Vertical federated learning backdoor attack defense method based on embedding and loss filtering

Abstract

The invention discloses a vertical federated learning backdoor attack defense method based on embedding and loss filtering, which explores related technologies for defending backdoor attacks in a VFL (Virtual File Language) for the first time under the condition that an attacker masters enough label information, and puts forward an FILTER. According to the invention, two filtering mechanisms, namely an embedding-based'filter 'and a loss-based'filter', are introduced. Wherein the'filter 'based on embedding is carried out all the time in the training process and is used for'filtering' completely consistent or extremely similar embedding vectors; a loss-based'filter 'is used for identifying backdoor embedded vectors based on loss differences of clean embedded vectors and embedded vectors with backdoors occurring in a model training phase. These filters may identify and remove backdoor samples in a later stage of training. The four most advanced attack methods are experimented on a plurality of reference data sets, and it is proved that the attack success rate can be remarkably reduced while the model performance is not affected.

Description

Technical Field

[0001] The present invention relates to the fields of machine learning, backdoor attacks, and federated learning technology. The present invention is applied to a vertical federated learning (VFL) scenario to prevent a training participant from maliciously injecting a backdoor into a vertical federated system. The invention discloses a vertical federated learning backdoor attack defense method (FILTER) based on embedding and loss filtering. Background Art

[0002] With the continuous development of deep learning, its application has spread to various fields, such as medicine, computer vision and finance. However, since training a high-performance deep neural network requires high-quality and high-quantity data, it has become very difficult in today's world where data privacy is becoming increasingly important. In order to solve this problem, Federated Learning (FL) came into being. In federated learning, multiple data entities (i.e., clients) and a computing center (i.e., server) jointly train models without sharing local data. According to the distribution of data among clients, federated learning can be divided into horizontal federated learning (HFL) and vertical federated learning (VFL). In HFL, clients have the same feature space but different sample spaces; while VFL involves client data with the same sample space but different feature spaces. VFL has been widely used in real life. For example, banks cooperate with invoice agencies to build financial risk models for corporate customers through VFL.

[0003] Backdoor attacks are a serious threat in deep learning. They manipulate the training process or introduce datasets containing malicious samples to make the model perform well on normal samples but perform abnormally on samples with specific triggers. Recent studies have shown that malicious clients can inject backdoor attacks in both HFL and VFL systems. Although some research has been devoted to backdoor defense in HFL, related research in VFL is still limited.

[0004] Existing VFL backdoor defense work usually assumes that malicious clients cannot obtain label information, so it prevents attackers from learning the label of a single sample and injecting a backdoor by protecting the label information. However, studies have shown that attackers only need to know the labels of a small number of samples to successfully inject a backdoor into the VFL system, and these labels can be obtained through offline methods. Insufficient research on defense against VFL backdoor attacks may pose a significant risk to its practical application.

[0005] Backdoor attacks against VFL. With the application of VFL in real-world scenarios, the risk of backdoor attacks has gradually emerged and cannot be ignored. Since the labels of all training samples in the VFL system are held by the server, malicious clients cannot directly modify the labels of samples. Therefore, all existing backdoor attacks against VFL are "clean label attacks."

[0006] He et al. proposed a backdoor attack against VFL, in which the attacker designs a trigger that looks normal but is significantly different from the embedding of non-target category samples, and replaces the embedding vector of the target label with the trigger during training. Bai et al. added a trigger to the embedding vector to replace the original embedding vector. Naseri et al. forced the embedding vector of the source category to be close to the embedding of the target category sample by injecting a trigger into the training samples with the source label. Zou et al. injected a trigger into samples with non-target labels and replaced the embedding vector of the target label samples with the trigger embedding of these samples. Since attackers have multiple ways to inject triggers, it is difficult for the server to accurately identify malicious embedding vectors.

[0007] For the defense against backdoor attacks, existing backdoor attack defense methods can be divided into three categories: model pruning, model fine-tuning, and distinguishing backdoor samples from normal samples. However, in the VFL system, since the server cannot access the client's local dataset and model, methods based on model pruning and fine-tuning are difficult to apply directly. In addition, unlike backdoor attacks in centralized training, in VFL, attackers can choose any training round to inject backdoor samples, which further increases the difficulty of distinguishing backdoor samples from normal samples.

