Block chain federal learning poisoning attack defense method supporting privacy protection

Abstract

The invention discloses a blockchain federal learning poisoning attack defense method supporting privacy protection. The method relates to five links of initialization, model training and blinding, malicious detection, model aggregation and model updating. According to the method, abnormal fluctuation is accumulated in a historical model updating form in a malicious detection process to highlight malicious behavior characteristics and realize accurate identification of malicious behaviors, so that poisoning attacks are effectively defended, and the robustness of a global model is improved. In addition, the poisoning attack defense effect of the method is not affected by model update protection, malicious detection can be carried out by using original features, and data privacy of participants is prevented from being directly exposed. And the contradiction that the original features updated by the model are hidden after privacy protection is implemented and are not beneficial to accurate identification of malicious detection is relieved to a certain extent, so that the overall security of block chain federal learning is further enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain federated learning security technology, and specifically relates to a blockchain federated learning poisoning attack defense method that supports privacy protection. The method can effectively defend against poisoning attacks in the scenario of implementing privacy protection for model updates, ensure the robustness of the global model, and thus improve the overall security of the blockchain federated learning system. Background Art

[0002] Blockchain federated learning can solve the problems of untrustworthy central servers and single point failures in traditional federated learning architectures. As a decentralized distributed ledger, blockchain can provide data sharing for federated learning and realize the complete storage and distribution of key data such as model updates in federated learning. It has become the current mainstream decentralized federated learning framework. However, in the blockchain federated learning model, since blockchain nodes still cannot access or verify the original local data sets of each participant in the federated learning, they cannot affect the data quality of the participants themselves or control their behavior. Some malicious participants can still indirectly or directly destroy the global model performance by maliciously tampering with the data set or model parameters, that is, conducting poisoning attacks. Therefore, how to detect malicious participants in blockchain federated learning to defend against poisoning attacks is an important issue. In addition, the transparency of blockchain leads to a high demand for privacy protection in blockchain federated learning. However, most of the existing malicious detection methods rely on the original value of the model update, which may weaken the defense effectiveness of poisoning attacks while enhancing privacy protection, and are therefore not suitable for direct application to scenarios where model updates are protected. Specifically, common privacy protection methods such as homomorphic encryption and differential privacy encrypt or perturb model updates, which will cause the characteristics of model updates to change significantly before and after protection. This change increases the difficulty of malicious detection, causes fluctuations in detection results, and seriously affects the accuracy of detection. Therefore, how to reduce the impact on malicious detection accuracy while protecting data privacy and achieve a balance between the privacy protection level of model updates and the accuracy of malicious detection is an important issue that needs to be urgently addressed in the defense of blockchain federated learning poisoning attacks. Summary of the invention

[0003] In view of the problem that protecting model updates in the blockchain federated learning mode may affect the malicious detection effect, the present invention proposes a blockchain federated learning poisoning attack defense method that supports privacy protection. In the scenario where the model update is blinded, this method performs malicious detection based on the original value of the historical model update, aiming to improve the detection accuracy, thereby enhancing the defense capability against poisoning attacks in the privacy protection scenario and improving the robustness of the global model.

[0004] To achieve defense against poisoning attacks, this method randomly selects a part of participants to form a committee and uses them as the executors of the defense strategy. In addition, to achieve privacy protection for the participants' model updates, a trusted agency TA is introduced. Figure 1 As shown, the method for defending against poisoning attacks on blockchain federated learning that supports privacy protection proposed in the present invention mainly involves four entities: a trusted institution TA, federated learning participants, a committee, and a blockchain node. The trusted institution TA provides the mask required for blinding the model update and the decoding information required to restore the original value of the model update. The participants use private data sets to complete local training. The committee is responsible for malicious detection of model updates uploaded by participants and global aggregation after excluding malicious updates. Blockchain, as a record and storage platform for intermediate parameters of federated learning, stores the local model updates, masks and malicious detection results, and aggregation results of participants in each round of iteration on the chain. In addition, smart contracts are used to automatically complete some computing tasks. This method mainly involves five stages: initialization, model training and blinding, malicious detection, model aggregation, and model update:

[0005] (1) During the initialization phase, the trusted authority TA uses a pseudo-random number generator PRG to generate a random mask for each participant. And distribute it to the corresponding participants, where i represents the participant number, n represents the total number of participants, and t represents the current round. At the same time, the participants obtain the initial model parameters of the first round of training from the blockchain.

