Backdoor attack method for convolutional neural network federated learning based on gradient adjustment factor

Abstract

This invention proposes a backdoor attack method for convolutional neural network federated learning based on gradient adjustment factors. The implementation steps are as follows: constructing a federated learning system; each client acquiring a training sample set; each client iteratively training its local model; and a central server acquiring the backdoor attack results. During the iterative training of the local model by each client, the malicious client calculates the gradient adjustment factor for each weight parameter using the normal loss value and the backdoor loss value of the local model, and updates the weight parameters based on this adjustment factor. This enhances the update magnitude of key weight parameters for backdoor attacks while weakening the updates of a large number of non-critical weight parameters, thus limiting the overall weight update magnitude. This not only effectively strengthens the backdoor attack but also resembles the gradient update characteristics of a benign client, thereby improving the stealth and persistence of the backdoor attack.

Description

Technical Field

[0001] This invention belongs to the field of federated learning security technology and relates to a backdoor attack method. Specifically, it relates to a backdoor attack method for convolutional neural network federated learning based on gradient adjustment factors, which can be applied to fields such as face recognition, finance, autonomous driving, biology, and chemistry. Background Technology

[0002] With the widespread application of machine learning and deep learning in various fields, model security has gradually attracted increasing attention. Backdoor attacks are a particularly stealthy and destructive attack method. Attackers implant specific "backdoor" samples into the training data, causing the trained model to perform well under normal circumstances, but make incorrect decisions according to the attacker's preset rules when encountering specific triggering conditions. The most significant characteristic of this attack is its stealth; the attack behavior is usually only activated when a specific triggering pattern appears, making it difficult to detect using conventional security detection methods. The implementation of a backdoor attack typically involves several steps: First, the attacker designs a triggering pattern, which could be a small perturbation in an image, certain color markings, or special symbols in text. These triggering patterns usually do not affect the model's normal decisions in most input samples. Next, the attacker injects samples containing these triggering patterns into the training data and deliberately modifies the labels of these samples to be inconsistent with the true labels. In this way, the model learns the association between these incorrect labels and the triggering patterns during training, but still maintains normal performance when processing other normal samples. Finally, the trained model will output incorrect results based on the attacker's expectations when it encounters data with triggering patterns, while it will continue to maintain normal classification function under normal input.

[0003] Federated learning is a distributed machine learning approach that allows multiple devices to train models locally without uploading data to a central server. Each device trains its model based on local data, generates updates (such as weights or gradients), and then sends these updates to a central server. The central server aggregates the updates from all devices to generate a global model. This method effectively protects data privacy while fully utilizing the computing power of distributed devices. The basic process is as follows: First, the central server initializes a global model and distributes it to the participating devices. Each device trains its model based on its local data and calculates updates (such as changes in gradients or weights). These local updates are sent back to the central server, which aggregates all updates using methods such as weighted averaging to generate a new global model. The updated global model is then returned to each device, which continues its local training based on it. This process is repeated until the global model converges or reaches a predetermined training objective. Through this process, federated learning ensures that data remains on the local device, avoiding the risk of data privacy breaches, while simultaneously improving the overall model performance through multiple rounds of local training and model aggregation.

[0004] Attackers can interfere with model training by adding samples with specific "triggers" to the training data on a local device. These samples appear harmless under normal circumstances, but they contain triggers preset by the attacker, typically manifested as specific pixel value patterns in the image—changes that wouldn't be apparent under other conditions. The attacker first adds triggers to some samples on the local device and deliberately alters their labels. Since convolutional neural networks rely primarily on local features for image recognition, these trigger-laden samples don't significantly affect the model's performance on other normal data. Next, the attacker uses this modified data to train the model locally, causing the local model to learn incorrect associations when encountering specific trigger conditions. Once the local model is trained, the device uploads model updates (such as weights or gradients) to a central server. Because the local model has learned the features of the trigger-laden samples, these abnormal updates will affect the training of the global model. The central server aggregates model updates from multiple devices and generates a new global model based on these updates. Although this global model performs well in most cases, it will make incorrect decisions as the attacker expects when encountering input data with triggers.