[0008] Zou et al. proposed to use a confusion autoencoder to construct a mapping to convert each label into a soft label with a higher probability of other labels, thereby defending against backdoor attacks in VFL. However, the success of this method depends on the attacker's inability to obtain label information; once the attacker has partial label information, this method will fail. Summary of the invention

[0009] The purpose of the present invention is to provide a vertical federated learning backdoor attack defense method based on embedding and loss filtering to address the problem of how to prevent malicious participants from injecting backdoors into the system during the training process of vertical federated learning. This method effectively prevents the injection of backdoors without affecting the original performance.

[0010] The specific technical solution for achieving the purpose of the present invention is:

[0011] A vertical federated learning backdoor attack defense method based on embedding and loss filtering, the method comprising the following specific steps:

[0012] Step 1: The server trains the model according to the vertical federation training protocol and uses filters based on embedding vectors to filter backdoor samples;

[0013] Step 2: In the middle and late stages of training, the server trains an auxiliary model without a backdoor based on the loss of the vectors in the batch, which is called the clean model;

[0014] Step 3: Continue training the clean model based on the sample score partition vector;

[0015] Step 4: Backdoor erasing of the clean model based on forgetting learning; where:

[0016] The step 1 specifically includes:

[0017] 1.1. The server receives and merges a batch of embedding vectors from each client, and obtains the label corresponding to the vector according to the index; clustering is performed through DBSCAN, specifically: define a threshold τ, randomly select one embedding vector with different labels from the batch, traverse the entire batch, and if the distance between an embedding vector and the selected vector with the same label is less than τ, it is assigned to a cluster; otherwise, it is a single cluster, and Calculate the distance; where |·|2 represents the L2 distance (in short, the straight-line distance between two points in space), i,j represents the index of the embedding vector, and c represents the category label of the embedding vector, so represents an embedding vector of the server sent by the kth client in the batch, with label c and index i;

[0018] 1.2. Count the number of vectors in each cluster, and mark the cluster with the largest number of vectors greater than 1 as a suspected malicious sample; replace the sample labels marked as suspected malicious samples with randomly generated labels and use them for training;

[0019] The step 2 specifically includes:

[0020] 2.1. When training to round T, the server copies the existing server model and clears the model weights to obtain a model that has not been trained to the server, called the clean model θ cl ;

[0021] 2.2. In the following training, the server receives a batch of data from each client and aggregates the loss of each sample:

[0022]

[0023] in represents the embedding vector with index i in an embedding vector batch B, represents the label of the embedding vector indexed i in an embedding vector batch B, θs Represents the server model, Represents loss functions, including MSELoss and CELoss;

[0024] Select the p with the highest loss initial The sample ratio is used to train the clean model. The vector index set selected from the batch is π, so the optimization goal of the clean model is as follows:

[0025]

[0026] where θ cl represents the clean model obtained in 2.1, represents the loss function, e π and π Respectively represent the embedding vector and its label whose subscript belongs to π;

[0027] The step 3 specifically includes:

[0028] 3.1. After 10 to 20 rounds of training, the clean model can classify a small number of clean embedding vectors to the correct label, but almost never classifies the backdoor embedding vectors as the backdoor label; at this time, when the server receives a batch of embedding vectors, it needs to use the server model to calculate the loss of each vector, that is, It is also necessary to use a clean model to calculate the loss of each vector, that is, in and represents the embedding vector indexed i and its label in an embedding vector batch B;

[0029] 3.2. Use the two losses calculated in step 3.1 and Each vector in the batch is evaluated as follows:

[0030]

[0031] Score i represents the score of the embedding vector with index i, and |·| represents the absolute value;

[0032] For the server model, the loss of malicious embedding vectors is small, while for the clean model it is the opposite; so when an embedding vector is malicious, Smaller, So when the sample is a backdoor sample, Score i The denominator is large and the numerator is small, Score i will be very small, otherwise vice versa;