[0006] (2) In the model training and blinding phase, participants use private datasets to perform local model training, obtain local model updates, and append masks received from TA to their respective model updates, as shown in formula (1). In addition, participants need to record the masks used each time in the form of cumulative sums. Afterwards, each participant uploads the blinded model updates and mask sums of this round to the blockchain.

[0007]

[0008] in, represents the model update obtained by local training of the i-th participant in the t-th round, represents the random mask received by the ith participant from the TA in round t, represents the model update after blinding, and n represents the total number of participants.

[0009] (3) In the malicious detection stage, since the optimization goals of the local training process of malicious participants and normal participants are essentially different, normal participants are always committed to adjusting the model to a state that matches the distribution of the local data set to minimize the loss value, so the model updates they submit have a relatively stable direction. However, malicious participants intend to guide the training results to deviate from the global optimal direction, resulting in drastic changes in the model updates they upload. Therefore, malicious updates can be identified by analyzing the differences between the local model updates submitted by the participants in each round. In addition, in order to further improve the accuracy of malicious detection, the present invention uses multiple rounds of historical model updates in malicious detection to accumulate abnormal fluctuations, making the abnormal characteristics of the model update in the gradient space more obvious, making it easier to accurately capture malicious updates during the detection process.

[0010] The malicious detection process based on historical model update is as follows Figure 2 As shown in Figure 2, it includes four steps: calculating historical model updates, decoding, malicious identification, and voting consensus. Specifically, whenever all participants complete uploading the model updates for this round, the smart contract will be triggered to automatically calculate the latest historical model updates for each participant. Then, the committee obtains the historical model updates and corresponding mask sums of all participants in this round from the blockchain. The calculation method of the participant's latest historical model update is shown in formula (2):

[0011]

[0012] Where k represents the number of iteration rounds. represents the blind model update of participant i in round k, Represents the latest blinded historical model update of participant i.

[0013] Since the historical model updates downloaded from the blockchain are protected, in order not to affect the detection effect, the committee needs to subtract the corresponding mask and decode it. The process of decoding the historical model updates before malicious detection is as follows:

[0014]

[0015] in, represents the latest blinded historical model update of participant i, represents the mask used by participant i in round k, represents the cumulative sum of the masks used by participant i in each round of t rounds, Represents the decoded historical model update.

[0016] Next, the committee identifies malicious updates by comparing the degree of abnormality between participants' historical model updates, distinguishing malicious participants from normal participants. When all members of the committee have completed malicious detection, they use voting to reach a consensus on the detection results. If a participant is detected as malicious by more than half of the committee members in this round, it will be recognized as a malicious participant by consensus; on the contrary, if it is detected as normal by the majority of committee members, it will be recognized as a normal participant by consensus, thus determining the malicious participant set P. malicoius and the set of normal participants P normal As the final test result of this round.

[0017] Furthermore, the process of identifying malicious updates in malicious detection is specifically as follows:

[0018] like Figure 2 As shown in Figure 1, the identification of malicious updates mainly includes calculating the median of historical model updates, calculating outliers, and finding separation boundaries. First, the committee obtains the latest blinded historical model updates from the participants on the blockchain and decodes them, and then calculates the median of the original values ​​of all historical model updates in this round. Second, the committee comprehensively evaluates the outlier value α of each historical model update relative to the median from the perspectives of cosine similarity and Euclidean distance. i , as shown in formula (3). Finally, the outliers of each participant’s historical model update are sorted, and the midpoint of the two adjacent outliers with the largest interval is used as the boundary α separating malicious updates and normal updates. φ If the outlier value α i Greater than the separation boundary α φ , then the model update corresponding to this round is marked as malicious, and the corresponding participant is marked as a malicious attacker. i Less than the separation boundary α φ , the corresponding model update is marked as normal, and the corresponding participant is marked as a normal participant. At this stage, the committee can only access the sum of the participant model updates and cannot obtain the original value of a single round of model updates, so it has a certain privacy protection capability.

[0019]

[0020] Among them, S(·) represents cosine similarity, D(·) represents Euclidean distance, represents the decoded historical model update of participant i, Represents the median of the decoded historical model updates of all participants in this round.

[0021] (4) In the model aggregation phase, a member is randomly selected from the committee to serve as a leader, responsible for aggregating normal model updates that have passed detection. First, the committee leader removes the model updates that are recognized as malicious during the detection phase, and then aggregates the remaining model updates using the federated average method. Then, the aggregation results of this round and the consensus detection results are uploaded to the blockchain.

