A federated learning hybrid attack data security defense system and method

Abstract

The application discloses a federal learning mixed attack data security defense system and method, belongs to the technical field of data security, and is applied to the aspect of federal learning protection. The implementation method of the application is as follows: 1. In a round of training, the server selects a client and communicates; 2. A local differential privacy dataset of the client is constructed to resist reasoning attacks; 3. The server receives local model parameters and local model gradient values of the self local training of the client; 4. The server side carries out byzantine model attack defense through clustering; 5. The server carries out collusion attack defense through a maximum connection subgraph; 6. The server carries out model disorder attack defense through reconstruction of the local model parameters of the client; 7. The server corrects malicious client gradients through a relative direction coefficient; 8. The server aggregates malicious and benign gradients, and obtains an optimized global model of federal learning through cyclic iteration. Compared with the prior art, the application realizes federal learning mixed attack data security defense.

Description

TECHNICAL FIELD

[0001] The present application relates to a federated learning hybrid attack data security defense system and method, belonging to the technical field of data security, and applied to the protection of local data and global models in federated learning. BACKGROUND

[0002] At present, the main attack methods of federated learning include Byzantine model attack and inference attack. The Byzantine model attack refers to changing the global model by tampering with or replacing the model information of the client, such as Gaussian attack, gradient sign inversion attack, etc. These attacks will cause the efficiency of the global model to decline, and even the global model cannot converge eventually. The inference attack refers to that the attacker obtains some model parameter or model gradient value information and uses the information to infer, such as gradient inversion attack.

[0003] The existing defense methods for federated learning model and data security have the following shortcomings: with the continuous evolution of attack methods, new model attack methods are more novel and concealed, such as disordering the position sequence of part of the parameters in the full connection layer in the model and scaling the parameters, or colluding attack to disguise as a normal user. The existing methods often consider the model attack and privacy attack in federated learning separately, and also set the number of attackers in advance and limit the attack party to be the client or the server, but in reality, the state of the client and the server is random every round, and different attacks may be initiated at the same time. At this time, the defense method effective for a single attack may fail when mixed attacks are encountered. In addition, although many defense methods can detect malicious attackers in federated learning, the number of benign clients after excluding the attackers is too small when aggregated, resulting in unsatisfactory federated aggregation effect.

[0004] Therefore, how to simultaneously defend against model attacks that cause model utility to decrease and inference attacks that cause data security to be leaked in federated learning hybrid attacks has become a problem to be solved. SUMMARY

[0005] The purpose of the present application is to solve the technical problems of model attacks that cause model utility to decrease and inference attacks that cause data security to be leaked in federated learning hybrid attacks, and to propose a federated learning hybrid attack data security defense system and method.

[0006] The purpose of the present application is achieved by the following technical solutions:

[0007] The federated learning hybrid attack data security defense method disclosed by the present application is applied to data interaction communication including one server and multiple clients, wherein the multiple clients are composed of multiple single clients, and includes the following steps:

[0008] Step 1: In a round of global model training, the server selects clients in a random hit manner and communicates with the selected clients by broadcasting global model parameters;

[0009] Step 2: A client local differential privacy dataset is constructed for the client selected by the server, which is used to remove the model parameters and gradients containing the original data information, thereby resisting the inference attack of the server and the client.

[0010] Step 2.1: A local dataset containing data samples and classification labels is constructed for the client selected by the server;

[0011] Step 2.2: The classification labels of the local dataset are processed by adding noise in the manner shown in formula (1) to form a one-hot vector;

[0012] h i =h i +Laplace(λ′) (1)

[0013] Wherein, h i represents the one-hot vector of the classification label, Laplace represents the Laplace noise, and λ' represents the Laplace noise parameter;

[0014] Step 2.3: The one-hot vector in step 2.2 is activated by a softmax layer, and the maximum value of the classification probability is taken as the perturbation label in the manner shown in formula (2);

[0015]

[0016] Wherein, softmax(·) represents the softmax layer activation, represents the perturbation label;

[0017] Step 2.4: The data sample and the perturbation label are used to construct a client local differential privacy dataset;

[0018] Step 3: The server receives the local model parameters and the local model gradient values from the client after its own local training;

[0019] Step 3.1: The differential privacy dataset is linearly mixed in the manner shown in formula (3) to perform local training by the client itself;

[0020] x′1=λx1+(1-λ)x2,y′1=λy1+(1-λ)y2 (3)

[0021] wherein λ is a linear mixing parameter, (x1, y1), (x2, y2) represent two pairs of instances randomly selected from the differential privacy dataset, and (x'1, y'1) represents an instance formed by mixing x'1 and y'1.

[0022] Step 3.2: Obtain the local model parameter by local training in the manner shown in formula (4);

[0023]

[0024] wherein w k is the local model parameter of the client k, t represents the current iteration number, η represents the learning rate, represents the gradient of the loss function for the i'th data point.

[0025] Step 3.3: Obtain the local model gradient value by local training in the manner shown in formula (5);

[0026]

[0027] wherein g k is the local model gradient value of the client k, t represents the current iteration number, W is the global model parameter, and w k is the local model parameter of the client k.

[0028] Step 3.4: Feedback the local model parameter and the local model gradient value to the server.

[0029] Step 4: The server receives the feedback information of the local model parameter and the local model gradient value of the selected client for clustering, and then performs Byzantine model defense on the selected client.

[0030] Step 4.1: The server receives the local model gradient value of the selected client through step 3;

[0031] Step 4.2: The server obtains the local model momentum of a single client in the manner shown in formula (6);

[0032]

[0033] wherein m k is the local model momentum of the client k, g k is the local model gradient value of the client k, t represents the current iteration number, μ is a parameter for calculating the local model momentum, and t k is the last round when the client was selected.

