Federal self-supervised learning backdoor attack method and system based on illusion positive example entanglement

Abstract

The invention discloses a federal self-supervised learning backdoor attack method and system based on illusion positive example entanglement, and the method comprises the steps: setting a target of an attacker to embed a backdoor into an image encoder during a pre-training period, and guaranteeing that a downstream classifier trained on the image encoder predicts an image with a trigger as a target class; the limited poisoning data is fully utilized, and the feature similarity of the same trigger sample is improved through the illusion enhancement module, so that the malicious client can effectively embed the backdoor into the global encoder. In the training process, a forged positive sample is generated, learning of the model in a feature space is misguided intentionally, poisoning data is utilized to the maximum extent, an entanglement loss function is designed to optimize a target, the attack efficiency is kept in the whole model aggregation process, and the attenuation risk is reduced. According to the invention, a new perspective and important challenge can be provided for the security research of the federated learning system, and the improvement and development of defense capability are promoted.

Description

Technical Field

[0001] The present invention belongs to the field of backdoor attack defense, and in particular relates to a federal self-supervised learning backdoor attack method and system based on hallucination positive example entanglement. Background Art

[0002] To mitigate the data security risks of centralized training, federated learning (FL) provides a distributed framework in which multiple clients collaborate to train a global model under the guidance of a central server while storing data locally. Therefore, integrating self-supervised learning into federated learning is a new and promising research hotspot. In addition, the rapid growth in the number of edge device applications has generated a large amount of unlabeled data, which encourages the shift from centralized self-supervised learning to federated self-supervised learning (FSSL), further revealing the potential value of decentralized unlabeled data.

[0003] However, existing research focuses on optimizing algorithm performance and expanding new application scenarios, but there is still a lack of clear understanding of the security of FSSL. In this study, we attempt to explore the potential security issues of FSSL from the perspective of backdoor attacks. Summary of the invention

[0004] Purpose of the invention: The present invention aims to effectively utilize the potential impact of poisoned data and ensure the persistence of backdoor effects during model aggregation. A federated self-supervised learning backdoor attack method (called HPE) and related evaluation and defense testing methods are proposed. The goal of HPE is to achieve effective isolation of poisoned data while maintaining the persistence of backdoor effects during the iterative process of federated learning. This provides new perspectives and important challenges for the security research of federated learning systems, and further promotes the improvement and development of defense capabilities.

[0005] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0006] A federated self-supervised learning backdoor attack method based on hallucination positive example entanglement includes the following steps:

[0007] Step 1: Set the attacker’s goal to embed the backdoor into the image encoder during pre-training, ensuring that the downstream classifier trained on the image encoder predicts images with the trigger as the target class.

[0008] Step 2: Make full use of limited poisoned data through the hallucination enhancement module to improve the feature similarity of the same trigger samples, so that the malicious client can effectively embed the backdoor into the global encoder.

[0009] Furthermore, in step 1, the backdoor injection steps are as follows:

[0010] 1) Data preprocessing: Using the MoCo framework, the input data x is first transformed through two different random enhancement sequences to generate positive samples: query x q and key x k Meanwhile, MoCo uses independent encoders: query encoder f and key encoder g to generate feature representation v q ,v k ∈R D ; R D Represents a D-dimensional real number space; MoCo also maintains a queue in The queue contains the M encoding keys from the most recent training iteration and the elements of the queue are used as negative samples during contrastive learning;

[0011] 2) Backdoor injection: local data D p Perform intervention, where p is the index of the malicious client; the attacker defines the target class y t , and embed the trigger Δ into the t The random position of the relevant sample x to generate the backdoor sample The attacker constrains the encoder E during the optimization process to generate feature vectors similar to clean samples for the backdoor samples of the target class;

[0012] To keep the attack stealthy, the malicious client needs to ensure that the feature vectors generated by the backdoor model for clean inputs are similar to those of the clean model.

[0013] Furthermore, in step 2, the steps of the illusion enhancement module are as follows:

[0014] 1) Hallucination enhancement: Introduce a new positive example v, which is defined by the following equation:

[0015]

[0016] Among them, v k is used to generate positive anchor views, and d∈R D represents the step size, the standardized step size ensures that the generated points are located on the unit hypersphere; the constraint d is aligned with the selected prototype P base , which is the direction of a set of randomly selected prototypes, the search space changes from exploring the entire v space to a subspace to define the direction along the connection v k and P base The middle point of the geodesic; the search space is expressed as follows:

[0017]

[0018] The search objective function is:

[0019]

[0020] v=v k +d(t,P base ,v k )

[0021]

[0022] Then, a new correct solution is generated as where t c It follows a uniform distribution from 0 to λt, and the fixed scalar λ is used to control the hardness of the generated positive; is the closest anchor point (v k ) prototype, prototype p = {P 1 ,…,P L} as the L cluster centroids of the data.

