Target label attack method, device and medium for longitudinal federated inference system

Abstract

The application discloses a target label attack method and device for a longitudinal federal inference system and a medium, and belongs to the field of artificial intelligence system security, and comprises the following steps: dividing the inference process of an attacker into a preparation stage and an attack stage; in the preparation stage, the attacker normally executes a longitudinal federal inference process, accumulates inference results fed back from a global longitudinal federal model as pseudo labels, and uses the pseudo labels to train a local substitute model locally, while estimating a detector in the global longitudinal federal inference system; in the attack stage, a projection gradient descent method is used to optimize input sample features to generate malicious samples, and the generated malicious samples are input into the federal inference system to perform target label attack. According to the method, the output results of the already-inferred samples can be accumulated as pseudo labels in the inference process, so that the attacker does not need to obtain sample labels to realize effective target label attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence system security, and particularly relates to a target label attack method for a vertical federated inference system. BACKGROUND

[0002] The vertical federated inference system allows multiple data participants to cooperatively complete an inference task. However, in actual application, some participants may have malicious behavior, and the malicious sample features provided by the participants may destroy the system security and further cause an incorrect inference result output. In view of the vulnerability of the vertical federated inference system, various techniques have attempted to attack the system from different angles to verify the vulnerability. These techniques usually adopt a method of constructing a shadow model locally by an attacker, optimize input features, make the shadow model output a target label, and then input the optimized feature vector into the global vertical federated inference model, so that the global model also outputs the target label.

[0003] However, these techniques usually assume that the attacker can access the probability vector output by the global vertical federated inference system, or assume that the attacker can obtain a data sample with a real label. These assumptions are often difficult to achieve in actual scenarios. In addition, the existing techniques ignore the detector module that may exist in the global vertical federated inference system. The role of the detector module is to monitor malicious sample features provided by potential malicious participants, so that when facing such a system with enhanced detectors, the existing attack methods often fail. Therefore, how to design a target label attack method for a detector-enhanced vertical federated inference system on the basis of reasonable attack background knowledge assumptions is still a research problem to be solved.

[0004] The existing target label attack techniques in the vertical federated inference system face the following two problems:

[0005] (1) Unrealistic attack knowledge assumptions: The existing techniques usually assume that the attacker can obtain a labeled sample, but in actual application, the attacker can only master the feature information of part of the samples, and cannot effectively obtain the label information of the samples. In addition, the existing techniques assume that the attacker can obtain the output probability vector of the global inference model, but in actual scenarios, the probability vector is highly private, and therefore the attacker cannot obtain it.

[0006] (2) Ignoring the detector module in the inference system: The existing techniques often ignore that in actual vertical federated inference systems, a detector module is usually deployed to identify malicious model input. When the attack method faces these detector modules, it is often identified as malicious input, thereby causing the attack to fail.

[0007] In view of this, the present application is proposed. SUMMARY

[0008] The application aims to provide a target label attack method, device and medium for a longitudinal federated inference system, which can accumulate the output results of the inferred samples as pseudo labels in the inference process, thereby avoiding the necessity for an attacker to obtain label samples to achieve effective target label attack, and thus solving the above technical problems existing in the prior art.

[0009] The application aims to achieve the above technical problems by the following technical solutions:

[0010] A target label attack method for a longitudinal federated inference system is used in a longitudinal federated inference system with a detector enhancement, and includes the following steps:

[0011] The inference process of an attacker is divided into the following two stages:

[0012] In the preparation stage, the attacker normally executes the longitudinal federated inference process, accumulates the inference results fed back from the global longitudinal federated model of the federated inference system as pseudo labels, and uses the pseudo labels to train a local substitute model locally, while estimating the detector in the global longitudinal federated inference system.

[0013] In the attack stage, the projection gradient descent method is used to optimize the input sample features to generate malicious samples, and the generated malicious samples are input into the global longitudinal federated model of the federated inference system for target label attack.

[0014] A processing device includes:

[0015] At least one memory for storing one or more programs;

[0016] At least one processor capable of executing one or more programs stored in the memory, so that the processor can implement the method described in the application when the one or more programs are executed by the processor.

[0017] A readable storage medium stores a computer program, which can implement the method described in the application when the computer program is executed by the processor.

