Federated learning freeloader attack detection method, device, equipment and storage medium

Abstract

A federated learning freeloader attack detection method, device, equipment and storage medium are disclosed, and belong to the technical field of federated learning. The method comprises the following steps: in a reference round, a server obtains a reference gradient of each first client; the parameters of each first client received by the server in the reference round are aggregated to obtain a reference model; in a verification round, after the parameters of the reference model are sent to a plurality of first clients, verification gradients of each first client are obtained; cosine similarities between the reference gradients and the verification gradients of each first client are obtained; based on the cosine similarities, second clients are determined; a zero-knowledge proof algorithm is used to verify the calculation process integrity of each second client, and the second clients that do not pass the calculation process integrity verification are marked as freeloader attackers. The method can accurately detect the freeloader attackers with memory and reuse capabilities.

Description

Technical Field

[0001] This disclosure relates to the field of federated learning technology, and in particular to a method, apparatus, device, and storage medium for detecting federated learning free-rider attacks. Background Technology

[0002] Federated Learning (FL) allows multiple participants to collaboratively train a global model without sharing local data. In this way, clients only need to send their local model updates to the server, which then aggregates the global model, thus preventing the leakage of sensitive data. Free-rider attacks are a type of attack in federated learning. In a free-rider attack, the attacker (a malicious client) reduces computational load, or even skips local training, by directly uploading fake or low-quality model updates, yet still attempts to benefit from improvements to the global model. Free-rider attacks not only severely impact the fairness of incentives in federated learning applications but can also cause the model to fail to converge properly, thereby undermining the stability of the entire federated learning system.

[0003] The free-rider attack detection methods in related technologies can usually only detect regular free-rider attackers, but it is difficult to detect free-rider attackers with memory and reuse capabilities. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, and storage medium for detecting federated learning free-rider attacks, capable of accurately detecting free-rider attackers with memory and reuse capabilities. The technical solution includes at least the following:

[0005] Firstly, a federated learning free-rider attack method is provided, comprising: in a reference round, the server obtains a reference gradient for each first client, the reference gradient being the gradient update of the first client in the reference round, the first client being the client to which the server sends parameters in the reference round; aggregating the parameters received by the server from each first client in the reference round to obtain a reference model; in a verification round, after sending the parameters of the reference model to multiple first clients, obtaining a verification gradient for each first client, the verification gradient being the gradient update of the first client in the verification round, the verification round being the round following the reference round; obtaining the cosine similarity between the reference gradient and the verification gradient of each first client; based on the cosine similarity, determining a second client, the second client being a first client whose cosine similarity is less than a similarity threshold; performing computational process integrity verification on each second client using a zero-knowledge proof algorithm, and marking the second client that fails the computational process integrity verification as a free-rider attacker.

[0006] Optionally, obtaining the cosine similarity between the reference gradient and the verification gradient of each first client includes: calculating the cosine similarity between the reference gradient and the verification gradient of the i-th first client using the following formula:

[0007]

[0008] in, Let be the cosine similarity between the reference gradient and the verification gradient of the i-th first client. Let i be the reference gradient for the first client. For the verification gradient of the i-th first client, This represents the inner product between the reference gradient of the i-th first client and the verification gradient of the i-th first client. This represents the calculation of the reference gradient of the i-th first client. Norm, This represents the computation of the verification gradient for the i-th first client. Norm.

[0009] Optionally, in the reference round, the server obtains the reference gradient of each first client, including: calculating the reference gradient of the i-th first client using the following formula:

[0010]

[0011] in, The parameters sent by the server to the i-th first client in the reference round. The parameter received by the server in the reference round is the i-th parameter fed back by the first client.

[0012] The step of obtaining the verification gradient of each of the first clients includes: calculating the verification gradient of the i-th first client using the following formula:

[0013]

[0014] in, The parameters of the reference model, The parameter is the i-th parameter returned by the first client that the server receives in the verification round.