[0033] 3.3. Based on Scorei Sort each embedding vector and select the Score i The larger part is used to train the clean model. The proportion of this part of the selected embedding vectors in this batch is defined as p t According to the following formula, p t It will gradually increase with the increase of training rounds t, but will not exceed its maximum value p max :

[0034]

[0035] Where T represents the round starting from step 3.3, p initial Indicates p t The initial value of . The embedding vector index selected by the above rules is denoted as π. At this time, the optimization target for the clean model is expressed as;

[0036]

[0037] The step 4 specifically includes:

[0038] 4.1. When the training reaches the last two rounds, the server not only selects Score i For a larger embedding vector, you also need to select the Score i The smallest proportion is (1-p max ), whose index set is labeled as un;

[0039] 4.2. Using random labels y′ un Substitute the original label y of the embedding vector indexed by un un , and optimize the following objectives:

[0040]

[0041] where θ cl represents the clean model, e un ,y un They represent the embedding vectors and their corresponding labels in un, respectively; this achieves the effect of erasing the backdoor;

[0042] 4.3. After training, the server uses the clean model θ in the inference phase cl Rather than the server-side model θ s Make inferences.

[0043] Beneficial effects of the present invention:

[0044] The present invention has conducted extensive experiments on multiple standard data sets (such as CIFAR-10, Credit, CINIC-10, etc.) and multiple existing vertical federated learning backdoor attack method settings, and has achieved good results. The present invention can successfully and effectively prevent the injection of backdoors when the attacker has sufficient labeled data, without affecting the original performance. Specifically, the present invention has demonstrated strong defense capabilities when dealing with multiple existing vertical federated learning backdoor attack methods. Using the method proposed in the present invention, the trained vertical federated learning system can effectively identify and prevent backdoor attacks, thereby avoiding misclassification of backdoor samples as backdoor labels, which makes the attack success rate almost zero. At the same time, the system's classification performance for benign samples remains stable, hardly affecting its prediction accuracy, and ensuring the effective use of benign data.

[0045] These experimental results fully demonstrate the efficiency and practicality of the present invention in actual vertical federated learning applications, especially in the face of malicious attacks and data pollution, the present invention can provide a reliable protection measure. In summary, the present invention not only provides a strong security guarantee for the vertical federated learning system, but also plays a vital role in the stability and accuracy of system performance in practical applications, and has high robustness and wide application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The present invention is a FILTER flow chart;

[0047] Figure 2 This is a schematic diagram of the results of visualizing a batch of embedding vectors using t-SNE in the present invention;

[0048] Figure 3 This is a diagram showing the defensive effect of the present invention when the attacker adopts the late start and early stop strategies. DETAILED DESCRIPTION

[0049] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0050] Symbol Settings

[0051] For a better introduction, a simple setting of symbols is given here.

[0052] Vertical federated learning (VEF) is a collaborative learning paradigm that allows multiple data entities (i.e., clients) to collaborate with a computing center (i.e., server) to train models without sharing the original data. The complete dataset is denoted as Each sample contains an M-dimensional feature vector x i =[x i,1 ,x i,2 ,…,xi,M ]. In the VFL system, there are a server and at least two clients (K ≥ 2), each of which maintains its local model. The local dataset held by the kth client is a partial feature vector of each sample, denoted as satisfy The server holds sample x i Label y i .

[0053] During the training process, each participant selects the corresponding index through the private set intersection technique to form batch data i∈B. The kth client uses the local model θ k Calculate the embedding vector And send it to the server. The server aggregates the embedding vectors from the client to get e B , and then use the server model θ s The loss is calculated and the server model is updated. The server then sends the gradients to each client to update the local model.

[0054] The present invention is a novel defense method called FILTER, which is used to eliminate backdoors in the late stage of training. Considering that the attacker may choose different samples as backdoor instances in different training cycles, the server cannot rely on historical cycle data (such as loss or gradient) to identify the compromised samples in the current cycle.