[0018] Compared with the prior art, the target label attack method, device and medium for a longitudinal federated inference system provided by the application have the following beneficial effects:

[0019] Firstly, the method considers the malicious input sample detector deployed in the actual longitudinal federated inference system, and designs the attack method based on such an actual inference system, so that the method has stronger practicability.

[0020] Secondly, the method does not rely on obtaining the probability confidence vector information of the global model output, and does not need to master the real label information of part of the samples, which makes the assumption condition of the attack more reasonable and conforms to the actual application scene.

[0021] Finally, the method can achieve a high attack success rate in practical application, that is, after optimizing most of the test samples as malicious samples, the global federated model can effectively predict the target label as an error. Therefore, the method has very high application prospects, especially in the scene where the attacker can control part of the input features.

[0022] In addition, the design of the method is simple and easy to implement, and is suitable for various vertical federated learning scenes. Due to its less attack knowledge assumption and design for detector evasion, the method can be widely used in data collaboration application scenes such as finance, medical treatment and smart city. These fields often have strict requirements for data privacy and security, so the method not only provides a new attack means for these scenes, but also brings new challenges to their security. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0024] Figure 1 The flowchart of the target label attack method for the vertical federated reasoning system provided by the embodiments of the present application.

[0025] Figure 2 The specific flowchart of the target label attack method for the vertical federated reasoning system provided by the embodiments of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the specific contents of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments, which do not constitute a limitation to the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0027] Firstly, the terms that can be used in this paper are explained as follows:

[0028] The term "and / or", "and / or" means that both of the two or both can be achieved simultaneously, for example, X and / or Y, both include "X" or "Y" case also includes "X and Y" three cases.

[0029] The term "include", "contain", "have", "with" or other similar semantic description, should be interpreted as non-exclusive including. For example: including a technical feature elements (such as raw materials, components, ingredients, carriers, dosage forms, materials, size, parts, components, mechanisms, devices, steps, processes, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products or articles, etc.), should be interpreted as not only including the explicitly listed technical feature elements, but also including other technical feature elements not explicitly listed in the art.

[0030] The term "consisting of" means excluding any technical feature elements not explicitly listed. If the term is used in the claims, the term will make the claim closed, so that it does not contain technical feature elements other than the explicitly listed technical feature elements, except for conventional impurities related thereto. If the term only appears in a certain clause of the claim, it is only limited to the elements explicitly listed in that clause, and the elements described in other clauses are not excluded from the overall claim.

[0031] Unless otherwise expressly provided or limited, the terms "mounting", "connecting", "connecting", "fixing" and the like should be broadly understood, for example: it can be fixedly connected, or it can be detachably connected, or it can be integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be connected inside two elements. For those skilled in the art, the specific meaning of the above terms in this paper can be understood according to the specific circumstances.

[0032] When the concentration, temperature, pressure, size or other parameters are expressed in the form of a numerical range, the numerical range should be understood as specifically disclosed all the ranges formed by any upper limit value, lower limit value, preferred value of the numerical range, regardless of whether the range is explicitly described; for example, if the numerical range "2-8" is described, the numerical range should be interpreted as including "2-7", "2-6", "5-7", "3-4 and 6-7", "3-5 and 7", "2 and 5-7" and the like. Unless otherwise specified, the numerical range described herein includes all integers and fractions within the numerical range, including the end values.

[0033] The terms "central," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," and the like indicate an orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are used only for convenience and simplicity of description and do not imply or create a requirement that the device or element be constructed or operated in a particular orientation, unless explicitly stated otherwise.

[0034] The schemes provided by the present application are described in detail below. The contents not described in detail in the embodiments of the present application belong to the prior art known to those skilled in the art. If the specific conditions are not specified in the embodiments of the present application, the conventional conditions or the conditions recommended by the manufacturer are used. If the reagents or instruments used in the embodiments of the present application are not specified by the manufacturer, they are all conventional products that can be purchased on the market.

[0035] As shown in Figure 1 and Figure 2 The embodiments of the present application provide a target label attack method for a longitudinal federated inference system, which is used in a longitudinal federated inference system with detector enhancement, and includes the following steps:

[0036] The inference process of the attacker is divided into the following two stages:

[0037] In the preparation stage, the attacker normally executes the longitudinal federated inference process, accumulates the inference results fed back from the global longitudinal federated model of the federated inference system as pseudo labels, and uses the pseudo labels to train a local substitute model locally, while estimating the detector in the global longitudinal federated inference system.

