated Contrastive Learning is a method that combines federated learning and contrastive learning. It can train unlabeled datasets based on a federated learning framework. Compared with supervised federated learning, it is closer to reality and has wider application value.
[0076] Neural network: Neural network is a model that simulates the animal neural network. It is composed of interconnected nodes and processes information by adjusting the relationship between each node. Neural network has a wide range of applications in many fields such as image recognition.
[0077] Client: The client here refers to the local end that participates in training in federated learning. In real scenarios, it can be an organization that needs to participate in federated learning, such as a hospital or bank; it can also be some devices, such as a smartphone.
[0078] Central server: The central server is the central node responsible for coordinating and managing the entire federated learning process. In federated learning, it is mainly responsible for processing the parameters uploaded by each client based on the federated learning algorithm to update the global model.
[0079] Membership inference attack: Membership inference attack is a privacy attack. The mainstream membership inference attack simulates the attacked model by training a shadow model, which essentially exploits the overfitting of the target model to obtain information. The purpose of membership inference attack is to infer whether certain specific data is used to train the attacked model, that is, whether it is a member of the attacked model.
[0080] Shadow model: The shadow model is a model trained by the attacker himself, which is mainly a simulation of the target model. In the present invention, the central server can obtain the model parameters uploaded by each client, and it is very convenient to simulate the target model based on the central server. Therefore, in the present invention, the shadow model is not additionally trained, and the central server with the client model information is directly used as the shadow model.
[0081] S2. The central server randomly selects several clients and downloads the corresponding local data set for each selected client. The client model corresponding to each client is trained based on the local data set to obtain the corresponding client weight and upload it to the central server. The client weights are federated averaged using the federated learning algorithm and the global model weights are updated.
[0082] Optionally, the central server randomly selects several clients, and downloads a corresponding local data set based on each selected client; trains a client model corresponding to each client based on the local data set to obtain a corresponding client weight, and uploads it to the central server; and uses a federated learning algorithm to perform federated averaging on the client weights and update the global model weights, including the following steps:
[0083] S21. The central server initializes the global model parameters and randomly selects clients to participate in training.
[0084] S22. The selected client obtains the client model from the central server, trains the client model using a local data set, and updates the client model parameters using a stochastic gradient descent algorithm; each client sends the updated client model parameters back to the central server.
[0085] S23. The central server performs weighted average aggregation on the received client model parameters.
[0086] Optionally, the central server performs weighted average aggregation on the received client model parameters, including the following steps:
[0087] S231, selecting a client for federation averaging based on the central server;
[0088] S232: Update the global model parameters according to the ratio of the number of clients to the total number of clients and in combination with the corresponding client model parameters.
[0089] S24. The central server sends the client model parameters after weighted average aggregation back to the selected client.
[0090] Optionally, the objective function formula of the federated learning algorithm is:
[0091]
[0092] Where M represents the number of clients participating in the training; w represents the given parameter; f(w) represents the loss function of the given parameter w; f(w * ) represents the minimum value of the loss function; E represents the mean square error function; f(w:x;x∈n) represents the local loss calculated on the nth client participating in the training; x represents the client local data.
[0093] Optionally, the expression of the weighted average aggregation is:
[0094]
[0095] In the formula, w t+1represents the new global model parameters, t+1 represents the current iteration number; K represents the number of clients participating in the iteration; n k represents the number of samples of client k; N represents the total number of samples of all participating clients; represents the model parameters of client k at the tth iteration.
[0096] It should be explained that, in this embodiment, the central server can randomly select clients within the scope of authority to participate in training, for example, select clients with street view data sets, clients with pedestrian data sets, clients with license plate data sets, etc. The selected clients use local data sets to train the model M downloaded from the central server. After several rounds of training, the parameters are uploaded to the central server for federal averaging, which is one communication.
[0097] The federated learning algorithm in this embodiment is the FedAvg algorithm, which selects specific client parameters for federated averaging, allowing multiple clients to jointly train the model without sharing local data, thereby achieving mutual learning between the clients. For example: Client A only has a license plate dataset locally, and the model has a low recognition success rate for non-license plate images; Client B only has a pedestrian dataset locally, and the model has a low recognition success rate for non-pedestrian images. After federated learning, both clients can achieve high success rate recognition of license plates and pedestrians. The loss function uses the cross entropy loss function. Among them, M i For the local client model, For client models to dataset The prediction of the nth one, j is the sample label. The training effect of the local client is as follows Figure 4 shown.
[0098] The detailed process steps of the FedAvg algorithm are as follows:
[0099] Step 1: The central server initializes the global model parameters.