[0055] Therefore, the server needs to use the information of the current batch as much as possible to identify backdoor samples. In addition, attackers can create damaged samples and damaged embedding vectors in VFL. Therefore, in order to effectively handle different types of trigger patterns, the method introduces two batch-level filtering mechanisms, namely, embedding vector-based filters and loss-based filters, such as Figure 1 The former identifies highly similar embedding vectors as corrupted, while the latter adopts a three-stage process to gradually narrow the criteria for detecting corrupted vectors in a batch.

[0056] Embedding vector based filtering

[0057] The embedding vector-based filter acts as the first line of defense and is designed to “filter out” obviously compromised embedding vectors. For example, an attacker might replace a complete vector with a trigger. In addition, an attacker might add random noise when replacing the vector to make the trigger less conspicuous. Therefore, the server cannot simply identify whether a vector is a backdoor vector or a benign vector by comparing their consistency alone. However, even in the case where the embedding vector is replaced with noise by a trigger, the distance between the vectors is still significantly smaller than that of benign samples. Therefore, in order to prevent malicious clients from injecting backdoors using this attack method, the server first needs to calculate the distance between the embedding vectors with the same label sent by each client. The L2 distance is used to evaluate the distance between vectors, Where c represents the label of e. If the distance is less than the threshold τ, the vectors are grouped into the same cluster. If a cluster contains multiple samples, it is considered a malicious embedding vector. In order to reduce backdoor injection during the loss calculation process, the server replaces the original labels of these threat embedding vectors with random labels. In order to improve computational efficiency, the DBSCAN algorithm is used for clustering. Specifically, after receiving the vector batches from all clients, the server iteratively processes the vectors with the same label from a specific client. If the distance from the vector to the existing cluster center is less than τ, the vector is added to the cluster; otherwise, the vector is designated as the new cluster center. Note that in this process, since the threshold τ is set small enough, when a batch is full of benign samples, each embedding vector often forms a cluster by itself, which does not affect the final training results. This process will continue to affect the training until the end. So subsequently, within each client, the cluster containing the most vectors is identified, and the original labels of the samples in the cluster are replaced with random labels, thereby hindering potential backdoor exploits. Note that the server can choose a very small τ to avoid degrading the performance of the VFL system on clean data.

[0058] Loss-based filtering

[0059] To improve the stealth of backdoor samples, attackers may choose not to completely replace the vectors, but to generate backdoor samples through other methods, such as adding triggers to the embedded vectors.

[0060] In the VFL scenario, we conducted preliminary experiments using the CIFAR-10 dataset, which included two clients, each with half of the features and using the ResNet18 model; the server used a four-layer fully connected neural network. In the experiment, we used t-SNE to visualize the embedding vectors of each label in different clients.

[0061] like Figure 2As shown, during the training process, when the attacker uses VILLAIN (a VFL backdoor attack method) to inject a backdoor, the clustering of the backdoor embedding vector will be very close to the normal vector of the same label in the batch. Since VILLAIN is a clean label attack, it is difficult for the server to distinguish between backdoor and normal samples only through the embedding vector. Existing research shows that backdoor samples can be distinguished from normal samples by the loss difference in the training phase. However, this type of method requires the inclusion of backdoor samples from the early stages of training, which may be challenging in practice because the attacker can introduce backdoor samples in the later stages of training. Therefore, the present invention focuses on the scenario in which the server distinguishes between backdoor samples and normal samples in the later stages of training. Based on this, a loss-based filtering method is proposed, the goal of which is to train a clean model for inference, which mainly includes three stages: clean server preheating, adaptive batch data partitioning, and backdoor elimination.

[0062] 1) Clean and preheat the server

[0063] According to observations, the loss of backdoor samples decreases rapidly during training, and the model injected with backdoors later will overfit the backdoor samples, making their loss even lower. Therefore, in the early stage of training, the server does not implement any defense mechanism, allowing the attack to successfully inject the backdoor; after reaching the predetermined training stage, the server selects some samples with higher loss from each batch to train the clean model θ cl .