[0015] Optionally, the third client generates a unique identifier after each training iteration. The third client declares that it has performed N training iterations and that the server has received N identifiers from the third client. The third client is any one of the second clients. The step of verifying the integrity of the computation process using a zero-knowledge proof algorithm for each second client includes: generating a computation key, a verification key, and a verification circuit, and then sending the computation key and the verification circuit to the third client; randomly sampling from the N identifiers to obtain a first identifier set; requesting a proof corresponding to each identifier in the first identifier set from the third client, wherein the proof corresponding to any identifier is generated by the third client based on the computation key and the verification circuit; using the verification key to verify the authenticity of the proof corresponding to each identifier; and determining that the third client is a second client that has failed the integrity verification of the computation process if there is a proof that fails the authenticity verification.

[0016] Secondly, a federated learning free-rider attack device is also provided. During the process of a server sending parameters to clients, the clients receiving parameters in adjacent rounds are different. The device includes: a first acquisition module, used in a reference round, whereby the server acquires a reference gradient for each first client, the reference gradient being the gradient update of the first client in the reference round, and the first client being the client to which the server sends parameters in the reference round; an aggregation module, used to aggregate the parameters received by the server from each first client in the reference round to obtain a reference model; and a second acquisition module, used in a verification round to send the reference gradient to multiple first clients. After determining the model parameters, a verification gradient for each first client is obtained. The verification gradient is the gradient update of the first client in the verification round, and the verification round is the round after the reference round. A third acquisition module is used to obtain the cosine similarity between the reference gradient and the verification gradient of each first client. A second client determination module is used to determine a second client based on the cosine similarity. The second client is a first client whose cosine similarity is less than a similarity threshold. A marking module is used to perform computation process integrity verification on each second client using a zero-knowledge proof algorithm, and to mark the second client that fails the computation process integrity verification as a free-rider attacker.

[0017] Optionally, the third acquisition module is further configured to: calculate the cosine similarity between the reference gradient and the verification gradient of the i-th first client using the following formula:

[0018]

[0019] in, Let be the cosine similarity between the reference gradient and the verification gradient of the i-th first client. Let i be the reference gradient for the first client. For the verification gradient of the i-th first client, This represents the inner product between the reference gradient of the i-th first client and the verification gradient of the i-th first client. This represents the calculation of the reference gradient of the i-th first client. Norm, This represents the computation of the verification gradient for the i-th first client. Norm.

[0020] Optionally, the first acquisition module is further configured to calculate the reference gradient of the i-th first client using the following formula:

[0021]

[0022] in, The parameters sent by the server to the i-th first client in the reference round. The parameter received by the server in the reference round is the i-th parameter fed back by the first client.

[0023] The second acquisition module is further configured to calculate the verification gradient of the i-th first client using the following formula:

[0024]

[0025] in, The parameters of the reference model, The parameter is the i-th parameter returned by the first client that the server receives in the verification round.

[0026] Optionally, the third client generates a unique identifier after each training iteration. The third client declares that it has performed N training iterations and that the server has received N identifiers from the third client. The third client is any one of the second clients. The marking module is further configured to generate a computation key, a verification key, and a verification circuit, and then send the computation key and the verification circuit to the third client; randomly sample from the N identifiers to obtain a first identifier set; request the proof corresponding to each identifier in the first identifier set from the third client, wherein the proof corresponding to any identifier is generated by the third client based on the computation key and the verification circuit; use the verification key to verify the authenticity of the proof corresponding to each identifier; and if there is a proof that fails the authenticity verification, determine that the third client is a second client that has failed the integrity verification of the computation process.

[0027] Thirdly, a computer device is also provided, comprising: a memory and a processor, wherein the memory stores at least one computer program, the at least one computer program being loaded and executed by the processor to perform the federated learning free-rider attack detection method described in the above embodiments.

[0028] Fourthly, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, the at least one computer program being loaded and executed by a processor to perform the federated learning free-rider attack detection method described in the above embodiments.

[0029] Fifthly, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the method described in the first aspect.