[0022] (5) In the model update phase, participants obtain the aggregated results of this round from the blockchain. Since the local model updates aggregated by the committee are protected, the aggregated results obtained will also be blinded. Therefore, decoding is required before using them to update the local model. Specifically, the average value of the masks used by all participants who have passed the test in this round is subtracted from the aggregated results obtained from the blockchain for decoding. For the purpose of privacy protection, each participant only knows his or her own mask and cannot know the mask information of other participants. Therefore, the assistance of a trusted institution TA is required for decoding. TA obtains the detection results of this round from the blockchain, calculates the average value of the masks used by the participants who have passed the test in this round based on the detection results, and sends it to each participant. After receiving it, the participant subtracts the average value of the mask from the aggregated result to obtain the decoded aggregated result, and then uses it to update the local model.

[0023] Furthermore, the decoding process of the aggregation result before the local model is updated is as follows:

[0024]

[0025] in, Represents the aggregation result of the current round t, which is updated by averaging the blind model of the participants who passed the test in this round get. Indicates the masks used by the participants who passed the test in this round The average value of P normal represents the set of normal participants that have passed the test, |P normal | represents the number of normal participants who passed the test.

[0026] After the participants complete the local model update using the decoded aggregation results, if the pre-defined number of training rounds has not been reached, they will start the next round of local training; otherwise, they will end the training and use the final global model as the result of the joint training.

[0027] Compared with the prior art, the present invention has the following advantages:

[0028] (1) Most existing malicious detection methods only use the differences between participants' single-round model updates as the standard for identifying malicious updates. However, some attackers may strategically perform well in certain rounds to evade detection, so sometimes a single round of model updates cannot fully reflect the essential characteristics of malicious behavior. To this end, the present invention proposes a malicious detection scheme based on historical model updates, which highlights the characteristics of malicious behavior by accumulating abnormal fluctuations, strengthens the attacker's confrontation goals, and ensures that even in complex attack scenarios where the attacker strategically behaves normally in some rounds, it is possible to accurately identify malicious behavior and maintain a stable defense effect, thereby improving the robustness of the global model.

[0029] (2) Existing malicious detection methods rarely support the detection of protected model updates, and the protection of model updates will affect the accuracy of malicious detection. This is mainly because common privacy protection methods such as encryption and differential privacy will cause the characteristics of model updates to change significantly before and after protection. This change in characteristics increases the difficulty of malicious detection. Since the original characteristics are lost, it will be difficult to make a correct judgment on the protected model updates, which will seriously affect the accuracy of detection. However, the present invention adds a mask to the model update to achieve privacy protection, and decodes the historical model update before performing malicious detection to restore its original characteristics. It is worth noting that the present invention uses historical model updates rather than single-round model updates in the malicious detection stage. After decoding, it is the sum of multiple rounds of model updates, and will not directly expose the gradient information of the participants. In this way, the data privacy of the participants can be protected to a certain extent, and malicious detection can be performed based on the original characteristics of the model update, effectively avoiding the problem of detection performance fluctuation caused by the protection of the model update. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 Schematic diagram of the method for defending against poisoning attacks in blockchain federated learning that supports privacy protection;

[0031] Figure 2 Schematic diagram of the malicious detection process based on historical model update. DETAILED DESCRIPTION

[0032] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0033] The specific implementation process of the blockchain federated learning poisoning attack defense method supporting privacy protection described in the present invention is as follows: Figure 1 As shown, the following steps are included:

[0034] Step 1: Initialization.

[0035] (1) The trusted institution TA uses the pseudo-random number generator PRG to generate random masks δ for n participants.i t , 1≤i≤n, where i represents the participant number, n represents the total number of participants, and t represents the current round;

[0036] (2) If it is the first round of training, participants obtain the initial global model parameters from the blockchain.

[0037] Step 2: Model training and blinding.

[0038] Participants train the model locally and calculate the model update. Then, they blind the model update with the mask attached and sum the masks used so far. Finally, they upload the blinded model update and the mask sum to the blockchain.

[0039] (1) Each participant uses the local dataset to perform local training and calculate model updates;

[0040] (2) Participants attach masks to their respective model updates and use formula (1) to calculate the blinded model update;

[0041] (3) Participant i records the mask received from TA in each round;

[0042] (4) Participant i sums up the masks used;

[0043] (5) Upload the blinded model update and the mask sum to the blockchain.

