Free-rider attack detection method and system for privacy-preserving vertical federated learning

Abstract

The present invention provides a method and system for detecting free-rider attacks in privacy-preserving vertical federated learning, relating to the field of data processing. The method comprises: generating a first ciphertext representation based on a local bottom model and receiving a second ciphertext representation sent by each passive participant; determining the maximum mean difference in ciphertexts corresponding to the passive participant based on the first and second ciphertext representations; sending the maximum mean difference in ciphertexts to a trusted third party, and receiving a free-rider detection result from the trusted third party. The free-rider detection result is determined by decrypting the maximum mean difference in ciphertexts by the trusted third party to obtain the maximum mean difference in plaintexts and applying a preset threshold. The preset threshold is determined based on multiple rounds of training. During training, the passive participant updates the bottom model based on update information sent by the active participant, with the update information being determined based on gradient information and the maximum mean difference in ciphertexts. The present invention can protect private data in vertical federated learning and detect free-rider attacks.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for detecting free-rider attacks in privacy-preserving vertical federated learning. Background Art

[0002] Traditional machine learning training requires service providers to collect user information for centralized training. If sensitive user information is exposed or misused during this process, it poses a direct threat to personal data security. Furthermore, training machine learning models requires large datasets, and insufficient datasets can significantly impact model performance. Faced with the growing conflict between data silos and the need for data fusion, vertical federated learning technology has emerged. Vertical federated learning allows multiple participants with the same sample but different features to collaborate by exchanging model representations and gradient updates, without requiring participants to transfer raw data.

[0003] While existing vertical federated learning systems have achieved considerable performance, they still face several challenges. The first is privacy leakage. While vertical federated learning systems rely on transmitting representations instead of raw data, research shows that representations can still leak users' private information. The second is the free-rider attack. In vertical federated learning scenarios, some passive participants may lack real data features and provide no local computing resources. They upload random noise disguised as representations to gain ultimate benefits. This free-rider attack can significantly undermine the fairness of collaborative learning and impact the distribution of benefits. Summary of the Invention

[0004] The present invention provides a free-rider attack detection method and system for privacy-preserving vertical federated learning, which is used to address the defects of privacy leakage and free-rider attacks in vertical federated learning systems in the prior art, and to protect the privacy data of vertical federated learning systems and detect free-rider attacks.

[0005] The present invention provides a free-rider attack detection method for privacy-preserving vertical federated learning, comprising:

[0006] Generate a first ciphertext representation of the sample to be predicted based on the local base model, and receive each second ciphertext representation, where the second ciphertext representation is generated by the passive participant for the sample to be predicted, and both the first ciphertext representation and the second ciphertext representation are obtained by encrypting based on a preset public key;

[0007] Determining, based on the first ciphertext representation and the second ciphertext representation, a maximum mean difference in ciphertexts corresponding to the passive participant, where the maximum mean difference in ciphertexts reflects a difference between the first ciphertext representation and the second ciphertext representation for a plurality of samples;

[0008] The maximum mean difference of the ciphertext is sent to a trusted third party, and a free-rider detection result sent by the trusted third party is received. The free-rider detection result is obtained by the trusted third party decrypting the maximum mean difference of the ciphertext using a preset private key to obtain the maximum mean difference of the plaintext, and is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant, and the update information is determined based on gradient information and the maximum mean difference of the ciphertext.

[0009] According to a free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention, the calculation formula for the maximum mean difference of the ciphertext is:

[0010] ;

[0011] in, represents the maximum mean difference of the ciphertext corresponding to the passive participant, represents the second ciphertext representation generated by the passive participant based on the i-th sample, represents the first ciphertext representation generated by the active participant based on the i-th sample, and B represents the number of samples included in a training batch.

[0012] According to a free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention, in each of the multiple rounds of training, the process of determining the update information includes:

[0013] generating a local first ciphertext representation for the training sample, and receiving the second ciphertext representation for the training sample sent by the passive participant;

[0014] Determining the gradient information in the current round of training based on the first ciphertext representations and the second ciphertext representations of multiple training samples in the current round of training and the locally held top model;

[0015] Determining a maximum mean difference of the ciphertexts in the current round of training based on the first ciphertext representations and the second ciphertext representations of multiple training samples in the current round of training;

[0016] The update information is determined based on the gradient information and the maximum mean difference of the ciphertext in this round of training.

