Poisoning attack defense method in privacy-protected blockchain federated learning

Abstract

The application discloses a method for defending against poisoning attacks in blockchain federated learning supporting privacy protection, and relates to five links of initialization, model training and blinding, malicious detection, model aggregation and model updating. In the process of malicious detection, the method accumulates abnormal fluctuations in the form of historical model updates to highlight the characteristics of malicious behavior and realize accurate identification of malicious behavior, thereby effectively defending against poisoning attacks and improving the robustness of the global model. In addition, the poisoning attack defense effect of the method will not be affected by the protection of model updates, which can realize malicious detection using original features and avoid direct exposure of participant data privacy, to a certain extent, alleviate the contradiction that the original features of model updates are hidden after the implementation of privacy protection, which is not conducive to the accurate identification of malicious detection, thereby further enhancing the overall security of blockchain federated learning.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of blockchain federated learning security, and particularly relates to a method for defending against poisoning attacks in a privacy-protected blockchain federated learning. BACKGROUND

[0002] Blockchain federated learning can solve the problems of untrusted central server and single point of failure in traditional federated learning architecture. As a decentralized distributed ledger, blockchain can provide data sharing for federated learning and realize complete storage and distribution of key data such as model updates in federated learning, and has become the current mainstream decentralized federated learning framework. However, in the blockchain federated learning mode, the blockchain nodes still cannot access or verify the original local data sets of each participant in federated learning, so they cannot affect the data quality of the participants themselves and control their behavior. Some malicious participants can still indirectly or directly damage the performance of the global model by maliciously tampering with the data set or model parameters, i.e., conducting a poisoning attack. Therefore, how to detect malicious participants in blockchain federated learning to defend against poisoning attacks is an important problem. In addition, the transparency of blockchain leads to a high demand for privacy protection in blockchain federated learning. However, most existing malicious detection methods rely on the original values of model updates, and enhancing privacy protection may weaken the effectiveness of poisoning attack defense, so they are not suitable for direct application to scenarios where model updates are protected. Specifically, common privacy protection methods such as homomorphic encryption and differential privacy encrypt or perturb the model updates, which will cause significant changes in the features of the model updates before and after protection. This change increases the difficulty of malicious detection and makes the detection effect fluctuate, seriously affecting the accuracy of detection. Therefore, how to balance the model update privacy protection level and the accuracy of malicious detection while ensuring data privacy and reducing the impact on the accuracy of malicious detection is an important problem that needs to be solved in the defense against poisoning attacks in blockchain federated learning. SUMMARY

[0003] To solve the problem that protecting model updates in the blockchain federated learning mode may affect the malicious detection effect, the application provides a method for defending against poisoning attacks in a privacy-protected blockchain federated learning. This method performs malicious detection based on the original values of historical model updates in the scenario where the model updates are blinded, aiming to improve the detection accuracy and thus enhance the defense capability against poisoning attacks in the privacy protection scenario and improve the robustness of the global model.

[0004] To achieve the defense of poisoning attack, the method randomly selects a part of participants to form a committee and takes them as the executors of the defense strategy. In addition, to achieve privacy protection of participant model updates, a trusted authority TA is introduced. As shown in Figure 1 The poisoning attack defense method for privacy protection blockchain federated learning proposed by the present application mainly involves four types of entities: trusted authority TA, federated learning participant, committee, and blockchain node. The trusted authority TA provides the mask needed for the blinding processing of the model update and the decoding information needed to restore the original value of the model update. The participant completes local training using a private data set. The committee is responsible for malicious detection of the model updates uploaded by the participants and global aggregation after excluding malicious updates. The blockchain, as a record storage platform for intermediate parameters in federated learning, stores the local model updates of the participants, the mask sum, the malicious detection results, and the aggregation results in each iteration on the chain. In addition, some computing tasks are automatically completed by using a smart contract. The method mainly involves five stages: initialization, model training and blinding, malicious detection, model aggregation, and model update.

[0005] (1) In the initialization stage, the trusted authority TA uses a pseudo-random number generator PRG to generate a random mask for each participant and distributes it to the corresponding participant, where i represents the participant number, n represents the total number of participants, and t represents the current round. At the same time, the participant obtains the initial model parameters for the first round of training from the blockchain.