[0038] In the attack stage, the projection gradient descent method is used to optimize the input sample features to generate malicious samples, and the generated malicious samples are input into the global longitudinal federated model of the federated inference system for target label attack. The generated malicious samples are samples that can make the local substitute model output the target class while avoiding being identified as malicious samples by the local estimated detector.

[0039] In the above preparation stage, the attacker honestly executes the longitudinal federated inference protocol, and accumulates the inference results fed back from the global federated model as data pseudo labels. Based on these pseudo labels, the attacker can estimate the global real detector locally, and train a local substitute model based on the data features owned by itself.

[0040] Preferably, in the preparation stage of the above method, the attacker normally executes the longitudinal federated inference process in the following manner, accumulates the inference results fed back from the global longitudinal federated model as pseudo labels, including:

[0041] Step 11, semi-supervised clustering:

[0042] The attacker divides the complete test set into multiple data clusters using a semi-supervised clustering algorithm; in this step 11, the attacker first divides the complete test set into multiple clusters, such as C clusters, using a semi-supervised clustering method (such as the Constrained Seed KMeans clustering algorithm). Since the attacker does not have additional label information at the initial clustering, the clustering process is consistent with the traditional standard KMeans clustering algorithm.

[0043] Step 12, sample selection:

[0044] The attacker calculates the expression ability value of the unlabeled samples in each data cluster, and selects unlabeled samples in each data cluster according to the accuracy of the local substitute model combined with the expression ability value of the unlabeled samples;

[0045] Specifically, in each cluster, the attacker selects samples with strong expression ability for subsequent standard vertical federated inference. The expression ability of the sample is determined by distance similarity and probability uncertainty. For unlabeled test samples, if they are closer to the data samples that have been inferred and obtained pseudo-labels, the expression ability is stronger; if it can make the local substitute model produce higher probability uncertainty, the expression ability is also stronger. The balance between these two indicators is achieved through a hyperparameter. In the early stage of vertical federated inference, since the accuracy of the local substitute model is low, the attacker tends to select samples with high probability uncertainty; while in the later stage, when the accuracy of the local substitute model improves, the effect of selecting samples with high probability uncertainty on performance improvement decreases, so the attacker tends to select samples with high distance similarity.

[0046] Step 13, standard vertical federated inference:

[0047] The attacker inputs all the unlabeled samples selected in step 12 into the global vertical federated model for standard vertical federated inference process, and the attacker receives the inference result returned by the global vertical federated model, and uses the inference result as the pseudo-label of the corresponding unlabeled sample;

[0048] Step 14, update pseudo-label information:

[0049] The attacker updates the clustering results according to step 11 using the pseudo-labels of the unlabeled samples, and obtains updated multiple data clusters;

[0050] The attacker utilizes multiple updated data clusters, following steps 12 and 13, to obtain the inference result for each unlabeled sample and use it as a pseudo-label for that sample. They then combine this pseudo-label with local sample features to generate pseudo-label samples and update the pseudo-label information. In this step, the attacker selects samples with strong expressive power from all unlabeled test samples and honestly inputs these samples into the vertical federated inference process. During this process, the inference results of the global vertical federated model are returned to each participant. The attacker accumulates these inference results as pseudo-labels for the unlabeled test samples.

[0051] Preferably, in step 12 of the above method, the attacker calculates the unlabeled samples within each data cluster in the following manner. expressive ability value ,include:

[0052] By distance similarity and probability uncertainty Identify unlabeled samples expressive ability value This determines unlabeled samples expressive ability value The calculation formula is:

[0053] ;

[0054] in, To balance distance similarity and probability uncertainty Hyperparameters of these two metrics; distance similarity The calculation formula is: Probability uncertainty The calculation formula is: Among them, distance similarity Used to measure unlabeled samples With the samples that have been inferred and have obtained pseudo-labels The distance size, Larger unlabeled samples With the samples that have been inferred and have obtained pseudo-labels The smaller the distance, the fewer the unlabeled samples. Their expressive abilities are stronger; Let i be the set of pseudo-label samples, where i represents the index of the pseudo-label sample in the set. For the attacker's local model; probabilistic uncertainty Used to measure unlabeled samples Probabilistic uncertainty in local substitution models The larger the value, the greater the uncertainty, indicating unlabeled samples. Their expressive abilities are stronger; a local substitute model of the attacker; () represents the entropy of the vector; () represents a function for calculating a classification probability vector.

