Camouflage data poisoning attack method for local differential privacy protocol

Abstract

The invention discloses a camouflage data poisoning attack method for a local differential privacy protocol, which comprises the following steps of: operating the results of three data analysis tasks (frequency estimation, hotspot identification and mean square error estimation) by deeply considering the inherent attributes of the local differential privacy protocol, and camouflaging attack behaviors; the system promotes the development of related knowledge of three most advanced local differential privacy protocols. According to the method, the target item is bound with the adjacent item, and the adjacent item is driven to change by enhancing the target item, so that the attack gain is improved to the maximum extent and the attack behavior is disguised. The defense method is explored by using discrete cosine transform, sampling and frequency domain clustering. Theoretical analysis and experimental results show that the method is superior to existing three attacks on multiple data sets. According to the method, the security research of the privacy protection technology is promoted, and a theoretical and practical basis is provided for improving the camouflage of a privacy protection system.

Description

Technical Field

[0001] The present invention relates to the technical field of local differential privacy protection, and in particular to a disguised data poisoning attack method for a local differential privacy protocol. Background Art

[0002] Local Differential Privacy (LDP) is a privacy-preserving technique in a distributed environment that enables users to locally perturb data from untrusted data collectors. Currently, LDP has been deployed and applied in major companies such as Google, Uber, and Apple, and there are many open source libraries available. For example, Google integrated RAP-POR in Chrome to collect users' answers to questions such as the default Chrome homepage. Apple deployed the LDP protocol in iOS to collect users' preferences for emojis. However, few studies have explored the security of LDP.

[0003] Several existing studies have shown that the LDP protocol has significant vulnerabilities in data poisoning attacks. The initial work initiated the input poisoning attack (IPA) on the LDP protocol, which highlighted the inherent vulnerability of the LDP protocol to data poisoning attacks, even if the attacker does not have a deep understanding of the underlying LDP protocol. Different from IPA, some existing works designed the output poisoning attack (OPA) on the LDP protocol to manipulate the results of the data analysis task and exploit the characteristics of the LDP protocol during execution. Summary of the invention

[0004] The purpose of this invention is to significantly improve the manipulation effect of data analysis tasks by analyzing the intrinsic characteristics of different local differential privacy protocols, design more disguised data poisoning attacks and more effective privacy protection measures, and promote the development of data privacy protection technology.

[0005] In order to achieve the above objectives, the technical solution of the present invention is to provide a disguised data poisoning attack method for a local differential privacy protocol. It is characterized by including a disguised data poisoning attack for three data analysis tasks: frequency estimation, hotspot identification, and mean variance estimation, and providing defense based on frequency analysis, wherein:

[0006] The frequency estimation attack is implemented by exploiting the characteristics of the Optimized Unary Encoding (OUE) protocol. The attacker manipulates the frequency statistics of the target item by bundling the target item with neighboring items through carefully designed false data injection. By randomly setting non-target bits and increasing the frequency of neighboring items associated with the target item, the attacker is able to effectively increase the frequency estimate of the target item without raising suspicion.

[0007] Hotspot identification attack implementation, the attacker exploits the iterative nature of the prefix extension method (PEM) protocol to assign the same prefix bits to the target item and its neighboring items. This strategy makes it more likely that the target item will be identified as a high-frequency item during the iteration process, while improving its position in the final ranking. In this way, the attacker is able to manipulate the aggregated results of the data collector while keeping the attack behavior hidden.

[0008] Implementation of mean variance estimation attack,The attacker uses a mixed integer linear programming method to manipulate the mean and variance estimates,simultaneously for the Sharding Mechanism (PM) protocol.,By calculating the correlation coefficient and the mean square error, the attacker,is able to quantify the effectiveness of the attack and ensure that the injected data,is statistically similar to the real user's data, thereby disguising the attack,and achieving the manipulation of the mean and variance estimates.

[0009] The defense implementation based on frequency analysis first converts the data into the frequency domain, and then samples and clusters the low-frequency components to identify and remove abnormal data points. This defense method does not rely on specific knowledge of the attack strategy, and therefore provides a more general defense method. Through appropriate parameter settings, this defense strategy can effectively reduce the impact of attacks on data analysis results and improve the robustness of the system.