[0017] According to a free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention, determining the gradient information in the current round of training based on the first ciphertext representation and the second ciphertext representation of multiple training samples in the current round of training and the locally held top model includes:

[0018] aggregating the first ciphertext representation and the second ciphertext representation sent by each of the passive participants to obtain a ciphertext aggregate representation, and sending the ciphertext aggregate representation to the trusted third party;

[0019] receiving a plaintext aggregate representation, where the plaintext aggregate representation is obtained by the trusted third party decrypting the ciphertext aggregate representation;

[0020] The plaintext aggregate representation is input into the locally held top model, and the gradient information is determined based on a prediction result output by the top model.

[0021] According to a free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention, after determining the update information based on the gradient information and the maximum mean difference of the ciphertext in the current round of training, the method includes:

[0022] The ciphertext representation of the update information is sent to the trusted third party, so that the trusted third party decrypts the ciphertext representation of the update information, obtains the plaintext update information and sends it to the passive participant for updating the underlying model of the passive participant.

[0023] According to a free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention, the calculation formula of the update information is:

[0024] ;

[0025] in, represents the ciphertext representation of the update information, represents the ciphertext representation of the gradient information, is the weighting coefficient, is information determined based on the maximum mean difference of the ciphertext, , represents the second ciphertext representation generated by the passive participant based on the i-th training sample in the training batch, represents the first ciphertext representation generated by the active participant based on the i-th training sample in the training batch, and B represents the number of samples included in a training batch.

[0026] The present invention also provides a free-rider attack detection system for privacy-preserving vertical federated learning, comprising:

[0027] a ciphertext representation determination module, configured to generate a first ciphertext representation of a sample to be predicted based on a local underlying model, and receive each second ciphertext representation, where the second ciphertext representation is generated by a passive participant for the sample to be predicted, and both the first ciphertext representation and the second ciphertext representation are obtained by encryption based on a preset public key;

[0028] a mean difference determining module, configured to determine a maximum mean difference of ciphertexts corresponding to the passive participant based on the first ciphertext representation and the second ciphertext representation, wherein the maximum mean difference of ciphertexts reflects a difference between the first ciphertext representation and the second ciphertext representation for a plurality of samples;

[0029] The free-rider detection module is configured to send the maximum mean difference of the ciphertext to the trusted third party and receive a free-rider detection result sent by the trusted third party, wherein the free-rider detection result is obtained by the trusted third party decrypting the maximum mean difference of the ciphertext using a preset private key to obtain a maximum mean difference of the plaintext, and the free-rider detection result is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on update information sent by the active participant, and the update information is determined based on gradient information and the maximum mean difference of the ciphertext.

[0030] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements any of the above-mentioned free-rider attack detection methods for privacy-preserving vertical federated learning.

[0031] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned free-rider attack detection methods for privacy-preserving vertical federated learning.

[0032] The present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements any of the above-mentioned free-rider attack detection methods for privacy-preserving vertical federated learning.

[0033] The present invention provides a free-rider attack detection method and system for privacy-preserving vertical federated learning. By setting a trusted third party, the trusted third party holds a private key for decryption, and the active and passive participants hold public keys for encryption, the passive participant generates a representation, encrypts it to obtain a second ciphertext representation, and sends it to the active participant. The active participant also encrypts the locally generated representation to generate a first ciphertext representation, and determines the maximum mean ciphertext value reflecting the difference between the first ciphertext representation and the second ciphertext representation based on the first ciphertext representation and the second ciphertext representation. During training, the maximum mean ciphertext value is compared with the gradient signal. Information fusion is used to generate update information for passive participants to update the bottom model. In this way, after multiple rounds of training, the maximum mean of the ciphertext of the passive participants who provide real data to participate in the training will inevitably evolve in a downward direction. After multiple rounds of training, the active participant sends the maximum mean of the ciphertext corresponding to the passive participant to the trusted terminal for decryption. Based on the comparison between the maximum mean of the ciphertext and the preset threshold, it can be determined whether the passive participant has a free-rider attack. At the same time, during the entire process, the active participant cannot obtain the plaintext information representing the passive participant, which improves the privacy protection performance of vertical federated learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 This is a flowchart of a free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention.