[0055] Preferably, in step 12 of the above method, the expression capacity value of the unlabeled sample is combined with the accuracy of the local substitute model in each data cluster to select the unlabeled sample in the following manner:

[0056] When the accuracy of the local substitute model is less than 50%, the attacker will select all the unlabeled samples with the maximum probability uncertainty value in descending order, and select the k samples with the maximum probability uncertainty value, k is a preset value, for example, if k is 1, the sample with the maximum probability uncertainty value is selected, and the hyperparameter for balance is set value is less than 0.5;

[0057] When the accuracy of the local substitute model is equal to or greater than 50%, the attacker will select all the unlabeled samples with the minimum distance similarity value in descending order, and select the k samples with the maximum distance similarity value, and set the hyperparameter for balance value is greater than 0.5.

[0058] Preferably, in the preparation stage of the above method, the attacker uses pseudo-labels to locally train a local substitute model, and estimates the detector in the global longitudinal federated inference system in the following manner:

[0059] Step 15, the attacker uses pseudo-labeled pseudo-labeled samples to locally construct the estimated detector and the local substitute model, and the local substitute model shares the same base model with the global longitudinal federated model, but uses a randomly initialized inference head model;

[0060] The attacker trains the estimated detector and the local substitute model using the pseudo-labeled samples, and the training process will stop when the model accuracy reaches the threshold set by the attacker.

[0061] Preferably, in the attack stage of the above method, the attacker optimizes the input sample features to generate malicious samples using the projected gradient descent method, and inputs the generated malicious samples into the global longitudinal federated model of the federated inference system for target label attack in the following manner:

[0062] Step 21, generate malicious samples:

[0063] The attacker uses the projected gradient descent algorithm to iteratively optimize the inference samples to generate the final malicious samples through the local substitute model and the estimated detector trained in the preparation stage.

[0064] Step 22, malicious vertical federated inference:

[0065] The attacker inputs the generated malicious sample into the global vertical federated inference system, so that the global vertical federated model predicts the feature of any sample input by other participants as the target label of the attacker.

[0066] Preferably, in step 21 of the above method, the attacker uses the projection gradient descent algorithm to iteratively optimize the inference sample to generate the final malicious sample by the prepared local substitute model and the estimated detector trained in the preparation stage, including:

[0067] The attacker inputs the remaining unlabeled sample in the test set into the local substitute model and the local estimated detector, and uses the projection gradient descent algorithm to iteratively optimize, and the optimization sub-target is to make the local substitute model predict the unlabeled sample as the target label with high confidence (generally, a prediction probability exceeding 0.8 can be considered as high confidence) satisfying a predetermined confidence, and the optimization sub-target is to ensure that the generated malicious sample after optimization can still be determined as a normal sample by the local estimated detector. The specific optimization objective function is:

[0068] ;

[0069] Wherein, represents the unlabeled sample; represents the cross-entropy loss function; represents the target label of the attacker; represents the local estimated detector; is a hyperparameter used to balance the two optimization sub-targets in the optimization process.

[0070] The embodiment of the application further provides a processing device, comprising:

[0071] at least one memory for storing one or more programs;

[0072] at least one processor capable of executing one or more programs stored in the memory, so that the processor can implement the above method when the one or more programs are executed by the processor.

[0073] The embodiment of the application further provides a readable storage medium storing a computer program, which can implement the above method when the computer program is executed by a processor.

[0074] As can be seen from the above, the target label attack method provided by the embodiment of the application is a more practical target label attack scheme, which has at least the following advantages compared with the prior art:

[0075] ​The method takes into account the detection of malicious input samples deployed in an actual longitudinal federal inference system, and is based on such an actual inference system to design the attack method, so that the method has stronger practicability.

[0076] Secondly, the method does not rely on obtaining the probability confidence vector information of the global model output, nor does it need to master the true label information of part of the samples, which makes the attack assumption more reasonable and conforms to the actual application scenario.