[0030] The beneficial effects of the technical solutions provided in this disclosure include at least the following:

[0031] In this embodiment, since the clients receiving parameters in adjacent rounds are different during the server's parameter distribution process, and the parameters distributed in the verification round are the parameters of the reference model (i.e., the parameters distributed in the next round of the reference round), the first client receives the reference model's parameters for the first time, not for the second time. At this point, a free-rider hidden within the first client cannot identify this round as a verification round. Even a free-rider with memory and reuse capabilities cannot perform the action of feeding back the parameters fed back to the server in the reference round to the server again in the verification round without recognizing the verification round; that is, they cannot impersonate the attacker. Therefore, the cosine similarity between the verification gradient and the reference gradient in the verification round for a free-rider with memory and reuse capabilities will be less than the similarity threshold, thus identifying them as a second client. Finally, by sequentially verifying the integrity of the computation process for each second client, the free-rider in federated learning can be identified. The method in this embodiment is particularly suitable for identifying free-riders with memory and reuse capabilities in federated learning. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 A flowchart illustrating a federated learning free-rider attack detection method provided in an exemplary embodiment of this disclosure is shown.

[0034] Figure 2 A flowchart is shown for a federated learning free-rider attack detection method provided in another exemplary embodiment of this disclosure;

[0035] Figure 3 This illustration shows a schematic diagram of the structure of a federated learning free-rider attack detection device provided in an exemplary embodiment of this disclosure;

[0036] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. Detailed Implementation

[0037] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” “third,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “comprising” or “including” and similar terms mean that the elements or objects preceding “comprising” or “including” encompass the elements or objects listed following “comprising” or “including” and their equivalents, but do not exclude other elements or objects.

[0038] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0039] To facilitate understanding of the embodiments of this disclosure, the federated learning and free-rider attacks with memory and reuse capabilities involved in the embodiments of this disclosure will be described below.

[0040] The main process of federated learning includes: the server sending the parameters of the server model in round i to multiple clients; each client, after receiving the parameters, trains its local model based on the received parameters and feeds back the parameters of its trained local model to the server; the server, after receiving the parameters from each client, aggregates these parameters to obtain the parameters of the server model in round i+1. This completes the training of round i, and for round i+1 training, only the parameters of the server model in round i+1 need to be sent.

[0041] A free-rider attack refers to an attacker receiving parameters, reducing or even omitting computation, but still claiming to have performed multiple calculations to the server, and then uploading fake or low-quality model updates. For example, a free-rider attacker might receive a model and perform only 10 iterations of training, but claim to have performed 1000 iterations.

[0042] The free-rider attack detection method in related technologies usually sets a round as a reference round. The server retains the parameters sent by the server in the reference round. In subsequent rounds of the reference round, a verification round is randomly inserted, and the parameters sent by the server in the reference round are sent in the verification round. Then, the similarity between the gradient update of the parameters returned by each client in the reference round and the gradient update of the parameters returned by each client in the verification round is calculated. If the similarity is low, it is considered to be a free-rider attack.

[0043] However, for free-rider attackers with memory and reuse capabilities, they record the parameters sent by the server and the parameters fed back to the server in each round. When such a free-rider attacker receives duplicate parameters, they realize that the server is currently detecting free-riders (i.e., the verification round, e.g., round i) and locate the reference round (i.e., the round with the same parameters sent by the server in round i, e.g., round j). Then, the free-rider attacker will feed back the parameters fed back to the server in the reference round to the server again in the verification round, thus disguising themselves. At this point, the similarity between the gradient update of the parameters fed back by the free-rider attacker in the reference round and the gradient update of the parameters fed back in the verification round will inevitably be high, causing the server to fail to detect the free-rider attacker.

[0044] Figure 1 A flowchart illustrating a federated learning free-rider attack detection method provided in an exemplary embodiment of this disclosure is shown, which can be executed by a computer device. See also Figure 1 The method includes:

[0045] In step 101, in the reference wheel, the reference gradient of each first client is obtained.

[0046] During the process of the server sending parameters to the client, the client receiving the parameters is different in two adjacent rounds.

[0047] For example, all clients participating in federated learning can be divided into M parts. The server sends parameters to the clients in part 1, part 2, ..., part M in rounds 1 to M, respectively. Then, it sends parameters to the clients in part 1, part 2, ..., part M in rounds M+1 to 2M, respectively, and so on, to perform multiple rounds of federated learning. Here, M is a positive integer.

[0048] For example, when M is 2, all clients participating in federated learning are divided into two groups: one group can be the first client, and the other group can be the fourth client. The server can send parameters to the first client in even-numbered rounds and to the fourth client in odd-numbered rounds. Alternatively, the server can send parameters to the second client in even-numbered rounds and to the first client in odd-numbered rounds.