[0034] Step 4.3: The server performs principal component analysis operation on the selected client's local model momentum from step 4.2, and obtains the reduced dimension client's local model momentum set as shown in equation (7);

[0035]

[0036] wherein m k is the reduced dimension local model momentum of client k, t represents the current iteration number, PCA(·) is the principal component analysis operation, and 0.98 represents that 98% of the original information is retained after dimension reduction; k

[0037] Step 4.4: The server classifies the selected client into two clusters by clustering the reduced dimension local model momentum of the selected client obtained in step 4.2, and classifies the selected client into two clusters as shown in equation (8);

[0038]

[0039] wherein CL1, CL2 are two clusters containing clients, and it is stipulated that |CL1|>|CL2|, DBSCAN is a density-based clusterer, is the set of reduced dimension local model momentum of the selected client;

[0040] Step 4.5: The server calculates the similarity between the medians of the two clusters obtained in step 4.4 as shown in equation (9);

[0041] sim = cos(m1, m2) (9)

[0042] wherein m1, m2 represent the medians of the two clusters CL1, CL2, cos(·) is the cosine similarity, and sim is the similarity between the two clusters;

[0043] Step 4.6: The server compares the similarity between the two clusters obtained in step 4.5 with the similarity threshold; further, if the similarity is lower than the threshold, the client cluster with smaller quantity is regarded as a malicious attacker, thereby filtering out these attackers; if the similarity is greater than the threshold, no client is excluded;

[0044] Step 4.7: The server obtains the client filtered out the Byzantine model attacker through step 4.6.

[0045] Step 5: The server performs collusion attack defense on the client filtered out the Byzantine attack through the maximum connected subgraph method;

[0046] Step 5.1: The server obtains the local model momentum of the client filtered out the Byzantine attacker through step 4;

[0047] ​Step 5.2: The server first constructs a graph with nodes as selected clients and edges as empty sets;

[0048] Step 5.3: The server obtains the similarity between the local model momentum of any two clients using formula (10);

[0049] sim i，j = cos(m i , m j ) (10)

[0050] where m i , m j are any two clients, cos(·) is the cosine similarity, and sim i，j is the similarity between the local model momentum of any two clients;

[0051] Step 5.4: The server compares the similarity between the local model momentum of any two clients obtained in step 5.3 with a similarity threshold. Further, if the similarity is greater than the threshold, it is considered that the local model momentum of the two clients is too similar, and an edge is added between the nodes representing the two clients in the graph created in step 5.2;

[0052] Step 5.5: The server extracts the maximum connected subgraph containing clients with extremely similar local model momentum from the graph obtained in step 5.4;

[0053] Step 5.6: The server compares the number of clients in the maximum connected subgraph obtained in step 5.5 with the number of clients selected by the server in step 1. Further, if the number of clients in the maximum connected subgraph is less than half of the number of clients selected by the server in step 1, the clients in the maximum connected subgraph are considered as colluding attackers, and are filtered from the clients filtered out by the Byzantine attackers through step 4, otherwise, no client is excluded;

[0054] Step 5.7: The server filters out the colluding attackers through step 5.6.

[0055] Step 6: The server defends against model reordering attacks on the clients filtered out by the Byzantine attackers and colluding attackers through the method of reconstructing the local model parameters of the clients;

[0056] Step 6.1: The server obtains the local model parameters of the clients filtered out by the colluding attackers through step 5;

[0057] Step 6.2: The server calculates the geometric median of the set of local model parameters of the clients obtained in step 6.1 using formula (11);

[0058]

[0059] Among them, w k Here are the local model parameters for client k, where K is the number of clients filtered out after filtering out colluding attackers, and w geo The geometric median of the local model parameter set for the client;

[0060] Step 6.3: The server preprocesses the local model parameters of the client obtained in step 6.1 using equation (12) to obtain the proxy local model parameters;

[0061] w′ k =w k -w geo (12)

[0062] Among them, w k For the local model parameters of client k, w geo w′ is the geometric mean of the local model parameter set for the client. k For the proxy local model parameters of client k;

[0063] Step 6.4: The server uses equation (13) to reconstruct the local model parameters of the client's proxy to obtain the reconstructed local model parameters;

[0064] r k =C(w′) k ,t) (13)

[0065] Among them, w′ k Here, t represents the surrogate local model parameters for client k, t represents the current iteration number, C is a conditional variational autoencoder, and r k The parameters of the local model after reconstruction for client k;

[0066] Step 6.5: The server uses equation (14) to obtain the mean square error of the local model parameters reconstructed by the client;

[0067] e k =MSELoss(w k r k (14)

[0068] Among them, w k For the local model parameters of client k, r k Let MSE(·) represent the local model parameters after reconstruction for client k, and let e represent the mean square error equation. k The mean square error of reconstructing local model parameters for the client;

[0069] Step 6.6: The server calculates the average mean square error of the client reconstruction local model parameters obtained in step 6.5 using equation (15);

[0070]

[0071] wherein e k is the mean square error of the local model parameters reconstructed by the client, K is the number of clients after filtering out colluding attackers, is the average of the mean square error of the local model parameters reconstructed by the clients;

[0072] Step 6.7: The server compares the mean square error of the local model parameters reconstructed by the client with the average of the mean square error obtained from step 6.6; further, if the mean square error of the local model parameters reconstructed by the client is greater than the average of the mean square error, the client is regarded as a model reordering attacker, and is filtered out from the clients after filtering out colluding attackers obtained through step 5; if the mean square error of the local model parameters reconstructed by the client is less than the average of the mean square error, the client is a benign client, and is not excluded.

[0073] Step 6.8: The server obtains the clients after filtering out model reordering attackers through step 6.7.