[0064] Specifically, after training T rounds, the server initializes a s Auxiliary model θ with the same structure but randomly initialized parameters cl , hereinafter referred to as the clean model. Receive the embedding vector batch e B After that, the server calculates each e i The loss of the highest loss is selected initial Ratio of samples used to train θ cl .

[0065] 2) Adaptive batch data partitioning

[0066] After the initial training phase is completed, the server maintains two models: θ that may contain backdoors s and θ without backdoor cl The server is gradually improved for training θ cl The embedding vector of occupies the proportion p of the embedding vectors in the batch and the proportion p of the vectors in the same batch to improve its performance on normal data. In order to more effectively distinguish backdoor and normal samples, the server compares θ s and θ cl The difference in loss for the same vector is used to divide the data. The backdoor sample is in θ s The loss on θ is lower, but clThe server calculates each e i The score Score is used to train θ cl For the i-th sample, the Score is calculated as

[0067] 3) Backdoor elimination of basis and forgetting learning

[0068] Although the server tries to ensure θ by batch division cl The training data of is normal samples, but may still contain some backdoor samples. For example, the backdoor samples in θ s There may be high loss on the training data, or there may be too many backdoor samples in the batch. To completely eliminate the backdoor, the server uses the lowest score (1-p max )% samples are used for forgetting learning (such as label replacement). Even if these samples contain some normal samples, it will not significantly affect θ cl Since the backdoor trigger is usually the most significant feature, the perturbation method can effectively decouple the trigger from the target label, thereby significantly reducing the attack success rate. After training, the server uses θ cl Make inferences.

[0069] Experimental setup

[0070] The default experimental settings include two clients and one server, and each client holds half of the feature vectors. For the bank dataset, the model of each client is a 3-layer fully connected neural network, and the model of the server is a 2-layer fully connected neural network. For the credit dataset, the model of each client is a 1-layer neural network, and the model of the server is a 1-layer fully connected neural network. For the MNIST dataset, the model of each client contains 2 convolutional layers and 2 fully connected layers. For the CIFAR-10 and CINIC-10 datasets, the model of each client is a ResNet18 network, and the model of the server is a 4-layer fully connected neural network. In vertical federated learning, the features held by the clients are non-overlapping. Therefore, for the image dataset, no data augmentation techniques such as rotation or translation are used. The total number of training rounds and batch size in the training phase are set to 100 and 256, respectively. The cross entropy loss function is used for all datasets, and the Adam optimizer is adopted with a learning rate of 0.001 and a weight decay rate of 0.0001.

[0071] Following the experimental settings in existing VFL research, two clients are included by default. The default embedding aggregation method of the server is embedding concatenation. Three typical VFL backdoor attack methods in the training phase are selected for evaluation: VILLAIN, BadVFL, and data poisoning attack (Optimal Trigger) dedicated to SplitNN. In addition, a baseline method using the traditional replacement trigger [1,-1,0,0,1,-1,0,0,1,-1], called Mask, is also evaluated. The attacker retains the value of the original embedding vector at the position where the trigger is 0, and replaces the value at the non-zero position. For each attack method, the settings proposed in the respective paper are followed. For VILLAIN, the trigger mask The number of 1s in is set to 5. For BadVFL, the trigger size is set to 3x3, and Optimal Selection is used to select the source and target labels. For Optimal Trigger, the attacker only adds trigger noise on the CIFAR-10 dataset, because adding noise on other datasets will cause the attack to fail. The specific rounds at which the attacker starts the attack are shown in the table. To ensure that all attacks can successfully inject the backdoor, the poisoning rate is set to 0.03.