[0005] However, research shows that backdoor attacks typically have poor persistence; that is, once the attacker stops uploading malicious updates, the backdoor usually does not persist in the global model for long. Furthermore, a central server can easily identify and remove backdoor gradients by deploying defensive aggregation rules. These defense mechanisms can effectively reduce the impact of backdoor attacks on the global model by pruning gradients containing backdoors or excluding them from the aggregation process. To address the aforementioned issues, Harbin Engineering University, for example, disclosed a federated learning backdoor attack method in its patent document "A Method, Program, Device and Storage Medium for Federated Learning Backdoor Attack Based on Learnable Triggers" (Patent Application No.: CN202410508819.2, Publication No.: CN118296597A). The main steps of this method are: (1) creating a local training task for a malicious client; (2) generating learnable triggers based on the local model and a small sample set of backdoor target classes; (3) injecting the learnable triggers into the local data, and implanting the backdoor into the local model during the training process; (4) uploading the local model update, averaging the model update through an aggregator, and transferring the backdoor information to the global model, so that the global model has a backdoor effect while working normally; (5) enhancing the trigger strength during the inference phase. This method improves the persistence of the backdoor by generating learnable triggers using the local model and a small sample set of target classes, and improves the concealment of the backdoor attack by controlling the magnitude of pixel perturbation during the generation of learnable triggers. However, in this method, the malicious client, during local model training, failed to consider the varying contributions of different weight parameters to the backdoor attack, neglecting that only some weights are crucial for the attack and failing to prioritize strengthening these key weights. Furthermore, it updated a large number of redundant weights, weakening the backdoor attack's effectiveness and thus affecting its persistence. Simultaneously, the malicious client did not limit the update magnitude of model parameters during iterative training, leading to excessive backdoor updates. This made it easy for the uploaded model parameters containing the backdoor to be identified and removed by the defense aggregation rules deployed on the central server, thereby weakening the backdoor attack's stealth. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the existing technology and propose a backdoor attack method for convolutional neural network federated learning based on gradient adjustment factor, which is used to solve the technical problems of low persistence and weak concealment of backdoor attacks in the existing technology.

[0007] To achieve the above objectives, the technical solution adopted by the present invention includes the following steps:

[0008] (1) Constructing a federated learning system:

[0009] Construct a federated learning system consisting of a central server and B clients, including N benign clients and K malicious clients. The central server sends a convolutional neural network as a global model to each client, where K ≥ 1, N ≥ 10, and the b-th client is c. b ;

[0010] (2) Each client obtains the training sample set:

[0011] Each client c b Obtain M RGB images containing P target categories, label the targets in each image, and then for each benign client c n The first training sample set D is composed of M RGB images and their labels. n train Each malicious client c k The trigger T is implanted into S RGB images and the image labels are modified. Then, the S RGB images containing the trigger and their modified labels, and J = MS RGB images without the trigger and their labels are combined to form the second training sample set D. k train Where P≥2, M≥200;

[0012] (3) Each client iteratively trains the local model:

[0013] Each client c b The central server sends a global model as a local model, and each malicious client iteratively trains the local model using its own training sample set as input. In each training iteration, each malicious client adjusts the gradient based on a gradient adjustment factor, and then sets the model weights ω of the trained local model. b Uploaded to the central server;

[0014] (4) The central server obtains the results of the backdoor attack:

[0015] The central server processes the model weights ω uploaded by all clients. b Aggregate the data to obtain a weight of ω. global A global model containing backdoor information.

[0016] Compared with the prior art, the present invention has the following advantages:

[0017] In this invention, during the iterative training of the local model by each client, the malicious client calculates the gradient adjustment factor for each weight parameter using the normal loss value and the backdoor loss value of the local model, and updates the weight parameters based on the adjustment factor. This can enhance the update magnitude of the weight parameters that are key to the backdoor attack, while weakening the update of a large number of non-key weight parameters, thus limiting the overall weight update magnitude. This not only effectively strengthens the backdoor attack, but also resembles the gradient update characteristics of a benign client, thereby improving the concealment and persistence of the backdoor attack. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the implementation of the present invention. Detailed Implementation

[0019] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0020] Reference Figure 1 The present invention includes the following steps:

[0021] Step 1) Construct a federated learning system:

[0022] Construct a federated learning system consisting of a central server and B clients, including N benign clients and K malicious clients. The central server sends a convolutional neural network as a global model to each client, where K ≥ 1, N ≥ 10, and the b-th client is c. b ;