[0049] The reference gradient is the gradient update of the first client in the reference round, where the first client is the client whose parameters are sent by the server in the reference round.

[0050] Optionally, at the beginning of federated learning training, one training round in which the global model has not converged is randomly selected as a reference round. In federated learning, the user's gradient updates to the non-converged global model are more obvious, so the training round in which the global model has not converged at the beginning of training is selected as the reference round.

[0051] In some embodiments, a round may be randomly selected as the reference round.

[0052] In step 102, the parameters received by the server from each first client in the reference round are aggregated to obtain the reference model.

[0053] For example, if the reference round is the r-th round, the parameters received by the server from each first client in the reference round are aggregated to obtain the reference model. The parameters of this reference model are the parameters that the server needs to send to the client in the (r+1)-th round.

[0054] Since the clients receiving parameters in adjacent rounds in this embodiment are different, the first client will not receive the parameters in round (r+1) (because the first client receives the parameters in round r, while the parameters in round (r+1) are sent to other clients).

[0055] In step 103, during the verification round, after sending the parameters of the reference model to multiple first clients, the verification gradient of each first client is obtained.

[0056] The validation gradient is the gradient update of the first client in the validation round, and the validation round is the round after the reference round.

[0057] Here, the verification round is a round randomly inserted after the reference round that does not affect the federated learning computation. The verification round is only used to identify free-rider attackers in the federated learning process.

[0058] In step 104, the cosine similarity between the reference gradient and the verification gradient of each first client is obtained.

[0059] In step 105, the second client is determined based on cosine similarity.

[0060] The second client is the first client whose cosine similarity is less than the similarity threshold.

[0061] In step 106, a zero-knowledge proof algorithm is used to verify the integrity of the computation process for each second client, and the second client that fails the integrity verification of the computation process is marked as a free-rider attacker.

[0062] When M is 2, when verifying whether there is a free-rider attacker in the fourth client using the method in this embodiment of the disclosure, a similar approach to steps 101 to 106 above can also be used, which will be omitted here.

[0063] In this embodiment, since the clients receiving parameters in adjacent rounds are different during the server's parameter distribution process, and the parameters distributed in the verification round are the parameters of the reference model (i.e., the parameters distributed in the next round of the reference round), the first client receives the reference model's parameters for the first time, not for the second time. At this point, a free-rider hidden within the first client cannot identify this round as a verification round. Even a free-rider with memory and reuse capabilities cannot perform the action of feeding back the parameters fed back to the server in the reference round to the server again in the verification round without recognizing the verification round; that is, they cannot impersonate the attacker. Therefore, the cosine similarity between the verification gradient and the reference gradient in the verification round for a free-rider with memory and reuse capabilities will be less than the similarity threshold, thus identifying them as a second client. Finally, by sequentially verifying the integrity of the computation process for each second client, the free-rider in federated learning can be identified. The method in this embodiment is particularly suitable for identifying free-riders with memory and reuse capabilities in federated learning.

[0064] Figure 2 A flowchart illustrating a federated learning free-rider attack detection method provided in another exemplary embodiment of this disclosure is shown, which can be executed by a computer device. See also Figure 2 The method includes:

[0065] In step 201, in the reference round, the reference gradient of each first client is obtained.

[0066] During the process of the server sending parameters to the client, the client receiving the parameters is different in two adjacent rounds.

[0067] For details regarding the reference wheel, please refer to step 101 above; further details are omitted here.

[0068] Optionally, the reference gradient of the i-th first client is calculated using formula (1).

[0069] (1)

[0070] In formula (1), Let i be the reference gradient for the first client. These are the parameters sent by the server to the i-th first client in the reference round. This refers to the parameter received by the server from the i-th first client in the reference round. Here, the parameters sent by the server to each first client in the reference round are the same, all being... .

[0071] In step 202, the parameters received by the server from each first client in the reference round are aggregated to obtain the reference model.

[0072] The process in step 202 can be represented as follows: Where I is the number of the first client, These are the parameters for the reference model. These parameters are the parameters that the server needs to send to the client in round r+1.