[0074] Step 7: The server corrects the gradient of the excluded malicious client by calculating the relative direction coefficient between the gradient of the excluded malicious client and the average of the gradients of benign clients;

[0075] Step 7.1: The server obtains the local model gradient value of the remaining k clients after filtering out the Byzantine model attackers, colluding attackers and model reordering attackers through step 6, and calculates the local model average gradient value of the remaining benign clients using formula (16);

[0076]

[0077] wherein, represents the local model gradient value of the kth benign client, M is the number of remaining benign clients, t represents the current iteration number, Δ t represents the local model average gradient value of the remaining benign clients;

[0078] Step 7.2: The server obtains the correction reference direction of the local model gradient value at this time using formula (17);

[0079]

[0080] wherein, t represents the current iteration number, Δ t represents the local model average gradient value of the remaining benign clients, r t is the correction reference direction of the local model gradient value at this time;

[0081] Step 7.3: The server obtains the filtered partial model gradient value of the malicious attacker through steps 4, 5 and 6, and calculates the relative direction coefficient between the partial model gradient value of the malicious attacker and the modified reference direction of the partial model gradient value according to formula (18);

[0082]

[0083] Wherein, r t is the modified reference direction of the partial model gradient value at this time, is the partial model gradient value of the malicious attacker, and c is the clipping hyperparameter, is the relative direction coefficient between the partial model gradient value of the malicious attacker and the modified reference direction of the partial model gradient value;

[0084] Step 7.4: The server modifies the partial model gradient value of the malicious attacker according to formula (19) to obtain the modified partial model gradient value of the malicious attacker, which is used to avoid the local gradient tending to the malicious direction while retaining the heterogeneity of the client;

[0085]

[0086] Wherein, is the partial model gradient value of the malicious attacker, is the relative direction coefficient between the partial model gradient value of the malicious attacker and the modified reference direction of the partial model gradient value, and r t is the modified reference direction of the partial model gradient value at this time, is the modified partial model gradient value of the malicious attacker;

[0087] Step 8: The server aggregates the malicious gradient modified through step 7 and the benign gradient filtered out through step 6, and obtains the optimized global model of federated learning through the way of cyclic iteration of steps 1 to 7, thereby realizing the federated learning mixed attack data security defense.

[0088] The application discloses a kind of federated learning mixed attack data security defense system, for realizing the above method.The application discloses a kind of federated learning mixed attack data security defense system, including client and server.Wherein, client is used to infer the defense processing of attack and mixed training partial model processing;Server is used to the defense processing of byzantine model attack, collusion attack and model disorder attack and optimization aggregation global model processing;The mixed training partial model module of client and the byzantine model attack defense module of server, optimization aggregation global model module are transmitted by the way of data interaction communication;

[0089] The client includes inference attack defense module, mixed training partial model module;

[0090] The inference attack defense module is configured to perform differential privacy processing on the local data set of the client, output a local data set result with labeled differential privacy, and serve as an input of the mixed training local model module.

[0091] The mixed training local model module is configured to perform linear mixed training processing on the local model of the client, output a local model parameter value and a local model gradient value result, and serve as an input of the byzantine model attack defense module of the server.

[0092] The server comprises a byzantine model attack defense module, a collusion attack defense module, a model disorder attack defense module, and an optimized aggregation global model module.

[0093] The byzantine model attack defense module is configured to perform clustering processing on the local model gradient value of the selected client of the server, output a result of a client of a filtered byzantine model attacker, and serve as an input of the collusion attack defense module.

[0094] The collusion attack defense module is configured to perform maximum connected subgraph construction processing on the local model gradient value of the client after excluding the byzantine attacker, output a result of a client of a filtered collusion attacker, and serve as an input of the model disorder attack defense module.

[0095] The model disorder attack defense module is configured to perform outlier detection processing on the local model parameter of the client after excluding the byzantine attacker and the collusion attacker, output a result of a client of a filtered model disorder attacker, and serve as an input of the optimized aggregation global model module.

[0096] The optimized aggregation global model module is configured to perform correction on the local model gradient value of the excluded malicious client and aggregation on the local model gradient value of the filtered k nature client, output a global model parameter value result, and serve as an input of the mixed training local model module of the client.

[0097] Beneficial effects:

[0098] Compared with the prior art, the present application has the following beneficial effects:

[0099] 1. The present application focuses on the urgency of an effective and comprehensive defense method against model attacks of the server and data privacy attacks of the client in federated learning.

[0100] 2. The present application proposes a defense method with robustness and privacy, which can detect abnormal values and prevent data leakage when the model is attacked, correct the optimization aggregation process of the malicious gradient of the client, and achieve the best effect. BRIEF DESCRIPTION OF DRAWINGS

[0101] Figure 1 is a general framework diagram of the robustness and privacy resistance mechanism of the embodiment of the present application;

[0102] Figure 2 is a mixed attack setting diagram of the embodiment of the present application. DETAILED DESCRIPTION

[0103] In order to better illustrate the purposes and advantages of the present application, the following further illustrates the content of the application in combination with the drawings and examples. It should be pointed out that the implementation of the present application is not limited to the following embodiments, and any form of variation or change of the present application will fall within the scope of protection of the present application.

[0104] Initialization parameters: the number of clients is 200, and the local data set of the client is D k , the global training round E = 200, the local training round e = 5, the number of clients randomly selected by the server each round is 100, the number of attackers is < 50, and the Laplace noise parameter The linear mixing parameter λ = beta(1.0, 1.0) during mixed training, the momentum parameter μ = 0.8, the local model training learning rate ηη = 0.001, the clustering similarity threshold α = 0 ~ 0.5, the maximum connected subgraph similarity threshold c max = 0.5 ~ 0.9, and the clipping hyperparameter c = 0.005.

[0105] EMBODIMENT

[0106] As Figure 1 shown, the specific implementation steps of the federated learning mixed attack data security defense method of the embodiment are as follows:

[0107] Step 1: In a round of global model training, the server selects clients in a random hit manner and communicates with the selected clients by broadcasting global model parameters;

[0108] In the embodiment, the server sends the global model parameters W t (t = 0, 1, 2,..., 199) of the current round to the randomly selected clients c k (k = 1, 2,..., 99). Wherein, t is the current global iteration round, and W t is the global model parameter of the tthround.