[0023] In this example, N = 99, K = 1;

[0024] In this example, the convolutional neural network takes an RGB image as input and extracts features step-by-step through an input layer and two sets of convolutional-pooling layers. The first set of convolutional layers contains 16 3×3 convolutional kernels and uses ReLU as the activation function, followed by downsampling of the feature map through a 2×2 max-pooling layer. The second set of convolutional layers expands the number of convolutional kernels to 32, continues to use the ReLU activation function, and also performs dimensionality reduction through a 2×2 max-pooling layer. After two feature extraction and dimensionality reduction steps, the feature map is flattened into a vector and passed to a fully connected layer with 128 hidden units, using ReLU as the activation function. Finally, the output layer consists of 10 neurons, using the Softmax activation function to map the features to a probability distribution of 10 categories.

[0025] Step 2) Each client obtains the training sample set:

[0026] Each client c b Obtain M RGB images containing P target categories, label the targets in each image, and then for each benign client cn The training sample set D is composed of M RGB images and their labels. n train Each malicious client c k The trigger T is implanted into S RGB images and the image labels are modified. Then, the S RGB images containing the trigger and their modified labels, and J = MS RGB images without the trigger and their labels are combined to form a training sample set D. k train Where P≥2, M≥200;

[0027] In this step, each malicious client c k A trigger T is implanted into S RGB images and the image labels are modified. The image obtained by implanting the trigger T into the s-th RGB image is x. s The implantation method is as follows:

[0028] x s =(1-δ)⊙x+δ⊙T

[0029] Where ⊙ represents the Hadamard product, x represents the image without the implanted trigger T, and δ is the position mask of the trigger.

[0030] The local training sample set used in this embodiment is the training set of the CIFAR-10 universal object color image dataset. The dataset has 10 target categories, P=10, namely: airplane, car, bird, cat, deer, dog, frog, horse, boat and truck, containing a total of 50,000 images. Each image has a pixel size of 32×32, and there are 5,000 images for each target category. In this embodiment, each client is set to have ten target category images, a total of 500 images, i.e., M=500, and the images held by each client are not repeated.

[0031] In this example, S = 100, that is... While choosing an excessively large S can increase the strength of the backdoor attack, it will affect the model's accuracy on the main task. When S exceeds a certain threshold, it may damage the entire model. On the other hand, choosing an excessively small S can make the backdoor attack more covert, but it will weaken the strength of the backdoor attack. In this example, the position mask used is the 3*3 position area in the upper left corner of the image, and the selected trigger is a white block. After the trigger is implanted into the sample, there will be a 3*3 white block in the upper left corner of the sample image.

[0032] Step 3) Each client iteratively trains the local model:

[0033] Each client c bThe central server sends a global model as a local model, and each malicious client trains the local model multiple times using its own training sample set as input. In each training iteration, each malicious client adjusts the gradient based on a gradient adjustment factor, and then sets the model weights ω of the trained local model... b Uploaded to the central server;

[0034] In this step, each client iteratively trains its local model, and the steps are as follows:

[0035] Step 3a) Initialize the number of iterations to v, the maximum number of iterations to V, V≥2, and the weights ω of the local model in the v-th iteration. v It includes O parameters, and sets v = 1;

[0036] In this convolutional neural network example, O = 268,650. These parameters include the weights of the convolutional kernels, the weights of the fully connected layers, and all bias terms. The specific distribution is as follows: First convolutional layer: 16 3×3 convolutional kernels, each with 3 input channels (RGB) and one bias, totaling 448 parameters. Second convolutional layer: 32 3×3 convolutional kernels, each with 16 input channels and one bias, totaling 4,640 parameters. Fully connected layer: The flattened feature size is 8×8×32 = 2,0488, connected to 128 hidden units, plus bias, totaling 262,272 parameters. Output layer: Connects from 128 hidden units to 10 classes, plus bias, totaling 1,290 parameters.