[0077] Finally, the method can achieve a high attack success rate in actual application, that is, after optimizing most of the test samples as malicious samples, it can effectively make the global federal model mispredict the target label. Therefore, the method has very high application prospect, especially in the scene where the attacker can control part of the input features.

[0078] In addition, the design of the method is simple and easy to implement, and is suitable for various longitudinal federal learning scenarios. Due to its less attack knowledge assumption and design for detector evasion, the method can be widely used in data collaboration application scenarios such as finance, medical treatment and smart city. These fields often have strict requirements for data privacy and security, so the method not only provides a new attack means for these scenarios, but also brings new challenges to their security.

[0079] In order to more clearly show the technical solutions and technical effects provided by the present application, the schemes provided by the embodiments of the present application are described in detail below with specific examples.

[0080] Embodiment 1

[0081] The embodiment provides a target label attack method for a longitudinal federal inference system, and the flow is as shown in Figure 1 The method does not need to assume that the attacker can obtain the label sample, and can effectively evade the detection of the detector. Specifically, the method accumulates the output results of the already inferred samples as pseudo labels during the inference process, thereby avoiding the assumption that the attacker must obtain the label sample. Our method divides the inference process into two stages: in the preparation stage of the first stage, the attacker normally executes the inference process, and uses the pseudo label to train a local substitute model locally, while estimating the detector module in the global inference system; in the attack stage of the second stage, the projection gradient descent technique is used to optimize the input sample features, so that the optimized features not only make the local substitute model output the target category, but also avoid being recognized as malicious samples by the locally estimated detector, and finally the optimized features are input into the federal inference system. The method can effectively solve the two problems in the prior art, and provides a more practical and feasible method for target label attack in the longitudinal federal inference system.

[0082] The method divides the complete inference process of the attacker on the test set into a preparation phase (see the left part of Figure 2 ) and an attack phase (see the right part of Figure 2 ). Figure 2

[0083] In the preparation phase, the attacker accumulates the required attack knowledge, and uses these knowledge to achieve more effective target label attacks in the attack phase. The specific process is as follows:

[0084] (1) Preparation phase:

[0085] In the preparation phase, the attacker honestly executes the vertical federated inference protocol, and accumulates the inference results fed back from the global federated model as pseudo labels. Based on these pseudo labels, the attacker can estimate the global real detector locally and train a local substitute model based on the data features possessed by itself. This phase specifically includes the following steps:

[0086] Step 11, semi-supervised clustering (see the step corresponding to reference numeral ① in Figure 2 ):

[0087] The attacker first uses a semi-supervised clustering method (such as the Constrained Seed KMeans clustering algorithm) to divide the complete test set into data clusters. Since the attacker does not master additional label information at the initial clustering, the clustering process is consistent with the traditional standard KMeans clustering algorithm.

[0088] Step 12, sample selection (see the step corresponding to reference numeral ② in Figure 2 ):

[0089] Within each data cluster, the attacker selects samples with strong expression ability for subsequent standard vertical federated inference. The expression ability of the sample is jointly determined by distance similarity and probability uncertainty. For unlabeled samples, if they are closer to the data samples that have been inferred and obtained pseudo labels, the expression ability is stronger; if they can make the local substitute model produce higher probability uncertainty, the expression ability is also stronger. The balance between the two indicators is achieved through the hyperparameter . In the early stage of vertical federated inference, since the accuracy of the local substitute model is low, the attacker tends to select samples with high probability uncertainty; and in the later stage, when the accuracy of the local substitute model improves, the effect of performance improvement of continuing to select samples with high probability uncertainty decreases, so the attacker tends to select samples with high distance similarity.

[0090] Step 13, standard vertical federated inference (see the step corresponding to reference numeral ③ in Figure 2 ): ​

[0091] In step ②, the attacker selects samples with strong expressive power from all unlabeled test samples and inputs all of these samples into the vertical federated inference process. During this process, the inference results of the global vertical federated model... It will be returned to each participant, and the attacker can use these inference results as pseudo-labels for unlabeled samples by accumulating them.