[0044] Step 3: Malicious detection.

[0045] After all participants have completed local training and uploaded the blinded model updates, the smart contract is triggered to automatically perform the calculation of the blinded historical model updates. Then, the committee obtains the latest blinded historical model updates and mask sums of all participants from the blockchain and decodes the blinded historical model updates. After that, the decoded historical model updates are maliciously identified and the consensus detection results are obtained by voting.

[0046] (1) Trigger the smart contract to automatically calculate the historical model update and use formula (2) to calculate the latest blinded historical model update for each participant;

[0047] (2) The committee obtains each participant’s latest blinded historical model update and corresponding mask sum from the blockchain;

[0048] (3) The committee decodes the historical model update and subtracts the corresponding mask sum from the blinded historical model update to obtain the decoded historical model update;

[0049] (4) The committee calculates the outliers of each participant's historical model updates, identifies malicious updates, and distinguishes malicious participants from normal participants. Each committee member will receive a copy of the detection results.

[0050] (5) A consensus is reached on the detection results by voting. If a participant is detected as malicious by more than half of the committee members in this round, it will be recognized as a malicious participant in this round and moved into the attacker set P. malicoius , otherwise move to the normal participant set P normal , thereby determining the final test results of this round.

[0051] The process of step 3-(4) identifying malicious updates is as follows: Figure 2 As shown, the following steps are included:

[0052] (1) Calculate the median of all decoded historical model updates;

[0053] (2) Calculate the cosine similarity and Euclidean distance between each participant's decoded historical model update and the median value;

[0054] (3) Calculate the abnormal value α of each participant's historical model update according to formula (3): i , i represents the participant number;

[0055] (4) Determine the separation boundary. Sort the outliers updated by the historical models of all participants by size, find the maximum interval between any two adjacent outliers, and use the midpoint of the interval as the separation boundary α φ ;

[0056] (5) Malicious identification. If α i Greater than the separation boundary α φ , then the model update corresponding to this round is marked as malicious, and the corresponding participant i is marked as a malicious attacker; if α i Less than the separation boundary α φ , then the current round of model update is considered normal, and the corresponding participant i is a normal participant;

[0057] Step 4: Model aggregation.

[0058] After completing the malicious detection, the model updates detected as malicious are removed, and the model updates that have passed the detection are aggregated using the average aggregation method. After that, the aggregation results of this round and the consensus detection results are uploaded to the blockchain.

[0059] (1) Randomly select a member from the committee to serve as the leader;

[0060] (2) The committee leader removes malicious model updates;

[0061] (3) The committee leader aggregates the remaining model updates using average aggregation to obtain the aggregation result of this round;

[0062] (4) Upload the aggregation results and detection results of this round to the blockchain.

[0063] Step 5: Model update.

[0064] In this step, participants obtain and decode the aggregation results of this round from the blockchain, and use the decoded aggregation results to update the local model in order to start the next round of training.

[0065] (1) Participants obtain the aggregation results of this round from the blockchain;

[0066] (2) TA obtains the test results of this round from the blockchain and obtains the set of normal participants who have passed the test;

[0067] (3) Based on the detection results, TA calculates the average value of the masks used by the normal participants who passed this round of detection in step 2-(2) and sends it to each participant;

[0068] (4) The participant subtracts the average value of the mask used by the normal participants from the aggregated result to obtain the decoded aggregated result;

[0069] (5) Participants update their local models based on the decoded aggregation results;

[0070] (6) If the pre-specified number of training rounds is not reached, return to step 1 and start the next round of local training; otherwise, terminate the training.

