A federated learning persistence backdoor attack method based on dynamic optimization flip-flop
By dynamically optimizing triggers and noise mechanisms, the problem of trigger failure in federated learning is solved, persistent and effective backdoor attacks are achieved, and the main task accuracy of the model and the robustness of attacks are maintained.
Patent Information
- Application Number
- CN202411499604.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-25
- Publication Date
- 2025-10-24
- Estimated Expiration
- 2044-10-25
AI Technical Summary
Existing backdoor attack methods in federated learning use fixed triggers that are easily overwritten by benign models, resulting in weakened attack effectiveness, high attack costs, and high exposure risks. Existing dynamic adjustment strategies fail to effectively discuss scenarios where triggers do not participate in model training.
A dynamic optimization trigger strategy is adopted. By reading the feedback indicator set, the attack parameters are adjusted to optimize the trigger to adapt to changes in the global model. Noise is added to the fully connected layer, and redundant neurons are used as attack indicators to achieve the persistence and effectiveness of the trigger.
The persistence of triggers and the effectiveness of attacks are achieved in federated learning, which can maintain high accuracy in multiple rounds of attacks without affecting the accuracy of the main task and is robust to defense measures.
Smart Images
Figure CN119670067B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the field of artificial intelligence security, and particularly relates to a federated learning persistence backdoor attack method based on dynamic optimization trigger. BACKGROUND
[0002] Federated learning can jointly train a model without sharing data among each client, which protects the privacy of private data of each client to a certain extent. However, although the data participating in training and local model training are privately controlled by each client, the invisibility of the server side to the local training process makes it impossible to verify the authenticity of the uploaded model parameters, and a malicious user may exploit this flaw to launch an attack on the server side, especially by uploading a malicious model in the communication process to destroy or affect the accuracy of the global model. Due to the data privacy in federated learning, attackers usually launch attacks on the global model in the form of model poisoning. In particular, a backdoor attack trains a poisoned model containing a carefully designed trigger, so that the model only outputs the target label in the scenario containing the trigger, without destroying the normal classification task of the model facing other benign data. At present, common triggers include image pixels, data natural attributes, and self-added noise.
[0003] A large number of studies have demonstrated the feasibility of implanting backdoors in federated learning. However, these methods often use a unique fixed trigger throughout the attack, ignoring the dynamic update feature of federated learning. A large number of benign models are aggregated with a small number of malicious models, which may cause the characteristics of the fixed trigger to be covered by the characteristics of the benign models, eventually losing the attack ability. At the same time, after stopping the implantation of the trigger, due to the unique "catastrophic forgetting" characteristic of neural networks, the effect of the backdoor attack will quickly weaken and lose its effect. In order to maintain the high accuracy of the attack, the attack has to be continuously launched, which not only greatly increases the cost of the attack, but also increases the risk of attack exposure. Existing dynamic adjustment strategies only focus on the attack effect of the local model and the global model at the moment of the attacker, and do not really discuss the scenario in which the trigger does not participate in model training. Therefore, how to dynamically adjust the trigger is still a technical problem worth exploring and to be solved. SUMMARY
[0004] The application proposes a federated learning persistence backdoor attack method based on dynamic optimization trigger, which can maintain the accuracy of the main task of federated learning without destroying it.
[0005] Technical scheme: The federated learning persistence backdoor attack method based on dynamic optimization trigger, specifically comprises the following steps:
[0006] (1) From the second attack round, the attacker first reads the global model received in this round to obtain a feedback index set, and then adjusts the attack parameters in this round according to the feedback index set;
[0007] (2) The attacker simulates a benign global model by using a local benign data set to predict the model after the attack stops; the trigger is optimized based on the idea of minimizing the potential representation difference of the poisoned data in the current global model and the simulated benign global model; the poisoned model is obtained by training using the optimized trigger;
[0008] (3) Noise is regarded as an optimization target, noise is added to the fully connected layer of the model to avoid over-concentration of neuron updates in the fully connected layer, and a poisoned model with added noise is obtained;
[0009] (4) Redundant neurons are used as feedback indicators of whether the attack is successful, the indicator set is initialized in the first attack round, and the values of the indicator set are updated in the remaining attack rounds; after updating, the poisoned model is uploaded to the server.
