Implementation method of federal learning security aggregation scheme

Abstract

The invention realizes a safe aggregation scheme of federal learning, and aims to cope with challenges caused by incapability of directly accessing private data of a client and restraining behaviors of the client in a training process. A malicious client may upload tampered model update to cause deviation and even failure of a global model, and therefore, through an improved OPTICS clustering algorithm, an aggregation server can effectively distinguish a benign client from the malicious client, and model update uploaded by the malicious client is prevented from participating in global aggregation. Meanwhile, a dynamically-adjusted client reputation scoring mechanism is designed, the participation priority of the client is dynamically adjusted according to historical behaviors of the client, it is ensured that the good client with high reputation participates in training preferentially, the training quality and safety of the model are fundamentally improved, and the efficiency and credibility of the federal learning process are further improved.

Description

Technical Field

[0001] The present invention relates to the field of federated learning training models. Background Art

[0002] Federated Learning (FL) has shown great development potential in many fields such as natural language processing, autonomous driving, financial technology, image classification, and medical imaging diagnosis. During the training process of neural networks, traditional centralized learning requires collecting a large amount of data from the client. However, since the data collector can directly access the user's sensitive information, traditional centralized learning may lead to user privacy leakage. Under the FL framework, multiple clients can collaborate to train a global model while keeping the training data locally. The client only needs to upload its model updates (such as gradients or weights) to the central server, and the original data is always stored locally and is not directly accessed by the outside world, thereby effectively protecting user privacy. Compared with distributed machine learning, federated learning has the following advantages:

[0003] (1) Participate in node collaborative training and share benefits;

[0004] (2) Data does not leave the local node, protecting data privacy and meeting data compliance;

[0005] (3) The model accuracy is equivalent to the accuracy of training after data aggregation.

[0006] The general steps of the process of a federated learning system can be summarized as follows:

[0007] (1) The aggregation server randomly selects a portion of clients;

[0008] (2) The aggregation server sends the global model to the client;

[0009] (3) The client uses local data to train the local model;

[0010] (4) The client uploads the local model to the aggregation server;

[0011] (5) The aggregation server aggregates the local models to obtain the global model;

[0012] (6) Iterate the above five steps until the model converges to the expected value.

[0013] Federated learning (FL) systems still face many security challenges. Since the central server cannot directly access the client's private data and cannot constrain the client's behavior, malicious clients can launch poisoning attacks on the global model by sending tampered harmful model updates to deceive the server. Model poisoning attacks are usually divided into untargeted attacks and targeted attacks according to the attack targets. In untargeted attacks, the damaged global model makes incorrect predictions for a large number of test inputs without distinguishing the specific targets. Fang et al. proposed an untargeted attack framework that transforms untargeted attacks into an optimization problem and maximizes the difference between the global model updates before and after the attack by designing the model updates of the malicious client. In targeted attacks, the damaged global model only makes incorrect predictions for the test inputs selected by the attacker while maintaining accuracy for other test inputs. For example, in image classification tasks, targeted attacks can induce the model to misclassify the label "apple" as "watermelon". Targeted attacks can be divided into two categories: naive methods and model substitution. Naive methods directly destroy model performance by adding mislabeled data to the training set. However, in federated learning, since the aggregation operation itself will offset the impact of malicious data on model accuracy, naive methods often require a large number of rounds of attacks to have limited effect. Model replacement is more effective by inducing global model misclassification through malicious clients uploading carefully designed model updates. This paper aims to propose a secure aggregation scheme in federated learning to prevent federated learning aggregation models from being damaged by malicious clients. Summary of the invention

[0014] The present invention proposes a secure aggregation scheme in federated learning.

[0015] The technical solution adopted by the present invention is: after the aggregation server receives the model update, it detects the model update, screens and excludes malicious model updates, and only retains benign updates to participate in the aggregation. The training process iterates T rounds in total. The training process is as follows:

[0016] 1. A method for implementing a secure aggregation scheme in federated learning, characterized by comprising the following steps:

[0017] Step 1: The aggregation server maps the client's reputation score to the probability of being selected, randomly selects a portion of clients to participate in the aggregation, and sends the global model to them;

[0018] Step 2: Each client uses its own dataset to train a local model;

[0019] Step 3: The aggregation server receives the model updates uploaded by each client;

[0020] Step 4: The aggregation server calculates the Euclidean distance between all model updates and obtains the maximum distance;

[0021] Step 5: The aggregation server inputs all model updates into the optics algorithm to obtain a list of reachable distances;

[0022] Step 6: The aggregation server observes the "benign distance difference" in the reachable distance list to determine whether there is a malicious model update in this round of model update; if not, all model updates are aggregated to obtain an aggregated model, and step 7 is skipped; if so, the aggregation server takes the average of the reachable distances in the reachable distance list and uses it as the clustering standard for clustering;

[0023] Step 7: The aggregation server obtains several clusters consisting of model updates and selects the model update of the largest cluster to participate in the aggregation;

[0024] Step 8: Test the model accuracy of the global model obtained by aggregation. If it meets the model evaluation criteria, the reputation score of the participating clients will be increased, and the reputation score of the selected but non-participating clients will be reduced. If it does not meet the model evaluation criteria, the reputation score of the participating clients will be reduced, and the model will be rolled back to the previous round model.