[0006] (2) In the model training and blinding stage, the participant performs local model training using a private data set to obtain a local model update, and appends the mask received from the TA to the respective model update, as shown in equation (1). In addition, the participant needs to record the mask used each time in the form of a cumulative sum. Then, each participant uploads the blinding model update and the mask sum of this round to the blockchain.

[0007]

[0008] where, represents the model update obtained by the i-th participant in the t-th round through local training, represents the random mask received by the i-th participant from the TA in the t-th round, represents the model update after blinding processing, and n represents the total number of participants.

[0009] (3) In the malicious detection phase, since the malicious participants are essentially different from the normal participants in the optimization objective of the local training process, the normal participants are always committed to adjusting the model to match the distribution of the local data set, so as to minimize the loss value, and therefore the model updates submitted by the normal participants have relatively stable directionality. However, the malicious participants intend to lead the training results to deviate from the global optimal direction, resulting in the model updates uploaded by the malicious participants changing dramatically. Therefore, the malicious updates can be identified by analyzing the differences between the local model updates submitted by the participants in each round. In addition, in order to further improve the accuracy of malicious detection, the application utilizes the historical model updates of multiple rounds in the malicious detection to accumulate abnormal fluctuations, so that the abnormal characteristics of the model updates in the gradient space are more obvious, and the malicious updates are more easily captured in the detection process.

[0010] The malicious detection process based on the historical model updates is as shown in Figure 2 , which includes four links of calculating the historical model updates, decoding, malicious identification and voting consensus. Specifically, whenever all the participants complete the uploading of the model updates of the current round, the smart contract will automatically calculate the latest historical model updates of each participant. Then, the committee obtains the historical model updates of all participants in the current round and the corresponding mask sum from the blockchain. The calculation method of the latest historical model updates of the participant is as shown in formula (2):

[0011]

[0012] wherein k represents the serial number of the iteration round, represents the blinded model update of the participant i in the kth round, represents the latest blinded historical model update of the participant i.

[0013] Since the historical model updates downloaded from the blockchain are protected, in order not to affect the detection effect, the committee needs to subtract the corresponding mask sum for decoding. The decoding process of the historical model updates before malicious detection is as follows:

[0014]

[0015] wherein, represents the latest blinded historical model update of the participant i, represents the mask used by the participant i in the kth round, represents the cumulative sum of the masks used by the participant i in the t rounds, represents the decoded historical model update.

[0016] Next, the committee identifies malicious updates by comparing the degree of anomalies among the participants' historical model updates, thus distinguishing malicious participants from normal participants. After all committee members have completed the malicious detection, a vote is used to reach a consensus on the detection results. If a participant is detected as malicious by more than half of the committee members in this round, it will be consensused as a malicious participant; conversely, if it is detected as normal by the majority of committee members, it will be consensused as a normal participant, thereby determining the set P of malicious participants. malicoius and the set of normal participants P normal This serves as the final test result for this round.

[0017] Furthermore, the process of identifying malicious updates in malicious detection is as follows:

[0018] like Figure 2 As shown, the identification of malicious updates mainly includes three parts: calculating the median of historical model updates, calculating outliers, and finding the separating boundary. First, after obtaining and decoding the latest blinded historical model updates from the participants on the blockchain, the committee calculates the median of the original values ​​of all historical model updates in this round. Second, the committee comprehensively evaluates the outlier α of each historical model update relative to the median from two perspectives: cosine similarity and Euclidean distance. i As shown in formula (3). Finally, the outliers in the historical model updates for each participant are sorted, and the midpoint between the two adjacent outliers with the largest interval is taken as the boundary α separating malicious updates and normal updates. φ If the outlier α i Greater than the separation boundary α φ If the difference α is significant, then the corresponding model update in this round will be marked as malicious, and the corresponding participant will be marked as a malicious attacker. i Less than the separation boundary α φ If the model update is positive, the corresponding model update will be marked as normal, and the corresponding participant will be marked as a normal participant. At this stage, the committee can only access the sum of the participants' model updates and cannot obtain the original values ​​of a single round of model updates, thus providing a certain degree of privacy protection.

[0019]

[0020] Where S(·) represents cosine similarity and D(·) represents Euclidean distance. This indicates the historical model update after decoding for participant i. This represents the median of the historical model updates after decoding for all participants in this round.

