Federal learning-based image classification method in backdoor attack scene

Abstract

The invention discloses an image classification method for backdoor attacks in a federated learning scene. The method comprises the following steps: 1, carrying out preparatory work such as defining a model gradient and a trigger; 2, initializing a local model gradient; 3, the backdoor client obtains an optimal trigger before backdoor attack by using gradient-free descent; 4, the backdoor client performs data reinsertion backdoor by using an optimal trigger, and performs gradient descent training under the constraint of a model gradient mask and a distance objective function to obtain an image classification model gradient of the backdoor client; 5, the normal client performs gradient descent training by using the local data set to obtain an image classification model gradient; 6, the central server performs federal aggregation; and 7, obtaining an image classification model under the backdoor attack corresponding to the optimal gradient, wherein the image classification model is used for realizing image classification. The invention provides an image backdoor attack method for a federated learning scene, which can effectively insert a backdoor into a federated classification model. By avoiding model parameter conflicts and avoiding detection of an existing defense mechanism, the method remarkably improves durability and concealment of backdoor attacks, and meanwhile, an efficient attack effect is kept in an image classification task.

Description

Technical Field

[0001] The present invention belongs to the field of federated learning image classification, and specifically is an image classification method in a backdoor attack scenario based on federated learning. Background Art

[0002] With the continuous development of the information society, all walks of life have accumulated massive amounts of data. Due to technical, security and regulatory limitations, private data cannot be effectively shared and aggregated, forming independent data islands, which seriously affect the development of machine learning. Therefore, federated learning technology came into being. As an emerging distributed machine learning paradigm, federated learning does not need to centralize data. Each participant uses private data to train the model locally and improves the performance of the global model through collaborative learning. As an excellent model training method, federated learning has been widely used in image classification tasks. For example, in the medical field, the medical image classification model trained by federated learning can accurately identify key information such as tumors and lesion areas, providing doctors with important auxiliary diagnosis basis.

[0003] As attack methods advance, the characteristics of federated learning based on participant model training and local model updates make it vulnerable to backdoor attacks. In image classification tasks, backdoor attackers manipulate the training process of multiple participant local image classification models to achieve attack effects, which may lead to incorrect predictions while maintaining the accuracy of normal samples when encountering specific triggers. These attacks exploit the aggregated nature of federated learning to compromise model integrity between different local models without being easily detected. However, federated backdoor attacks gradually lose their effectiveness as the number of rounds increases after the attack stops, and ordinary federated backdoor attacks cannot break through advanced defense detection. This causes the backdoor attack to fail to insert into the central server, resulting in the failure of the attack.

[0004] In summary, in the field of federated learning image classification, once the backdoor attack stops, the federated backdoor will gradually lose its effect; with the emergence of more and more federated backdoor detection technologies, the federated backdoor is not easy to insert into the central server, and the concealment of image backdoor attacks is also facing challenges. Summary of the invention

[0005] The present invention aims to solve the deficiencies of the above-mentioned prior art and propose an image classification method in a backdoor attack scenario based on federated learning, in order to improve the concealment and persistence of the backdoor of federated learning image classification.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme:

[0007] The image classification method in the backdoor attack scenario based on federated learning of the present invention is characterized in that it is applied to a central server, Normal clients and In a network environment consisting of backdoor clients, the central server stores a test image dataset with labels. ,in, For the test images, , C is the total number of test images, Normal clients and Each backdoor client stores a local image dataset with labels, K is Normal clients and The total number of local images of each backdoor client; The local labeled private image dataset of a normal client is denoted as ,in, For the The first of the normal clients local images, for ; The local labeled private image dataset of the backdoor client is denoted as ,in, For the The backdoor client stores local images, for The image backdoor attack method comprises the following steps:

[0008] Step 1. Define the current round as ,initialization ,definition is the serial number of any normal client, defined is the serial number of any backdoor client, , ;

[0009] Definition A normal client The gradient of the local image classification model is , No. Backdoor client The gradient of the local image classification model is ;

[0010] Assume that from The backdoor attack starts in round 1, defining the central server in the The gradient of the image classification model under the backdoor attack is , define The trigger of the wheel is ;

[0011] Step 2. The central server will Distribute to Normal clients and A backdoor client is initialized , ;

[0012] Step 3. Backdoor client exploit For local labeled private image data After processing, enter Backdoor Client The first round of local image classification model Rounds of non-gradient descent training to optimize , thus obtaining Wheel Trigger ;

