Backdoor detection and repair method and system for vertical federated learning

Abstract

The present invention provides a backdoor detection and repair method and system for vertical federated learning, which relates to the field of data processing. The method includes: obtaining an auxiliary dataset including a complete sample; constructing K-1 alternative models to simulate the feature extraction models held by other participants, and updating the alternative models, the locally held feature extraction model, and the task output model based on the auxiliary dataset; obtaining a local embedding vector based on the complete sample features and the locally held updated feature extraction model, and obtaining the embedding vector to be detected generated by the other participants; combining the embedding vector to be detected and the local embedding vector and inputting it into the updated task output model to obtain a prediction result, and determining the backdoor embedding vector based on the prediction result; and repairing the backdoor embedding vector based on the locally held updated feature extraction model and the alternative model corresponding to the backdoor embedding vector. The present invention can detect and repair backdoors in vertical federated learning systems.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a backdoor detection and repair method and system for vertical federated learning. Background Art

[0002] Traditional machine learning training requires service providers to collect user information for centralized training. However, user data is closely related to sensitive user information. If this information is leaked or exploited by service providers during the collection process, it will directly threaten the user's personal information security. Contradictory to this, the machine learning training process relies on the collection and fusion of large amounts of data. Without access to rich information to train the model, the model's performance will be greatly limited. Against the backdrop of the growing contradiction between data silos and the need for data fusion, vertical federated learning technology has emerged. Vertical federated learning allows multiple participants holding the same samples but different features to collaborate on learning by exchanging model embeddings. This solution does not require participants to transfer original data, improving the performance of machine learning models while avoiding the leakage of local privacy data.

[0003] Although existing vertical federated learning systems have achieved comparable performance, they are still vulnerable to backdoor attacks. In a backdoor attack in vertical federated learning scenarios, a malicious party may upload tampered embeddings to misclassify the model into the target category specified by the attacker. Summary of the Invention

[0004] The present invention provides a backdoor detection and repair method and system for vertical federated learning, which is used to address the defect of backdoor attack threats in vertical federated learning systems in the prior art and to detect and repair backdoor attacks in vertical federated learning systems.

[0005] The present invention provides a backdoor detection and repair method for vertical federated learning, comprising:

[0006] Acquire an auxiliary data set, where the auxiliary data set includes multiple complete samples, each of which includes complete sample features and corresponding labels;

[0007] Construct K-1 surrogate models, which are used to simulate the feature extraction models held by the other participants in the vertical federated learning. Update the surrogate models and the feature extraction model and task output model held by the local participants based on the auxiliary dataset, where K is the number of participants in the vertical federated learning.

[0008] Based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, a local embedding vector is obtained, and the embedding vector to be detected generated by each of the remaining participants based on the object to be predicted is obtained;

[0009] Inputting a detection vector combination into the updated task output model to obtain prediction results output by the task output model, and determining a backdoor embedding vector based on the prediction results, wherein the detection vector combination includes the local embedding vector and one of the embedding vectors to be detected;

[0010] The backdoor embedding vector is repaired based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector.

[0011] According to a backdoor detection and repair method for vertical federated learning provided by the present invention, the updating of the replacement model and the feature extraction model and task output model held by the local participant based on the auxiliary dataset includes:

[0012] The surrogate model, the feature extraction model held by the local participant, and the task output model are updated based on the following optimization objectives:

[0013] ;

[0014] in, represents the parameters of the feature extraction model held by the local party, denote the parameters of the surrogate model, represents the task output model, Represents the label in the auxiliary dataset. When k=1, Represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participant. When k=2,…,K, represents the sample features extracted from the complete sample features according to the feature dimensions held by the participant corresponding to the kth alternative model, Used to measure the difference between A and B.

[0015] According to a backdoor detection and repair method for vertical federated learning provided by the present invention, obtaining a local embedding vector based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant includes:

[0016] The complete sample features corresponding to multiple categories are sampled in the auxiliary data set, partial sample features are determined based on the feature dimensions corresponding to the local participant in the complete sample features obtained by sampling, and each of the partial sample features is input into the updated feature extraction model held by the local participant to obtain the local embedding vector corresponding to each category.

[0017] According to a backdoor detection and repair method for vertical federated learning provided by the present invention, determining a backdoor embedding vector based on the prediction result includes:

[0018] Calculating an entropy value based on the prediction result, where the entropy value reflects the credibility of the embedded vector to be detected in the detection vector combination;

[0019] When the entropy value is less than a preset threshold, it is determined that the embedded vector to be detected included in the detection vector combination is the backdoor embedded vector.