[0010] Further, the step (1) comprises the following steps:
[0011] (11) Obtain the feedback index set: the attacker first receives the global model G t of this round c , the position of the indicator neuron is represented by the index set , and the parameter value of the model L c at the index I c is represented as represents the model update value of the model L c at the index I c compared with the model G t , if there is in the received global model G t , it means that the poisoning fails and is recorded as r, otherwise it is considered as effective poisoning and is recorded as a; the feedback index set array is obtained according to the above judgment standard;
[0012] (12) Adjust the attack parameters: the attack parameters that need to be adjusted include α and β, α is used to balance the proportion of the trigger effectiveness and the persistence task, if the feedback index set contains a, it means that the attack effectiveness direction meets the requirement, the optimization trigger task should focus on enhancing the persistence of the attack, and the value of α is increased by a certain increment; β is used to balance the two objectives of the noise task, to reduce the variance of the update energy of the fully connected layer and to constrain all added noise to satisfy The norm is 0; if the number of feedback indication set containing r is greater than or equal to half of the number of indication set, it indicates that the attacker fails to attack successfully, the output layer may still exist significant difference, so the noise task should focus on reducing the difference, and the value of beta is increased by a certain increment; the increment is 0.01.
[0013] Further, the resources used by the attacker in step (2) only include the global model downloaded by the server and the local data set of the poisoned client, that is, the attack occurs in a black box environment.
[0014] Further, the step (2) comprises the following steps:
[0015] (21) Training a benign global model: in each round of attack, the attacker receives the global model downloaded, and trains a benign global model using the local data set mastered by the attacker, which is used to simulate the global model after the attack stops;
[0016] (22) Optimization trigger: the attacker uses the trained benign global model and the global model received in the current round to minimize the difference between the potential representation of the implanted trigger data in the two models, and uses the following loss function:
[0017]
[0018] Wherein, represents the trigger in the current global model G t , and the attack task loss is α, which is used to balance the proportion of trigger effectiveness and persistence task, x * =x⊕ξ represents the poisoned data implanted with the trigger, ξ represents the backdoor trigger, y * represents the target poisoning label; calculated by the following formula:
[0019]
[0020] Wherein, σ(·) is the activation function of the first activation layer of the model, which is used to represent the potential representation of the data containing the trigger; represents the cross entropy loss; is the simulated global model after the attack stops;
[0021] (24) Poisoning training: using the optimized trigger to poison the data, and using the poisoned data to train the local model to obtain the poisoned model.
[0022] Further, the step (3) is realized by the following formula:
[0023]
[0024] Wherein, Loss function of the noise optimization method, represents the variance of the output layer neurons, used to reduce the dispersion degree of the output neuron update energy; the second term of the loss is used to constrain the l2 norm of all added noise sums to be 0, m represents the number of output layer neurons; and β is used to balance the two objectives of the noise task.
[0025] Further, the step (4) comprises the following steps:
[0026] (41) Finding neurons with minimum absolute gradient and curvature: using local data D train
[0027] {D benign ,D backdoor} to obtain the approximate gradient and approximate curvature;
[0028] (42) Constructing an index set: selecting neurons with minimum absolute gradient and curvature as indicator neurons and recording their index set Change the parameter value to k times as the index set, After modifying the model parameters, upload the final poisoned model to the server.
[0029] Further, the backdoor trigger ξ in step (22) is initialized as a 5x5 size pixel block with a value of 0.5; the optimization process does not change the size of the trigger, only the value of the trigger.
[0030] Further, the index set in step (42) has a collection size equal to the number of attackers, and each attacker corresponds to an index.