[0013] Step 4. Backdoor client exploit right After processing, enter Backdoor client The first round of local image classification model Round of gradient descent training, get Wheel Gradient ;

[0014] Step 5. A normal client uses the local dataset The local image classification model After a round of gradient descent training, we get Wheel Gradient ;

[0015] Step 6. The central server uses formula (6) to calculate the M normal clients in the first The gradient of the round and the M backdoor clients in the first The gradients of the first round are aggregated to obtain Backdoor attack on the gradient of image classification model ;

[0016] (6)

[0017] In formula (6), Represents an aggregate function;

[0018] Step 7. Assign to After that, return to step 2 and execute sequentially until the maximum number of rounds is reached, so as to obtain the image classification model under the backdoor attack corresponding to the optimal gradient;

[0019] Step 8. The central server uses the image classification model under the backdoor attack corresponding to the optimal gradient to predict the C test images and obtain the predicted category labels under the backdoor attack.

[0020] The image classification method in a backdoor attack scenario based on federated learning described in the present invention is also characterized in that step 3 includes:

[0021] Step 3.1. Using Wheel Trigger For the kth image sample Perform preprocessing to obtain the kth image sample after preprocessing , After preprocessing, local images, and ; express The category label of

[0022] Step 3.2. A backdoor client will Enter the Backdoor client The local image classification model is used to process the image, and then the formula (1) is used to obtain the first Wheel Trigger ;

[0023] (1)

[0024] In formula (1), ψ is a hyperparameter, for norm; For optimization function.

[0025] Further, the step 4 comprises:

[0026] Step 4.1. Use formula (2) to After processing, the first images , thus obtaining a local labeled and preprocessed private image dataset ;

[0027] (2)

[0028] Step 4.2. Define the total number of rounds of local training as , the current round of local training is ,initialization , initialize the Backdoor client The local image classification model is Gradients of local training round ;

[0029] definition For the The backdoor client is in The distance objective function of the local training round is initialized =0;

[0030] The first Wheel Gradient After the multi-dimensional vector of the corresponding image classification model is expanded in one dimension, the absolute values ​​of the vector parameters are obtained and then sorted in ascending order. The first several vector parameters are selected and their corresponding positions in the image classification model are recorded as 1, and the remaining positions are marked as 0, thereby obtaining the gradient mask as the image classification model. ;

[0031] Step 4.3. The backdoor client uses formula (3) to The local image classification model performs the e-th round of local training and obtains the Backdoor client The local image classification model is Gradients of local training round :

[0032] (3)

[0033] In formula (3), For the Backdoor client Gradients of the local image classification model exist On the first The gradient descent function during round training, For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, ρ represents the hyperparameter;

[0034] Step 4.4. Calculate the first Backdoor client The local image classification model is +1 round of local training of the target distance function ;

[0035] (4)

[0036] In formula (4), For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, is the cosine similarity function, For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, for norm, , , There are 3 hyper parameters respectively;

[0037] Step 4.5. Assign to Then, return to step 4.3. and execute sequentially until e> So far, the obtained Backdoor client The local image classification model is Gradients of local training round Assign to Backdoor client +1 round of gradients for the local image classification model .

[0038] Further, the step 5 comprises:

[0039] Step 5.1. Initialization , initialize the A normal client The local image classification model is Gradients of local training round ;

[0040] Step 5.2. A normal client sends the kth image sample Enter the A normal client The local image classification model is used to process the first The local image classification model is used for the first After a round of gradient descent training, we get A normal client The local image classification model is Gradients of local training round ;

[0041] (5)

[0042] Step 5.3. Assign to After that, return to step 5.2 and execute sequentially until the maximum round E is reached, so that the gradient of the local training of local E is obtained. Assign to A normal client Gradients of the local image classification model .

[0043] An electronic device of the present invention includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the image classification method in the backdoor attack scenario, and the processor is configured to execute the program stored in the memory.

[0044] The present invention provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program executes the steps of the image classification method in the backdoor attack scenario when the computer program is executed by a processor.

[0045] Compared with the prior art, the present invention can achieve the following beneficial effects:

[0046] 1. The present invention proposes an image classification method for enhanced backdoor attack, namely Enhanced-Neurotoxin technology, which provides a dynamic trigger optimization strategy to enhance the attack efficiency with dynamic triggers, provides better flexibility and more powerful backdoor attack capabilities than conventional static triggers, and can adapt to the flexibility required by different frameworks, defense mechanisms and data sets, thereby optimizing the attack effect.