[0020] According to a backdoor detection and repair method for vertical federated learning provided by the present invention, the entropy value is calculated based on the prediction result, including:

[0021] The entropy value is calculated based on the following formula:

[0022] ;

[0023] Where C represents the number of categories, Indicates the prediction result corresponds to the probability of category j, , represents the updated task output model, represents the local embedding vector corresponding to the i-th category, represents the embedding vector to be detected of the kth participant.

[0024] According to a backdoor detection and repair method for vertical federated learning provided by the present invention, the backdoor embedding vector is repaired based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector, including:

[0025] The backdoor embedding vector is repaired based on the following formula:

[0026] ;

[0027] in, represents the repaired backdoor embedding vector, represents the embedding vector extracted by the local participant for the object to be predicted based on the updated feature extraction model held by the local participant, , when k=1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participant, represents the updated feature extraction model held by the local participant. When k=2,…,K-1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the participant corresponding to the kth alternative model, represents the updated k-th alternative model held by the local participant, and d represents the embedding dimension of the local participant.

[0028] The present invention also provides a backdoor detection and repair system for vertical federated learning, comprising:

[0029] An auxiliary data set construction module is used to obtain an auxiliary data set, wherein the auxiliary data set includes multiple complete samples, and the complete samples include complete sample features and corresponding labels;

[0030] A local model update module is used to construct K-1 surrogate models, which are used to simulate the feature extraction models held by the other participants in the vertical federated learning. The surrogate models and the feature extraction models and task output models held by the local participants are updated based on the auxiliary dataset. K is the number of participants in the vertical federated learning.

[0031] An embedding vector acquisition module, configured to obtain a local embedding vector based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, and to obtain the embedding vector to be detected generated by each of the remaining participants based on the object to be predicted;

[0032] a backdoor detection module, configured to input a detection vector combination into the updated task output model to obtain prediction results output by the task output model, and determine a backdoor embedding vector based on the prediction results, wherein the detection vector combination includes the local embedding vector and one of the embedding vectors to be detected;

[0033] A backdoor repair module is used to repair the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector.

[0034] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, any one of the above-mentioned backdoor detection and repair methods for vertical federated learning is implemented.

[0035] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned backdoor detection and repair methods for vertical federated learning.

[0036] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned backdoor detection and repair methods for vertical federated learning.

[0037] The present invention provides a backdoor detection and repair method and system for vertical federated learning. The method and system construct an auxiliary data set including complete sample features locally at the active participant, train the local feature extraction model and task output model based on the auxiliary data set, and train an alternative model for simulating the feature extraction models held by other participants. According to the updated feature extraction model held by the local participant, a local embedding vector is obtained, and the embedding vector to be detected generated by the other participants based on the object to be predicted is obtained. The local embedding vector and the embedding vector to be detected are combined and input into the updated task output model. Based on the prediction result output by the task output model, it is determined whether the embedding vector to be detected is a post-text embedding vector. The backdoor embedding vector is repaired based on the updated feature extraction model held by the local participant and the alternative model corresponding to the backdoor embedding vector, thereby realizing backdoor detection and repair in the vertical federated learning system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 This is a flow chart of the backdoor detection and repair method for vertical federated learning provided by the present invention.

[0040] Figure 2 This is an algorithm logic block diagram of the backdoor detection and repair method for vertical federated learning provided by the present invention.

[0041] Figure 3 This is a structural diagram of the backdoor detection and repair system for vertical federated learning provided by the present invention.

[0042] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0043] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0044] The following combination Figure 1-Figure 2 Describe the backdoor detection and repair method for vertical federated learning provided by the present invention, such as Figure 1 As shown, the method includes the steps of:

[0045] S110: Acquire an auxiliary data set, where the auxiliary data set includes multiple complete samples, each of which includes complete sample features and corresponding labels.

[0046] S120. Construct K-1 surrogate models, which are used to simulate the feature extraction models held by the other participants in the vertical federated learning. Update the surrogate models and the feature extraction models and task output models held by the local participants based on the auxiliary dataset. K is the number of participants in the vertical federated learning.