[0073] In step 203, during the verification round, after sending the parameters of the reference model to multiple first clients, the verification gradient of each first client is obtained.

[0074] The validation gradient is the gradient update of the first client in the validation round, and the validation round is the round after the reference round.

[0075] The essence of step 203 is that the server first sends the parameters of the reference model to multiple first clients in the verification round, and then the server obtains the parameters fed back by each first client in the verification round, thereby calculating the verification gradient of each first client based on the parameters fed back by each first client in the verification round and the parameters of the reference model.

[0076] Optionally, the verification gradient of the i-th first client is calculated using formula (2).

[0077] (1)

[0078] In formula (2), For the verification gradient of the i-th first client, These are the parameters received by the server from the i-th first client during the verification round. Here, the parameters sent by the server to each first client during the verification round are the same, and are all parameters from the reference model. The meanings of the other parameters in formula (2) are the same as those in formula (1), and will not be elaborated here.

[0079] In step 204, the cosine similarity between the reference gradient and the verification gradient of each first client is obtained.

[0080] Optionally, the cosine similarity between the reference gradient and the verification gradient of the i-th first client can be calculated using formula (3).

[0081] (3)

[0082] In formula (3), Let be the cosine similarity between the reference gradient and the verification gradient of the i-th first client. This represents the inner product between the reference gradient of the i-th first client and the verification gradient of the i-th first client. This represents the calculation of the reference gradient of the i-th first client. Norm, This represents the computation of the verification gradient for the i-th first client. Norm. The meanings of the other parameters in formula (3) are the same as those in formulas (1) and (2), and are omitted here.

[0083] In federated learning systems, the client's local training updates should align with the optimization direction of the reference gradient. The effectiveness of the client-uploaded parameters can be evaluated by calculating the cosine similarity between the gradients of the client-uploaded parameters and the reference gradient. Cosine similarity measures the directional similarity between two vectors, with values ​​ranging from -1 to 1. A higher cosine similarity value indicates a more consistent direction between the two vectors.

[0084] In step 205, the second client is determined based on cosine similarity.

[0085] The second client is the first client whose cosine similarity is less than the similarity threshold.

[0086] For example, the similarity threshold can be in the range of 0.2-0.4, such as 0.2, 0.3 or 0.4.

[0087] If the cosine similarity between the reference gradient and the validation gradient of a first client is less than the similarity threshold, it indicates that the parameters uploaded by the first client are not generated by the real training process, but may be randomly generated or forged by a free-rider. In this case, the client can be marked as the second client. However, there are also cases where a normal first client may have a cosine similarity less than the similarity threshold due to gradient explosion. Therefore, the second client is not necessarily a free-rider, but a suspected free-rider. Step 206 is needed to verify the second client again to identify the free-rider within the second client.

[0088] In step 206, a zero-knowledge proof algorithm is used to verify the integrity of the computation process for each second client, and the second client that fails the integrity verification of the computation process is marked as a free-rider attacker.

[0089] The biggest difference between a free-rider attacker and a normal client is that the actual number of training iterations by a free-rider attacker is far less than the number of iterations they claim. Therefore, a zero-knowledge proof algorithm can be used to verify the integrity of the computation process for each second client to determine whether the number of training iterations claimed by each second client matches the actual number of training iterations.

[0090] The computational integrity verification here only addresses the integrity of the computation process itself, i.e., whether the second client has completed its claimed computational task (number of training iterations), which differs from the traditional concept of data integrity. In federated learning scenarios, since data is solely managed by each participant, there is no issue of storage integrity.

[0091] In this embodiment, the output of any client after one iteration of training is the state of that iteration, and each iteration's state uniquely corresponds to an identifier. For example, the output of client A after the k-th iteration is client A's state during the k-th iteration. A unique identifier can be generated from this state to prove that client A has performed the k-th iteration. Many related technologies exist for implementing the generation of unique identifiers from states, and details are omitted here.

[0092] In this scenario, the third client can implement zero-knowledge proof algorithm to verify the integrity of the computation process based on the following steps: The third client is any one of the second clients. After each training iteration, the third client generates a unique identifier. The third client declares that it has performed N training iterations and that the server has received N identifiers from the third client.

[0093] Step a: After generating the computation key, verification key, and verification circuit, the computation key and verification circuit are sent to the third client.

