Federal learning backdoor attack method for face recognition system
By using auxiliary dataset initialization and adaptive optimization triggers in federated learning, combined with data and model poisoning methods, the problem of backdoor attacks diluted in dynamic model updates and aggregation is solved, and the long-term effectiveness and concealment of backdoors in face recognition systems is achieved.
Patent Information
- Application Number
- CN202411725040.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-28
- Publication Date
- 2025-03-28
AI Technical Summary
Dynamic model updates and aggregation in federated learning lead to backdoor attack dilution problems, making it difficult to effectively implant backdoors in facial recognition systems for a long time.
By training the auxiliary face recognition model with auxiliary dataset samples, and adaptively optimize the trigger in the malicious client, combining data poisoning and model poisoning methods, ensure that the backdoor exists in the global model for a long time.
It significantly improves the persistence and concealment of backdoor attacks, so that the face recognition system can recognize face images with triggers incorrectly and can still be triggered after multiple updates.
Smart Images
Figure CN119723633A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of face recognition and relates to a federated learning backdoor attack method for a face recognition system. Background Art
[0002] The face recognition system is a biometric-based identity authentication technology that is widely used in security, payment, access control and other fields. This technology can quickly identify individual identities by capturing facial images and performing feature extraction and matching. However, since facial images are sensitive personal privacy data, directly sharing these data for model training poses serious privacy leakage and legal and regulatory issues. In order to effectively utilize these data while protecting privacy, federated learning has emerged. Federated learning uses distributed data stored on many devices to train machine learning models. It allows multiple devices to collaboratively train a global model without having to access data stored locally on the end-user device to compromise data privacy. Federated learning collects and aggregates model updates from participating clients through a coordinating server, calculates global model updates, and sends them to clients in the next round of training. Federated learning provides a feasible way to train machine learning models while protecting privacy.
[0003] However, training a machine learning model usually requires a large amount of data, and usually an organization does not have all the data required for training. Specifically, valuable data or features are held by different organizations or institutions. For example, privacy issues limit the data sharing of medical images for machine learning tasks. While solving the privacy protection problem, federated learning also introduces new security challenges. That is, due to the distributed nature of federated learning clients and the heterogeneity of data sets, it is difficult for the server to verify the integrity and credibility of local model updates, which makes the federated learning system vulnerable to backdoor attacks. Backdoor attacks aim to mislead machine learning models so that they behave as expected by attackers on samples with backdoor triggers, but behave normally on all normal samples. The application of backdoor attack methods in traditional machine learning to federated learning faces a major problem: updates uploaded by malicious clients will be diluted by updates from other benign clients, causing the backdoor effect to decrease or disappear. In existing studies, backdoor attacks in federated learning assume that the server is honest and trustworthy, and there is a certain proportion of malicious clients. Unlike backdoor attacks in traditional machine learning, attackers in federated learning can inject backdoors at different stages of the training process, and the attack is not limited to clean labels, which makes the backdoor design more flexible. Previous studies have shown that through carefully designed attack schemes, backdoors can be implanted into global models without being detected.
[0004] The aggregation server in the federated learning system cannot access the local data and training process of the participants, which makes it possible for attackers to implant backdoors into the global model by controlling the local training data set, local model parameters, learning rate and number of training rounds during the local training process. At the same time, the training data sets between different participants have non-independent and identically distributed properties, so attackers have enough space to disguise malicious updates to avoid detection. Existing work can be divided into two categories according to the attack method: data poisoning and model poisoning. In the data poisoning method, there are two main ideas to enhance the persistence and effectiveness of the federated backdoor. The first idea uses the distributed characteristics of federated learning to assign a unique sub-trigger to each malicious client. The malicious client poisons the local data set, adds trigger patterns to the image and modifies the corresponding labels, and sets the learning rate and number of training rounds specially. The second idea focuses on the trigger pattern, improves the attack effect by optimizing the trigger pattern, optimizes the trigger pattern through the corresponding trigger optimization function, generates a specific trigger pattern, and makes it imperceptible to the naked eye. Another optimization method optimizes the trigger by using the prediction results of the diluted global model and the backdoor model to enhance the persistence and effectiveness of the backdoor. In the model poisoning method, the attacker can manipulate the entire client training process. Methods to enhance the persistence of the backdoor include directly amplifying the size of malicious updates to offset the dilution effect of benign client updates, and improving the persistence of the backdoor by controlling the local model to only update some rarely updated parameters. In most cases, combining data poisoning and model poisoning can improve the effectiveness of the attack. When the malicious client uses the optimization trigger for poisoning, it freezes some unstable model parameters and only updates some stable model parameters to enhance the persistence of the backdoor.