[0025] Then steps 1 to 8 are repeated for T rounds. After T rounds of iterations, the aggregation server obtains the global model of this round.

[0026] The present invention has the following beneficial effects: through the improved OPTICS clustering algorithm, the aggregation server can accurately distinguish between benign clients and malicious clients, effectively prevent the model updates uploaded by malicious clients from participating in global aggregation, thereby solving the problem of global model deviation or even failure caused by the malicious client uploading carefully tampered model updates. In addition, the present invention proposes a dynamically adjusted client reputation scoring mechanism, which dynamically adjusts its participation priority according to the client's historical behavior, ensures that high-reputation benign clients participate in training first, and fundamentally improves the training quality and security of the model. In order to cope with the situation where the judgment mechanism may fail in extreme cases, the present invention designs a special model update judgment standard and model rollback mechanism, so that the server can roll back to the previous model version when necessary, thereby effectively avoiding malicious updates from causing continuous damage to the global model, and further enhancing the robustness of the training process. Finally, the present invention innovatively proposes a "reachable distance difference" evaluation standard. By observing the "reachable distance difference" in the client model update, the aggregation server can accurately judge whether there is malicious behavior in the selected client in the current round. This mechanism not only reduces misjudgment, but also significantly reduces the waste of benign client resources, and greatly improves the efficiency and credibility of the federated learning process. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:Figure 1 The training process of the present invention is described. Sequence number 1 represents step 1 of the training process, that is, the aggregation server maps the reputation score of the client to the probability of being selected, randomly selects a part of the clients to participate in the aggregation, and sends the global model to them. Sequence number 2 represents step 2, that is, each client uses its own data set to train the local model. Sequence number 3 represents step 3, that is, the aggregation server receives the model update uploaded by each client. Sequence number 4 represents step 4, that is, the aggregation server calculates the Euclidean distance between all model updates and obtains the maximum distance therein. Sequence number 5 represents step 5, that is, the aggregation server inputs all model updates into the optics algorithm to obtain a reachable distance list. Sequence number 6 represents step 6, that is, the aggregation server observes the "benign distance difference" in the reachable distance list to determine whether there is a malicious model update in this round of model update; if not, all model updates participate in the aggregation to obtain the aggregated model, and step 7 is skipped; if so, the aggregation server takes the average of the reachable distances in the reachable distance list and clusters it as the clustering standard. Sequence number 7 represents step 7, that is, the aggregation server obtains a number of clusters composed of model updates, and selects the model update of the largest cluster to participate in the aggregation. Sequence number 8 represents step 8, i.e., testing the model accuracy of the global model obtained by aggregation. If it meets the model evaluation criteria, the reputation score of the participating aggregation clients will be increased, and the reputation score of the selected but non-participating clients will be reduced. If it does not meet the model evaluation criteria, the reputation score of the participating aggregation clients will be reduced, and the model will be rolled back to the previous round model.

[0028] Then steps 1 to 8 are repeated for T rounds. After T rounds of iterations, the aggregation server obtains the global model of this round. DETAILED DESCRIPTION

[0029] Assume that there are N clients {c1,c2,...,c N}, use D i To represent the client c i The data set {D1,D2,...,D N},|D i | is the number of samples. i To represent c i model, and w represents the global model.

[0030] The training process iterates for T rounds, and the training process is as follows:

[0031] Step 1: At the beginning of the algorithm, the aggregation server first sets a global variable score for each client. The value of score is used as the benign score of each client. Then the clients participating in the aggregation are selected. The probability of each client being selected is the proportion of the benign score of this client to the benign scores of all clients.

[0032]

[0033] Where P i For client c i The probability of being selected for training, score i For client c i The benignity score of N is the total number of clients. The global model is sent to the selected clients.