[0037] Step 3b) Each benign client c n Each malicious client c k D respectively n train D k train The first training sample x is used as input to its local model for forward propagation to obtain each first training sample x. m Predicted labels and each second training sample x of the implanted trigger s Predicted Labels and each second training sample x that was not implanted j Predicted labels

[0038] Step 3c) employs the cross-entropy loss function, where each client uses the predicted labels from the training samples. The true class label y corresponding to the training sample m Calculate the normal loss value L of the local model. norm The malicious client predicts the labels of S training samples with implanted triggers. Modified labels corresponding to training samples Predicted labels of J training samples with implanted triggers The true class label y corresponding to the training sample j Calculate the backdoor loss value L of the local model. back and clean loss L clean ;

[0039] The modified label in this example All are 0

[0040] In this step, the normal loss value L norm and backdoor loss value L back and clean loss L clean The calculation formulas are as follows:

[0041]

[0042] Where ∑ represents the summation operation and log represents the logarithmic operation.

[0043] Step 3d) The malicious client accesses L back With model weights ω v The partial derivatives and L clean With ω v Calculation of partial derivatives of ω v The gradient adjustment factor φ for each weight parameter o And based on φ of each weight parameter o Through L back and L clean For ω v o To update, benign clients directly use stochastic gradient descent, through L... norm For ω v o Update, where φ o ω represents the gradient adjustment factor for the o-th parameter of the model weights. v o This represents the o-th parameter in the model weights;

[0044] In this step, the malicious client calculates the gradient adjustment factor. The formula for calculating the gradient adjustment factor of the o-th weight parameter is:

[0045]

[0046] L1 = L back +L clean

[0047] Where, ω v o This represents the o-th parameter of the model weights. `max(·)` calculates the maximum value, and `min(·)` calculates the minimum value. This indicates the partial derivative operation.

[0048] When calculating the gradient adjustment factor, the importance of each weight parameter to the backdoor attack is first assessed by calculating the partial derivative of each weight parameter with respect to the backdoor loss value. Typically, in continuous learning, weight parameters with larger gradients are considered crucial to the current task, while those with smaller gradients are considered to contribute less. In reality, most weight parameters in the model have limited practical effect on the task, with only a few significantly impacting model performance. Therefore, the gradient adjustment factor is designed to effectively enhance the persistence of backdoor attacks by assigning larger adjustment values ​​to important weight parameters and very small adjustment values ​​to redundant or unimportant weight parameters. To further enhance the stealth of backdoor attacks, the gradient adjustment factor calculation also incorporates the L2L2 norm of the normal loss value and the partial derivatives of the model weights with respect to that loss. Specifically, by introducing this reference mechanism, the optimization direction of the normal task can be considered simultaneously when updating the backdoor loss, avoiding excessive deviation from the parameter distribution of the normal model. This adjustment method ensures that the performance of the finally trained model is close to that of a benign model while maintaining the effectiveness of the backdoor attack, making the attack more difficult to detect. Overall, the gradient adjustment factor not only enhances the effectiveness of backdoor attacks but also improves the stealth and persistence of attacks through meticulous adjustments in loss updates, making the model more difficult to identify or defend against in practical applications. This method provides an optimization strategy that combines effectiveness and stealth for implementing backdoor attacks.

[0049] In this step, based on φ for each weight parameter o Through L back and L clean For ω v o The update formula is as follows:

[0050]

[0051] Where η represents the learning rate, and ω represents the learning rate. v+1 o Represents ω v o The updated results.

[0052] In this step, via L norm For ω v o The update is performed using the following formula:

[0053]

[0054] Where, ω v+1 Represents ωv The updated results;

[0055] In this example, η = 0.02;

[0056] Compared to stochastic gradient updates, updating each parameter using gradient adjustment factors offers significant advantages. Stochastic gradient updates treat all weight parameters in the model equally, failing to effectively differentiate their importance, while only a small portion of these weights play a crucial role in the main or attack task. In contrast, gradient adjustment factors allocate values ​​based on each weight parameter's gradient contribution relative to a specific task (e.g., backdoor attacks), assigning larger adjustment values ​​to important weights and ensuring these key parameters are prioritized for optimization during training. Simultaneously, assigning minimal adjustment values ​​to redundant parameters effectively reduces perturbations from irrelevant parameters, avoiding negative impacts on overall model performance. This approach not only improves training efficiency but also significantly enhances the persistence and stealth of attacks in backdoor attack scenarios, making the final model more difficult to detect.

[0057] Step 3e) Determine if v = V is true. If yes, obtain the trained model weights ω. b If the local model is not found, then let v = v + 1 and proceed to step 3b).