[0094] There are many methods for implementing the computation key, verification key, and verification circuit, which will not be detailed here.

[0095] For example, the server uses the KeyGen function to generate the computation key and the verification key.

[0096] Here, before the verification circuit is sent to the third client, it needs to be converted into a QAP program (Quadratic Arithmetic Program) to facilitate the implementation of zero-knowledge proof.

[0097] Step b: Randomly sample from N identifiers to obtain the first identifier set.

[0098] One identifier corresponds to one training iteration. Random sampling from N identifiers is used to check the N training iterations. Since N training iterations are usually too numerous to check all of them, random sampling is used to check a portion of the iterations.

[0099] Step c: Request proofs for each identifier in the first identifier set from the third client.

[0100] The proof corresponding to any identifier is generated by a third client based on the computation key and the verification circuit.

[0101] For example, if a certain identifier in the first identifier set corresponds to the k-th iteration of training, then the third client can generate the proof corresponding to that identifier based on the data from the k-th iteration of training, the state of the (k-1)-th iteration, the verification circuit, and the computation key.

[0102] Step d: Use the verification key to verify the authenticity of the proof corresponding to each identifier.

[0103] Verifying the authenticity of the proof corresponding to each identifier using a verification key means using the verification key to determine whether a given identifier and its corresponding proof are the same. If a given identifier and its corresponding proof are the same, then the proof has passed the authenticity verification; if a given identifier and its corresponding proof are different, then the proof has failed the authenticity verification.

[0104] If, during the authenticity verification process, the proof corresponding to each identifier in the first identifier set passes the authenticity verification, it indicates that the iterative training of the third client's claims is genuine, meaning the third client is not a free-rider attacker. If, during the authenticity verification process, the proof corresponding to at least one identifier in the first identifier set fails the authenticity verification, it indicates that the iterative training of the third client's claims contains spurious iterations, meaning the third client is a free-rider attacker.

[0105] Step e: If there is proof that has failed the authenticity verification, the third client is identified as the second client that has failed the integrity verification of the computation process.

[0106] There are many ways to implement the above step ae, so we will omit the details here.

[0107] By performing the above steps ae on each second client, the integrity of the computation process can be verified for each second client, thereby identifying free-rider attackers in the second client.

[0108] For example, if a second client is a free-rider attacker, suppose it claims to have performed 1000 iterations, but actually only 100. When the server executes step ae above on this second client, the client needs to send 1000 identifiers to the server. Of these 1000 identifiers, only 100 are genuine; the remaining 900 must be forged. Only genuine identifiers can pass the authenticity verification in step d; forged identifiers cannot. Therefore, when the server randomly samples the 1000 identifiers sent by the second client and performs authenticity verification on each sampled identifier using step cd, it is highly likely to select forged identifiers that fail the authenticity verification. If forged identifiers are found among the identifiers sent by the second client, then the second client can be identified as a free-rider attacker.

[0109] The following are device embodiments of this application. For details not described in detail in the device embodiments, please refer to the above method embodiments.

[0110] Figure 3 A schematic diagram of a federated learning free-rider attack detection apparatus provided in an exemplary embodiment of this disclosure is shown below. See also: Figure 3 The federated learning free-rider attack detection device 300 includes: a first acquisition module 301, an aggregation module 302, a second acquisition module 303, a third acquisition module 304, a second client determination module 305, and a marking module 306.

[0111] The first acquisition module 301 is used to acquire the reference gradient of each first client in the reference round. The reference gradient is the gradient update of the first client in the reference round. The first client is the client that receives parameters from the server in the reference round.

[0112] The aggregation module 302 is used to aggregate the parameters received by the server from each first client in the reference round to obtain the reference model.

[0113] The second acquisition module 303 is used to acquire the verification gradient of each first client after sending the parameters of the reference model to multiple first clients in the verification round. The verification gradient is the gradient update of the first client in the verification round, and the verification round is the round after the reference round.

[0114] The third acquisition module 304 is used to acquire the cosine similarity between the reference gradient and the verification gradient of each first client.

[0115] The second client determination module 305 is used to determine the second client based on cosine similarity. The second client is the first client whose cosine similarity is less than the similarity threshold.