[0036] Figure 2 This is a schematic diagram of the interactions among the parties in the free-rider attack detection method for privacy-preserving vertical federated learning provided by the present invention.

[0037] Figure 3 This is a structural diagram of a free-rider attack detection system for privacy-preserving vertical federated learning provided by the present invention.

[0038] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0040] The following combination Figure 1-Figure 2 The present invention describes a free-rider attack detection method for privacy-preserving vertical federated learning, which is performed by active participants in the vertical federated learning, such as Figure 1 As shown, the method includes the steps of:

[0041] S110: Generate a first ciphertext representation of the sample to be predicted based on the local base model, and receive each second ciphertext representation, where the second ciphertext representation is generated for the sample to be predicted by the passive participant policy, and both the first ciphertext representation and the second ciphertext representation are obtained by encryption based on a preset public key;

[0042] S120: Determine, based on the first ciphertext representation and the second ciphertext representation, a maximum mean difference in ciphertexts corresponding to the passive participant, where the maximum mean difference in ciphertexts reflects a difference between the first ciphertext representation and the second ciphertext representation for multiple samples;

[0043] S130. Send the maximum mean difference of the ciphertext to a trusted third party, and receive the free-rider detection result sent by the trusted third party. The free-rider detection result is obtained by decrypting the maximum mean difference of the ciphertext by the trusted third party using a preset private key to obtain the maximum mean difference of the plaintext, and is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant, and the update information is determined based on the gradient information and the maximum mean difference of the ciphertext.

[0044] The method provided by the present invention establishes a trusted third party that holds a private key for decryption, and an active and passive participant that holds a public key for encryption. After generating a representation, the passive participant encrypts the second ciphertext representation and sends it to the active participant. The active participant also encrypts the locally generated representation to generate a first ciphertext representation. Based on the first and second ciphertext representations, a maximum mean ciphertext value reflecting the difference between the first and second ciphertext representations is determined. During training, the maximum mean ciphertext value is fused with gradient information to generate update information used by the passive participant to update the underlying model. This allows the passive participant to reduce the maximum mean ciphertext value of the passive participant, who provides real data for training, after multiple rounds of training. After multiple rounds of training, the active participant sends the maximum mean ciphertext value corresponding to the passive participant to a trusted terminal for decryption. Based on a comparison of the maximum mean ciphertext value with a preset threshold, it is determined whether the passive participant has engaged in a free-rider attack. Furthermore, throughout the entire process, the active participant cannot obtain the plaintext information of the passive participant's representation, thereby improving the privacy protection performance of vertical federated learning.

[0045] The method provided by the present invention is executed by the terminal corresponding to the active participant of vertical federated learning. For ease of understanding, a brief introduction to the vertical federated learning system is first given. There are K participants in the vertical federated learning system, one of which is an active participant, and the remaining participants can be called passive participants. The active participant wants to train a model to perform a prediction task, but the active participant may not hold a large number of complete sample features to support the training of the complete model. For example, assuming that the active participant is a social platform, it wants to classify users. In addition to the user's social data features, it also requires the user's data features on other platforms (such as e-commerce platforms). However, for the sake of user sensitive data security, the e-commerce platform may not provide this data to the social platform. Vertical federated learning can solve this problem. In vertical federated learning, each participant collaborates for training but does not involve the exchange of original data between the participants. Specifically, in the vertical federated learning system, each participant holds a bottom model locally, which is used to extract representation data of the original data. In addition to the bottom model, the active participant also holds a top model. For the same object, the participants other than the active participant extract features of part of the feature data of the object held locally based on the bottom model held locally, obtain a representation, and send the representation to the active participant. The active participant extracts features of part of the feature data of the object held locally based on the bottom model held locally, obtains a representation, and fuses it with the representations sent by other participants to obtain a complete representation, which is input into the top model to obtain the prediction result output by the top model.