[0023] Using the generated points as hallucination keys within the MoCo framework, the loss function is defined as follows:

[0024]

[0025] Where T is the temperature coefficient, G sel is a positive number that satisfies the constraints.

[0026] 2) Backdoor function entanglement, introducing entanglement loss L BEF , is designed to maximize the query sample v q And the key samples in the same backdoor sample set B The similarity of features between:

[0027]

[0028] in Representation and query sample v q Feature vectors of positive samples that share the same trigger, which form positive pairs during training, and whose feature similarity is maximized to enhance the entanglement effect; In the dataset representing malicious clients, the client belongs to class y t All samples from malicious client D p The target class y t All samples with backdoor triggers in Represents the feature vector of negative samples extracted from the queue; the overall loss is as follows:

[0029] L Total =L CL +αL HE +βL BEF

[0030] Where L CLis the contrastive learning loss in the MoCo framework, and α, β are hyperparameters that balance the two loss terms.

[0031] An evaluation method for backdoor attacks in federated self-supervised learning based on hallucination positive example entanglement includes the following steps:

[0032] Design and deploy a backdoor attack experimental environment, and select representative federated learning tasks, such as image classification, speech recognition, and other application scenarios, to test the performance of the model under different data sets and attack conditions. This design ensures that the selected tasks are representative and can fully reflect the behavioral characteristics of the model in federated learning;

[0033] A backdoor attack method of federated self-supervised learning based on hallucination positive example entanglement is used to perform a backdoor attack on the target model;

[0034] Compare the performance of the global encoder before and after the attack, including model accuracy, robustness, and response under backdoor triggering conditions, and analyze its impact on the overall performance of the model. This can clearly show the potential threats and changes of backdoor attacks to the model in different scenarios;

[0035] Evaluate the accuracy of the model for normal and malicious tasks in the presence of backdoor attacks, verify the success rate of the attack and the robustness of the model, and ensure the comprehensiveness and scientificity of the evaluation. Through such dual evaluation, we can understand the characteristics of the model when it is attacked and provide data support for the design of subsequent defense mechanisms;

[0036] In addition, we can further analyze the impact of backdoor attacks on model privacy protection and evaluate the model's anti-attack capabilities under different privacy protection mechanisms to provide reference for subsequent research. This is not only about evaluating the impact of attacks on model behavior, but also about how to improve the effectiveness of data privacy protection in federated learning.

[0037] For potential application scenarios, the feasibility and scalability of the attack method in different practical applications are evaluated. For example, in smart healthcare, the backdoor security of the model is evaluated to ensure the privacy and accuracy of patient data; in autonomous driving, the reliability and security of the on-board model is ensured; and in personalized recommendation systems, the recommendation results are protected from the control of attackers. These evaluations help to demonstrate the application risks and security challenges of the method in practice.

[0038] A defense testing method for federated self-supervised learning backdoor attack based on hallucination positive example entanglement includes the following steps:

[0039] Design a test environment to simulate the performance of the target model under different attack conditions, and select representative federated learning application scenarios, such as smart healthcare and driverless cars, to fully demonstrate the potential risks and security threats of the model;

[0040] A backdoor attack method of federated self-supervised learning based on hallucination positive example entanglement is used to perform a backdoor attack on the target model;

[0041] After the attack, apply a variety of defense mechanisms to test the target model's ability to resist attacks. Specifically, techniques such as adversarial training, model repair, and gradient shielding can be used to mitigate the impact of backdoor attacks. By testing these defense mechanisms, the performance of the model under different defense strategies can be evaluated, and the most effective defense method can be determined to reduce the possibility of a successful backdoor attack on the model;

[0042] Compare the model performance before and after applying the defense mechanism, including model accuracy, robustness, and behavior under backdoor triggering conditions. This allows analysis of the positive and negative impacts of different defense strategies on model performance, and finds the optimal defense combination to achieve the goal of balancing security and model performance;

[0043] For specific practical application scenarios, evaluate the operability of defense mechanisms in different tasks and their effectiveness in actual deployment. For example, in smart healthcare, ensure that the model can still provide highly accurate and safe diagnostic recommendations after applying the defense mechanism; in autonomous driving, ensure that the vehicle control model can still drive safely after being attacked, and respond to potential malicious behaviors in a timely and effective manner;

[0044] Based on the results of defense testing, we explore how to further optimize the security and robustness of the federated self-supervised learning system. By introducing different defense levels and building a multi-defense system, we can enhance the model's immunity to complex attacks and ultimately achieve reliable application of the federated learning system in various extreme scenarios.