[0100] Step 2: In each round of iteration, the central server randomly selects a part of clients to participate in this round of training.
[0101] Step 3: The selected client downloads the global model, trains the downloaded model using the local dataset, and then updates the model parameters using the stochastic gradient descent algorithm.
[0102] Step 4: Each client sends the updated model parameters back to the central server.
[0103] Step 5: After receiving the parameters from each client, the central server performs weighted average aggregation.
[0104] Step 6: The central server sends the aggregated new model parameters back to all clients, completing a round of training.
[0105] Step 7: Repeat steps 2 to 6 until the predetermined number of training rounds is reached or the model performance meets the user's requirements.
[0106] After each communication, several clients are randomly selected to participate in the next round of training. After several communications, the trained global model is obtained.
[0107] S3, iterate and repeat step S2 for multiple times to obtain the convergence of the global model of the central server, simulate and build the client local model based on the convergence of the global model and adopt the client model parameters uploaded by the client, and use the simulated client local model as the shadow model.
[0108] Optionally, the multiple iterations and repeated execution of step S2 to obtain the convergence of the global model of the central server, based on the convergence of the global model and using the client model parameters uploaded by the client, simulating and constructing the client local model, and using the simulated client local model as the shadow model include the following steps:
[0109] S31, based on step S2, the global model of the central server converges;
[0110] S32, according to the convergence of the obtained global model, combining the central server's own framework and the received client model parameters, simulate and build the client local model;
[0111] S33. Construct a shadow model according to the model parameters in the client local model finally uploaded by the client.
[0112] It should be explained that during the process of training the shadow model, since the central server can receive the local model parameters uploaded by the client, the central server can build a model that is similar to the client model based on its own framework and the received model parameters. In the present invention, the client model is built using the model parameters uploaded by the attacked client for the last time, and it is directly used as the shadow model, without the need for additional training of the shadow model.
[0113] S4. Construct an inference training data set according to the shadow model, construct a binary inference classifier as an attack model according to the inference training data set, and train the attack model using the inference training data set; and infer member information of the attacked client based on the attack model.
[0114] It should be explained that in the process of extracting member information features, it is necessary to give input x and perform data augmentation to obtain Use the shadow model h to generate feature vectors for each augmented input and further obtain member features The expression is:
[0115]
[0116] In the formula, represents the feature vector generated by the shadow model for the augmented input x; S represents the similarity between two feature vectors; n represents the number of augmented data after augmentation for a given input x; Representing the shadow model The returned result for the input x is the feature vector; i and j represent the serial numbers of the augmented inputs, the range of i and j is from 1 to n, and j>i is guaranteed, that is, the similarity is calculated between the n augmented inputs.
[0117] Optionally, constructing an inference training data set according to the shadow model, constructing a binary inference classifier as an attack model according to the inference training data set, and training the attack model using the inference training data set; and inferring member information of the attacked client based on the attack model comprises the following steps:
[0118] S41. Calculate the similarity score between the shadow model dataset and the client model local dataset, obtain the member dataset feature vector and mark it.
[0119] S42. Based on selecting the data set that does not participate in the federated contrastive learning process, extract the feature vectors of the non-member data set and mark them.
[0120] S43. Construct an inference training data set based on the feature vector of the member data set and the feature vector of the non-member data set, and train the data set to obtain an attack model.
[0121] Optionally, constructing and training a reasoning training data set according to the feature vector of the member data set and the feature vector of the non-member data set to obtain an attack model comprises the following steps:
[0122] S431, discretize and count the feature vectors of the inference training data set, construct a histogram, and obtain the feature values of the inference training data set;
[0123] S432, traversing the characteristic values of the inference training data set, and calculating the accuracy under each threshold based on the characteristic values, and selecting the threshold that meets the preset requirements;
[0124] S433. In the inference training data set, the feature value of each test sample is compared with the corresponding threshold value, and the test samples belonging to the attacked model are screened according to the comparison result.
[0125] It should be explained that the present invention adopts a threshold-based classifier to pass That is, for a list of feature vectors All elements in are averaged to get the average of similarity scores to judge its membership. When the similarity score is high, it is judged as a member sample, otherwise it is a non-member sample.
[0126] The binary inference classifier in this embodiment is a threshold-based classifier, which essentially calculates and counts the average feature values of training data and test data, uses a histogram to analyze the features in the data set, and finds a suitable threshold.
[0127] Step 1: Construct a histogram. Discretize the feature distribution of the training samples and count the number of samples within a specific range.
[0128] Step 2: Threshold selection: Traverse the feature values of the training set, calculate the accuracy at each threshold, and select the threshold that maximizes the accuracy.