[0046] The method provided by the present invention is to prevent malicious participants from being present among participants other than the active participant, so that when sending the representation to the active participant, instead of the correct representation, random noise or other data is sent to perform a free-rider attack. The active participant can use the method provided by the present invention to detect the representations sent by other participants, identify the free-rider attack, and also perform security protection on the representations during the vertical federated learning process, thereby improving the privacy protection of vertical federated learning.

[0047] The method provided by this invention trains the maximum mean difference of ciphertexts simultaneously through multiple rounds of training during vertical federated learning, so that the maximum mean difference of ciphertexts decreases as training progresses. Therefore, during subsequent training or task processing, the maximum mean difference of ciphertexts corresponding to the passive participant can be used to detect whether the passive participant is engaging in a free-rider attack by comparing the maximum mean difference of ciphertexts corresponding to the passive participant with a preset threshold. Specifically, the formula for calculating the maximum mean difference of ciphertexts is:

[0048] ;

[0049] in, represents the maximum mean difference of the ciphertext corresponding to the passive participant, represents the ciphertext representation generated by the passive participant based on the i-th sample, represents the ciphertext representation generated by the active participant based on the i-th sample, and B represents the number of samples included in a training batch.

[0050] In the method provided by the present invention, k corresponds to a participant. When k=1, it corresponds to an active participant, and when k is greater than 1, it corresponds to a passive participant. In the calculation formula for the maximum mean difference of ciphertexts, k is greater than 1. For each participant for which k is greater than 1, that is, each passive participant, the corresponding maximum mean difference of ciphertexts can be calculated.

[0051] In the process of training the maximum mean difference of ciphertexts using multiple rounds of training, the process of determining the updated information in each round of training includes:

[0052] Generate a local first ciphertext representation for the training sample, and receive a second ciphertext representation for the training sample sent by the passive participant;

[0053] Determine the gradient information in this round of training based on the first ciphertext representations and the second ciphertext representations of multiple training samples in this round of training and the locally held top model;

[0054] Determine the maximum mean difference of ciphertexts in the current training round based on the first ciphertext representations and the second ciphertext representations of multiple training samples in the current training round;

[0055] Based on the gradient information in this round of training and the maximum mean difference of the ciphertext, the update information is determined.

[0056] The update information is used by the passive participant to update the underlying model it holds. In fact, the method provided by the present invention integrates the maximum mean difference of ciphertext as new gradient information on the basis of traditional gradient information. In model training, when updating the underlying model, the update is performed in the direction of reducing the gradient information. Therefore, after multiple rounds of training, the maximum mean difference of ciphertext will inevitably evolve in the direction of reduction.

[0057] Determining the gradient information in the current round of training based on the first ciphertext representations and the second ciphertext representations of multiple training samples in the current round of training and a locally held top model includes:

[0058] aggregating the first ciphertext representation and the second ciphertext representation sent by each of the passive participants to obtain a ciphertext aggregate representation, and sending the ciphertext aggregate representation to the trusted third party;

[0059] receiving a plaintext aggregate representation, where the plaintext aggregate representation is obtained by the trusted third party decrypting the ciphertext aggregate representation;

[0060] The plaintext aggregate representation is input into the locally held top model, and the gradient information is determined based on a prediction result output by the top model.

[0061] In the method provided by the present invention, a trusted third party is set up. The trusted third party is considered to be a safe execution party. It will strictly process data in accordance with the pre-set data processing method and will not tamper with the data. Figure 2 As shown, before the vertical federated learning begins, the trusted third party determines the set of participants in the system ,in For active participants, For passive participants, a trusted third party determines the public and private keys for homomorphic encryption , the public key is made public in the vertical federated learning system, that is, the public key is sent to the active and passive participants, and the private key is only held by a trusted third party. The public key is used to encrypt data and cannot decrypt the data, while the private key can decrypt the data. All passive participants and active participants use the private set intersection to align the sample index and sample size .

[0062] In each training round, each participant Sampling local batch samples , and perform the bottom model forward propagation to get the representation , Indicates the participants The local bottom model is obtained by encrypting the representation using the public key , is the ciphertext representation. When k=1, it represents the first ciphertext representation. When k is greater than 1, it represents the second ciphertext representation. Represent the ciphertext Passed to active participants , active participants Aggregate the local representation and the received ciphertext representation to obtain the ciphertext aggregate representation , and send it to a trusted third party, where the aggregation operation represents the summation operation of the corresponding positions. The trusted third party decrypts the ciphertext aggregation representation to obtain , and sent to the active participants .