[0021] (4) In the model aggregation phase, a member is randomly selected from the committee to be the leader, which is responsible for aggregating the normal model updates passed the detection. First, the committee leader removes the model updates that are detected as malicious by the consensus, and then aggregates the remaining model updates by federated averaging. Then, the aggregation result of this round and the consensus detection result are uploaded to the blockchain.

[0022] (5) In the model update phase, the participants obtain the aggregation result of this round from the blockchain. Since the local model updates aggregated by the committee are protected, the obtained aggregation result will also be blinded. Therefore, decoding is needed before updating the local model. Specifically, the aggregation result obtained from the blockchain is subtracted by the average of the masks used by the participants passed the detection in this round to decode. For privacy protection purposes, each participant only knows its own mask and cannot know the mask information of other participants, so the assistance of a trusted authority TA is needed when decoding. TA obtains the detection result of this round from the blockchain, calculates the average of the masks used by the participants passed the detection in this round according to the detection result, and sends it to each participant. After receiving it, the participant subtracts the average of the masks from the aggregation result to obtain the decoded aggregation result, and then uses it to update the local model.

[0023] Further, the decoding process of the aggregation result before the local model update is as follows:

[0024]

[0025] Wherein, denotes the aggregation result of the current t th round, which is obtained by averaging and aggregating the blinded model updates of the participants passed the detection in this round . denotes the average of the masks used by the participants passed the detection in this round. normal denotes the set of normal participants passed the detection, |P normal | denotes the number of normal participants passed the detection.

[0026] After the participants complete the local model update using the decoded aggregation result, if the pre-specified number of training rounds is not reached, the next round of local training is started, otherwise, the training is ended and the final global model is taken as the result of the joint training.

[0027] Compared with the prior art, the present application has the following advantages:

[0028] ​(1) Existing malicious detection methods mostly only rely on the difference between single round model updates of participants as the standard for identifying malicious updates. However, some attackers may strategically perform well in certain rounds to evade detection, so sometimes a single round of model updates cannot fully represent the essential characteristics of malicious behavior. Therefore, the present application proposes a malicious detection scheme based on historical model updates, which highlights the characteristics of malicious behavior by accumulating abnormal fluctuations, strengthens the attacker's countermeasures, and ensures that even in complex attack scenarios where attackers strategically perform normally in certain rounds, accurate identification of malicious behavior can be achieved, maintaining stable defense effects and improving the robustness of the global model.

[0029] (2) Existing malicious detection methods rarely support detection of protected model updates. Protecting model updates can affect the accuracy of malicious detection. This is mainly because common privacy protection methods such as encryption and differential privacy can significantly change the characteristics of model updates before and after protection, making malicious detection more difficult. Without the original characteristics, it will be difficult to make correct judgments about protected model updates, which will seriously affect the accuracy of detection. However, the present application adds a mask to the model update to achieve privacy protection, and decodes the historical model updates before performing malicious detection to restore their original characteristics. It is worth noting that the present application uses historical model updates rather than single round model updates for malicious detection, and the decoded form is the sum of multiple rounds of model updates, which does not directly expose the gradient information of the participants. In this way, the data privacy of the participants can be protected to some extent, and malicious detection based on the original characteristics of the model updates can be achieved, effectively avoiding the detection performance fluctuations caused by protecting the model updates. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 Schematic diagram of a poisoning attack defense method for privacy-protected blockchain federated learning

[0031] Figure 2 Schematic diagram of a malicious detection process based on historical model updates. DETAILED DESCRIPTION

[0032] The present application will be further described below in conjunction with the drawings and specific embodiments.

[0033] The specific implementation process of the poisoning attack defense method for privacy-protected blockchain federated learning described in the present application is shown in Figure 1 , including the following steps:

[0034] Step 1: Initialization.

[0035] (1) The trusted authority TA uses a pseudo-random number generator PRG to generate random masks δ for the n participants respectivelyi t , 1≤i≤n, where i represents the participant sequence number, n represents the total number of participants, and t represents the current round;

[0036] (2) If it is the first round of training, the participant obtains the initial global model parameters from the blockchain.

[0037] Step 2: Model training and blinding.

[0038] The participants perform local model training and calculate model updates. Then, the model updates are blinded by appending masks, and the used masks are summed. Finally, the blinded model updates and the masks are uploaded to the blockchain.