[0045] A federated self-supervised learning backdoor attack system based on hallucination positive example entanglement, including:

[0046] A backdoor injection module, which sets the attacker’s goal to embed a backdoor into the image encoder during pre-training, ensuring that the downstream classifier trained on the image encoder predicts images with the trigger as the target class;

[0047] The hallucination enhancement module is used to make full use of the limited poisoned data to improve the feature similarity of the same trigger samples, enabling the malicious client to effectively embed the backdoor into the global encoder.

[0048] A computer system comprises a memory, a processor and a computer program / instruction stored in the memory and executable on the processor, wherein the steps of any of the above methods are implemented when the computer program / instruction is executed by the processor.

[0049] A computer-readable storage medium stores a computer program, wherein the computer program implements the steps of any of the above methods when executed by a processor.

[0050] A computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the steps of any of the above methods when executed by a processor.

[0051] Beneficial effects: Compared with the prior art, the present invention has the following effects: The present invention proposes a new backdoor attack method for federated learning based on self-supervised learning - HPE. Effectively executing backdoor attacks in federated self-supervised learning scenarios requires overcoming two major challenges: 1) effective use of poisoned data; 2) maintaining the persistence of attack effects during model aggregation. The present invention introduces an illusion enhancement module and a feature entanglement strategy into the traditional backdoor attack framework. Specifically, the illusion enhancement module intentionally misleads the model's learning of the feature space by generating forged positive samples during the training process to maximize the utilization efficiency of poisoned data. At the same time, the designed entanglement loss function is used to optimize the attack target, ensure that the attack effect is maintained throughout the model aggregation process, and reduce the risk of attack effect attenuation.

[0052] Experimental results show that HPE not only significantly improves the success rate of backdoor attacks, but also outperforms baseline methods under different data sets and settings. More importantly, HPE still shows strong attack effectiveness when facing common defense mechanisms (such as pruning and aggregation robustness defense), with excellent concealment and robustness, proving the stability and adaptability of the method. In addition, the successful implementation of HPE has raised new challenges and reference directions for the development of effective defense mechanisms, further promoting the security research and defense capabilities of federated learning systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is an overall flow chart of an embodiment of the present invention.

[0054] Figure 2 This is a framework diagram of the backdoor attack method.

[0055] Figure 3 It is a concept map of hallucination enhancement.

[0056] Figure 4 It is a performance evaluation result diagram of the impact of encoder architecture.

[0057] Figure 5 This is the result graph of the impact of batch size.

[0058] Figure 6 This is a performance result chart under different ratios of malicious clients and toxic samples. DETAILED DESCRIPTION

[0059] The present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods. The following embodiments are used to illustrate the present invention but are not used to limit the protection scope of the present invention.

[0060] like Figure 1 As shown, the embodiment of the present invention discloses a federated self-supervised learning backdoor attack method based on hallucination positive example entanglement, including:

[0061] Step 1. Set the attacker’s goal to embed the backdoor into the image encoder during pre-training, ensuring that the downstream classifier trained on this encoder predicts images with the trigger as the target class.

[0062] Step 2: Make full use of limited poisoned data through the hallucination enhancement module to improve the feature similarity of the same trigger samples, so that the malicious client can effectively embed the backdoor into the global encoder.

[0063] The global encoder refers to a unified encoding model shared by all participating nodes after multiple rounds of communication and training in the federated self-supervised learning framework. The global encoder is used to extract features from input data and generate a universal feature representation. It is continuously updated through the federated learning mechanism to integrate the data distribution information of all nodes, so that it has generalization performance and adaptability, and can produce consistent representations on different data sets on different nodes.

[0064] In this method, the main function of the global encoder is to map data from different nodes to the same feature space, thereby achieving the goal of feature sharing and distributed training. The training of the global encoder relies on the accumulation of local model gradients of each node, and updates are achieved through algorithms such as federated averaging. During the attack process, the attacker may use the sharing characteristics of the global encoder to inject a backdoor, causing the global encoder to generate malicious feature representations for the input data under specific trigger conditions, thereby achieving an attack effect on the overall system.

[0065] Combine the following Figure 2 and Figure 3 The backdoor embedding and hallucination enhancement in the embodiments of the present invention are described in detail.