[0005] Attack scenarios also play an important role in federated learning backdoor attacks. The timing of the attacker's submission of updates and the number of times the attacker participates in global model training have a significant impact on the effectiveness of the backdoor. Most studies have reached a consensus that attackers usually submit malicious updates within a limited number of rounds. In addition, the number of clients controlled by the attacker is also an important factor. In some methods, it is assumed that the attacker only controls one malicious client and participates in each round of training; while in other methods, the attacker controls multiple malicious clients to participate in training. These studies show that the frequency and strategy of the attacker submitting malicious updates have an important impact on the effectiveness of the attack. Summary of the invention
[0006] The purpose of the present invention is to propose a federated learning backdoor attack method for a face recognition system, which is conducive to solving the backdoor attack dilution problem caused by dynamic model updating and aggregation in federated learning, and can make the attacked face recognition system misrecognize face images with triggers, and is effective for a long time.
[0007] In order to achieve the above object, the present invention adopts the following technical scheme:
[0008] A federated learning backdoor attack method for a face recognition system includes the following steps:
[0009] Step 1. The attacker first uses the auxiliary dataset samples containing various face images to train an auxiliary face recognition model f sur , using f sur Initialize a trigger and send it to the controlled malicious client;
[0010] Step 2. When the malicious client is selected and receives the global face recognition model sent by the server to the malicious client, the trigger is adaptively optimized to enhance the persistence of the backdoor;
[0011] Step 3. After the malicious client completes the adaptive optimization of the trigger, it uses the optimized trigger to poison the local face training dataset and conduct model training. After the training is completed, it submits the update to the server;
[0012] The poisoning process includes superimposing the optimized triggers into the local face training dataset to generate poisonous data, and training the local model with the poisonous data so that it can generate backdoor behavior when the trigger exists.
[0013] The present invention has the following advantages:
[0014] As described above, the present invention relates to a federated learning backdoor attack method for a face recognition system. The method targets the backdoor attack dilution problem caused by dynamic model updates and aggregation in federated learning. First, by using auxiliary data set samples of face images in the trigger initialization phase, the auxiliary face recognition model is more likely to capture face features and more likely to establish a connection between the trigger and the target label, thereby significantly improving the attack success rate. At the same time, in the trigger adaptive optimization phase, the trigger mode is dynamically adjusted according to the changes in the global face recognition model, effectively coping with the backdoor dilution effect of the federated learning aggregation update, ensuring that the backdoor can exist in the face recognition system for a long time, and effectively improving the persistence and concealment of the backdoor. The method proposed in the present invention effectively enhances the persistence and effectiveness of backdoor attacks in a federated learning environment. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 Flow chart of a federated learning backdoor attack method for a face recognition system in an embodiment of the present invention;
[0016] Figure 2 A federated learning framework diagram of a federated learning backdoor attack method for a face recognition system in an embodiment of the present invention; DETAILED DESCRIPTION
[0017] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:
[0018] Example 1
[0019] This embodiment describes a federated learning backdoor attack method for a face recognition system. The method targets the backdoor attack dilution problem caused by dynamic model updates and aggregation in federated learning. First, an initial trigger is optimized using an auxiliary data set containing various face images. The initial trigger is then sent to a controlled malicious client, and the malicious client uses the received global face recognition model to adaptively optimize the trigger. The optimized trigger is then used to poison local face data. After the malicious client completes training the local model using the poisoned data set, the model update is submitted to the server, thereby achieving the purpose of implanting a backdoor into the global model, effectively enhancing the persistence and effectiveness of the backdoor attack.