[0109] Step 2: Construct a client local differential privacy data set for the clients selected by the server, which is used to remove the model parameters and gradients containing the original data information of the clients, so as to resist the inference attack of the server and the clients.

[0110] Step 2.1: Construct a local data set containing data samples and classification labels for the clients selected by the server;

[0111] Step 2.2: The classification label of the local data set is added with noise in the form of formula (1) to form a one-hot vector;

[0112] h i = h i + Laplace (λ') (1)

[0113] wherein h i represents the one-hot vector of the classification label, Laplace represents the Laplace noise, and λ' represents the Laplace noise parameter;

[0114] Step 2.3: The one-hot vector in step 2.2 is activated by a softmax layer, and the maximum classification probability is taken as the perturbation label in the form of formula (2);

[0115]

[0116] wherein softmax (·) represents the softmax layer activation, represents the perturbation label;

[0117] Step 2.4: The data sample and the perturbation label are used to construct a client local differential privacy data set;

[0118] In the embodiment, the input local data set is a handwritten digit recognition data set MNIST / EMNIST, the data sample is an image sample such as the pixel representation of the number "9", and the classification label is the classification label of the handwritten digit image, i.e. the number "9". The data sample of the output client differential privacy data set is still the original image sample of MNIST / EMNIST, i.e. the pixel representation of the number "9", and the perturbation label is still within the classification label range of the data set, such as the number "7".

[0119] Step 3: The server receives the local model parameters and the local model gradient values trained by the client itself;

[0120] Step 3.1: The differential privacy data set is linearly mixed in the form of formula (3) to train the client itself locally;

[0121] x'1 = λx1 + (1-λ)x2, y'1 = λy1 + (1-λ)y2 (3)

[0122] wherein λ is a linear mixing parameter, (x1, y1) and (x2, y2) represent two pairs of random instances in the differential privacy data set, and (x'1, y'1) represents the instance formed by mixing x'1 and y'1;

[0123] Step 3.2: Obtain the local model parameter of the client k by local training in the form of formula (4);

[0124]

[0125] wherein w k is the local model parameter of the client k, t represents the current iteration number, η represents the learning rate, represents the gradient of the loss function for the i'th data point;

[0126] Step 3.3: Obtain the local model gradient value of the client k by local training in the form of formula (5);

[0127]

[0128] wherein g k is the local model gradient value of the client k, t represents the current iteration number, W is the global model parameter, w k is the local model parameter of the client k;

[0129] Step 3.4: Feedback the local model parameter and the local model gradient value to the server.

[0130] In the embodiment, the client receives the global model parameter W t Then, the model is trained using the differential privacy dataset, wherein the optimizer used at the client is torch.optim.SGD, and the learning rate η = 0.001. The input is the local differential privacy dataset and the local model parameter obtained in step 2; the output is the local model parameter and the local model gradient wherein k is the number of each client, and t is the current global iteration round.

[0131] Step 4: The server receives the feedback information of the local model parameter and the local model gradient value of the selected client for clustering, and then performs byzantine model defense on the selected client;

[0132] Step 4.1: The server receives the local model gradient value of the selected client through step 3;

[0133] Step 4.2: The server obtains the local model momentum of a single client by using the form of formula (6) on the selected client;

[0134]

[0135] wherein m k is the local model momentum of the client k, g kis the local model gradient value of the client k, t represents the current iteration number, and μ is a parameter for calculating the local model momentum of the client k k is the last round selected by the client k;

[0136] Step 4.3: The server performs a principal component analysis operation on the local model momentum of the selected client obtained from step 4.2, and obtains the dimension-reduced local model momentum set of the client by using formula (7);

[0137]

[0138] wherein m k is the dimension-reduced local model momentum of the client k, t represents the current iteration number, and PCA(·) is a principal component analysis operation, and 0.98 represents that 98% of the original information is retained after dimension reduction. k 98% of the original information is retained after dimension reduction;

[0139] Step 4.4: The server classifies the selected client into two clusters by clustering the dimension-reduced local model momentum of the selected client obtained from step 4.2, and divides the selected client into two clusters by using formula (8);

[0140]

[0141] wherein CL1 and CL2 are two clusters containing clients, and it is stipulated that |CL1|>|CL2|, DBSCAN is a density-based clusterer, is the set of dimension-reduced local model momentum of the selected client;

[0142] Step 4.5: The server calculates the similarity between the medians of the two clusters obtained from step 4.4 by using formula (9);

[0143] sim = cos(m1, m2) (9)

[0144] wherein m1 and m2 represent the medians of the two clusters CL1 and CL2, cos(·) is a cosine similarity, and sim is the similarity between the two clusters.

[0145] Step 4.6: The server compares the similarity between the two clusters obtained from step 4.5 with a similarity threshold value; further, if the similarity is lower than the threshold value, the client cluster with a smaller number is regarded as a malicious attacker, so as to filter out these attackers; if the similarity is greater than the threshold value, no client is excluded;

[0146] Step 4.7: The server obtains the client filtered out of the Byzantine model attacker through step 4.6.

[0147] In the embodiment, the server filters out the Byzantine model attacker based on the dimension-reduced momentum of the client The clusterer adopted is DBSCAN for density clustering to obtain two clusters CL1 and CL2. Among them, the domain radius eps = 0.25, the minimum number of points in the domain radius that become core objects min_sample = 5, and the algorithm for calculating point-by-point distance and finding the nearest neighbor algorithm = 'kd_tree'. The input is the client set; the output is the client set excluding the outliers after clustering, wherein the clustering similarity threshold a = 0-0.5.