[0066] Specifically, the backdoor injection mechanism in step 1 above includes:

[0067] 1) Data Preprocessing: We consider a typical FSSL setting where K local clients collaborate to train a global SSL model. In each communication round, each client uses its unlabeled local dataset to train a local SSL model. In this case, we adopt the MoCo framework, which is an efficient contrastive learning (CL) algorithm known for its excellent representation learning ability. The key idea of ​​CL is to obtain robust feature representation in high-dimensional space by maximizing the similarity between two views of an image (positive) while keeping its distance from the features of the other image (negative). Specifically, the input data x of MoCo is first passed through two different random augmentation sequences A. q ,A k ∈A to transform, generate positive samples, query x q and key x k Here A represents a set of data augmentation operations, including random cropping, rotation, color transformation, etc., which are used to perform different degrees of random transformation on the input data to increase the generalization ability of the model. At the same time, MoCo uses independent encoders, query encoder f and key encoder g, to generate feature representation v q ,v k ∈R D Here R D Represents a D-dimensional real space, that is, the feature representation is projected into a D-dimensional vector space to describe the high-dimensional features of the data. Although f is trained using backpropagation, g is updated by the moving average of f's weights.

[0068] v q =f(x q )

[0069] v k =g(x k )

[0070] In addition to encoding positive samples, MoCo also maintains a queue in The queue contains the M encoding keys from the most recent training iteration, and the elements of the queue are used as negative samples during contrastive learning. To train the model, we use the InfoNCE objective function to update the parameters of f. The loss function used is given by:

[0071]

[0072] where v q is the feature representation of the query sample extracted by the query encoder. is the positive sample vector corresponding to the query sample, which is extracted by the key encoder and usually represents another enhanced view of the same image. Represents the feature vector of negative samples from the cohort, where i∈{1,2,…,M}, with a total of M negative samples. T is the temperature coefficient and exp() is the natural exponential function. Note that SSL can effectively obtain robust feature representations from unlabeled data by leveraging the contrastive learning mechanism.

[0073] 2) Backdoor Injection: In the context of FSSL, the goal of a malicious client is to embed a backdoor into the global model during the federated self-supervised learning process, which can be quietly activated in downstream tasks.

[0074] To achieve this, the attacker will p , where p is the index of the malicious client. Specifically, the attacker defines the target class y t , and embed the trigger Δ into the t The random position of the relevant sample x to generate the backdoor sample The attacker constrains the encoder E during the optimization process to generate similar feature vectors for backdoor samples and clean samples of the target class. This goal can be stated as follows:

[0075]

[0076] Where s() measures the similarity between two feature vectors, E is the encoder, and θ is the backdoor model parameter to be optimized. represents the backdoor target class. Note that we only maximize the feature similarity between the backdoor samples and the target class instead of directly associating the samples with specific labels since we are unaware of the downstream tasks.

[0077] Furthermore, to keep the attack stealthy, malicious clients should not degrade the performance of the primary task. Therefore, they need to ensure that the feature vectors generated by the backdoor model for clean inputs are similar to those of the clean model. We can formulate this goal as follows:

[0078]

[0079] Where D c represents a dataset of clean input samples, E b is the backdoor encoder, E c is the encoder of the clean model.

[0080] The steps of the illusion enhancement module described in step 2 above are as follows:

[0081] 1) Enhanced hallucinations

[0082] In order to make full use of the poisoned data samples and further achieve a stable poisoning effect during the attack, we introduce a hallucination enhancement module. Our core idea is to generate additional synthetic positive samples during the encoder optimization process. These samples keep a certain distance from the positive anchors in the latent space while still maintaining semantic similarity. The synthetic positive samples further expand the coverage of the poisoned positive samples in the feature space, thereby promoting the trigger image to be close to the poisoned class y. t Clean image of A more stable correlation pattern between them.

[0083] The specific method is, given the current encoded (anchor) key v k , we can explore the high-dimensional space around it to find locations that the encoder can scalably reach with closely related real data. We define the prototype p = {P 1 ,…,P L} as the L cluster centroids of the data. Intuitively, the prototypes p can represent various data classes. To obtain these prototypes, we encode the input data into a high-dimensional feature space and apply k-means clustering to the data points lying on the unit hypersphere using the relevant Riemannian metric. This approach effectively captures the similarities and differences between high-dimensional features, so that the data class structure can be accurately described. According to our requirements, we can formulate the following objective to find hard positives:

[0084]

[0085] in, is the closest anchor point (v k ), and sim() represents the cosine similarity between two samples in the latent space. Through this optimization process, our goal is to generate the closest prototype that is far away from the anchor but still shares the same. We call this constraint our hierarchy. However, the complexity of the original objective makes direct optimization computationally intensive and impractical for each individual sample. Therefore, we propose a series of simplifications of the above objectives.