Claims

1. A blockchain federated learning poisoning attack defense method supporting privacy protection, characterized in that: The following steps are involved: Step 1: Initialization; (1) The trusted institution TA uses the pseudo-random number generator PRG to generate random masks δ for n participants. i t , 1≤i≤n, where i represents the participant number, n represents the total number of participants, and t represents the current round; (2) If it is the first round of training, participants obtain the initial global model parameters from the blockchain; Step 2: Model training and blinding; (1) Each participant uses the local dataset to perform local training and calculate model updates; (2) Participants append a mask to their model updates to obtain blinded model updates; (3) Participant i records the mask received from TA in each round; (4) Participant i sums up the masks used; (5) Upload the blinded model update and mask to the blockchain; Step 3: Malicious detection; (1) Trigger the smart contract to automatically calculate the latest blinded historical model update for each participant; (2) The committee obtains each participant’s latest blinded historical model update and corresponding mask sum from the blockchain; (3) The committee decodes the historical model update and subtracts the corresponding mask sum from the blinded historical model update to obtain the decoded historical model update; (4) The committee calculates the outliers of each participant's historical model updates, identifies malicious updates, and distinguishes malicious participants from normal participants. Each committee member will receive a copy of the detection results. (5) A consensus is reached on the detection results by voting. If a participant is detected as malicious by more than half of the committee members in this round, it will be recognized as a malicious participant in this round and moved into the attacker set P. malicoius , otherwise move to the normal participant set P normal , thereby determining the final test results of this round; Step 4: Model aggregation; (1) Randomly select a member from the committee to serve as the leader; (2) The committee leader removes the malicious model update in this round; (3) The committee leader aggregates the remaining model updates using average aggregation to obtain the aggregation result of this round; (4) Upload the aggregation results of this round and the consensus detection results to the blockchain; Step 5: Model update; (1) Participants obtain the aggregation results of this round from the blockchain; (2) TA obtains the test results of this round from the blockchain and obtains the set of normal participants who have passed the test; (3) Based on the detection results, TA calculates the average value of the masks used by the normal participants who passed this round of detection in step 2-(2) and sends it to each participant; (4) The participant subtracts the average value of the mask used by the normal participants from the aggregated result to obtain the decoded aggregated result; (5) Participants update their local models based on the decoded aggregation results; (6) If the pre-specified number of training rounds is not reached, return to step 1 and start the next round of local training; otherwise, terminate the training.

2. The method for defending against poisoning attacks in blockchain federated learning supporting privacy protection according to claim 1, characterized in that: The step 3-(4) of identifying malicious updates in malicious detection includes the following steps: (1) Calculate the median of all decoded historical model updates; (2) Calculate the cosine similarity and Euclidean distance between each participant's decoded historical model update and the median value; (3) Calculate the outlier value α of each participant’s historical model update i , i represents the participant number; (4) Determine the separation boundary: sort the outliers updated by the historical models of all participants by size, find the maximum interval between any two adjacent outliers, and use the midpoint of the interval as the separation boundary α φ ; (5) Malicious identification; if α i Greater than the separation boundary α φ , then the model update corresponding to this round is marked as malicious, and the corresponding participant i is marked as a malicious attacker; if α i Less than the separation boundary α φ , then this round of model update is considered normal. The corresponding participant i is a normal participant.

3. The method for defending against poisoning attacks in blockchain federated learning supporting privacy protection according to claim 1, characterized in that: The formula for calculating the blind model update in step 2-(2) is as follows: in, represents the model update obtained by local training of the i-th participant in the t-th round, represents the random mask received by the ith participant from the TA in round t, represents the model update after blinding, and n represents the total number of participants.

4. The method for defending against poisoning attacks in blockchain federated learning supporting privacy protection according to claim 1, characterized in that: The method of calculating the blinded historical model update in step 3-(1) is as follows: Where k represents the number of iteration rounds. represents the blind model update of participant i in round k, Represents the latest blinded historical model update of participant i.

5. The method for defending against poisoning attacks in blockchain federated learning supporting privacy protection according to claim 1, characterized in that: The process of updating the decoding of the model in step 3-(3) before malicious detection is as follows: in, represents the latest blinded historical model update of participant i, represents the mask used by participant i in round k, represents the cumulative sum of the masks used by participant i in each round of t rounds, Represents the decoded history model update.

6. The method for defending against poisoning attacks in blockchain federated learning supporting privacy protection according to claim 1, characterized in that: Step 3-(4) calculates each participant's historical model update outlier value α i The formula is as follows: in, represents the decoded historical model update of participant i, represents the median of the decoded historical model updates of all participants in this round, S(·) represents the cosine similarity, and D(·) represents the Euclidean distance.

7. The method for defending against poisoning attacks in blockchain federated learning supporting privacy protection according to claim 1, characterized in that: The process of decoding the aggregation result in step 5-(4) before updating the local model is as follows: in, Represents the aggregation result of the current round t, which is updated by averaging the blind model of the participants who passed the test in this round i∈P normal get; i∈P normal Indicates the masks used by the participants who passed the test in this round The average value of P normal represents the set of normal participants that have passed the test, |P normal | represents the number of normal participants who passed the test.

Images