[0148] Step 5: The server performs collusion attack defense on the clients filtered out by the Byzantine attack through the maximum connected subgraph method;

[0149] Step 5.1: The server obtains the local model momentum of the clients filtered out by the Byzantine attack through step 4;

[0150] Step 5.2: The server first constructs a graph with the selected clients as nodes and an empty set as edges;

[0151] Step 5.3: The server obtains the similarity between the local model momentum of any two clients using formula (10);

[0152] sim i,j =cos(m i ,m j ) (10)

[0153] Where m i , m j are any two clients, cos(·) is the cosine similarity, and sim i，j is the similarity between the local model momentum of any two clients;

[0154] Step 5.4: The server compares the similarity between the local model momentum of any two clients obtained from step 5.3 with the similarity threshold; further, if the similarity is greater than the threshold, it is considered that the local model momentum of the two clients is too similar, and an edge is added between the nodes represented by the two clients in the graph created in step 5.2;

[0155] Step 5.5: The server extracts the maximum connected subgraph containing clients with extremely similar local model momentum from the graph obtained in step 5.4;

[0156] Step 5.6: The server compares the number of clients in the maximum connected subgraph obtained from step 5.5 with the number of clients selected by the server in step 1; further, if the number of clients in the maximum connected subgraph is less than half of the number of clients selected by the server in step 1, the clients in the maximum connected subgraph are considered as colluding attackers, and are filtered from the clients filtered from the Byzantine attackers obtained in step 4, otherwise, no client is excluded;

[0157] Step 5.7: The server obtains the clients filtered from the colluding attackers through step 5.6.

[0158] In the embodiment, the server creates a graph G = networkx.Graph() through the networkx library of python. Then the server draws edges between clients i, j in the graph based on the cosine similarity sim i , j of the momentum of the two clients i, j, and compares the threshold value c max = 0.5 ~ 0.9, to obtain the maximum connected subgraph G' in the graph G. The input is the clients filtered from the Byzantine model attackers in step 4; the output is the client set excluding colluding attackers.

[0159] Step 6: The server performs model reordering attack defense on the clients filtered from the Byzantine attackers and the colluding attackers through the method of reconstructing the local model parameters of the clients;

[0160] Step 6.1: The server obtains the local model parameters of the clients filtered from the colluding attackers through step 5;

[0161] Step 6.2: The server calculates the geometric median of the local model parameter set of the clients obtained in step 6.1 using formula (11);

[0162]

[0163] where w k is the local model parameter of the client k, K is the number of clients filtered from the colluding attackers, and w geo is the geometric median of the local model parameter set of the client;

[0164] Step 6.3: The server pre-processes the local model parameters of the clients obtained in step 6.1 to obtain the proxy local model parameters using formula (12);

[0165] w′ k = w k -w geo (12)

[0166] where w kw geo is the geometric median of the local model parameters of the clients, w' k is the proxy local model parameter of the client k;

[0167] Step 6.4: The server reconstructs the proxy local model parameter of the client k to obtain the reconstructed local model parameter r

[0168] r k = C(w' k , t) (13)

[0169] where w' k is the proxy local model parameter of the client k, t represents the current iteration number, C is a conditional variational autoencoder, and r k is the reconstructed local model parameter of the client k;

[0170] Step 6.5: The server obtains the mean square error of the reconstructed local model parameter of the client k using formula (14);

[0171] e k = MSELoss(w k , r k ) (14)

[0172] where w k is the local model parameter of the client k, r k is the reconstructed local model parameter of the client k, MSE(·) represents the mean square error equation, and e k is the mean square error of the reconstructed local model parameter of the client k;

[0173] Step 6.6: The server calculates the average value of the mean square error of the reconstructed local model parameter of the client k obtained in step 6.5 using formula (15);

[0174]

[0175] where e k is the mean square error of the reconstructed local model parameter of the client k, K is the number of clients after filtering out colluding attackers, and e is the average value of the mean square error of the reconstructed local model parameter of the client k;

[0176] Step 6.7: The server compares the mean square error of the local model parameters reconstructed by the client with the average of the mean square errors obtained from step 6.6; further, if the mean square error of the local model parameters reconstructed by the client is greater than the average of the mean square errors, the client is regarded as a model reordering attacker, and is filtered from the clients filtered out from the colluding attackers obtained through step 5; if the mean square error of the local model parameters reconstructed by the client is less than the average of the mean square errors, the client is a benign client, and is not excluded.

[0177] Step 6.8: The server obtains the clients filtered out from the model reordering attackers through step 6.7.

[0178] In the embodiment, the server first initializes the conditional variational encoder as

[0179] CVAE(input_dim, condition_dim, latent_dim), wherein input_dim is the dimension of the local model gradient value, condition_dim is 1, and latent_dim is 50. The input is the client filtered out from the colluding attackers through step 5; and the output is the client set after excluding the model reordering attackers.

[0180] Step 7: The server corrects the gradient of the excluded malicious client by calculating the relative direction coefficient between the gradient of the excluded malicious client and the average of the gradients of the benign clients;

[0181] Step 7.1: The server obtains the local model gradient value of the remaining k clients filtered out from the Byzantine model attackers, the colluding attackers and the model reordering attackers through step 6, and calculates the local model average gradient value of the remaining benign clients by using formula (16);

[0182]

[0183] wherein, represents the local model gradient value of the kth benign client, M represents the number of the remaining benign clients, t represents the current iteration number, and Δ t represents the local model average gradient value of the remaining benign clients.