[0010] Specifically, the present invention has the following advantages:

[0011] 1) The present invention is the first to perform disguised data poisoning attacks on three state-of-the-art LDP protocols, namely OUE, PEM and PM, and can manipulate the statistics of data analysis tasks and disguise attack behaviors for three basic data analysis tasks, namely frequency estimation, hotspot identification and mean variance estimation.

[0012] 2) This paper also explores a defense strategy to mitigate the proposed disguised poisoning attack, and empirical results show that the defense is only effective in some cases, while further new defenses are needed in other cases. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a system block diagram of a disguised data poisoning attack method for a local differential privacy protocol provided by the present invention in an embodiment;

[0014] Figure 2 It is a block diagram of a defense algorithm based on frequency analysis provided by the present invention in an embodiment. DETAILED DESCRIPTION

[0015] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0016] 1) Attacker’s Background Knowledge and Goals

[0017] In this invention, the attacker is able to manipulate m fake users and has the ability to inject these users into n real users. At the same time, they have the ability to deeply understand the local differential privacy (LDP) protocol, including its encoding and perturbation steps. They know the key parameters of the LDP protocol, such as the privacy budget ε and the perturbation probability, which enables them to carefully design and inject fake data. In addition, the attacker also understands the technical details of the LDP protocol such as the domain size d, the encoding space D, and the support set S(y), which enables them to manipulate the data more precisely.

[0018] In addition, the main purpose of the attacker in this invention is to change the results of three data analysis tasks by manipulating the injected false data. In frequency estimation, they try to increase the reporting frequency of a specific item; in hotspot identification, their goal is to make the target item listed as one of the most frequent items; and in mean-variance estimation, they try to manipulate the statistical mean and variance to make them close to the target value set by the attacker.

[0019] 2) Frequency Estimation Attacks on OUE

[0020] The present invention proposes an attack on the frequency estimation task of the OUE protocol. The attacker selects a perturbation vector y i , which satisfies the constraint And at the time hour, Where r is the number of target items, t is the target item, T is the target item set, is the characteristic function of item t. In order to make the sum of the characteristic functions of the target items equal to r, the attacker initializes a binary vector filled with zeros for each fake user and sets the value of all items t belonging to the item set T to y i,t =1, where y i,tis the tth value of the i-th user in the vector, called the target bit of user i. However, this attack behavior is easy to detect because it only operates on the target bit. To this end, it is necessary to randomly set the non-target bits to 1, which effectively masks the frequency manipulation of the target item. In addition, the correlation between the target item and its neighboring items is increased to further mask the attacker's behavior. For example, when a certain type of car is very popular, its complementary accessories and brand derivatives (such as corresponding smart speakers and video devices) may also experience a chain reaction. Therefore, in order to mask the frequency manipulation of a specific product, the frequency of these surrounding products should also increase accordingly. First, all items need to be sorted so that the serial numbers of neighboring items can be continuous. Then the serial number of each item is encoded as a d-bit binary vector. If the serial number of item t is 3 (the third item), the vector can be {···100···}. Then, the fourth item is encoded as {···010···}, and the fifth item is encoded as {···001···}. Afterwards, if the corresponding bits of the perturbation values ​​of the three neighboring items are set to 1, that is, {···111···}, the sum of the characteristic functions will increase. Therefore, increasing the correlation between the target term and its neighboring terms leads to the characteristic function of the neighboring terms Increase. The perturbation values ​​of the target item t and its neighboring items will become {···111···}.

[0021] 3) Hotspot identification attack against PEM

[0022] The present invention proposes an attack on the hotspot identification task of the PEM protocol. In the attack, each item is encoded as an n-bit binary vector, and users are randomly assigned to g groups. Therefore, the average proportion of fake users in each group is m / (n+m). In the jth iteration, the attacker replaces the first τ of the target item with the last τ. j bit as the "target" and assign the same first τ to the neighboring items j This is used to make fake values ​​sent by fake users. This attack can increase the probability of promoting the target item to the top k high-frequency items while improving the ranking of its neighboring items. First, the items need to be classified. Second, assuming that the prefix of the target item at the jth iteration is {011···}, a total of τ j Finally, the same prefix is ​​assigned to the neighboring items of the target item so that items of related categories will be assigned the same perturbation value prefix.