[0058] Step 4) The central server obtains the backdoor attack results:

[0059] The central server processes the model weights ω uploaded by all clients. b Aggregate the data to obtain a weight of ω. global A global model containing backdoor information.

[0060] In this step, the central server aggregates the model weights uploaded by all clients using the following aggregation formula:

[0061]

Claims

1. A method for backdoor attack on federated learning of convolutional neural networks based on gradient adjustment factors, characterized in that, The method comprises the following steps: (1) constructing a federated learning system: A federated learning system is constructed, which comprises a central server and a plurality of clients consisting of a plurality of benign clients and a plurality of malicious clients , the central server sends a convolutional neural network as a global model to each client, wherein , , the first client is ; (2) each client obtains a training sample set: each client obtains a plurality of RGB images including target categories, and labels the targets in each of the images, and then each benign client forms a first training sample set by combining the plurality of RGB images and their labels , and each malicious client implants a trigger into the plurality of RGB images and modifies the labels of the images, and then forms a second training sample set by combining the plurality of RGB images containing the trigger and their modified labels, and the plurality of RGB images not containing the trigger and their labels ;​​​​​​​​ (3) each client iteratively trains a local model: Each client The central server will send the global model as a local model, and its own training sample set as the input of the local model to iteratively train it. Each malicious client adjusts the gradient based on the gradient adjustment factor in each training, and then uploads the model weight of the trained local model to the central server, wherein the gradient adjustment factor of each weight parameter is The formula for calculating the gradient adjustment factor of each weight parameter is: ​ ； ； in, The first value represents the weight of the model. One parameter, This represents the operation to find the maximum value. This represents the operation of finding the minimum value. This indicates the partial derivative operation. , These represent the backdoor loss and clean loss of the local model, respectively. Indicates the first The weights of the local model in the next iteration; (4) the central server obtains the backdoor attack result: The central server aggregates all the model weight uploaded by the clients to obtain a global model with backdoor information with weight .

2. The method of claim 1, wherein, The global model in step (1) comprises a stacked input layer, a plurality of convolution-pooling layers, and a fully connected layer.

3. The method of claim 1, wherein, each of the malicious clients in step (2) triggers implanted into the RGB image and modify the annotation of the image, wherein the trigger implanted into the first the image obtained from the first implantation method is: ； wherein, denotes a Hadamard product, denotes an image of a flip-flop that is not implanted, is a position mask of the flip-flop.

4. The method of claim 1, wherein, The implementation step of the iterative training of the local model by each client in step (3) is: (3a) initialize the iteration number as , the maximum iteration number as , , the weight of the local model in the th iteration as including parameters, and let ; (3b) each benign client , each malicious client respectively forward-propagates , as input of its own local model to obtain a predicted label for each first training sample , a predicted label for each second training sample with implanted trigger, and a predicted label for each second training sample without implantation; (3c) using a cross-entropy loss function, each client computes a normal loss value of the local model by the predicted label of the training sample and the real class label corresponding to the training sample , the malicious client computes a backdoor loss value of the local model by the predicted label of the training sample and the modified label corresponding to the training sample , the predicted label of the training sample and the real class label corresponding to the training sample , and the clean loss ; (3d) malicious clients pass through the partial derivative of the model weight with respect to the partial derivative of the model weight with respect to the gradient adjustment factor of each weight parameter , and update based on the gradient adjustment factor of each weight parameter by and , benign clients directly participate in the random gradient descent method, update by , wherein represents the gradient adjustment factor of the model weight th parameter, represents the model weight th parameter; (3e) judge whether or not is true, if yes, get the trained model weight as the local model, otherwise, let and execute step (3b).

5. The method of claim 4, wherein, The normal loss value described in step (3c) and the backdoor loss value and the clean loss , respectively. ； ； ； wherein represents summing operation, represents a logarithm operation.

6. The method of claim 4, wherein, The updating of the above-mentioned by 、 and in step (3d) is given by the formula: ​ ； wherein, denotes learning rate, denotes the update result of 7. The method of claim 4, wherein, by the process described in step (3d) is updated by the formula is updated by the formula ； wherein represents the update result.

8. The method of claim 1, wherein, The aggregation formula of the model weight uploaded by all clients by the central server in step (4) is: 。

Images