[0020] Before introducing the method of the present invention, the face recognition federated learning system and the backdoor attack problem in the present invention are first described. Figure 2 As shown in the figure, the face recognition federated learning system includes a server Server and multiple clients C1, C2, ..., C k-1 ,C k , where it is assumed that client C2 is a malicious client controlled by the attacker.
[0021] At the beginning of each round of training, the server will send the global model W t It is sent to all clients (as shown by arrow ① in the figure), and each client uses its local data to train the model and generate a local update W t,k (As shown by arrow ④ in the figure), these updates are then uploaded back to the server for global model updating.
[0022] In a backdoor attack, the client controlled by the attacker designs a specific poisoned data generation mechanism and trigger embedding strategy (such as the "poisoned data generation" module shown in the malicious client part of the figure) to add training samples with backdoor triggers to the local data (as shown by arrow ② in the figure). t,2 In the process of embedding a backdoor into the model, the malicious client uses the poisoned data. The malicious client then uploads the model update with the backdoor information to the server (arrow ③ in the figure). If the server cannot detect the malicious update, the backdoor information will be merged into the global model, causing the global model to behave abnormally on inputs with specific triggers, that is, output the target category as the attacker intends.
[0023] like Figure 1As shown, the federated learning backdoor attack method for the face recognition system in this embodiment includes the following steps:
[0024] Step 1. Initialize the trigger. The attacker first uses the auxiliary dataset samples containing various face images to train an auxiliary face recognition model f sur , using f sur Initialize a trigger and send it to the controlled malicious client. Here, the samples collected by the auxiliary dataset are face samples outside the distribution of the local face dataset.
[0025] Since the aggregation server randomly selects a part of the clients to participate in the update in the federated learning system, the attacker cannot ensure that the malicious clients can participate in each round of training. In order to achieve better attack effects, when selecting the initial trigger, the attacker tries to use auxiliary samples outside the distribution of the data set to initialize the trigger mode, making it easier for the model to establish the connection between the trigger and the target label. In the trigger initialization stage, the malicious client cannot access the global model. Therefore, the attacker uses the auxiliary samples and the target class data to train an auxiliary model f sur Used for trigger optimization.
[0026] First, train an auxiliary face recognition model f sur , f sur The training process is as follows:
[0027] First, the target face data is combined with samples outside the dataset distribution to form an auxiliary dataset;
[0028] Next, the auxiliary model f is trained using the auxiliary dataset sur , optimize the auxiliary model by minimizing the loss function of the auxiliary dataset samples on the model, and use the gradient descent method to update the model f sur ;
[0029] Finally, we get an auxiliary model f that can accurately identify the category of face samples. sur .
[0030] Next, using the auxiliary model f sur To optimize the trigger, the initial trigger generation method is as follows:
[0031] First, use the auxiliary dataset of face images to train an auxiliary face recognition model f related to the federated learning task. sur , embed triggers into non-target class images in the auxiliary face dataset to generate toxic images;
[0032] Using poisonous image input f sur The cross entropy loss function between the prediction result and the target label optimizes the trigger mode;
[0033] Repeat the above process until the loss function converges and the trigger initialization is completed.
[0034] Specifically, this embodiment uses the auxiliary model f sur The process of initializing a trigger is as follows:
[0035] First, non-target face samples are separated from the auxiliary dataset and recorded as
[0036] Then, initialize the trigger δ and add it to On the sample;
[0037] Next, by minimizing f sur predict The loss function between the result after adding the trigger δ and the target label is used, and the trigger δ is iteratively optimized using the gradient descent method to gradually establish an association with the target label;
[0038] Finally, an initial trigger δ is obtained, which enables the model to output the target label when predicting the face sample with the added trigger.