[0086] First, we introduce a new positive example v, which is defined by the following equation:

[0087]

[0088] Among them, v k is used to generate positive anchor views, and d∈R D Represents the step size, and the standardized step size ensures that the generated points are located on the unit hypersphere, similar to v k and v q .

[0089] To constrain the search space to be positively hallucinated, we propose to restrict d to align the selected prototypes P base , which is the direction of a set of randomly selected prototypes. This approach effectively restricts the search space to the region where the data instances are located, thus promoting the generation of hard positives. As a result, the search space changes from exploring the entire v space to a specific subspace to define the direction along the connection v k and P base Since these points are located on the hypersphere, the corresponding search space can be expressed as follows:

[0090]

[0091] We now use the equation v = v k +d(t,P base ,v k ) is verified. The optimal value of t is determined in the restricted search space by the following modified objective function.

[0092]

[0093] v=v k +d(t,P base ,v k )

[0094]

[0095] Intuitively, t constrains v k and P base The geodesic between corresponds to a well-formed positive line segment. Then, we generate a new positive solution as where t c It follows a uniform distribution from 0 to λt, and a fixed scalar λ is used to control the hardness of the generated positivity.

[0096] The last step of the proposed method involves using these generated points to train the model. It is important to note that these generated points do not have any gradients. Therefore, we utilize the generated points as hallucination keys within the MoCo framework, and the loss function is defined as follows:

[0097]

[0098] Where T is the temperature coefficient, G sel is a positive number that satisfies the constraints.

[0099] 2) Backdoor Function Entanglement

[0100] In the federated learning scenario, model aggregation constrains different clients to move towards a common optimization goal; however, this process also reduces the effectiveness of the poisoned model to some extent. In addition, the randomness inherent in data augmentation (such as random cropping) may interfere with the triggering function, resulting in reduced effectiveness of the attack. To address these challenges, we introduce an innovative backdoor feature entanglement mechanism. The main goal of feature entanglement is to maximize the similarity between samples sharing the same trigger in the feature space, thereby promoting the entanglement of latent features. Through the optimization contrastive learning framework, the backdoor feature entanglement (BFE) method conceptualizes other samples sharing the same trigger as "extended positive pairs", thereby gradually enhancing their feature similarity during training. We enforce the backdoor samples to maintain consistent feature representation throughout the global model aggregation process, effectively enhancing the concealment and persistence of the backdoor features.

[0101] Specifically, for a given query sample v q , our goal is to entangle v q To establish strong feature correlations in the feature space with other samples with the same trigger. To achieve this, we introduce the entanglement loss L BEF , is designed to maximize the query sample v q And the key samples in the same backdoor sample set B The similarity of features between them.

[0102]

[0103] in Representation and query sample v q The feature vectors of positive samples that share the same trigger. These samples form positive pairs during training, and their feature similarity is maximized to enhance the entanglement effect. Set B contains samples from malicious client D p The target class y t All samples with backdoor triggers in are formally expressed as in addition, Represents the feature vector of negative samples extracted from the queue. The overall loss of HPE is as follows:

[0104] L Total =L CL +αL HE +βL BEF

[0105] Among them, α and β are hyperparameters that balance the two loss terms.

[0106] In an evaluation method for a backdoor attack on federated self-supervised learning based on hallucination positive example entanglement disclosed in an embodiment of the present invention, first, an experimental environment for backdoor attack is designed and deployed, and representative federated learning tasks, such as image classification and speech recognition, are selected to test the performance of the target model under different data sets and attack conditions. Through this experimental design, it can be ensured that the selected tasks fully reflect the behavioral characteristics of the model in federated learning. Then, the backdoor attack method of the aforementioned embodiment is used to perform a backdoor attack on the target model. Next, a global encoder performance comparison is performed before and after the attack, including model accuracy, robustness, and response under backdoor triggering conditions, so as to analyze the impact of the attack on the overall performance of the model. At the same time, the accuracy of the model for normal tasks and malicious tasks when it is attacked by the backdoor is evaluated to verify the success rate of the attack and the robustness of the model, and to ensure the scientificity and comprehensiveness of the evaluation. In addition, the impact of the backdoor attack on the privacy protection of the model can be further analyzed, especially the evaluation of the anti-attack capability under different privacy protection mechanisms, so as to provide reference for subsequent research and the design of defense mechanisms. Evaluating the feasibility and scalability of this attack method for potential application scenarios, such as smart healthcare, driverless cars, and personalized recommendation systems, will help demonstrate the security risks and challenges in practical applications.