[0047] S130: Based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, a local embedding vector is obtained, and embedding vectors to be detected generated by each of the remaining participants based on the object to be predicted are obtained;

[0048] S140: Input the detection vector combination into the updated task output model to obtain prediction results output by the task output model, and determine the backdoor embedding vector based on the prediction results. The detection vector combination includes the local embedding vector and an embedding vector to be detected.

[0049] S150: Repair the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector.

[0050] The method provided by the present invention constructs an auxiliary data set including complete sample features locally at the active participant, trains the local feature extraction model and task output model based on the auxiliary data set, and trains an alternative model for simulating the feature extraction models held by other participants. According to the updated feature extraction model held by the local participant, a local embedding vector is obtained, and the embedding vector to be detected generated by the other participants based on the object to be predicted is obtained. The local embedding vector and the embedding vector to be detected are combined and input into the updated task output model. Based on the prediction result output by the task output model, it is determined whether the embedding vector to be detected is the back-text embedding vector. Based on the updated feature extraction model held by the local participant and the alternative model corresponding to the backdoor embedding vector, the backdoor embedding vector is repaired, thereby realizing backdoor detection and repair in the vertical federated learning system.

[0051] The method provided by the present invention is executed by the terminal corresponding to the active participant of vertical federated learning. For ease of understanding, a brief introduction to the vertical federated learning system is first given. There are K participants in the vertical federated learning system, one of which is an active participant, and the remaining participants can be called passive participants. The active participant wants to train a model to perform classification tasks, but the active participant may not hold a large number of complete sample features to support the training of the complete model. For example, assuming that the active participant is a social platform, it wants to classify users. In addition to the user's social data features, it also requires the user's data features on other platforms (such as e-commerce platforms). However, for the sake of user sensitive data security, the e-commerce platform may not provide this data to the social platform. Vertical federated learning can solve this problem. In vertical federated learning, each participant collaborates for training but does not involve the exchange of original data between the participants. Specifically, in the vertical federated learning system, each participant holds a feature extraction model locally. In addition to the feature extraction model, the active participant also holds a task output model. For the same object, participants other than the active participant perform feature extraction on part of the feature data of the object held locally based on the locally held feature extraction model to obtain an embedding vector, and send the embedding vector to the active participant. The active participant performs feature extraction on part of the feature data of the object held locally based on the locally held feature extraction model to obtain an embedding vector and combines it with the embedding vectors sent by other participants to obtain a complete embedding vector. The complete embedding vector is input into the task output model to obtain the prediction result output by the task output model, which reflects the category of the object.

[0052] The method provided by the present invention is to prevent malicious participants from being present among participants other than the active participant. When an embedding vector is sent to the active participant, the embedded vector sent is not the correct embedding vector, but a tampered backdoor embedding vector. The active participant can use the method provided by the present invention to detect the embedded vectors sent by other participants, identify the backdoor embedding vector, and repair it.

[0053] Specifically, the active participant constructs an auxiliary data set locally, which includes multiple complete samples. The complete samples include complete sample features and corresponding labels. In actual applications, although the active participant cannot obtain a large number of complete sample features that can be used to support the model from initialization to training, it may be possible to obtain some complete sample features, based on which an auxiliary data set can be constructed. As mentioned in the example above, when the active participant is a social platform, it cannot obtain a large number of e-commerce data features from other platforms to form the complete features of the user, but it can obtain some e-commerce data features through other legal channels, thereby obtaining the complete features of some users. For example, it can obtain the complete sample features of some users by conducting questionnaires on its employees or some authorized users, so that an auxiliary data set can be constructed.

[0054] The local participant who performs the method provided by the present invention, i.e. the active participant, uses the auxiliary data set held locally and locally held trained feature extraction models And the task output model , build Alternative models Each surrogate model corresponds to one of the remaining participants. The input dimension of the surrogate model is consistent with the data feature dimension held locally by the corresponding participant. The model parameters are fine-tuned through the following optimization objectives to update the surrogate model and the feature extraction model and task output model held by the local participant:

[0055] ;

[0056] in, represents the parameters of the feature extraction model held by the local party, denote the parameters of the surrogate model, represents the task output model, Represents the label in the auxiliary dataset. When k=1, Represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participant. When k=2,…,K-1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the participant corresponding to the kth alternative model, Used to measure the difference between A and B.