[0039] The trigger initialization problem is described as:
[0040]
[0041] Among them, δ * represents the optimized trigger mode, δ represents the trigger mode to be optimized, δ≤∈ represents that the perturbation range of the trigger is limited to ∈, ∈ adopts L ∞ norm, limiting the trigger's change to each pixel to no more than 16 / 255 of the maximum pixel value, to ensure that the trigger evades possible manual inspection, represents the non-target class part in the auxiliary data set, (x, y) represents In the sample, x represents the sample image, y represents the true label, t represents the target class label, and f sur (x+δ) represents the auxiliary model f sur The prediction results of the face image with the added trigger, L(f sur (x+δ),t) represents the auxiliary model f sur Cross entropy loss between the prediction results and the target labels for the face images with added triggers.
[0042] Step 2. When the malicious client is selected and receives the global face recognition model sent by the server to the malicious client, the trigger is adaptively optimized to enhance the persistence of the backdoor. Persistence refers to the ability of the backdoor embedded by the attacker to remain stable and effectively trigger the target behavior for a long time during multiple rounds of aggregation and updating of the global model.
[0043] When a malicious client is selected and receives the global model, in order to enhance the persistence of the backdoor, the trigger mode needs to be dynamically optimized according to the changes in the global model. Since the aggregated updates of federated learning will dilute the backdoor, when optimizing the trigger, it is necessary to comprehensively consider the local attack success rate and the global attack success rate of the backdoor attack. When updates from different clients are aggregated, the backdoor is diluted, resulting in a decrease in the attack success rate. The malicious client needs to make corresponding adjustments to the trigger to deal with this phenomenon. Before training the local data set, the malicious client first optimizes the trigger in a targeted manner to deal with the problem of backdoor dilution.
[0044] Specifically, the malicious client minimizes the number of samples with trigger δ in the global face recognition model f g And the model after the dilution backdoor The prediction loss on , comprehensively considers the local attack success rate and the global attack success rate. In each iteration, the trigger δ is updated by the gradient descent method so that it can adapt to the changes of the global model, thereby enhancing the persistence and concealment of the backdoor attack, and finally an adaptively optimized trigger δ is obtained so that it can maintain the attack effect in subsequent training rounds.
[0045] Among them, concealment refers to the ability of the backdoor trigger to be easily identified by the human eye and anomaly detection system.
[0046] The optimization problem of adaptively optimizing triggers is described as:
[0047]
[0048] Among them, δ represents the trigger mode to be optimized, δ≤∈ means that the perturbation range of the trigger is limited to ∈, and ∈ adopts the L-∞ norm; represents non-target images, D local represents the local face training dataset, (x, y) represents the samples in the local face training dataset, Represents the global face recognition model f g The cross entropy loss between the prediction results of the face image with the added trigger and the target label, Represents the model after dilution backdoor Cross-entropy loss of the predicted results and target labels for face images with added triggers.
[0049] In the process of trigger optimization, the pixel value of the trigger is adjusted to make it more consistent with the global face recognition model f. g And the global face recognition model after the diluted backdoor The above can effectively implement backdoor attacks and ensure the persistence and concealment of the backdoor.
[0050] Since the attacker cannot access the updates of other benign clients, Machine forgetting learning technology is used to eliminate backdoors to simulate the global face recognition model after backdoor dilution.
[0051] Specifically, when a malicious client receives the global face recognition model, it first uses machine forgetting learning technology to simulate the update process of other benign clients to dilute the backdoor effect in the global face recognition model.
[0052] The malicious client minimizes the loss function between the predicted result of the input sample in the local dataset plus the trigger δ and its true label, thereby diluting or removing the backdoor information, and finally obtaining a global face recognition model with diluted backdoor
[0053] Since the attacker has all the knowledge about the trigger, The process of diluting the backdoor is expressed as the following optimization problem:
[0054]
[0055] Among them, D local is the local face training dataset of the malicious client, L(f g (x+δ), y) represents the cross entropy loss between the prediction result of the global face recognition model for the face image with the added trigger and the true label of the face image.