[0072] The server starts using FILTER from epoch 85, where the second and third phases of the loss-based filter start at epoch 86 and epoch 98, respectively. The initial probability p initial Set to 0.15, the maximum probability p max is set to 0.9. The threshold τ of the embedding-based filter is set to 0.001. Four defense methods are also selected to compare with the method of the present invention: Fake Gradient (FG), ANP, ABL and CEA. It is worth noting that FG is used by the client to defend against gradient leakage attacks in VFL. In the setting, the server uses FG to generate fake gradients and then sends them to the client. Similar to previous studies, the present invention uses attack success rate (ASR) and benign sample accuracy (CDA) to evaluate the effectiveness of backdoor attacks. In addition, a new evaluation metric is introduced: Defense Effectiveness Score (DES), which is used to balance the trade-off between evaluating CDA and ASR. Among them and CDA noDefense and ASR noDefense Denote CDA and ASR respectively when there is no defense method. Therefore, if DES = 1, it means that the defense successfully reduces ASR to 0 while not reducing CDA.

[0073] Experimental Results

[0074] Table 1. Overview of the comparison between the present invention and other defense methods against different backdoor attacks in VFL

[0075]

[0076] Table 1 shows the results of the method of the present invention on backdoor attacks in different VFLs. Based on these results, the following conclusions can be drawn:

[0077] 1) The method of the present invention can effectively reduce ASR without significantly reducing CDA. Regardless of the attack method used on all datasets, the DES of the method of the present invention is at least 0.8, and in most cases close to 1.0.

[0078] 2) FILTER is significantly better than other defense methods in fighting backdoor attacks in VFL. The DES of the method of the present invention is significantly higher than the other four defense methods. For example, when the attacker uses VILLAIN to attack, DES is close to 1.0, while the other methods do not exceed 0.8.

[0079] The failure of the ABL approach may be because the server has already partitioned the dataset before the attacker uses the backdoor vector for training. In the setting, the attacker has enough knowledge of the labels, so using CEA to map the original labels to a set of "soft pseudo labels" does not affect the backdoor injection. Similar to CAE, if the server uses FG to defend against backdoor attacks, the pseudo gradients sent to the client only make it more difficult for the malicious client to obtain additional information from the gradient, but cannot effectively prevent backdoor attacks. Since the server cannot access the local models of other participants and can only prune the server model, this reduces the effectiveness of ANP.

[0080] Table 2 Defense effect when there are more clients

[0081]

[0082] Since all attacks can be extended to VFL scenarios with more than two clients, the ResNet18 and VGG16 models are used on the CIFAR-10 and CINIC-10 datasets, and 2, 4, and 8 clients are set respectively to evaluate the effectiveness of the method of the present invention. Similar to the default setting, each client has half, a quarter, or an eighth of the feature vectors. As shown in Table 2, the method of the present invention can be extended to scenarios with more clients. Regardless of the number of clients, the ASR remains at a low level, and the CDA does not drop significantly. In most cases, the method of the present invention reduces the ASR to less than 20% with almost no impact on the CDA.

[0083] Under the default setting, the server starts using this method at the 85th round. However, a malicious client may start the attack after the 85th round. To evaluate the effectiveness of the proposed method in this case, an experiment was conducted on the CIFAR-10 dataset, where the attacker launched the attack at the 90th round. Figure 3 As shown in (a), the results show that ASR remains at a low level, while CDA does not drop significantly. Since the server will learn the low-score vectors in the last two rounds of training, the performance of the method of the present invention is evaluated when the attacker stops poisoning in the 97th round. Figure 3 As shown in (b), even if the attacker stops using backdoor samples or vectors at epoch 97, they are still able to reduce ASR without significantly reducing CDA. It is worth noting that ASR is reduced compared to the default setting, whether poisoning in the late stage or stopping poisoning early. This suggests that the attacker may avoid launching time-dependent attacks at the beginning or end of training.

[0084] Table 3 Ablation experiment

[0085]

[0086] The ablation experiment was carried out on each component in the method (FILTER) of the present invention. The results are shown in Table 3, and the following conclusions can be drawn:

[0087] 1) The embedding-based filter is only effective for Optimal Trigger. In addition, even without using the embedding-based filter, Optimal Trigger can still achieve high ASR.

[0088] 2) Backdoor Unlearning can significantly reduce ASR without affecting CDA.

[0089] 3) Compared with meta-split, the Score in the method of the present invention is more effective in resisting these backdoor attacks.