[0057] Active participants fine-tune the model parameters according to the above training objectives and obtain , when k=1, represents the updated parameters of the feature extraction model held locally by the active participant. When k=2,…,K, represents the updated parameters of the substitution model corresponding to the kth participant, represents the updated parameters of the task output model held locally by the active participant. The active participant can also extract the relevance embedding vector based on the updated alternative model ,in Indicates that Import into updated alternative model After processing, the embedded vector is output.

[0058] After updating the model held by the local participant, the local embedding vector is obtained based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, and the embedding vectors to be detected generated by each other participant based on the object to be predicted are obtained. Then, based on the local embedding vector and the embedding vector to be detected, it is determined whether the embedding vector to be detected is a backdoor embedding vector.

[0059] Specifically, based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, a local embedding vector is obtained, including:

[0060] Complete sample features corresponding to multiple categories are sampled in the auxiliary dataset, and partial sample features are determined based on the feature dimensions corresponding to the local participants in the complete sample features obtained by sampling. After the partial sample features are input into the updated feature extraction model held by the local participants, the local embedding vectors corresponding to each category are obtained.

[0061] like Figure 2 As shown, local participants from the auxiliary dataset mid-sampling Inputs of different categories, extract corresponding embedding vectors as a local embedding vector, that is, It is the embedding vector output by the local feature extraction model after sampling the complete sample features of the i-th category in the auxiliary dataset and extracting the corresponding features from the complete sample features based on the input dimension of the local feature extraction model and inputting them into the locally held feature extraction model.

[0062] For the local embedding vector corresponding to the i-th category, compare it with the received Embedding vector of Combine to get the detection vector combination ,in Represents a 0 vector, that is, the detection vector combination is filled into the input dimension of the task output model. The detection vector combination is input into the task output model to obtain the prediction result of the task output model output. The backdoor embedding vector is determined based on the prediction result, specifically including:

[0063] Calculate the entropy value based on the prediction results. The entropy value reflects the credibility of the embedded vector to be detected in the detection vector combination.

[0064] When the entropy value is less than a preset threshold, it is determined that the embedded vector to be detected included in the detection vector combination is a backdoor embedded vector.

[0065] The entropy value corresponding to the kth participant The calculation formula is:

[0066] ;

[0067] Where C represents the number of categories, Represents the prediction results corresponds to the probability of category j, , represents the updated task output model, represents the local embedding vector corresponding to the i-th category, represents the embedding vector to be detected for the kth participant.

[0068] Active participants set the backdoor embedding detection threshold , the threshold can be obtained through experimental testing or calculated based on data in the longitudinal federated learning process.

[0069] The active participant initializes the mask vector , the length is , the initial value is all 0; the active participant determines that if the entropy value is less than the pre-set threshold, that is , then the mask Set to 1 and mark is the detected backdoor embedding vector.

[0070] The detected backdoor embedding vector can be restored using a locally held replacement model. Specifically, based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector, the backdoor embedding vector is repaired, including:

[0071] The backdoor embedding vector is repaired based on the following formula:

[0072] ;

[0073] in, represents the repaired backdoor embedding vector, Represents the embedding vector extracted by the local participant for the predicted object based on the updated feature extraction model held. , when k=1, Represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participants, represents the updated feature extraction model held by the local participant. When k=2,…,K-1, Represents the sample features extracted from the complete sample features according to the feature dimensions held by the participants corresponding to the k-th alternative model, represents the updated k-th alternative model held by the local participant, and d represents the embedding dimension of the local participant.

[0074] The repaired embedding vector is combined with the remaining non-backdoor embedding vectors and input into the task output model for model inference to obtain the output result.

[0075] The following describes the backdoor detection and repair system for vertical federated learning provided by the present invention. The backdoor detection and repair system for vertical federated learning described below and the backdoor detection and repair method for vertical federated learning described above can be used for reference. Figure 3 As shown, the backdoor detection and repair system for vertical federated learning provided by the present invention includes:

[0076] An auxiliary data set construction module 310 is used to obtain an auxiliary data set, where the auxiliary data set includes multiple complete samples, each of which includes complete sample features and corresponding labels;

[0077] A local model update module 320 is configured to construct K-1 surrogate models, which are used to simulate the feature extraction models held by the remaining participants in the vertical federated learning. The surrogate models, as well as the feature extraction models and task output models held by the local participants, are updated based on the auxiliary dataset, where K is the number of participants in the vertical federated learning.