[0056] It should be noted that in the trigger optimization process in step 1 and step 2, the Adam optimization algorithm is used to improve the optimization efficiency, which can quickly find the optimal trigger parameters and ensure the efficiency of the backdoor attack.
[0057] Step 3. After the malicious client completes the adaptive optimization of the trigger, it uses the optimized trigger to poison the local face training dataset and conduct model training. After the training is completed, it submits the update to the server;
[0058] The poisoning process includes superimposing the optimized triggers into the local face training dataset to generate poisonous data, and training the local model with the poisonous data so that it can generate backdoor behavior when the trigger exists.
[0059] The method of poisoning the dataset is:
[0060] After the malicious client optimizes the trigger, it poisons the local client face samples according to a certain ratio. The trigger δ is added to the samples in the local dataset, and the labels of the samples are modified to the target labels to form the poisoned dataset D poison .
[0061] Specifically, the trigger δ adaptively optimized in step 2 is added one by one to the pixels of the sample image x in the local face training dataset of the malicious client to generate a poisoned image. This process ensures that the local model can produce the expected attack effect on samples with triggers, but still maintains good performance on normal samples.
[0062] At the same time, the label of the sample image is changed to the target label.
[0063] Malicious clients use poisoned dataset D poison The received global model is trained so that the model learns the association between the trigger and the target label. After the training is completed, the malicious client submits the updated model to the server.
[0064] Step 4. After the server receives updates from all clients, it aggregates all received updates to form a new global model. Through this aggregation process, the backdoor trigger of the malicious client is implanted into the global model.
[0065] When the server selects the malicious client to submit an update again, steps 2 to 3 are repeated to enhance the backdoor attack effect.
[0066] The method proposed in the present invention can effectively implant a backdoor in the global model during the federated learning process, and can also ensure that the backdoor is effective in the intelligent security system for a long time. Even after multiple updates, the specific faces with added triggers can still be misclassified, thereby significantly improving the concealment and persistence of the backdoor attack in the federated learning process.
[0067] Of course, the above description is only a preferred embodiment of the present invention, and the present invention is not limited to the above embodiments. It should be noted that all equivalent substitutions and obvious deformation forms made by any technician familiar with the field under the guidance of this specification fall within the essential scope of this specification and should be protected by the present invention.
Claims
1. A federated learning backdoor attack method for face recognition system, characterized in that: The following steps are involved: Step 1. The attacker first uses the auxiliary dataset samples containing various face images to train an auxiliary face recognition model f sur , then use f sur Initialize a trigger and send it to the controlled malicious client; Step 2. When the malicious client is selected and receives the global face recognition model sent by the server to the malicious client, the trigger is adaptively optimized to enhance the persistence of the backdoor; Step 3. After the malicious client completes the adaptive optimization of the trigger, it uses the optimized trigger to poison the local face training dataset and conduct model training. After the training is completed, it submits the update to the server; The poisoning process includes superimposing the optimized triggers into the local face training dataset to generate poisonous data, and training the local model with the poisonous data so that it can generate backdoor behavior when the trigger exists.
2. The federated learning backdoor attack method for face recognition system according to claim 1, characterized in that: In step 1, the samples collected by the auxiliary data set are face samples outside the distribution of the training data set.
3. The federated learning backdoor attack method for face recognition system according to claim 1, characterized in that: In step 1, the auxiliary face recognition model f sur The training process is as follows: First, the target face data is combined with samples outside the dataset distribution to form an auxiliary dataset; Next, the auxiliary model f is trained using the auxiliary dataset sur , optimize the auxiliary model by minimizing the loss function of the auxiliary dataset samples on the model, and use the gradient descent method to update the model f sur ; Finally, we get an auxiliary model f that can accurately identify the category of face samples. sur .