[0184] Step 7.2: The server obtains the correction reference direction of the local model gradient value at this time by using formula (17);

[0185]

[0186] wherein, t represents the current iteration number, and Δ t represents the local model average gradient value of the remaining benign clients, and r tthe modified reference direction of the local model gradient value at this moment,

[0187] Step 7.3: The server obtains the filtered local model gradient value of the malicious attacker through steps 4, 5, and 6, and calculates the relative direction coefficient between the local model gradient value of the malicious attacker and the modified reference direction of the local model gradient value using formula (18);

[0188]

[0189] wherein, r t the modified reference direction of the local model gradient value at this moment, the local model gradient value of the malicious attacker, and c is the clipping hyperparameter, the relative direction coefficient between the local model gradient value of the malicious attacker and the modified reference direction of the local model gradient value;

[0190] Step 7.4: The server modifies the local model gradient value of the malicious attacker using formula (19) to obtain the modified local model gradient value of the malicious attacker, which is used to avoid the local gradient tending to the malicious direction while preserving the heterogeneity of the client;

[0191]

[0192] wherein, the local model gradient value of the malicious attacker, the relative direction coefficient between the local model gradient value of the malicious attacker and the modified reference direction of the local model gradient value, r t the modified reference direction of the local model gradient value at this moment, the modified local model gradient value of the malicious attacker;

[0193] In the embodiment, the server receives the filtered gradient of the benign client and calculates the local model average gradient value Δ t Since the participation rate of the client is as high as 50%, the server can approximate the local model gradient direction of all benign clients by calculating the average of the sum of the local model average gradient values of the benign clients at the last moment and at this moment. The server then calculates the relative direction coefficient through the clipping hyperparameter c = 0.005. The input is the local model gradient value of the client and the malicious client after filtering all attackers through step 6. The output is the modified local model gradient value of the attacker.

[0194] Step 8: The server aggregates the malicious gradient modified in step 7 and the benign gradient filtered out of the attacker in step 6, and obtains an optimized global model of federated learning by iteratively performing steps 1 to 7, thereby realizing the federated learning mixed attack data security defense.

[0195] In the embodiment, the server receives the local model gradient value of all benign clients and the modified local model gradient value of all malicious clients The adamw optimizer is used for aggregation, wherein the adamw optimizer learning rate ηη=0.001, and the parameters betas=(0.5, 0.999). The input is the filtered local model gradient value of the benign client and the modified local model gradient value of the attacker; and the output is the global model parameter W t+1 updated in this round.

[0196] The federated learning mixed attack data security defense system disclosed by the application is used to realize the above method. The federated learning mixed attack data security defense system disclosed by the application comprises a client and a server. The client is used for defense processing of inference attacks and processing of mixed training of local models. The server is used for defense processing of Byzantine model attacks, collusion attacks and model disorder attacks and processing of optimization and aggregation of global models. The mixed training local model module of the client is transmitted to the Byzantine model attack defense module and the optimization and aggregation global model module of the server through data interaction communication.

[0197] The client comprises an inference attack defense module and a mixed training local model module.

[0198] The inference attack defense module is used for differential privacy processing operation on the local data set of the client, and outputs a local data set result with label differential privacy. The inference attack defense module is used as the input of the mixed training local model module.

[0199] The mixed training local model module is used for linear mixed training processing operation on the local model of the client, and outputs a local model parameter value and a local model gradient value result. The mixed training local model module is used as the input of the Byzantine model attack defense module of the server.

[0200] The server comprises a Byzantine model attack defense module, a collusion attack defense module, a model disorder attack defense module and an optimization and aggregation global model module.

[0201] The Byzantine model attack defense module is used for clustering processing operation on the local model gradient value of the selected client of the server, and outputs a client result of a filtered Byzantine model attacker. The Byzantine model attack defense module is used as the input of the collusion attack defense module.

[0202] The collusion attack defense module is used to perform maximum connectivity subgraph construction processing on the local model gradient values ​​of the client after excluding Byzantine attackers, and output the client results that filter out collusion attackers; this will be used as the input of the model disorder attack defense module.

[0203] The model out-of-order attack defense module is used to perform outlier detection processing on the local model parameters of the client after excluding Byzantine attackers and colluding attackers, and output the client results that filter out model out-of-order attackers; it will be used as input to the global model optimization and aggregation module.

[0204] The optimized global model module is used to correct the local model gradient values ​​of the excluded malicious clients and aggregate them with the local model gradient values ​​of the filtered benign clients, outputting the global model parameter values; these will be used as input to the client's hybrid training local model module.

[0205] In this embodiment, the client-side inference attack defense module configures gradient inversion attacks on both the server and client. A pseudo-sample x is randomly initialized locally on the client. dum and pseudo-labels y dum A pseudo gradient is obtained by training the received global model parameters. By continuously optimizing the gradient values ​​of the pseudo-model and the real model The distance d between them gradually restores the privacy sample; the attack at the server is similar, where local model parameters are trained. The server's Byzantine model attack defense module is configured with Gaussian attack. and gradient sign inversion attack Where N(0, σ) 2 ) represents the variance as σ 2 =1,000,000 Gaussian noise, g t These are the gradient values ​​of the original local model on the client side. For the malicious model gradient values ​​of the Byzantine model attacker; the server's collusion attack defense module, configured for collusion attacks. Where μ and σ are the mean and standard deviation of the gradient values ​​of all local models of the benign client, and z is a random variable value obtained according to a given probability. To prevent malicious model gradient values ​​from being manipulated on the client side, the server's model out-of-order attack defense module sets the weights and biases of the fully connected layers within the model out of order and performs scaling. Here, W1 and b1 represent the weights and biases in the first fully connected layer of the local model, and r... i r j The rows swapped in W1 and b1 yield W1′ and b1′; W2 and b2 are the weights and biases in the second fully connected layer of the local model, c i c jFor the exchanged column in W2, W2' is obtained, and r is defined i = c i , r j = c j ; the scaling factor is beta=1.04, ReLU(·) is an excitation function, alpha'1 and alpha'2 are excitations in hidden layers of the model x is an input sample.

[0206] The results show that the application solves the technical problems of model attack in the federal learning hybrid attack, which leads to the decrease of model utility and the data security leakage of inference attack.