[0047] 2. The present invention provides a strategy to control the significant difference between the backdoor model and the clean client model. By quantitatively calculating the distance between the backdoor model and the clean model, the difference between the local neural network model of the backdoor client and the normal client is reduced, which successfully circumvents the server aggregation defense and significantly improves the concealment and persistence of the backdoor.

[0048] 3. The present invention is a supervised learning method that does not increase the communication overhead of the participants. It solves the problem that after the attack stops, the huge difference between the models may cause conflicts between the backdoor and clean parameters, thereby reducing durability. At the same time, the implementation of the present invention is only based on public information and does not interfere with the training of other normal clients, thereby improving the feasibility of the image backdoor attack method. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the image classification method for backdoor attack of the present invention;

[0050] Figure 2 A flow chart of a backdoor attack performed by a backdoor client of the present invention;

[0051] Figure 3 This is a diagram showing the improvement of the image classification method for backdoor attacks of the present invention. DETAILED DESCRIPTION

[0052] In this embodiment, an image classification method in a backdoor attack scenario based on federated learning is applied to a central server, Normal clients and In a network environment consisting of 3 backdoor clients, a central server stores a test image dataset with labels. ,in, For the test images, , C is the total number of test images, Normal clients and Each backdoor client stores a local image dataset with labels, K is Normal clients and The total number of local images of each backdoor client; The local labeled private image dataset of a normal client is denoted as ,in, For the The first of the normal clients local images, for ; The local labeled private image dataset of the backdoor client is denoted as ,in, For the The backdoor client stores local images, for The category label of Figure 1As shown in the figure, the basic idea is that in the training process of the image classification model of federated learning, by optimizing the trigger, the distance between the image classification model of the backdoor client and the global image classification model is constrained, so that the image classification model of the backdoor client is more "similar" to that of the normal client, thereby avoiding the federation defense method and improving the backdoor classification effect of the image. The backdoor attack method includes the following steps:

[0053] Step 1. Define the current round as ,initialization ,definition is the serial number of any normal client, defined is the serial number of any backdoor client, , ;

[0054] Definition A normal client The gradient of the local image classification model is , No. Backdoor client The gradient of the local image classification model is ;

[0055] Assume that from The backdoor attack starts in round 1, defining the central server in the The gradient of the image classification model under the backdoor attack is , define The trigger of the wheel is .

[0056] Step 2. Define the central server Distribute to Normal clients and A backdoor client is initialized , .

[0057] Step 3. For the specific process of backdoor client, please refer to Figure 2 , No. Backdoor client exploit For local labeled private image data After processing, enter Backdoor Client The first round of local image classification model Rounds of non-gradient descent training to optimize , thus obtaining Wheel Trigger ;

[0058] Step 3.1. Using Wheel Trigger For the kth image sample Perform preprocessing to obtain the kth image sample after preprocessing , After preprocessing, local images, and ; express , and , is the backdoor target label.

[0059] Step 3.2. A backdoor client will Enter the Backdoor client The local image classification model is used to process the image, and then the formula (1) is used to obtain the first Wheel Trigger ;

[0060] (1)

[0061] In formula (1), ψ is a hyperparameter, for norm; is the optimization function;

[0062] Step 4. Backdoor client exploit right After processing, enter Backdoor client The first round of local image classification model After a round of gradient descent training, we get Wheel Gradient ;

[0063] Step 4.1. Use formula (2) to After processing, the first images , thus obtaining a local labeled and preprocessed private image dataset ;

[0064] (2)

[0065] Step 4.2. Define the total number of rounds of local training as , the current round of local training is ,initialization , initialize the Backdoor client The local image classification model is Gradients of local training round .

[0066] definition For the The backdoor client is in The distance objective function of the local training round is initialized =0;

[0067] The first Image classification model gradient of round central server After the multi-dimensional vector of the corresponding image classification model is expanded in one dimension, the absolute values ​​of the vector parameters are obtained and then sorted in ascending order. The first several vector parameters are selected and their corresponding positions in the image classification model are recorded as 1, and the remaining positions are marked as 0, thereby obtaining the gradient mask as the image classification model. .