[0039] (1) Each participant performs local training using the local data set and calculates the model update;

[0040] (2) The participant appends a mask to the respective model update and calculates the blinded model update using formula (1);

[0041] (3) Participant i records the masks received from the TA in each round;

[0042] (4) Participant i sums the used masks;

[0043] (5) Upload the blinded model updates and the masks to the blockchain.

[0044] Step 3: Malicious detection.

[0045] After waiting for all participants to complete local training and upload blinded model updates, the smart contract is triggered to automatically perform the calculation of blinded historical model updates. Then, the committee obtains all participant's current latest blinded historical model updates and masks from the blockchain and decodes the blinded historical model updates. After that, the decoded historical model updates are maliciously identified, and the consensus detection result is obtained by voting.

[0046] (1) Trigger the smart contract to automatically calculate the historical model updates, and calculate each participant's current latest blinded historical model updates using formula (2);

[0047] (2) The committee obtains each participant's current latest blinded historical model updates and the corresponding masks from the blockchain;

[0048] (3) The committee decodes the historical model updates, subtracts the corresponding masks from the blinded historical model updates, and obtains the decoded historical model updates;

[0049] (4) The committee calculates the anomaly value of each participant's historical model update, identifies malicious updates, and distinguishes between malicious participants and normal participants. Each committee member will receive a detection result;

[0050] (5) The detection results are reached by consensus through voting. If a participant is detected as malicious by more than half of the committee members in this round, it will be consensus as the malicious participant in this round and will be moved to the attacker set P malicoius , otherwise, it will be moved to the normal participant set P normal , so as to determine the final detection result of this round.

[0051] The flow of step 3-(4) for identifying malicious updates is shown in Figure 2 , including the following steps:

[0052] (1) Calculate the median of all decoded historical model updates;

[0053] (2) Calculate the cosine similarity and Euclidean distance between each participant's decoded historical model update and the median, respectively;

[0054] (3) Calculate the anomaly value of each participant's historical model update according to formula (3) i , i represents the participant number;

[0055] (4) Determine the separation boundary. Sort all participant historical model update anomaly values by size, find the maximum interval between any two adjacent anomaly values, and take the midpoint of the interval as the separation boundary a φ ;

[0056] (5) Malicious identification. If a i is greater than the separation boundary a φ , the corresponding model update in this round is identified as malicious, and the corresponding participant i is identified as a malicious attacker; if a i is less than the separation boundary a φ , the model update in this round is considered normal, and the corresponding participant i is a normal participant.

[0057] Step 4: Model aggregation.

[0058] After malicious detection, remove the model updates detected as malicious, and at the same time, aggregate the model updates passed through detection by using the average aggregation method. Then upload the aggregation results of this round and the consensus detection results to the blockchain.

[0059] (1) Randomly select a member from the committee to serve as the leader;

[0060] (2) The committee leader removes malicious model updates;

[0061] (3) The committee leader aggregates the remaining model updates using the average aggregation method to obtain the aggregation result of this round;

[0062] (4) Upload the aggregation result of this round and the detection result to the blockchain.

[0063] Step 5: Model update.

[0064] In this step, the participants obtain the aggregation result of this round from the blockchain and decode it, and update the local model using the decoded aggregation result to start the next round of training.

[0065] (1) Participants obtain the aggregation result of this round from the blockchain;

[0066] (2) The TA obtains the detection result of this round from the blockchain to obtain the set of normal participants who pass the detection;

[0067] (3) The TA calculates the average value of the mask used by the normal participants who pass the detection in step 2-(2) according to the detection result, and sends it to each participant;

[0068] (4) The participants subtract the average value of the mask used by the normal participants from the aggregation result to obtain the decoded aggregation result;

[0069] (5) The participants update the local model according to the decoded aggregation result;

[0070] (6) If the pre-specified number of training rounds has not been reached, go back to step 1 and start the next round of local training, otherwise end the training.