[0107] In a defense test method for a backdoor attack based on federated self-supervised learning with hallucination positive example entanglement disclosed in an embodiment of the present invention, a test environment is first designed to simulate the performance of the target model under different attack conditions, and representative federated learning application scenarios such as smart medical care and unmanned driving are selected to fully demonstrate the risks and security threats that the model may face. Then, the backdoor attack method of the aforementioned embodiment is used to backdoor attack the target model. Next, a variety of defense mechanisms, such as adversarial training, model repair, and gradient shielding, are applied to test the anti-attack ability of the target model and evaluate the effectiveness of these defense strategies. Next, by comparing the model performance before and after the application of the defense mechanism, including accuracy, robustness, and behavioral performance under backdoor triggering conditions, the positive and negative effects of different defense strategies are analyzed, and the optimal defense combination is determined to achieve a balance between security and performance. In addition, for different actual application scenarios, such as diagnostic suggestions in smart medical care and vehicle control in unmanned driving, the effectiveness and operability of the defense mechanism in real deployment are evaluated to ensure that the model is still safe and reliable after the defense measures are applied. Finally, based on the defense test results, we explored ways to optimize the security and robustness of the federated self-supervised learning system, enhanced the model's ability to resist complex attacks through a multi-level defense system, and ensured the reliable application of the federated learning system in extreme scenarios.

[0108] The implementation effect of the present invention is verified below with reference to specific experimental examples.

[0109] Experimental Example 1: We conduct experiments on four standard image datasets, namely CIFAR-10, STL10, CIFAR-100, and ImageNet-100. In addition, in order to evaluate the backdoor attack when the pre-training and downstream datasets are different, we also include GTSRB as an additional dataset. Both CIFAR-10 and CIFAR-100 contain 50,000 training images and 10,000 test images, the former contains 10 classes and the latter contains 100 classes, with an equal number of images for each class. GTSRB contains 51,800 traffic sign images of 43 categories, divided into 39,200 training images and 12,600 test images. STL-10 contains 10 classes, each class contains 500 labeled training images and 800 labeled test images. ImageNet-100 contains 100 categories, with 100,000 training images and 10,000 test images. To simulate a federated setting, we divide a dataset equally into K clients. For the IID simulation, each client contains the same number of images of all classes. For the Non-IID simulation, we randomly assign data categories to each client.

[0110] As shown in Table 1, the specific implementation steps are as follows:

[0111] We use MoCo-v2 as the default value and adopt ResNet-18 as the default architecture network for the encoder. In addition, we use a two-layer multilayer perceptron (MLP) as the predictor, use a decay rate m = 0.99, a batch size B = 128, SGD as the optimizer with a learning rate η = 0.032, and run the experiment for R = 100 training rounds with K = 5 clients (one malicious, with a poisoning rate of 1%), where each client performs E = 3 local epochs in each round. Data augmentation for contrastive learning includes random cropping and resizing, random color distortion, random flipping, and Gaussian blur.

[0112] We evaluate our HPE using model accuracy (ACC) and attack success rate (ASR). ACC represents the classification accuracy of the global SSL model for clean images, and ASR represents the proportion of samples with embedded triggers that are misclassified as the labels specified by the attacker. A well-executed backdoor attack should significantly maximize the ASR while maintaining a high ACC.

[0113] Table 1 shows the performance comparison results of HPE and four baseline backdoor methods.

[0114] Table 1

[0115]

[0116] From the experimental results, the HPE algorithm can achieve an automatic recognition rate of more than 87% on 4 benchmark datasets, which is better than the other 3 methods. Specifically, HPE achieves the best performance when using the CIFAR-10 dataset for pre-training and the STL-10 dataset for downstream tasks, with an ASR of 98.61. Compared with the worst-performing CorruptEncoder (ASR of 55.52), HPE's attack performance is improved by 43.09%. In addition, as the dataset size increases, HPE maintains a high and stable ASR, showing stronger and superior performance in different pre-training and downstream dataset combinations compared to other backdoor methods.

[0117] Experimental Example 2: Performance evaluation of HPE using different encoder architectures and batch sizes.

[0118] Steps: Evaluate the performance of HPE using different encoder architectures and batch sizes.

[0119] Figure 4 The results are the impact of the encoder architecture.

[0120] From the experimental results, different encoder architectures have little effect on HPE. Although the ACC of HPE varies among ResNet-18, ResNet-50, and ViT] architectures, the ASR is always over 96%. This result shows that HPE exhibits strong robustness to the encoder architecture and is able to maintain stable attack performance across different models.

[0121] Figure 5 The results show the impact of batch size.

[0122] From the experimental results, when the batch size reaches 128 or more, the ACC and ASR of HPE tend to be stable, and the ASR remains at a high level. This shows that stable and effective attack performance can be achieved without a large batch size.