[0068] Step 4.3. The backdoor client uses formula (3) to The local image classification model performs the e-th round of local training and obtains the Backdoor client The local image classification model is Gradients of local training round :

[0069] (3)

[0070] In formula (3), For the Backdoor client Gradients of the local image classification model exist On the first The gradient descent function during round training, For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, ρ represents the hyperparameter.

[0071] Step 4.4. Calculate the first Backdoor client The local image classification model is +1 round of local training of the target distance function ;

[0072] (4)

[0073] In formula (4), For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, is the cosine similarity function, For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, for norm, , , There are 3 hyper parameters respectively.

[0074] Step 4.5. Assign to Then, return to step 4.3. and execute sequentially until e> So far, the obtained Backdoor client The local image classification model is Gradients of local training round Assign to Backdoor client +1 round of gradients for the local image classification model .

[0075] Step 5. A normal client uses the local dataset Input to the local image classification model for the first After a round of gradient descent training, we get Wheel Gradient ;

[0076] Step 5.1. Initialization , initialize the A normal client The local image classification model is Gradients of local training round .

[0077] Step 5.2. A normal client sends the kth image sample Enter the A normal client The local image classification model is used to process the first The local image classification model is used for the first After a round of gradient descent training, we get A normal client The local image classification model is Gradients of local training round ;

[0078] (5)

[0079] Step 5.3. Assign to After that, return to step 5.2 and execute sequentially until the maximum round E is reached, so that the gradient of the local training of local E is obtained. Assign to A normal client Gradients of the local image classification model .

[0080] Step 6. The central server uses formula (6) to calculate the M normal clients in the first The gradient of the round and the M backdoor clients in the first The gradients of the first round are aggregated to obtain Backdoor attack on the gradient of image classification model ;

[0081] (6)

[0082] In formula (6), Represents an aggregate function.

[0083] Step 7. Central server utilizes gradient The corresponding image classification model predicts C test images and obtains +1 round of predicted category labels under C backdoor attacks, thus according to Statistics +1 round of C backdoor attacks in the predicted category labels, the total number of correct predictions , the total number can be used To dynamically quantify each The effect of backdoor attack on image classification.

[0084] Step 8. Assign to After that, return to step 2 and execute sequentially until the maximum number of rounds is reached, so as to obtain the image classification model under the backdoor attack corresponding to the optimal gradient;

[0085] Step 9. The central server uses the image classification model under the backdoor attack corresponding to the optimal gradient to predict C test images and obtains C predicted category labels under the backdoor attack. The effect is as follows: Figure 3 As shown, compared with common backdoor attacks, the Enhanced-Neurotoxin technology of the present invention can obtain a more persistent and more hidden backdoor when performing image classification. Figure 3 The blue curve represented by Baseline is the effect trend of the common federated backdoor attack technology, and the orange curve represented by Enhanced-Neurotoxin is the effect trend of the technology of this invention. Above the image are three federated aggregation defense methods. ASR represents the success rate of the attack. The bottom Round indicates the current attack round.

[0086] In this embodiment, an electronic device includes a memory and a processor, wherein the memory is used to store a program of the above-mentioned image classification method, and the processor runs the program stored in the memory.

[0087] In this embodiment, a readable storage medium is used to store computer program instructions, and the computer program instructions are read by a processor and execute the steps of the above-mentioned image classification method when executed.

[0088] It should be emphasized that the above embodiments are only preferred embodiments of the present invention and are not intended to limit the present invention. Any changes, modifications and variations made within the essential scope of the present invention should be within the protection scope of the present invention.