4. The method for a federated learning backdoor attack on a face recognition system according to claim 1, characterized in that: In step 1, the process of initializing the trigger is as follows: First, non-target face samples are separated from the auxiliary dataset and recorded as Then, initialize the trigger δ and add it to On the sample; Next, by minimizing f sur predict The loss function between the result after adding the trigger δ and the target label is used, and the trigger δ is iteratively optimized using the gradient descent method to gradually establish an association with the target label; Finally, an initial trigger δ is obtained, which enables the model to predict the output target label when adding a trigger to a face sample.
5. The method for a federated learning backdoor attack on a face recognition system according to claim 4, characterized in that: In step 1, the trigger initialization problem is described as: Among them, δ* represents the optimized trigger mode, δ represents the trigger mode to be optimized, δ≤∈ represents that the perturbation range of the trigger is limited to ∈, ∈ adopts the L~ norm, represents the non-target class part in the auxiliary dataset, (x, y) represents In the sample, x represents the sample image, y represents the true label, t represents the target class label, and f sur (x+δ) represents the model f sur The prediction results of the face image with the added trigger δ, L(f sur (x+δ), t) represents the model f sur Cross entropy loss between the prediction results and the target labels for the face images with added triggers.
6. The method for a federated learning backdoor attack on a face recognition system according to claim 1, characterized in that: In step 2, the malicious client minimizes the number of samples with trigger δ in the global face recognition model f g And the model after the dilution backdoor The prediction loss on is used to comprehensively consider the local attack success rate and the global attack success rate; In each iteration, the trigger δ is updated by the gradient descent method to adapt to the changes in the global model, thereby enhancing the persistence and concealment of the backdoor attack, and finally obtaining an adaptively optimized trigger δ; The optimization problem of adaptively optimizing triggers is described as: Among them, δ represents the trigger mode to be optimized, δ≤∈ means that the perturbation range of the trigger is limited to ∈, and ∈ adopts L ∞ norm; represents non-target images, D local represents the local face training dataset, (x, y) represents the samples in the local face training dataset, Represents the global face recognition model f g The cross entropy loss between the prediction results of the face image with the added trigger and the target label, Represents the model after dilution backdoor The cross entropy loss between the prediction result of the face image with the added trigger and the target label; In the process of trigger optimization, the pixel value of the trigger is adjusted to make it more consistent with the global face recognition model f. g And the model after the dilution backdoor The backdoor attack can be effectively implemented in all of the above to ensure the persistence and concealment of the backdoor.
7. The method for a federated learning backdoor attack on a face recognition system according to claim 6, characterized in that: In step 2, the trigger optimization algorithm in the malicious client The generation method is as follows: When the malicious client receives the global face recognition model, it first uses machine forgetting learning technology to simulate the update process of other benign clients to dilute the backdoor effect in the global face recognition model. The malicious client minimizes the loss function between the predicted result of the input sample in the local data set plus the trigger δ and its true label, thereby diluting or removing the backdoor information, and finally obtains a global face recognition model with diluted backdoor. It can be expressed as the following optimization problem: Among them, D local is the local face training dataset of the malicious client, L(f g (x+δ), y) represents the cross entropy loss between the prediction result of the global face recognition model for the face image with the added trigger and the true label y of the face image.
8. The method for a federated learning backdoor attack on a face recognition system according to claim 1, characterized in that: In step 3, the data set poisoning method is: The trigger δ after adaptive optimization in step 2 is added to the pixels of the sample image x in the local face training dataset of the malicious client one by one to generate a poisonous image; at the same time, the label of the sample image is modified to the target label.
9. The method for a federated learning backdoor attack on a face recognition system according to claim 1, characterized in that: During the trigger optimization process in step 1 and step 2, the Adam optimization algorithm is used.
10. The method for a federated learning backdoor attack on a face recognition system according to claim 1, characterized in that: After step 3, further comprising Step 4. After the server receives updates from all clients, it aggregates all received updates to form a new global model. Through the aggregation process, the backdoor trigger of the malicious client is implanted into the global model; When the server selects the malicious client to submit an update again, steps 2 to 3 are repeated to enhance the backdoor attack effect.