[0123] Example 3: In FL scenarios, different data distribution is an important and practical consideration. Table 2 shows the HPE results under different data distribution conditions.

[0124] Table 2 shows the performance results of HPE under different data distribution settings.

[0125] Table 2

[0126]

[0127] From the experimental results, the ACC is always higher in the IID setting than in the non-IID setting. This difference is inevitable, but the FSSL framework mitigates the impact of this problem to a large extent. In addition, regardless of the data distribution, the ASR is always maintained at a satisfactory level. This shows that HPE is able to effectively embed backdoors and maintain high ASR in different data distribution scenarios.

[0128] Experimental Example 4: We further analyze the impact of the ratio of virus samples and malicious clients on HPE. In our FL setting, we have five clients, each with the same number of samples. The malicious client selects a class as the target class, so the maximum ratio of the dataset that can be poisoned is 2%.

[0129] Figure 6 The performance of HPE under different ratios of malicious clients and poisonous samples.

[0130] From the experimental results, HPE performs better when dealing with higher virus samples and malicious clients. In addition, even if only 0.4% of the data is poisoned, HPE can still achieve significant attack effects.

[0131] Experimental Example 5: The performance of our HPE against five existing defense methods in the non-IID setting.

[0132] Table 3 shows the performance of HPE under different defense methods

[0133] Table 3

[0134]

[0135] The experimental results clearly show that despite the deployment of existing defenses, malicious clients can still infiltrate the global model to a certain extent and exhibit backdoor behaviors. Specifically, on the CIFAR-10 dataset, the ASRs under the Krum and FLTrust defenses are 95.67 and 94.45, respectively. On the STL-10 and CIFAR100 datasets, the ASRs of Foolsgold and FLAME reach 92.71 and 94.13, respectively. Even on the most complex Imagenet-100 dataset, the ASRs of all defense methods remain above 83. This shows that HPE has strong robustness and effectiveness under different defenses. At the same time, the introduction of defense measures does lead to a decrease in model accuracy (ACC), but HPE's ASR is still high, thanks to the effective role of hallucination enhancement and feature entanglement modules, which allow backdoor features to be quietly embedded in the model. Overall, the existing defense strategies need to be further optimized in the face of this type of backdoor attacks. In particular, defense measures can be taken from the aspects of enhancing the detection capability of backdoor features, strengthening the robustness of the global model, and improving the defense confrontation, designing a more effective defense mechanism against such attacks, thereby further improving the security of the federated learning system. Finally, based on the defense test results, we will explore ways to optimize the security and robustness of the federated self-supervised learning system, enhance the model's ability to resist complex attacks through a multi-level defense system, and ensure the reliable application of the federated learning system in extreme scenarios.

[0136] Based on the same inventive concept, an embodiment of the present invention also discloses a federated self-supervised learning backdoor attack system based on hallucination positive example entanglement, including: a backdoor injection module, used to set the attacker's goal to embed the backdoor into the image encoder during pre-training, ensuring that the downstream classifier trained on the image encoder predicts the image with the trigger as the target class; and, a hallucination enhancement module, used to make full use of limited poisoned data to improve the feature similarity of the same trigger samples, so that the malicious client can effectively embed the backdoor into the global encoder.

[0137] An embodiment of the present invention further discloses a computer system, including a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, wherein the computer program / instruction implements the steps in the aforementioned method embodiments when executed by the processor.

[0138] The embodiment of the present invention further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program / instructions are executed by a processor, the steps in the aforementioned method embodiments are implemented.

[0139] The embodiment of the present invention further discloses a computer program product, including a computer program / instruction, which implements the steps in the aforementioned method embodiments when the computer program / instruction is executed by a processor.

Claims

1. A federated self-supervised learning backdoor attack method based on hallucination positive example entanglement, characterized by: The following steps are involved: Step 1: Set the attacker’s goal to embed the backdoor into the image encoder during pre-training, ensuring that the downstream classifier trained on the image encoder predicts images with the trigger as the target class. Step 2: Make full use of limited poisoned data through the hallucination enhancement module to improve the feature similarity of the same trigger samples, so that the malicious client can effectively embed the backdoor into the global encoder.