[0023] IV) Mean-variance estimation attack on PM

[0024] The present invention maps the proposed attack to the perturbation value of the PM mechanism of high-dimensional data. Specifically, firstly, all users are divided into two groups g1 and g2, where the number of real users is n1 and n2, and the number of fake users is m1 and m2. The original value u of each real user is i, for multiple numerical attributes j, it is expressed as The production data of each fake user is represented as Where j is the dimension of the data, 1≤j≤d. According to the following equation, an attacker can calculate a false value of a certain dimension j by solving the following mixed integer linear programming problem:

[0025]

[0026] in μ t，j and are the corresponding target mean and variance, is the data submitted by the first group of users and, is the sum of squares of data submitted by the second group of users. Divide the expression on the right side of the equation by m1 or m2 to solve the first two equations. However, the false values ​​calculated in this way are the same, and it is unlikely that many real users will send the same perturbation value. To solve this problem, the attacker introduces a random perturbation mechanism for each value while keeping the sum unchanged and ensuring that the value of each dimension is within [-s, s]. At the same time, it is necessary to ensure that r i，j ≥θ, where i∈[n+1,n+m], j∈[1,n]. Subsequently, the attacker randomly assigns values ​​to the two groups of fake users for a certain dimension. When the perturbation values ​​calculated by the attacker are randomly assigned, the perturbation values ​​made for the fake users should be correlated with the perturbation values ​​of the neighboring real users. This ensures that the fake users can effectively disguise themselves as real users, thus achieving the disguise goal.

[0027] 5) Defense algorithm based on frequency analysis

[0028] The present invention proposes a defense strategy based on frequency analysis, which does not rely on a specific attack strategy and provides a wider range of defense effects.

[0029] like Figure 2 As shown, the defense takes the false data generated by the poisoning attack proposed by the attacker, the perturbation data of the real user, the minimum cluster size a and the low-frequency ratio α as input. It filters out the false data and obtains the data analysis results. Specifically, it first converts the false data to the frequency domain using discrete cosine transform (DCT). Then, the low-frequency components are obtained by extracting the first α parts of the frequency domain. By reshaping and adjusting the low-frequency components to (-1,1), each sample has a feature. After that, it clusters the reshaped low-frequency components and filters out the false data based on the presence of the -1 label. Finally, the defense strategy obtains the data of the real user. In summary, the defense algorithm based on frequency analysis proposed in the present invention is as follows:

[0030]

Claims

1. A disguised data poisoning attack method for a local differential privacy protocol, characterized in that: It includes three data analysis tasks: frequency estimation, hotspot identification, and mean variance estimation. It provides a defense algorithm based on frequency analysis, including: The fake data poisoning attack of the data analysis task, the attacker can access the implementation details of the LDP protocol locally, control a group of fake users, and inject carefully designed data into the LDP protocol, that is, bundle the target item with the adjacent items, and use the enhancement of the target item to drive the changes in its adjacent items, so as to achieve complex manipulation of the bundled items and make the target item more reasonable compared with the rest of the items, thereby minimizing the risk of being discovered, and then send these carefully designed data to the data collector to manipulate the data analysis results; The defense algorithm based on frequency analysis uses discrete cosine transform (DCT) to convert the data into the frequency domain, samples the low-frequency part of the data in the frequency domain, and clusters the sampled data to ultimately delete the forged data.

2. According to claim 1, a method for poisoning a disguised data against a local differential privacy protocol is characterized in that: Manipulating the results of data aggregation tasks through carefully crafted fake data; In the frequency estimation task, the attacker bundles the target item with the neighboring items and uses the enhancement of the target item to indirectly affect the neighboring items to maximize the attack gain of the target item and disguise the attack behavior; in the hotspot identification task, the attacker increases the possibility of becoming the top k hotspots by assigning the same prefix to the selected target items; for the mean-variance estimation task, the attacker uses mixed integer linear programming to simultaneously manipulate the mean and variance estimates to ensure the statistical similarity between the attack data and the real data to avoid detection.

3. According to claim 2, a method for poisoning a disguised data against a local differential privacy protocol is characterized in that: The data is converted to the frequency domain using discrete cosine transform (DCT), and then the low-frequency part is sampled and clustered to identify and remove false data injected by attackers. This method does not rely on specific knowledge of the attack strategy and therefore provides a more general defense method. By setting the minimum cluster size and low-frequency ratio, the defense can effectively reduce the impact of attacks on data analysis results in different scenarios.

Images