Claims

1. An image classification method in a backdoor attack scenario based on federated learning, characterized in that: Applicable to 1 central server, Normal clients and In a network environment consisting of backdoor clients, the central server stores a test image dataset with labels. ,in, For the test images, , C is the total number of test images, Normal clients and Each backdoor client stores a local image dataset with labels, K is Normal clients and The total number of local images of each backdoor client; The local labeled private image dataset of a normal client is denoted as ,in, For the The first of the normal clients local images, for ; The local labeled private image dataset of the backdoor client is denoted as ,in, For the The backdoor client stores local images, for The image backdoor attack method comprises the following steps: Step 1. Define the current round as ,initialization ,definition is the serial number of any normal client, defined is the serial number of any backdoor client, , ; Definition A normal client The gradient of the local image classification model is , No. Backdoor client The gradient of the local image classification model is ; Assume that from The backdoor attack starts in round 1, defining the central server in the The gradient of the image classification model under the backdoor attack is , define The trigger of the wheel is ; Step 2. The central server will Distribute to Normal clients and A backdoor client is initialized , ; Step 3. Backdoor client exploit For local private image data with labels After processing, enter Backdoor Client The local image classification model is used for the first Rounds of non-gradient descent training to optimize , thus obtaining Wheel Trigger ; Step 4. Backdoor client exploit right After processing, enter Backdoor client The local image classification model is used for the first After a round of gradient descent training, we get Wheel gradient ; Step 5. A normal client uses the local dataset The local image classification model After a round of gradient descent training, we get Wheel gradient ; Step 6. The central server uses formula (6) to calculate the M normal clients in the first The gradient of the round and the M backdoor clients in the first The gradients of the first round are aggregated to obtain Backdoor attack on the gradient of image classification model ; (6) In formula (6), Represents an aggregate function; Step 7. Assign to After that, return to step 2 and execute sequentially until the maximum number of rounds is reached, so as to obtain the image classification model under the backdoor attack corresponding to the optimal gradient; Step 8. The central server uses the image classification model under the backdoor attack corresponding to the optimal gradient to predict the C test images and obtain the predicted category labels under the backdoor attack.

2. According to claim 1, the image classification method in a backdoor attack scenario based on federated learning is characterized in that: The step 3 comprises: Step 3.

1. Using Wheel Trigger For the kth image sample Perform preprocessing to obtain the kth image sample after preprocessing , After preprocessing, local images, and ; express The category label of Step 3.

2. A backdoor client will Enter the Backdoor client The local image classification model is used to process the image, and then the formula (1) is used to obtain the first Wheel Trigger ; (1) In formula (1), ψ is a hyperparameter, for norm; For optimization function.

3. According to claim 2, the image classification method in a backdoor attack scenario based on federated learning is characterized in that: The step 4 comprises: Step 4.

1. Use formula (2) to After processing, the first images , thus obtaining a local labeled and preprocessed private image dataset ; (2) Step 4.

2. Define the total number of rounds of local training as , the current round of local training is ,initialization , initialize the Backdoor client The local image classification model is Gradients of local training round ; definition For the The backdoor client is in The distance objective function of the local training round is initialized =0; The first Wheel Gradient After the multi-dimensional vector of the corresponding image classification model is expanded in one dimension, the absolute values ​​of the vector parameters are obtained and then sorted in ascending order. The first several vector parameters are selected and their corresponding positions in the image classification model are recorded as 1, and the remaining positions are marked as 0, thereby obtaining the gradient mask as the image classification model. ; Step 4.

3. The backdoor client uses formula (3) to The local image classification model is trained for the eth round and the Backdoor client The local image classification model is Gradients of local training round : (3) In formula (3), For the Backdoor client Gradients of the local image classification model exist On the first The gradient descent function during round training, For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, ρ represents the hyperparameter; Step 4.

4. Calculate the first Backdoor client The local image classification model is +1 round of local training of the target distance function ; (4) In formula (4), For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, is the cosine similarity function, For the Backdoor client Gradients of the local image classification model In local dataset On the first The gradient descent function during round training, for norm, , , There are 3 hyper parameters respectively; Step 4.

5. Assign to Then, return to step 4.

3. and execute sequentially until e> So far, the obtained Backdoor client The local image classification model is Gradients of local training round Assign to Backdoor client +1 round of gradients for the local image classification model .

4. According to claim 3, the image classification method in a backdoor attack scenario based on federated learning is characterized in that: The step 5 comprises: Step 5.

1. Initialization , initialize the A normal client The local image classification model is Gradients of local training round ; Step 5.

2. A normal client sends the kth image sample Enter the A normal client The local image classification model is used to process the first The local image classification model is used for the first After a round of gradient descent training, we get A normal client The local image classification model is Gradients of local training round ; (5) Step 5.

3. Assign to After that, return to step 5.2 and execute sequentially until the maximum round E is reached, so that the gradient of the local training of local E is obtained. Assign to A normal client Gradients of the local image classification model .

5. An electronic device, comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute the image classification method in any backdoor attack scenario described in claims 1-4, and the processor is configured to execute the program stored in the memory.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the image classification method in any backdoor attack scenario of claims 1-4 are executed.

Images