[0078] Embedding vector acquisition module 330, used to obtain a local embedding vector based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, and obtain the embedding vector to be detected generated by each other participant based on the object to be predicted;

[0079] A backdoor detection module 340 is configured to input a detection vector combination into the updated task output model, obtain prediction results of the task output model, and determine a backdoor embedding vector based on the prediction results. The detection vector combination includes a local embedding vector and an embedding vector to be detected.

[0080] The backdoor repair module 350 is used to repair the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector.

[0081] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4 As shown, the electronic device may include: a processor (processor) 410, a communication interface (Communications Interface) 420, a memory (memory) 430 and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call the logic instructions in the memory 430 to execute the backdoor detection and repair method for vertical federated learning, which includes: obtaining an auxiliary data set, the auxiliary data set including multiple complete samples, the complete samples including complete sample features and corresponding labels; constructing K-1 replacement models, the replacement models are used to simulate the feature extraction models held by the other participants of the vertical federated learning, and the replacement models and the feature extraction models and task output models held by the local participants are updated based on the auxiliary data set, where K is the number of participants participating in the vertical federated learning; based on the complete sample features in the auxiliary data set and the updated feature extraction model held by the local participants, a local embedding vector is obtained, and the embedding vectors to be detected generated by each of the other participants based on the object to be predicted are obtained; the detection vector combination is input into the updated task output model to obtain each prediction result output by the task output model, and the backdoor embedding vector is determined based on the prediction result, the detection vector combination includes the local embedding vector and an embedding vector to be detected; based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector, the backdoor embedding vector is repaired.

[0082] Furthermore, the logic instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0083] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the backdoor detection and repair method for vertical federated learning provided by the above methods. The backdoor detection and repair method for vertical federated learning includes: obtaining an auxiliary data set, which includes multiple complete samples, and the complete samples include complete sample features and corresponding labels; constructing K-1 substitution models, which are used to simulate the feature extraction models held by other participants in the vertical federated learning, and based on the auxiliary data set, the substitution model and the feature extraction models held by the local participants are simulated. Some feature extraction models and task output models are updated, where K is the number of participants participating in vertical federated learning; based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, the local embedding vector is obtained, and the embedding vectors to be detected generated by each remaining participant based on the object to be predicted are obtained; the detection vector combination is input into the updated task output model to obtain the various prediction results output by the task output model, and the backdoor embedding vector is determined based on the prediction results. The detection vector combination includes the local embedding vector and an embedding vector to be detected; based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector, the backdoor embedding vector is repaired.

[0084] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute the backdoor detection and repair method for vertical federated learning provided by the above methods, and the backdoor detection and repair method for vertical federated learning includes: obtaining an auxiliary data set, the auxiliary data set including multiple complete samples, the complete samples including complete sample features and corresponding labels; constructing K-1 substitution models, the substitution models are used to simulate the feature extraction models held by other participants in the vertical federated learning, and the substitution models and the feature extraction models and task output models held by the local participants are simulated based on the auxiliary data set. Update, where K is the number of participants in vertical federated learning; based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, obtain the local embedding vector, and obtain the embedding vectors to be detected generated by each other participant based on the object to be predicted; input the detection vector combination into the updated task output model to obtain the various prediction results output by the task output model, and determine the backdoor embedding vector based on the prediction results. The detection vector combination includes the local embedding vector and an embedding vector to be detected; based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector, repair the backdoor embedding vector.

[0085] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0086] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A backdoor detection and repair method for vertical federated learning, characterized by: include: Acquire an auxiliary data set, where the auxiliary data set includes multiple complete samples, each of which includes complete sample features and corresponding labels; Construct K-1 surrogate models, which are used to simulate the feature extraction models held by the other participants in the vertical federated learning. Update the surrogate models and the feature extraction model and task output model held by the local participants based on the auxiliary dataset, where K is the number of participants in the vertical federated learning. Based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, a local embedding vector is obtained, and the embedding vector to be detected generated by each of the remaining participants based on the object to be predicted is obtained; Inputting a detection vector combination into the updated task output model to obtain prediction results output by the task output model, and determining a backdoor embedding vector based on the prediction results, wherein the detection vector combination includes the local embedding vector and one of the embedding vectors to be detected; Repairing the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector; The determining of the backdoor embedding vector based on the prediction result includes: Calculating an entropy value based on the prediction result, where the entropy value reflects the credibility of the embedded vector to be detected in the detection vector combination; When the entropy value is less than a preset threshold, determining that the embedded vector to be detected included in the detection vector combination is the backdoor embedded vector; The repairing of the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector includes: The backdoor embedding vector is repaired based on the following formula: ； in, represents the repaired backdoor embedding vector, represents the embedding vector extracted by the local participant for the object to be predicted based on the updated feature extraction model held by the local participant, , when k=1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participant, represents the updated feature extraction model held by the local participant. When k=2,…,K-1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the participant corresponding to the kth alternative model, represents the updated k-th alternative model held by the local participant, and d represents the embedding dimension of the local participant.