[0129] Step 3: Use the selected threshold to predict the test data. For each test sample, compare its feature value with the threshold. If the feature value is greater than or equal to the threshold, predict that the sample is one of the training samples of the attacked model; otherwise, predict that the sample has never participated in the training process of the attacked model.
[0130] S44: Input the pre-configured image into the attack model to infer member information of the attacked client.
[0131] Optionally, the expression of the inference training data set is:
[0132]
[0133] Where E represents the inference training dataset; M(x1,h1) represents the return result of model h1 for the input xi; x1 represents the dataset member of the shadow model, x2 represents the dataset member of the attacked model; h1 represents the shadow model, and h2 represents the attacked model.
[0134] According to another aspect of the present invention, a member reasoning attack system based on a federated self-supervised learning framework is also provided. Figure 2 As shown, the member reasoning attack system includes: an initialization module 1, a federated learning module 2, a shadow model training module 3 and a member reasoning attack module 4;
[0135] Initialization module 1 is used for the central server to initialize the global model and use the global weight variable to store the weight of the global model; each client downloads the client model based on the global model from the central server and copies the global model weight to each client model;
[0136] Federated learning module 2 is used for the central server to randomly select several clients, download the corresponding local data set based on each selected client; train the client model corresponding to each client based on the local data set, obtain the corresponding client weight, and upload it to the central server; use the federated learning algorithm to perform federated averaging on the client weights and update the global model weights; iterate and repeat the client training for multiple times, update the global model weights in the global model, and obtain the global model convergence of the central server;
[0137] The shadow model training module 3 is used to simulate and construct a client local model based on the convergence of the global model and the client model parameters uploaded by the client, and use the simulated client local model as the shadow model;
[0138] The member reasoning attack module 4 is used to construct a reasoning training data set according to the shadow model, construct a binary reasoning classifier as an attack model according to the reasoning training data set, and train the attack model using the reasoning training data set; and reason the member information of the attacked client based on the attack model.
[0139] In summary, with the help of the above technical solution of the present invention, the present invention realizes the member reasoning attack with the central server as the attacker and the local client as the attacked in the federated comparative learning scenario. Previous studies have focused on the member reasoning attack of the local client on the local client, so that the research with the central server as the attacker has not been perfected. The present invention focuses on the member reasoning attack initiated by the central server, and effectively verifies the possibility of leakage of member training information of the local client under the federated self-supervised learning framework; the present invention creatively uses the parameters uploaded by the attacked model for the last time and the central server itself to directly construct the shadow model, omitting the additional shadow model training steps; the present invention can provide a central server with a way to review whether the training data of each client is personal unauthorized privacy data, and can be used to review whether the data owner's data is illegally used, thereby protecting the data owner's data copyright.
[0140] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A membership inference attack method based on a federated self-supervised learning framework, characterized in that: The member reasoning attack method includes the following steps: S1. The central server initializes the global model and uses the global weight variable to store the weight of the global model; each client downloads the client model based on the global model from the central server and copies the global model weight to each client model; S2. The central server randomly selects several clients and downloads the corresponding local data set based on each selected client; trains the client model corresponding to each client based on the local data set, obtains the corresponding client weight, and uploads it to the central server; uses the federated learning algorithm to perform federated averaging on the client weights and updates the global model weights; S3, iterate and repeat step S2 for multiple times to obtain the convergence of the global model of the central server, simulate and build the client local model based on the convergence of the global model and the client model parameters uploaded by the client, and use the simulated client local model as the shadow model; S4. Construct an inference training data set according to the shadow model, construct a binary inference classifier as an attack model according to the inference training data set, and train the attack model using the inference training data set; and infer member information of the attacked client based on the attack model.
2. According to claim 1, a member reasoning attack method based on a federated self-supervised learning framework is characterized in that: The central server randomly selects a number of clients, and downloads a corresponding local data set based on each selected client; trains a client model corresponding to each client based on the local data set, obtains a corresponding client weight, and uploads it to the central server; Using the federated learning algorithm to federate the client weights and update the global model weights includes the following steps: S21, the central server initializes the global model parameters and randomly selects clients to participate in training; S22, the selected client obtains the client model from the central server, trains the client model using the local data set, and updates the client model parameters using the stochastic gradient descent algorithm; each client sends the updated client model parameters back to the central server; S23, the central server performs weighted average aggregation on the received client model parameters; S24. The central server sends the client model parameters after weighted average aggregation back to the selected client.