[0116] The marking module 306 is used to perform computation process integrity verification on each second client using a zero-knowledge proof algorithm, and to mark the second client that fails the computation process integrity verification as a free-rider attacker.

[0117] In the process of the server sending parameters to the client, the client receiving the parameters is different in two adjacent rounds.

[0118] Optionally, the third acquisition module 304 is further configured to: calculate the cosine similarity between the reference gradient and the verification gradient of the i-th first client using the following formula:

[0119]

[0120] in, Let be the cosine similarity between the reference gradient and the verification gradient of the i-th first client. Let i be the reference gradient for the first client. For the verification gradient of the i-th first client, This represents the inner product between the reference gradient of the i-th first client and the verification gradient of the i-th first client. This represents the calculation of the reference gradient of the i-th first client. Norm, This represents the computation of the verification gradient for the i-th first client. Norm.

[0121] Optionally, the first acquisition module 301 is further configured to calculate the reference gradient of the i-th first client using the following formula:

[0122]

[0123] in, These are the parameters sent by the server to the i-th first client in the reference round. This refers to the i-th parameter received by the server from the first client in the reference round;

[0124] The second acquisition module 303 is also used to calculate the verification gradient of the i-th first client using the following formula:

[0125]

[0126] in, For the parameters of the reference model, This refers to the parameter received by the server from the first client in the i-th verification round.

[0127] Optionally, the third client generates a unique identifier after each training iteration. The third client declares that it has performed N training iterations and that the server has received N identifiers from the third client. The third client is any one of the second clients. The marking module 306 is also used to generate a computation key, a verification key, and a verification circuit, and then send the computation key and verification circuit to the third client; randomly sample from the N identifiers to obtain a first identifier set; request the proof corresponding to each identifier in the first identifier set from the third client, where the proof corresponding to any identifier is generated by the third client based on the computation key and the verification circuit; use the verification key to verify the authenticity of the proof corresponding to each identifier; and if there is a proof that fails the authenticity verification, determine that the third client is a second client that failed the integrity verification of the computation process.

[0128] It should be noted that the federated learning free-rider attack detection device provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the federated learning free-rider attack detection device and the federated learning free-rider attack detection method embodiments are based on the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0129] The module division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in the various embodiments of this disclosure can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0130] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device (which may be a personal computer, mobile phone, or communication device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0131] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. For example... Figure 4 As shown, the computer device 400 includes a processor 401 and a memory 402.

[0132] Processor 401 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 401 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 401 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 401 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 401 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0133] The memory 402 may include one or more computer-readable storage media, which may be non-transitory. The memory 402 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 402 are used to store at least one instruction, which is executed by the processor 401 to implement the federated learning free-rider attack detection method provided in this disclosure embodiment.

[0134] Those skilled in the art will understand that Figure 4 The structure shown does not constitute a limitation on computer device 400, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0135] This disclosure also provides a non-transitory computer-readable storage medium, wherein when the instructions in the storage medium are executed by the processor of a computer device, the computer device is able to execute the federated learning free-rider attack detection method provided in this disclosure.

[0136] This disclosure also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the federated learning free-rider attack detection method provided in this disclosure.

[0137] The above description is merely an optional embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. A method for detecting federated learning free-rider attacks, characterized in that, In the process of the server sending parameters to the client, if the client receiving the parameters is different in two consecutive rounds, the method includes: In the reference wheel, the server obtains the reference gradient of each first client, the reference gradient being the gradient update of the first client in the reference wheel, and the first client being the client whose parameters are sent by the server in the reference wheel; The parameters received by the server from each of the first clients in the reference round are aggregated to obtain a reference model; In the verification round, after sending the parameters of the reference model to multiple first clients, the verification gradient of each first client is obtained. The verification gradient is the gradient update of the first client in the verification round, and the verification round is the round after the reference round. Obtain the cosine similarity between the reference gradient and the verification gradient of each of the first clients; Based on the cosine similarity, a second client is determined, which is the first client whose cosine similarity is less than the similarity threshold; For each second client, a zero-knowledge proof algorithm is used to verify the integrity of the computation process, and the second client that fails the integrity verification of the computation process is marked as a free-rider attacker.