2. The backdoor detection and repair method for vertical federated learning according to claim 1 is characterized in that: The updating of the replacement model and the feature extraction model and the task output model held by the local participant based on the auxiliary data set includes: The surrogate model, the feature extraction model held by the local participant, and the task output model are updated based on the following optimization objectives: ； in, represents the parameters of the feature extraction model held by the local party, denote the parameters of the surrogate model, represents the task output model, represents the feature extraction model held by the local party, represents the alternative model, Represents the label in the auxiliary dataset. When k=1, Represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participant. When k=2,…,K, represents the sample features extracted from the complete sample features according to the feature dimensions held by the participant corresponding to the kth alternative model, Used to measure the difference between A and B.

3. The backdoor detection and repair method for vertical federated learning according to claim 1 is characterized in that: The obtaining of a local embedding vector based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant includes: The complete sample features corresponding to multiple categories are sampled in the auxiliary data set, partial sample features are determined based on the feature dimensions corresponding to the local participant in the complete sample features obtained by sampling, and each of the partial sample features is input into the updated feature extraction model held by the local participant to obtain the local embedding vector corresponding to each category.

4. The backdoor detection and repair method for vertical federated learning according to claim 1 is characterized in that: The calculating the entropy value based on the prediction result includes: The entropy value is calculated based on the following formula: ； Where C represents the number of categories, Indicates the prediction result corresponds to the probability of category j, , represents the updated task output model, represents the local embedding vector corresponding to the i-th category, represents the embedding vector to be detected of the kth participant.

5. A backdoor detection and repair system for vertical federated learning, characterized by: The system comprises: An auxiliary data set construction module is used to obtain an auxiliary data set, wherein the auxiliary data set includes multiple complete samples, and the complete samples include complete sample features and corresponding labels; A local model update module is used to construct K-1 surrogate models, which are used to simulate the feature extraction models held by the other participants in the vertical federated learning. The surrogate models and the feature extraction models and task output models held by the local participants are updated based on the auxiliary dataset. K is the number of participants in the vertical federated learning. An embedding vector acquisition module, configured to obtain a local embedding vector based on the complete sample features in the auxiliary dataset and the updated feature extraction model held by the local participant, and to obtain the embedding vector to be detected generated by each of the remaining participants based on the object to be predicted; a backdoor detection module, configured to input a detection vector combination into the updated task output model to obtain prediction results output by the task output model, and determine a backdoor embedding vector based on the prediction results, wherein the detection vector combination includes the local embedding vector and one of the embedding vectors to be detected; a backdoor repair module, configured to repair the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector; The determining of the backdoor embedding vector based on the prediction result includes: Calculating an entropy value based on the prediction result, where the entropy value reflects the credibility of the embedded vector to be detected in the detection vector combination; When the entropy value is less than a preset threshold, determining that the embedded vector to be detected included in the detection vector combination is the backdoor embedded vector; The repairing of the backdoor embedding vector based on the updated feature extraction model held by the local participant and the replacement model corresponding to the backdoor embedding vector includes: The backdoor embedding vector is repaired based on the following formula: ； in, represents the repaired backdoor embedding vector, represents the embedding vector extracted by the local participant for the object to be predicted based on the updated feature extraction model held by the local participant, , when k=1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the local participant, represents the updated feature extraction model held by the local participant. When k=2,…,K-1, represents the sample features extracted from the complete sample features according to the feature dimensions held by the participant corresponding to the kth alternative model, represents the updated k-th alternative model held by the local participant, and d represents the embedding dimension of the local participant.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the backdoor detection and repair method for vertical federated learning as described in any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the backdoor detection and repair method for vertical federated learning as described in any one of claims 1 to 4 is implemented.

8. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the backdoor detection and repair method for vertical federated learning as described in any one of claims 1 to 4 is implemented.

Images