3. According to claim 2, a member reasoning attack method based on a federated self-supervised learning framework is characterized in that: The objective function formula of the federated learning algorithm is: Where M represents the number of clients participating in the training; w represents the given parameter; f(w) represents the loss function of the given parameter w; f(w * ) represents the minimum value of the loss function; E represents the mean square error function; f(w:x;x∈n) represents the local loss calculated on the nth client participating in the training; x represents the client local data.
4. According to claim 2, a member reasoning attack method based on a federated self-supervised learning framework is characterized in that: The central server performs weighted average aggregation on the received client model parameters, including the following steps: S231, selecting a client for federation averaging based on the central server; S232: Update the global model parameters according to the ratio of the number of clients to the total number of clients and in combination with the corresponding client model parameters.
5. According to claim 2, a member reasoning attack method based on a federated self-supervised learning framework is characterized in that: The expression of the weighted average aggregation is: In the formula, w t+1 represents the new global model parameters, t+1 represents the current iteration number; K represents the number of clients participating in the iteration; n k represents the number of samples of client k; N represents the total number of samples of all participating clients; represents the model parameters of client k at the tth iteration.
6. According to claim 1, a member reasoning attack method based on a federated self-supervised learning framework is characterized in that: The multiple iterations and repeated execution of step S2 to obtain the convergence of the global model of the central server, based on the convergence of the global model and using the client model parameters uploaded by the client, simulating and constructing the client local model, and using the simulated constructed client local model as the shadow model include the following steps: S31, based on step S2, the global model of the central server converges; S32, according to the convergence of the obtained global model, combining the central server's own framework and the received client model parameters, simulate and build the client local model; S33. Construct a shadow model according to the model parameters in the client local model finally uploaded by the client.
7. The member reasoning attack method based on the federated self-supervised learning framework according to claim 1 is characterized in that: The inference training data set is constructed according to the shadow model, a binary inference classifier is constructed according to the inference training data set as an attack model, and the attack model is trained using the inference training data set; Inferring the member information of the attacked client based on the attack model includes the following steps: S41, calculating the similarity score between the shadow model dataset and the client model local dataset, obtaining the member dataset feature vector and marking it; S42, based on selecting data that does not participate in the federated contrastive learning process as a set, extracting and marking feature vectors of the non-member data set; S43, constructing an inference training data set according to the feature vector of the member data set and the feature vector of the non-member data set, and training the data set to obtain an attack model; S44: Input the pre-configured image into the attack model to infer member information of the attacked client.
8. The member reasoning attack method based on the federated self-supervised learning framework according to claim 7 is characterized in that: The expression of the inference training data set is: Where E represents the inference training dataset; M(x1,h1) represents the return result of model h1 for the input xi; x1 represents the dataset member of the shadow model, x2 represents the dataset member of the attacked model; h1 represents the shadow model, and h2 represents the attacked model.
9. The member reasoning attack method based on the federated self-supervised learning framework according to claim 7 is characterized in that: The step of constructing and training a reasoning training data set according to the feature vector of the member data set and the feature vector of the non-member data set to obtain an attack model comprises the following steps: S431, discretize and count the feature vectors of the inference training data set, construct a histogram, and obtain the feature values of the inference training data set; S432, traversing the characteristic values of the inference training data set, and calculating the accuracy under each threshold based on the characteristic values, and selecting the threshold that meets the preset requirements; S433. In the inference training data set, the feature value of each test sample is compared with the corresponding threshold value, and the test samples belonging to the attacked model are screened according to the comparison result.
10. A member reasoning attack system based on a federated self-supervised learning framework, used to implement a member reasoning attack method based on a federated self-supervised learning framework as claimed in any one of claims 1 to 9, characterized in that: The member reasoning attack system includes: an initialization module, a federated learning module, a shadow model training module and a member reasoning attack module; The initialization module is used for the central server to initialize the global model and use the global weight variable to store the weight of the global model; each client downloads the client model based on the global model from the central server and copies the global model weight to each client model; The federated learning module is used for the central server to randomly select several clients, download the corresponding local data set based on each selected client, train the client model corresponding to each client based on the local data set, obtain the corresponding client weight, and upload it to the central server; use the federated learning algorithm to perform federated averaging on the client weights and update the global model weights; iterate and repeat the client training for multiple times, update the global model weights in the global model, and obtain the global model convergence of the central server; A shadow model training module is used to simulate and build a client local model based on the convergence of the global model and the client model parameters uploaded by the client, and use the simulated client local model as the shadow model; The member reasoning attack module is used to construct a reasoning training data set according to the shadow model, construct a binary reasoning classifier as an attack model according to the reasoning training data set, and train the attack model using the reasoning training data set; and reason about the member information of the attacked client based on the attack model.