[0063] Active participants Using Aggregate Representation Input to top model Afterwards, calculate and encrypt the master task for each passive participant Gradient information of each passive participant The corresponding ciphertext representation of the gradient information Based on the ciphertext representation of the gradient information and the maximum ciphertext mean, the update information corresponding to each passive participant is determined.

[0064] Specifically, the calculation formula for the update information is:

[0065] ;

[0066] in, The ciphertext representation of the update information, The ciphertext representation of the gradient information, is the weighting coefficient, is the information determined based on the maximum mean difference of the ciphertext, , represents the ciphertext representation generated by the passive participant based on the i-th training sample in the training batch, It represents the ciphertext representation generated by the active participant based on the i-th training sample in the training batch, and B represents the number of samples included in a training batch.

[0067] Active participants For each passive participant , calculate the maximum mean difference between it and the active participant’s ciphertext representation, and get , After that, the active participants For each passive participant The weighted sum of the ciphertext main task gradient update and the ciphertext maximum mean difference is calculated as the ciphertext representation of the update information and sent to the trusted third party.

[0068] The trusted third party decrypts the updated information of each passive participant and obtains the decrypted information in plain text. , and sent to each passive participant Each passive participant Use the decryption result Update bottom model ,in, represents the parameters of the bottom model during the t-1 round of training, represents the parameters of the bottom model during t rounds of training, is the weight coefficient.

[0069] The above process is executed in each training round to update the bottom model of the participants, complete multiple rounds of vertical federation training, and achieve training on the maximum mean difference of ciphertext. In subsequent training or task execution, each passive participant Computational representation , and use the public key to encrypt the representation to obtain , and pass it to the active participants , active participants For each passive participant Calculate the maximum mean difference of ciphertext , and sent to a trusted third party, which will The maximum mean difference of the ciphertext Decrypt and square to get ,based on The relationship between the value of ∑ k and the preset threshold is used to determine whether the kth participant has engaged in a free-rider attack. The preset threshold can be obtained by statistically analyzing the maximum mean difference in multiple rounds of training.

[0070] The following describes the free-rider attack detection system for privacy-preserving vertical federated learning provided by the present invention. The free-rider attack detection system for privacy-preserving vertical federated learning described below and the free-rider attack detection method for privacy-preserving vertical federated learning described above can be used for reference. Figure 3 As shown, the free-rider attack detection system for privacy-preserving vertical federated learning provided by the present invention includes:

[0071] A ciphertext representation determination module 310 is configured to generate a first ciphertext representation of a sample to be predicted based on a local underlying model and receive each second ciphertext representation, wherein the second ciphertext representation is generated for the sample to be predicted by a passive participant policy and both the first ciphertext representation and the second ciphertext representation are encrypted using a preset public key.

[0072] A mean difference determination module 320 is configured to determine a maximum mean difference in ciphertexts corresponding to the passive participant based on the first ciphertext representation and the second ciphertext representation, where the maximum mean difference in ciphertexts reflects the difference between the first ciphertext representation and the second ciphertext representation for a plurality of samples;

[0073] The free-rider detection module 330 is configured to send the maximum mean difference of the ciphertext to a trusted third party and receive the free-rider detection result sent by the trusted third party. The free-rider detection result is obtained by decrypting the maximum mean difference of the ciphertext by the trusted third party using a preset private key to obtain the maximum mean difference of the plaintext, and is determined based on the maximum mean difference of the plaintext and a preset threshold. The preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant. The update information is determined based on gradient information and the maximum mean difference of the ciphertext.