Claims

1. A method for defending against poisoning attacks in privacy-preserving federated learning of blockchains, characterized in that, The method comprises the following steps: Step 1: initialization; (1) The trusted authority TA uses a pseudo-random number generator PRG to generate random masks δ for n participants respectively i t , 1≤i≤n, where i represents the participant serial number, n represents the total number of participants, and t represents the current round. (2) if it is the first round of training, the participants obtain initial global model parameters from the blockchain; Step 2: model training and blinding; (1) each participant performs local training using a local data set, and calculates a model update; (2) the participant appends a mask to the respective model update to obtain a blinded model update; (3) the participant i records the mask received from the TA in each round; (4) the participant i sums the used masks; (5) the blinded model update and the mask are uploaded to the blockchain; Step 3: malicious detection; (1) the smart contract is triggered to automatically calculate the latest blinded historical model update of each participant; (2) the committee obtains the latest blinded historical model update and the corresponding mask sum of each participant from the blockchain; (3) the committee decodes the historical model update, subtracts the corresponding mask sum from the blinded historical model update, and obtains the decoded historical model update; (4) the committee calculates the outliers of the historical model update of each participant, identifies malicious updates, and distinguishes between malicious participants and normal participants, and each committee member will obtain a detection result; (5) The detection results are reached by consensus through voting. If a participant is detected as malicious by more than half of the committee members in this round, he will be considered as a malicious participant in this round and will be moved to the attacker set P malicoius , otherwise, he will be moved to the normal participant set P normal , so as to determine the final detection result in this round. Step 4: model aggregation; (1) a member is randomly selected from the committee to serve as a leader; (2) the committee leader removes the malicious model update in this round; (3) the committee leader aggregates the remaining model updates using the average aggregation method to obtain the aggregation result in this round; (4) the aggregation result in this round and the consensus detection result are uploaded to the blockchain; Step 5: model update; (1) the participant obtains the aggregation result in this round from the blockchain; (2) the TA obtains the detection result in this round from the blockchain to obtain a set of normal participants who pass the detection; (3) the TA calculates the average value of the masks used by the normal participants who pass the detection in step 2-(2) according to the detection result, and sends it to each participant; (4) the participant subtracts the average value of the masks used by the normal participants from the aggregation result to obtain the decoded aggregation result; (5) the participant updates the local model according to the decoded aggregation result; (6) if the predetermined number of training rounds has not been reached, return to step 1 to start the next round of local training, otherwise end the training.

2. The method of claim 1, wherein, The step 3-(4) for identifying malicious updates in the malicious detection comprises the following steps: (1) calculate the median of all decoded historical model updates; (2) calculate the cosine similarity and Euclidean distance between the decoded historical model update of each participant and the median, respectively; (3) Calculate the anomaly value a of each participant's historical model update i i represents the participant number; (4) Determine the separation boundary; sort all the abnormal values of the participant history model update by size, find the maximum interval between any two adjacent abnormal values, and take the midpoint of the interval as the separation boundary α φ ; (5) evil discrimination; if α i is greater than the separation boundary α φ , the model update corresponding to this round is identified as malicious, and the corresponding participant i is identified as a malicious attacker; if α i is less than the separation boundary α φ , it is considered that the model update of this round is normal, The corresponding participant i is a normal participant.

3. The method of claim 1, wherein, The formula for calculating the blinded model update in step 2-(2) is as follows: wherein, denotes the model update obtained by the i-th participant in the t-th round, denotes the random mask received by the i-th participant in the t-th round from the TA, denotes the blinded model update, and n denotes the total number of participants.

4. The method of claim 1, wherein, The method for calculating the blinded historical model update in step 3-(1) is as follows: where k denotes the iteration round number, denotes the blinded model update of participant i at round k, denotes the participant i's current latest blinded history model update.

5. The method of claim 1, wherein, The process of decoding the model update before the malicious detection in step 3-(3) is as follows: wherein, denotes the current latest blinded history model update of participant i, denotes the mask used by participant i in round k, denotes the cumulative sum of the masks used by participant i in the t rounds, denotes the decoded history model update.

6. The method of claim 1, wherein, The step 3-(4) calculates the historical model update outlier value a of each participant i The formula is as follows: wherein, denotes the decoded history model update of participant i, denotes the median of the decoded history model updates of all participants in this round, S(·) denotes the cosine similarity and D(·) denotes the Euclidean distance.

7. The method of claim 1, wherein, The process of decoding the aggregation result before updating the local model in step 5-(4) is as follows: wherein, denotes the current round t aggregation result, which is updated by averaging the blinded model updates of the participants detected in the current round i∈P normal obtained; i∈P normal denotes the average of the masks used by the detected participants in the current round P normal denotes the set of normal participants detected, |P normal | denotes the number of normal participants detected.

Images