Claims

1. A vertical federated learning backdoor attack defense method based on embedding and loss filtering, characterized in that the method includes the following specific steps: Step 1: The server trains the model according to the vertical federation training protocol and uses filters based on embedding vectors to filter backdoor samples; Step 2: In the middle and late stages of training, the server trains an auxiliary model without a backdoor based on the loss of the vectors in the batch, which is called the clean model; Step 3: Divide the vector based on the sample scores and continue training the clean model; Step 4: Backdoor erasing of the clean model based on forgetting learning; where: The step 1 specifically includes: 1.

1. The server receives and merges a batch of embedding vectors from each client, and obtains the label corresponding to the vector according to the index; clustering is performed through DBSCAN, specifically: define a threshold τ, randomly select one embedding vector with different labels from the batch, traverse the entire batch, and if the distance between an embedding vector and the selected vector with the same label is less than τ, it is assigned to a cluster; otherwise, it is a single cluster, and Calculate the distance; where |·|2 represents the L2 distance, i.e., the straight-line distance between two points in space, i,j represents the index of the embedding vector, and c represents the category label of the embedding vector, so represents an embedding vector of the server sent by the kth client in the batch, with label c and index i; 1.

2. Count the number of vectors in each cluster, and mark the cluster with the largest number of vectors greater than 1 as a suspected malicious sample; The labels of samples marked as suspected malicious samples are replaced with randomly generated labels and used for training; The step 2 specifically includes: 2.

1. When training to round T, the server copies the existing server model and clears the model weights to obtain a model that has not been trained to the server, called the clean model θ cl ; 2.

2. In the following training, the server receives a batch of data from each client and aggregates the loss of each sample: in represents the embedding vector with index i in an embedding vector batch B, represents the label of the embedding vector indexed i in an embedding vector batch B, θ s Represents the server model, Represents loss functions, including MSELoss and CELoss; Select the proportion of samples with the highest loss p initial For training the clean model, let the vector index set selected from the batch be π, so the optimization goal of the clean model is as follows: where θ cl represents the clean model obtained in 2.1, represents the loss function, e π and π Respectively represent the embedding vector and its label whose subscript belongs to π; The step 3 specifically includes: 3.

1. After 10 to 20 rounds of training, the clean model can classify a small number of clean embedding vectors to the correct label, but almost never classifies the backdoor embedding vectors as the backdoor label; at this time, when the server receives a batch of embedding vectors, it needs to use the server model to calculate the loss of each vector, that is, It is also necessary to use a clean model to calculate the loss of each vector, that is, in and represents the embedding vector indexed i and its label in an embedding vector batch B; 3.

2. Use the two losses calculated in step 3.1 and Each vector in the batch is evaluated as follows: Score i represents the score of the embedding vector with index i, and |·| represents the absolute value; For the server model, the loss of malicious embedding vectors is small, while for the clean model, the opposite is true; when an embedding vector is malicious, Smaller, So when the sample is a backdoor sample, Score i The denominator is large and the numerator is small, Score i will be very small, otherwise vice versa; 3.

3. Based on Score i Sort each embedding vector and select the Score i The larger part is used to train the clean model; the proportion of samples in this batch of selected embedding vectors is defined as p t According to the following formula, p t It will gradually increase with the increase of training rounds t, but will not exceed its maximum value p max : in, T represents the round starting from step 3.3, p initial Indicates p t The initial value of; The embedding vector index selected by the above rules is recorded as π. At this time, the optimization target for the clean model is expressed as; The step 4 specifically includes: 4.

1. When the training reaches the last two rounds, the server not only selects Score i For a larger embedding vector, you also need to select the Score i The smallest proportion is (1-p max ), whose index set is labeled as un; 4.

2. Using random labels y′ un Substitute the original label y of the embedding vector indexed by un un , and optimize the following objectives: where θ cl represents the clean model, e un ,y un They represent the embedding vectors and their corresponding labels in un, respectively; this achieves the effect of erasing the backdoor; 4.

3. After training, the server uses the clean model θ in the inference phase cl Rather than the server-side model θ s Make inferences.

Images