[0074] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4 As shown, the electronic device may include: a processor (processor) 410, a communication interface (Communications Interface) 420, a memory (memory) 430 and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call the logic instructions in the memory 430 to execute the free-rider attack detection method for privacy-preserving vertical federated learning. The free-rider attack detection method for privacy-preserving vertical federated learning includes: generating a first ciphertext representation of the sample to be predicted based on the local bottom model, and receiving each second ciphertext representation, the second ciphertext representation is generated by the passive participant for the sample to be predicted, and the first ciphertext representation and the second ciphertext representation are both obtained based on the preset public key encryption; based on the first ciphertext representation and the second ciphertext representation, determining the maximum mean difference of the ciphertext corresponding to the passive participant, and the maximum mean difference of the ciphertext reflects the difference in the ciphertext for the passive participant. The difference between a first ciphertext representation and a second ciphertext representation of multiple samples; sending the maximum mean difference of the ciphertext to a trusted third party, and receiving the free-rider detection result sent by the trusted third party, where the free-rider detection result is obtained by decrypting the maximum mean difference of the ciphertext by the trusted third party through a preset private key to obtain the maximum mean difference of the plaintext, and is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant, and the update information is determined based on the gradient information and the maximum mean difference of the ciphertext.

[0075] Furthermore, the logic instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0076] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the free-rider attack detection method for privacy-preserving vertical federated learning provided by the above methods. The free-rider attack detection method for privacy-preserving vertical federated learning includes: generating a first ciphertext representation of a sample to be predicted based on a local bottom model, and receiving each second ciphertext representation, the second ciphertext representation is generated by a passive participant for the sample to be predicted, and the first ciphertext representation and the second ciphertext representation are both obtained based on a preset public key encryption; based on the first ciphertext representation and the second ciphertext representation The method comprises the following steps: determining the maximum mean difference of the ciphertext corresponding to the passive participant, where the maximum mean difference of the ciphertext reflects the difference between the first ciphertext representation and the second ciphertext representation for multiple samples; sending the maximum mean difference of the ciphertext to a trusted third party, and receiving the free-rider detection result sent by the trusted third party. The free-rider detection result is that the trusted third party decrypts the maximum mean difference of the ciphertext through a preset private key to obtain the maximum mean difference of the plaintext, and determines it based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant, and the update information is determined based on the gradient information and the maximum mean difference of the ciphertext.

[0077] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute the free-rider attack detection method for privacy-preserving vertical federated learning provided by the above methods, and the free-rider attack detection method for privacy-preserving vertical federated learning includes: generating a first ciphertext representation of a sample to be predicted based on a local bottom model, and receiving each second ciphertext representation, the second ciphertext representation is generated by a passive participant for the sample to be predicted, and the first ciphertext representation and the second ciphertext representation are both obtained based on a preset public key encryption; based on the first ciphertext representation and the second ciphertext representation, determining the ciphertext representation corresponding to the passive participant; Maximum mean difference, the maximum mean difference of the ciphertext reflects the difference between the first ciphertext representation and the second ciphertext representation for multiple samples; the maximum mean difference of the ciphertext is sent to a trusted third party, and the free-rider detection result sent by the trusted third party is received. The free-rider detection result is that the trusted third party decrypts the maximum mean difference of the ciphertext through a preset private key to obtain the maximum mean difference of the plaintext, and is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant, and the update information is determined based on the gradient information and the maximum mean difference of the ciphertext.

[0078] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0079] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A free-rider attack detection method for privacy-preserving vertical federated learning, characterized by: The method is performed by an active participant in a vertical federated learning system, including: Generate a first ciphertext representation of the sample to be predicted based on the local base model, and receive each second ciphertext representation, where the second ciphertext representation is generated by the passive participant for the sample to be predicted, and both the first ciphertext representation and the second ciphertext representation are obtained by encrypting based on a preset public key; Determining, based on the first ciphertext representation and the second ciphertext representation, a maximum mean difference in ciphertexts corresponding to the passive participant, where the maximum mean difference in ciphertexts reflects a difference between the first ciphertext representation and the second ciphertext representation for a plurality of samples; The maximum mean difference of the ciphertext is sent to a trusted third party, and a free-rider detection result sent by the trusted third party is received. The free-rider detection result is obtained by the trusted third party decrypting the maximum mean difference of the ciphertext using a preset private key to obtain the maximum mean difference of the plaintext, and is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on the update information sent by the active participant, and the update information is determined based on gradient information and the maximum mean difference of the ciphertext.