Claims

1. A data security defense method for federated learning hybrid attacks, characterized in that: Includes the following steps, Step 1: In a round of global model training, the server selects clients randomly and communicates with the selected clients by broadcasting global model parameters. Step 2: Construct a client-local differential privacy dataset for the client selected by the server. This dataset is used by the client to remove model parameters and gradients that contain information from the original data, thereby resisting inference attacks from both the server and the client. Step 2.1: Construct a local dataset containing data samples and classification labels for the clients selected by the server; Step 2.2: Add noise to the classification labels of the local dataset as shown in Equation (1) to form one-hot vectors; h i =h i +Laplace(λ′) (1) Among them, h i It is represented as a one-hot vector of the classification label, Laplace represents the Laplace noise, and λ′ represents the Laplace noise parameter; Step 2.3: Activate the one-hot vector described in Step 2.2 with a softmax layer and use the maximum classification probability as the perturbation label in the manner shown in Equation (2); Where softmax(·) represents the activation of the softmax layer. Indicates a disturbance label; Step 2.4: Construct a client-side local differential privacy dataset by combining the data samples with perturbation labels; Step 3: The server receives the local model parameters and local model gradient values ​​trained locally by the client. Step 3.1: Linearly mix the instances of the differential privacy dataset as shown in Equation (3) and train them locally on the client. x′1=λx1+(1-λ)x2,y′1=λy1+(1-λ)y2 (3) Where λ is the linear mixing parameter, (x1,y1) and (x2,y2) represent two random pairs of instances in the differential privacy dataset, and (x′1,y′1) represents the instance formed by mixing x′1 and y′1. Step 3.2: Obtain local model parameters through local training in the manner shown in equation (4); Among them, w k Here are the local model parameters for client k, where t represents the current iteration number and η represents the learning rate. This represents the gradient of the loss function for the i′-th data point; Step 3.3: Obtain the local model gradient values ​​through local training in the manner shown in Equation (5); Among them, g k Here, t represents the local model gradient value for client k, t represents the current iteration number, and W represents the global model parameters. k For the local model parameters of client k; Step 3.4: Feed back the local model parameters and local model gradient values ​​to the server; Step 4: The server receives feedback information on the local model parameters and local model gradient values ​​of the selected client, performs clustering, and then performs Byzantine model defense on the selected client. Step 5: The server uses the maximum connection subgraph method to defend against collusion attacks on clients that have been filtered out for Byzantine attacks. Step 6: The server defends against model disorder attacks on the client after filtering out Byzantine attackers and colluding attackers by reconstructing the local model parameters of the client. Step 7: The server corrects the gradient of the excluded malicious clients by calculating the relative direction coefficient between the gradient of the excluded malicious clients and the average gradient of the benign clients. Step 7.1: The server obtains the local model gradient values ​​of the remaining benign clients after filtering out Byzantine model attackers, colluding attackers and model disorder attackers through step 6, and calculates the local model average gradient value of the remaining benign clients using Equation (16). in, Let represent the local model gradient value of the k-th benign client, M be the number of remaining benign clients, t be the current iteration number, and Δ be the local model gradient value. t This represents the local model average gradient value of the remaining benign clients; Step 7.2: The server uses equation (17) to obtain the correction reference direction for the local model gradient value at this time; Where t represents the current iteration number, Δ t r represents the local model average gradient value of the remaining benign clients. t This serves as a reference direction for correcting the local model gradient values ​​at this time; Step 7.3: The server obtains the local model gradient value of the filtered malicious attacker through steps 4, 5, and 6, and calculates the relative direction coefficient between the local model gradient value of the malicious attacker and the correction reference direction of the local model gradient value using Equation (18). Where, r t This serves as a reference direction for correcting the gradient values ​​of the local model at this point. Let be the local model gradient value of the malicious attacker, and c be the pruning hyperparameter. This refers to the relative direction coefficient between the local model gradient value of a malicious attacker and the correction reference direction of the local model gradient value; Step 7.4: The server uses Equation (19) to correct the local model gradient value of the malicious attacker, and obtains the local model gradient value after the malicious attacker is corrected. This is used to avoid the local gradient from tending to the malicious direction while preserving the heterogeneity of the client. in, For the local model gradient values ​​of a malicious attacker, r is the relative direction coefficient between the local model gradient value of the malicious attacker and the correction reference direction of the local model gradient value. t This serves as a reference direction for correcting the gradient values ​​of the local model at this point. The local model gradient values ​​corrected by a malicious attacker; Step 8: The server aggregates the malicious gradients corrected in Step 7 and the benign gradients filtered out by attackers in Step 6. By iterating through Steps 1 to 7, an optimized federated learning global model is obtained, thereby achieving data security defense against hybrid attacks using federated learning.

2. The method for data security defense against federated learning hybrid attacks as described in claim 1, characterized in that: Step 4 is implemented as follows: Step 4.1: The server receives the local model gradient values ​​from the selected client via step 3; Step 4.2: The server obtains the local model momentum of a single client by using the method shown in Equation (6); Where, m k Let g be the local model momentum of client k. k Let t be the local model gradient value of client k, t represent the current iteration number, and μ be the parameter for calculating the local model momentum. k This refers to the last round selected by the client. Step 4.3: The server will perform principal component analysis on the local model momentum of the selected client obtained in step 4.2, and use Equation (7) to obtain the dimensionality-reduced set of local model momentum of the client. Where, m k ′ represents the local model momentum of client k after dimensionality reduction, t represents the current iteration number, PCA(·) is the principal component analysis operation, and 0.98 indicates that 98% of the original information is retained after dimensionality reduction; Step 4.4: The server clusters the local model momentum of the selected clients obtained in step 4.2 by using equation (8) to divide the selected clients into two clusters. Here, CL1 and CL2 are two clusters containing clients, and it is stipulated that |CL1|>|CL2|. DBSCAN is a density-based clusterer. This represents the set of local model momentum after dimensionality reduction for the selected client. Step 4.5: The server calculates the similarity between the medians of the two clusters obtained in Step 4.4 using Equation (9); sim=cos(m1,m2) (9) Where m1 and m2 represent the medians of the two clusters CL1 and CL2, cos(·) is the cosine similarity, and sim is the similarity between the two clusters; Step 4.6: The server will compare the similarity between the two clusters obtained in Step 4.5 with the similarity threshold; further, if the similarity is lower than the threshold, the smaller number of client clusters will be considered as malicious attackers, and these attackers will be filtered out; if the similarity is higher than the threshold, no client will be excluded. Step 4.7: The server obtains the client that filters out Byzantine model attackers through step 4.