2. The method according to claim 1, characterized in that, The step of obtaining the cosine similarity between the reference gradient and the verification gradient of each of the first clients includes: The cosine similarity between the reference gradient and the verification gradient of the i-th first client is calculated using the following formula: in, Let be the cosine similarity between the reference gradient and the verification gradient of the i-th first client. Let i be the reference gradient for the first client. For the verification gradient of the i-th first client, This represents the inner product between the reference gradient of the i-th first client and the verification gradient of the i-th first client. This represents the calculation of the reference gradient of the i-th first client. Norm, This represents the computation of the verification gradient for the i-th first client. Norm.

3. The method according to claim 2, characterized in that, In the reference round, the server obtains the reference gradient for each first client, including: The reference gradient of the i-th first client is calculated using the following formula: in, The parameters sent by the server to the i-th first client in the reference round. The parameter received by the server in the reference round is the i-th parameter fed back by the first client. The step of obtaining the verification gradient for each of the first clients includes: The verification gradient of the i-th first client is calculated using the following formula: in, The parameters of the reference model, The parameter is the i-th parameter returned by the first client that the server receives in the verification round.

4. The method according to any one of claims 1 to 3, characterized in that, The third client generates a unique identifier after each training iteration. The third client declares that it has performed N training iterations and that the server has received N identifiers from the third client. The third client is any one of the second clients. The step of verifying the integrity of the computation process for each of the second clients using a zero-knowledge proof algorithm includes: After generating the computing key, the verification key, and the verification circuit, the computing key and the verification circuit are sent to the third client. A first set of identifiers is obtained by randomly sampling from the N identifiers; The third client is requested to obtain the proof corresponding to each identifier in the first identifier set, and the proof corresponding to any identifier is generated by the third client based on the computing key and the verification circuit. The authenticity of the proof corresponding to each identifier is verified using a verification key; If there is evidence that fails the authenticity verification, the third client is determined to be the second client that failed the integrity verification of the computation process.

5. A federated learning free-rider attack detection device, characterized in that, In the process of the server sending parameters to the client, the client receiving the parameters is different in two adjacent rounds, and the device includes: The first acquisition module is used to acquire, in the reference wheel, the reference gradient of each first client, the reference gradient being the gradient update of the first client in the reference wheel, and the first client being the client whose parameters are sent by the server in the reference wheel; An aggregation module is used to aggregate the parameters received by the server from each of the first clients in the reference round to obtain a reference model; The second acquisition module is used to acquire the verification gradient of each first client after sending the parameters of the reference model to multiple first clients in the verification round. The verification gradient is the gradient update of the first client in the verification round, and the verification round is the round after the reference round. The third acquisition module is used to acquire the cosine similarity between the reference gradient and the verification gradient of each of the first clients; The second client determination module is used to determine a second client based on the cosine similarity, wherein the second client is a first client whose cosine similarity is less than a similarity threshold; The marking module is used to perform computation process integrity verification on each of the second clients using a zero-knowledge proof algorithm, and to mark the second clients that fail the computation process integrity verification as free-rider attackers.

6. The apparatus according to claim 5, characterized in that, The third acquisition module is also used for: The cosine similarity between the reference gradient and the verification gradient of the i-th first client is calculated using the following formula: in, Let be the cosine similarity between the reference gradient and the verification gradient of the i-th first client. Let i be the reference gradient for the first client. For the verification gradient of the i-th first client, This represents the inner product between the reference gradient of the i-th first client and the verification gradient of the i-th first client. This represents the calculation of the reference gradient of the i-th first client. Norm, This represents the computation of the verification gradient for the i-th first client. Norm.

7. The apparatus according to claim 6, characterized in that, The first acquisition module is further configured to calculate the reference gradient of the i-th first client using the following formula: in, The parameters sent by the server to the i-th first client in the reference round. The parameter received by the server in the reference round is the i-th parameter fed back by the first client. The second acquisition module is further configured to calculate the verification gradient of the i-th first client using the following formula: in, The parameters of the reference model, The parameter is the i-th parameter returned by the first client that the server receives in the verification round.

8. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the method according to any one of claims 1 to 4.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the method of any one of claims 1 to 4.

10. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method described in any one of claims 1 to 4.

Images