2. According to claim 1, a federated self-supervised learning backdoor attack method based on hallucination positive example entanglement is characterized by: In step 1, the backdoor injection steps are as follows: 1) Data preprocessing: Using the MoCo framework, the input data x is first transformed through two different random enhancement sequences to generate positive samples: query x q and key x k Meanwhile, MoCo uses independent encoders: query encoder f and key encoder g to generate feature representation v q ,v k ∈R D ; R D Represents a D-dimensional real number space; MoCo also maintains a queue in The queue contains the M encoding keys from the most recent training iteration and the elements of the queue are used as negative samples during contrastive learning; 2) Backdoor injection: local data D p Perform intervention, where p is the index of the malicious client; the attacker defines the target class y t , and embed the trigger Δ into the t The random position of the relevant sample x to generate the backdoor sample The attacker constrains the encoder E during the optimization process to generate feature vectors similar to clean samples for the backdoor samples of the target class; To keep the attack stealthy, the malicious client needs to ensure that the feature vectors generated by the backdoor model for clean inputs are similar to those of the clean model.

3. According to claim 1, a federated self-supervised learning backdoor attack method based on hallucination positive example entanglement is characterized by: In step 2, the steps of the illusion enhancement module are as follows: 1) Hallucination enhancement: Introduce a new positive example v, which is defined by the following equation: Among them, v k is used to generate positive anchor views, and d∈R D represents the step size, the standardized step size ensures that the generated points are located on the unit hypersphere; the constraint d is aligned with the selected prototype P base , which is the direction of a set of randomly selected prototypes, the search space changes from exploring the entire v space to a subspace to define the direction along the connection v k and P base The middle point of the geodesic; the search space is expressed as follows: Where t∈[0,1], andφ∈[0,π] The search objective function is: Where v=v k +d(t,P base ,v k ) Then, a new correct solution is generated as where t c It follows a uniform distribution from 0 to λt, and the fixed scalar λ is used to control the hardness of the generated positive; is the closest anchor point (v k ) prototype, prototype p = {P1,…,P L } as the L cluster centroids of the data. Using the generated points as hallucination keys within the MoCo framework, the loss function is defined as follows: Where T is the temperature coefficient, G sel is a positive number that satisfies the constraints. 2) Backdoor function entanglement, introducing entanglement loss L BEF , is designed to maximize the query sample v q And the key samples in the same backdoor sample set B The similarity of features between: in Representation and query sample v q Feature vectors of positive samples that share the same trigger, which form positive pairs during training, and whose feature similarity is maximized to enhance the entanglement effect; In the dataset representing malicious clients, the client belongs to class y t All samples from malicious client D p The target class y t All samples with backdoor triggers in Represents the feature vector of negative samples extracted from the queue; the overall loss is as follows: L Total =L CL +αL HE +βL BEF Where L CL is the contrastive learning loss in the MoCo framework, and α, β are hyperparameters that balance the two loss terms.

4. The federated self-supervised learning backdoor attack scheme of hallucination positive example entanglement according to claim 1 is characterized by: The global encoder refers to a unified encoding model shared by all participating nodes after multiple rounds of communication and training in a federated self-supervised learning framework.

5. A method for evaluating backdoor attacks in federated self-supervised learning based on hallucination positive example entanglement, characterized by: The following steps are involved: Design and deploy a backdoor attack experimental environment and select representative federated learning tasks to test the performance of the model under different data sets and attack conditions; Perform a backdoor attack on the target model using a federated self-supervised learning backdoor attack method based on hallucination positive example entanglement according to any one of claims 1 to 4; Compare the performance of the global encoder before and after the attack, including model accuracy, robustness, and response under backdoor triggering conditions, and analyze their impact on the overall performance of the model; Evaluate the accuracy of the model for normal and malicious tasks in the presence of backdoor attacks, and verify the success rate of the attack and the robustness of the model.

6. A defense test method for federated self-supervised learning backdoor attacks based on hallucination positive example entanglement, characterized by: The following steps are involved: Design a test environment to simulate the performance of the target model under different attack conditions and select representative federated learning application scenarios; Perform a backdoor attack on the target model using a federated self-supervised learning backdoor attack method based on hallucination positive example entanglement according to any one of claims 1 to 4; After the attack, multiple defense mechanisms are applied to test the anti-attack capabilities of the target model, including adversarial training, model repair, and gradient shielding techniques to mitigate the impact of backdoor attacks; Compare the model performance before and after applying the defense mechanism, including model accuracy, robustness, and behavior under backdoor triggering conditions; Aiming at actual application scenarios, the operability of the defense mechanism in different tasks and the effectiveness in actual deployment are evaluated.

7. A federated self-supervised learning backdoor attack based on hallucination positive example entanglement, characterized by: include: A backdoor injection module, which sets the attacker’s goal to embed a backdoor into the image encoder during pre-training, ensuring that the downstream classifier trained on the image encoder predicts images with the trigger as the target class; The hallucination enhancement module is used to make full use of the limited poisoned data to improve the feature similarity of the same trigger samples, enabling the malicious client to effectively embed the backdoor into the global encoder.

8. A computer system comprising a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images