2. The free-rider attack detection method for privacy-preserving vertical federated learning according to claim 1 is characterized in that: The calculation formula for the maximum mean difference of the ciphertext is: ； in, represents the maximum mean difference of the ciphertext corresponding to the passive participant, represents the second ciphertext representation generated by the passive participant based on the i-th sample, represents the first ciphertext representation generated by the active participant based on the i-th sample, and B represents the number of samples included in a training batch.

3. The free-rider attack detection method for privacy-preserving vertical federated learning according to claim 1 is characterized in that: In each of the multiple rounds of training, the process of determining the update information includes: generating a local first ciphertext representation for the training sample, and receiving the second ciphertext representation for the training sample sent by the passive participant; Determining the gradient information in the current round of training based on the first ciphertext representations and the second ciphertext representations of multiple training samples in the current round of training and the locally held top model; Determining a maximum mean difference of the ciphertexts in the current round of training based on the first ciphertext representations and the second ciphertext representations of multiple training samples in the current round of training; The update information is determined based on the gradient information and the maximum mean difference of the ciphertext in this round of training.

4. The free-rider attack detection method for privacy-preserving vertical federated learning according to claim 3 is characterized in that: The determining the gradient information in the current round of training based on the first ciphertext representation and the second ciphertext representation of the plurality of training samples in the current round of training and the locally held top model includes: aggregating the first ciphertext representation and the second ciphertext representation sent by each of the passive participants to obtain a ciphertext aggregate representation, and sending the ciphertext aggregate representation to the trusted third party; receiving a plaintext aggregate representation, where the plaintext aggregate representation is obtained by the trusted third party decrypting the ciphertext aggregate representation; The plaintext aggregate representation is input into the locally held top model, and the gradient information is determined based on a prediction result output by the top model.

5. The free-rider attack detection method for privacy-preserving vertical federated learning according to claim 3 is characterized in that: After determining the update information based on the gradient information and the maximum mean difference of the ciphertext in the current round of training, the method includes: The ciphertext representation of the update information is sent to the trusted third party, so that the trusted third party decrypts the ciphertext representation of the update information, obtains the plaintext update information and sends it to the passive participant for updating the underlying model of the passive participant.

6. The free-rider attack detection method for privacy-preserving vertical federated learning according to claim 3, characterized in that: The calculation formula for the update information is: ； in, represents the ciphertext representation of the update information, represents the ciphertext representation of the gradient information, is the weighting coefficient, is information determined based on the maximum mean difference of the ciphertext, , represents the second ciphertext representation generated by the passive participant based on the i-th training sample in the training batch, represents the first ciphertext representation generated by the active participant based on the i-th training sample in the training batch, and B represents the number of samples included in a training batch.

7. A free-rider attack detection system for privacy-preserving vertical federated learning, characterized by: The system comprises: a ciphertext representation determination module, configured to generate a first ciphertext representation of a sample to be predicted based on a local underlying model, and receive each second ciphertext representation, where the second ciphertext representation is generated by a passive participant for the sample to be predicted, and both the first ciphertext representation and the second ciphertext representation are obtained by encryption based on a preset public key; a mean difference determining module, configured to determine a maximum mean difference of ciphertexts corresponding to the passive participant based on the first ciphertext representation and the second ciphertext representation, wherein the maximum mean difference of ciphertexts reflects a difference between the first ciphertext representation and the second ciphertext representation for a plurality of samples; A free-rider detection module is configured to send the maximum mean difference of the ciphertext to a trusted third party and receive a free-rider detection result sent by the trusted third party, wherein the free-rider detection result is obtained by decrypting the maximum mean difference of the ciphertext by the trusted third party using a preset private key to obtain a maximum mean difference of the plaintext, and the free-rider detection result is determined based on the maximum mean difference of the plaintext and a preset threshold, wherein the preset threshold is obtained based on multiple rounds of training. In each round of the multiple rounds of training, the passive participant updates the bottom model of the passive participant based on update information sent by the active participant, and the update information is determined based on gradient information and the maximum mean difference of the ciphertext.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, it implements the free-rider attack detection method for privacy-preserving vertical federated learning as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the free-rider attack detection method for privacy-preserving vertical federated learning is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the free-rider attack detection method for privacy-preserving vertical federated learning is implemented.

Images