[0031] Advantages: Compared with the prior art, the advantages of the present application are: the present application proposes a new dynamic optimization trigger strategy, discusses the scenario where the trigger does not participate in model training, optimizes the trigger before each round of aggregation in federated learning, trains the global model to have the ability to remember the characteristics of the trigger, and prolongs the persistence of the trigger; the present application combines the indication mechanism to adaptively add noise in the fully connected layer, balances the significant differences in the output layer of the poisoned model by regarding the noise as an optimizable variable, thereby improving the effectiveness of the backdoor attack; and the present application does not destroy the accuracy of the main task of federated learning. BRIEF DESCRIPTION OF DRAWINGS
[0032] Figure 1 Flowchart of the present application;
[0033] Figure 2 Effect figure of attack effectiveness, wherein (a) is the experimental result of the MNIST data set; (b) is the experimental result of the CIFAR-100 data set;
[0034] Figure 3 Fig. 2 shows the attack persistence effect diagram; wherein (a) is the experimental result of the CIFAR-10 dataset, and (b) is the experimental result of the CIFAR-100 dataset. DETAILED DESCRIPTION
[0035] The application will be further described in detail below with reference to the accompanying drawings.
[0036] The application proposes a federated learning persistence backdoor attack method based on dynamic optimization trigger, which focuses on solving the problem that the trigger is easy to fail in the backdoor attack. Specifically, in the scene where the trigger does not participate in model training in each round of prediction of federated learning dynamic update, the backdoor trigger is synchronized and dynamically optimized, so that the trigger can adapt to the global model after the attack stops in advance. At the same time, a reasonable noise adding method is designed, and redundant neurons are fused as an attack indication mechanism to monitor the poisoning effect. Finally, based on the optimized trigger, the poisoning is launched, and the noise is relieved to highlight the features, realizing the hidden and persistent federated learning backdoor attack. As shown in Fig. 2, it specifically includes the following steps: Figure 1
[0037] Step 1: Attack strategy adjustment. Except for the first attack round, the attacker first reads the global model received in this round to obtain the feedback index set, and then adjusts the attack parameters in this round according to the feedback index set.
[0038] Obtaining the feedback index set. The attacker first receives the global model in this round. For the attacker, the index set is used to represent the position of the index neuron, and the parameter value of the index of the model is represented as, which represents the model update value of the model at the index compared with the model. If there is in the received global model, it indicates that the poisoning fails and is recorded as r, otherwise it is considered as effective poisoning and is recorded as a. According to the above judgment standard, the feedback index set array is obtained.
[0039] Adjusting the attack parameters. The attack parameters that need to be adjusted include and. Among them, is used to balance the proportion of trigger effectiveness and persistence task. If the feedback index set contains a, it indicates that the attack effectiveness direction satisfies, and the optimization trigger task should focus on enhancing the persistence of the attack, so the value increases by 0.01. is used to balance the two goals of the noise task, which is to reduce the variance of the full connection layer update energy and to constrain all added noise to satisfy the norm. If the number of r in the feedback index set is greater than or equal to half of the number of index sets, it indicates that the attacker has failed to attack successfully, and there may still be significant differences in the output layer, so the noise task should focus on reducing the difference, and the value increases by 0.01.
[0040] Step 2: The trigger is optimized and the poisoning model is trained. The attacker simulates a benign global model by using the local benign dataset, which is used to predict the model after the attack stops. The trigger is optimized based on the idea of minimizing the potential representation difference of the poisoned data in the current global model and the simulated benign global model. The poisoning model is trained using the optimized trigger.
[0041] The benign global model is trained. In each round, the attacker receives the global model issued, and trains a benign global model using the local dataset mastered by the attacker, which is used to simulate the global model after the attack stops at this time.
[0042] Optimize the trigger. The attacker uses the trained benign global model and the global model received in this round to minimize the potential representation difference of the implanted trigger data in the two models. The loss function used is:
[0043]
[0044] where, represents the attack task loss of the trigger in the current global model G t , and α is used to balance the proportion of the effectiveness of the trigger and the persistence task, x * = x⊕ξ represents the poisoned data implanted with the trigger, ξ represents the trigger, y * represents the target poisoning label. It is calculated by the following formula:
[0045]
[0046] where σ(·) is the activation function of the first activation layer of the model, which is used here to represent the latent representation of the data containing the trigger; represents the cross-entropy loss; is the simulated global model after the attack stops.