[0034] Step 2: Each client trains a local model using its own dataset. i The optimization is performed using mini-batch stochastic gradient descent. In the tth round, c i The t-th aggregation model of is denoted as After τ iterations of training, In the kth (k=1,2,...,τ)th iteration, client c i From its local dataset D i Extract a small batch data set of size B from Then, the client c i Update the local model using the following equation Conclusion

[0035]

[0036] in, represents the loss function, represents the updated c at the kth iteration of the tth round i Initially, is the aggregation model of the tth round, that is,

[0037] Step 3: The aggregation server receives the model updates uploaded by each client. The aggregation server needs to wait until all clients upload the model updates before starting the next step.

[0038] Step 4: The aggregation server calculates the Euclidean distance between all model updates and obtains the maximum distance. That is, the Euclidean distance between every two model updates is calculated, and then the maximum value is selected.

[0039] max_distance=max(compute_distance(modelupdate)).

[0040] Step 5: The aggregation server inputs all model updates into the optics algorithm, where the neighborhood radius is set to the maximum distance between model updates and the density threshold is set to 2 to obtain a list of reachable distances.

[0041] reachability_distance=OPTICS(allmodelupdate,max_distance,2) The aggregation server first randomly selects a model update to insert into the reachable distance list, calculates the reachable distances between other model updates and the model updates in the reachable distance list, selects the model update with the closest reachable distance and inserts it into the reachable distance list, and iterates in this cycle until all model updates are included in the reachable distance list.

[0042] Step 6: The aggregation server observes the "benign distance difference" in the reachable distance list to determine whether there is a malicious model update in this round of model update, that is, whether the difference between the maximum and minimum reachable distances in the reachable distance list is less than the "benign distance difference". If it is less than, there is no malicious model update, and all model updates participate in the aggregation to obtain the aggregated model, skipping step 7; if it is greater than, there is a malicious model update, and the aggregation server takes the average of the reachable distances in the reachable distance list and uses it as the clustering standard for clustering. For model updates in the list, those with reachable distances less than the average are grouped into the same cluster as the previous model update; otherwise, it is taken as the first model update of a new cluster.

[0043] Step 7: The aggregation server obtains several clusters consisting of model updates and selects the model update of the largest cluster to participate in the aggregation.

[0044] Step 8: Test the model accuracy of the global model obtained by aggregation. If the model accuracy is greater than 0.9 times the accuracy of the previous round of models, it is considered to meet the model evaluation criteria. Clients that do not participate in the aggregation are identified as malicious clients, and their reputation scores are deducted and updated to score = score-s*multiple r-1 , where s is the basic deduction value each time it is identified as a malicious client, multiple is the multiplication factor of the deduction when it is continuously identified as a malicious client, and r is the number of rounds in which the client is continuously identified as a malicious client. The client participating in the aggregation is identified as a benign client and its reputation score is increased, updated to score = score + s. If it does not meet the model evaluation criteria, the client participating in the aggregation is identified as a malicious client, and the reputation score of the client participating in the aggregation is reduced by score = score-t*multiple r-1 , and revert the model to the previous round model, w t =w t-1 Then steps 1 to 8 are repeated for T rounds. After T rounds of iterations, the aggregation server obtains the global model of this round.

[0045] The above is the specific implementation process of the present invention. Through this process, we have realized a secure aggregation solution for federated learning.

Claims

1. A method for implementing a secure aggregation scheme in federated learning, characterized in that: The following steps are involved: Step 1: The aggregation server maps the client's reputation score to the probability of being selected, randomly selects a portion of clients to participate in the aggregation, and sends the global model to them; Step 2: Each client uses its own dataset to train a local model; Step 3: The aggregation server receives the model updates uploaded by each client; Step 4: The aggregation server calculates the Euclidean distance between all model updates and obtains the maximum distance; Step 5: The aggregation server inputs all model updates into the optics algorithm to obtain a list of reachable distances; Step 6: The aggregation server observes the "benign distance difference" in the reachable distance list to determine whether there is a malicious model update in this round of model update; if not, all model updates are aggregated to obtain an aggregated model, and step 7 is skipped; If it exists, the aggregation server takes the average of the reachable distances in the reachable distance list and uses it as the clustering criterion for clustering; Step 7: The aggregation server obtains several clusters consisting of model updates and selects the model update of the largest cluster to participate in the aggregation; Step 8: Test the model accuracy of the global model obtained by aggregation. If it meets the model evaluation criteria, the reputation score of the participating clients will be increased, and the reputation score of the selected but non-participating clients will be reduced. If it does not meet the model evaluation criteria, the reputation score of the participating clients will be reduced, and the model will be rolled back to the previous round model. Then steps 1 to 8 are repeated for T rounds. After T rounds of iterations, the aggregation server obtains the global model of this round.

Images