6.

3. The data security defense method for federated learning hybrid attacks as described in claim 1, characterized in that: Step 5 is implemented as follows: Step 5.1: The server obtains the local model momentum of the client after filtering out Byzantine attackers through step 4; Step 5.2: The server first constructs a graph with nodes representing the selected clients and edges in an empty set; Step 5.3: The server uses equation (10) to obtain the similarity between the local model momentum of any two clients; sim i,j =cos(m i ,m j ) (10) Where, m i ,m j For any two clients, cos(·) represents cosine similarity, and sim i,j Let be the similarity between the local model momentum of any two clients; Step 5.4: The server compares the similarity between the local model momentum of any two clients obtained in Step 5.3 with a similarity threshold; further, if the similarity is greater than the threshold, it is considered that the local model momentum of the two clients is too similar, and an edge is added between the nodes represented by the two clients in the graph created in Step 5.

2. Step 5.5: The server extracts the maximum connected subgraph containing clients with extremely similar local model momentum from the graph obtained in Step 5.4; Step 5.6: The server compares the number of clients in the maximum connection subgraph obtained in Step 5.5 with the number of clients selected by the server in Step 1; further, if the number of clients in the maximum connection subgraph is less than half of the number of clients selected by the server in Step 1, the clients in the maximum connection subgraph are considered to be colluding attackers and are filtered from the clients after filtering out Byzantine attackers obtained in Step 4; otherwise, no client is excluded. Step 5.7: The server uses Step 5.6 to filter out clients that are colluding with attackers.

4. The data security defense method for federated learning hybrid attacks as described in claim 1, characterized in that: Step 6 is implemented as follows: Step 6.1: The server obtains the local model parameters of the client after filtering out colluding attackers through step 5; Step 6.2: The server calculates the geometric median of the local model parameter set of the client obtained in Step 6.1 using Equation (11); Among them, w k Here are the local model parameters for client k, where K is the number of clients filtered out after filtering out colluding attackers, and w geo The geometric median of the local model parameter set for the client; Step 6.3: The server preprocesses the local model parameters of the client obtained in step 6.1 using equation (12) to obtain the proxy local model parameters; In' k =in k -In geo (12) Among them, w k For the local model parameters of client k, w geo w′ is the geometric mean of the local model parameter set for the client. k For the proxy local model parameters of client k; Step 6.4: The server uses equation (13) to reconstruct the local model parameters of the client's proxy to obtain the reconstructed local model parameters; r k =C(w′ k ,t) (13) Among them, w′ k Here, t represents the surrogate local model parameters for client k, t represents the current iteration number, C is a conditional variational autoencoder, and r k The parameters of the local model after reconstruction for client k; Step 6.5: The server uses equation (14) to obtain the mean square error of the local model parameters reconstructed by the client; e k =MSELoss(w k ,r k ) (14) Among them, w k For the local model parameters of client k, r k Let MSE(·) represent the local model parameters after reconstruction for client k, and let e represent the mean square error equation. k The mean square error of reconstructing local model parameters for the client; Step 6.6: The server calculates the average mean square error of the client reconstruction local model parameters obtained in step 6.5 using equation (15); Among them, e k The mean squared error of reconstructing local model parameters for the client, where K is the number of clients filtered out after eliminating colluding attackers. The average mean square error of the reconstructed local model parameters for the client; Step 6.7: The server compares the mean squared error of the client's reconstructed local model parameters with the average mean squared error obtained from Step 6.

6. Further, if the mean squared error of the client's reconstructed local model parameters is greater than the average mean squared error, the client is considered a model disorder attacker and is filtered out from the clients that have been filtered out of collusion attackers in Step 5. If the mean squared error of the client's reconstructed local model parameters is less than the average mean squared error, the client is a benign client and is not excluded. Step 6.8: The server obtains the client that has been filtered out by the model disorder attacker through step 6.

7.

5. A federated learning hybrid attack data security defense system that implements the method described in claim 1, characterized in that: Includes both client and server; The client is used for defense against inference attacks and for processing of hybrid training local models; The server is used for defense against Byzantine model attacks, collusion attacks, and model disorder attacks, as well as for optimizing and aggregating global model processing. The client's hybrid training local model module and the server's optimization and aggregation global model module are transmitted through data interaction communication.

6. The federated learning hybrid attack data security defense system as described in claim 5, characterized in that: The client includes an inference attack defense module and a hybrid training local model module; The inference attack defense module is used to perform differential privacy processing on the client's local dataset and output the local dataset result with labeled differential privacy; this result will be used as the input to the hybrid training local model module. The hybrid training local model module is used to perform linear hybrid training on the client's local model, and output the local model parameter values ​​and local model gradient values; these will serve as the input to the server's optimization aggregation global model module.

7. A federated learning hybrid attack data security defense system as described in claim 5, characterized in that: The server includes a Byzantine model attack defense module, a collusion attack defense module, a model disorder attack defense module, and an optimized aggregated global model module. The Byzantine model attack defense module is used to perform clustering processing on the local model gradient values ​​of the selected client on the server, and output the client results that filter Byzantine model attackers; this will be used as the input of the collusion attack defense module. The collusion attack defense module is used to perform maximum connectivity subgraph construction processing on the local model gradient values ​​of the client after excluding Byzantine attackers, and output the client results that filter out collusion attackers; this will be used as the input of the model disorder attack defense module. The model out-of-order attack defense module is used to perform outlier detection processing on the local model parameters of the client after excluding Byzantine attackers and colluding attackers, and output the client results that filter out model out-of-order attackers. This will be used as input to the module that optimizes the aggregated global model; The optimized global model module is used to correct the local model gradient values ​​of the excluded malicious clients and aggregate them with the local model gradient values ​​of the filtered benign clients, outputting the global model parameter values; these will be used as input to the client's hybrid training local model module.

Images