[0047] Poisoning training. Use the optimized trigger to poison the data, and use the poisoned data to train the local model to obtain the poisoning model.
[0048] Step 3: Add noise to the fully connected layer of the model, considering noise as an optimizable target, to avoid over-concentration of neurons in the fully connected layer. The model after adding noise. The following loss function is used:
[0049]
[0050] where, represents the variance of the output layer neurons, which is used to reduce the dispersion of the output neuron update energy; the second term of the loss is used to constrain the l2 norm of all added noise and to be 0, m represents the number of output layer neurons; β is an attack parameter that balances the influence of the two.
[0051] Step 4: Update the index set. Use redundant neurons as feedback indicators of whether the attack is successful. Initialize the index set in the first attack round, and update the numerical value of the index set in the remaining attack rounds. Upload the poisoned model to the server after updating.
[0052] Finding redundant neurons. Redundant neurons need to meet the condition that the gradient update is significantly small; the parameter changes slightly and does not affect the main task loss, that is, finding the neuron with the smallest absolute gradient and curvature. Since it is in a black box environment, the current global model G t Specific gradient update, so use local data D train
[0053] {D benign ,D backdoor} to obtain the approximate gradient and curvature.
[0054] Construct an index set; select the neuron with the smallest absolute gradient and curvature as the indicator neuron, and record its index set Change the parameter value here to k times as the index set, After modifying the model parameters, upload the final poisoned model to the server.
[0055] Figure 2 The attack success effect of the present application is shown. The attack success rates of the present application and three comparative methods are shown in the figure. The results are the average values of the attack success rates of the last 10 rounds of attack. In 2 data and 5 defenses, the attack is successful, Figure 2 (a) in the MNIST data set, Figure 2 (b) in the CIFAR-100 data set, all can achieve nearly 100% attack success rate.
[0056] Figure 3 The attack persistence effect of the present application is shown, Figure 3 (a) in the CIFAR-10 data set, Figure 3 (b) in the CIFAR-100 data set. The two types of icons in the present application represent: the symbol "*" represents the addition of the scaling coefficient in the present application, and the one without "*" represents the non-addition of the scaling coefficient. The scaling coefficient refers to the attack strategy of amplifying the model update parameters in DBA, which is set to 100 here. DBA points out that only one complete attack is performed, and the attacker needs to perform scaling of the malicious update to overwhelm other benign updates and ensure that the backdoor survives in the aggregation step. The results show that although the present application without scaling cannot achieve an advantage, after adding the scaling parameter, our method is significantly superior to the advanced distributed trigger in a single attack.
[0057] By comparison, the method provided by the application can initiate effective and persistent attacks in the field of common image recognition, and has excellent robustness to several popular backdoor defense means. Especially in the image multi-classification scene of the MNIST, CIFAR-10 and CIFAR-100 three data sets, the application prolongs the persistence of the attack while ensuring the effectiveness of the attack by dynamically optimizing the trigger, that is, the method proposed by the application enhances the ability of the attacker and has good attack performance.
[0058] The above only describes the preferred embodiments of the application, and it should be pointed out that those skilled in the art can make some improvements and refinements without departing from the principles of the application, and these improvements and refinements should also be considered as the protection scope of the application.
Claims
1. A method for federated learning persistence backdoor attack based on dynamic optimization flip-flop, characterized in that, The method comprises the following steps: (1) from the second attack round, the attacker first reads the global model received in the current round to obtain a feedback index set, and then adjusts the attack parameters in the current round according to the feedback index set; (2) the attacker simulates a benign global model by using a local benign data set to predict the model after the attack stops; the trigger is optimized based on the idea of minimizing the potential representation difference of the poisoned data in the current global model and the simulated benign global model; the poisoned model is obtained by training using the optimized trigger; (3) the noise is regarded as an optimizable target, and noise is added to the full connection layer of the model to avoid over-concentration of neuron updates in the full connection layer, thereby obtaining a poisoned model with added noise; (4) redundant neurons are used as feedback indicators of whether the attack is successful, the indicator set is initialized in the first attack round, and the values of the indicator set are updated in the remaining attack rounds; after updating, the poisoned model is uploaded to the server.
2. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 1, characterized in that, The step (1) comprises the following steps: (11) Obtain a set of feedback indicators: the attacker first receives the global model G t , for the attacker L c , using the indicator set to represent the position of the indicator neuron, the parameter value of the model L c at index I c is represented as , the model L c compared with the model G t , the model update value at index I c , if there is in the received global model G t , record r as poisoning failure, otherwise as poisoning effective a; obtain the feedback indicator set array according to the above judgment standard; (12) Adjusting attack parameters: the attack parameters that need to be adjusted include α and β, α is used to balance the proportion of trigger effectiveness and persistence task, if the feedback indicator set contains a, indicating that the attack effectiveness direction meets, the optimization trigger task should focus on enhancing the persistence of the attack, then the α value increases by a certain increment; β is used to balance the two goals of the noise task, reduce the variance of the full connection layer update energy and constrain all added noise and satisfy If the number of feedback indicators set contains r is greater than or equal to half of the number of indicator set, indicating that the attacker fails to attack successfully, the output layer may still have significant differences, so the noise task should focus on reducing the difference, then the β value increases by a certain increment.
3. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 1, characterized in that, The resources used by the attacker in step (2) only include the global model downloaded from the server and the local data set of the poisoned client, that is, the attack occurs in a black box environment.
4. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 1, characterized in that, The step (2) comprises the following steps: (21) training a benign global model: in each attack round, the attacker receives the global model downloaded from the server, and trains a benign global model using the local data set mastered by the attacker, which is used to simulate the global model after the attack stops; (22) optimizing the trigger: the attacker uses the trained benign global model and the global model received in the current round to minimize the potential representation difference of the implanted trigger data in the two models, and the loss function used is: where, represents the trigger in the current global model G t the attack task loss, a is used to balance the ratio of the trigger effectiveness and the persistence task, represents the poisoned data implanted with the trigger, ξ represents the backdoor trigger, y * represents the target poisoning label; is calculated by the following formula: where σ(·) is the activation function of the first activation layer of the model, used to represent the latent representation of the trigger-containing data; denotes the cross-entropy loss; is the simulated attack stop global model; (23) poisoning training: the poisoned model is obtained by training using the optimized trigger.
5. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 1, characterized in that, The step (3) is realized by the following formula: wherein, is a loss function of the noise optimization method, represents the variance of the output layer neurons, used to reduce the dispersion degree of the output neuron update energy; the second term of the loss is used to constrain the l2 norm of all added noise and to be 0, m represents the number of output layer neurons; β is used to balance the two objectives of the noise task.
6. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 1, characterized in that, The step (4) comprises the following steps: (41) Finding neurons with minimum absolute gradient and curvature: using local data D train = {D benign ,D backdoor}obtaining an approximate gradient and an approximate curvature; (42) Constructing indicator set: Select the neuron with the smallest absolute gradient and curvature as the indicator neuron, and record its index set As an indicator set, change the parameter value to k times, After modifying the model parameters, upload to the server as the final poisoning model.
7. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 4, characterized in that, In step (22), the backdoor trigger ξ is initialized to a 5x5 pixel block with a value of 0.5; the optimization process does not change the size of the trigger, only the value of the trigger.
8. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 6, characterized in that, In step (42), the size of the index set is equal to the number of attackers, and each attacker corresponds to an index.
9. The federated learning persistence backdoor attack method based on dynamic optimization trigger according to claim 2, characterized in that, The increase is 0.01.