[0092] Step 14, update pseudo-label information (see...) Figure 2 (Step corresponding to number ④ in the text)

[0093] After obtaining the inference result for each unlabeled sample, the attacker uses it as a pseudo-label for that sample and combines it with local sample features to generate pseudo-labeled samples. As more local test samples are assigned pseudo-labels, the attacker can update the semi-supervised clustering process, using the newly acquired pseudo-label information to update the clustering results on the test set.

[0094] Step 15, Local Training (see...) Figure 2 (Step corresponding to label ⑤ in the text)

[0095] The attacker uses pseudo-labeled samples to locally build an estimated detector and a local alternative model. This model shares the same bottom model as the global federated model but uses a randomly initialized inference head model. The attacker then trains the estimated detector and the local alternative model using the pseudo-labeled samples; the training process stops when the model accuracy reaches a threshold set by the attacker.

[0096] (2) Attack phase:

[0097] During the attack phase, the attacker deliberately deviates from the vertical federated inference protocol, using gradient optimization to generate malicious samples with the help of a local substitute model. Based on the estimated detector, the attacker ensures that the attack sample can evade the local detector. The attacker then migrates the generated malicious sample into the federated inference system, aiming to cause the global inference model to incorrectly predict the malicious sample as the target label. This phase includes the following two sub-steps:

[0098] Step 21, generate a malicious sample (see...) Figure 2 (Step corresponding to label ⑥ in the text)

[0099] The attacker uses the projection gradient descent algorithm to iteratively optimize the inference sample with the local substitute model and the estimated detector trained in the preparation phase, and finally generates a malicious sample. The specific process is as follows: the attacker selects a label-free sample with weak expression ability from the test set, and inputs it into the local substitute model and the local estimated detector at the same time. The optimization goal is to make the local substitute model predict the sample as the target label with high confidence, while ensuring that the optimized sample can still be judged as a normal sample by the local estimated detector. The two sub-goals in the optimization process are balanced through hyperparameters .

[0100] Step 22, malicious vertical federated inference (see Figure 2 corresponding to step ⑦ in the figure):

[0101] When the optimization process is completed, the attacker inputs the generated malicious sample into the global vertical federated inference system, aiming to make the global vertical federated model incorrectly predict the sample as the target label of the attacker regardless of the sample features input by other honest participants.

[0102] Embodiment 2

[0103] This embodiment provides a target label attack method for a vertical federated inference system, see Figure 1 and Figure 2 , comprising:

[0104] The number of participants in the vertical federated inference system is set to 2; there are 6 test samples in the test set , i.e. ; the hyperparameters and are set to 1; the number of data categories is 2; and the target label of the attacker is 0. The specific implementation steps are as follows:

[0105] (1) Preparation phase:

[0106] Step 11, semi-supervised clustering (see Figure 2 corresponding to step ① in the figure):

[0107] The attacker uses the Constrained Seed KMeans clustering algorithm to cluster the complete test set into two data clusters, where data cluster , and data cluster .

[0108] Step 12, sample selection (see Figure 2 corresponding to step ② in the figure):

[0109] Calculate two data clusters and The expressive power value of each unlabeled sample is obtained. arrive The expressive power values ​​for each unlabeled sample were: 0.8, 0.6, 0.4, 0.7, 0.3, and 1.1. (Due to the unlabeled samples...) The data samples with the highest expressive power values ​​are located in the two data clusters, therefore... Selected.

[0110] Step 13, Standard Longitudinal Federated Reasoning (see...) Figure 2 (Step corresponding to label ③ in the text)

[0111] Unlabeled samples The input is fed into the global longitudinal federated model, resulting in predictions of 0 and 1 for two unlabeled samples. These predictions are then used as... Pseudo-tags.

[0112] Step 14, update pseudo-label information (see...) Figure 2 (Step corresponding to number ④ in the text)

[0113] Two data clusters and Unlabeled samples and Having pseudo-labels allows us to use them to update the clustering results. The resulting clustering result is... and The resulting clustering is more accurate than the initial clustering.

[0114] Step 15, Local Training (see...) Figure 2 (Step corresponding to label ⑤ in the text)

[0115] Unlabeled samples Combined with pseudo-labels to form local test samples and This is used to train the local substitution model and the detector for local estimation. After 50 iterations, the local substitution model converges, and training terminates.

[0116] (2) Attack phase:

[0117] Step 21, generate a malicious sample (see...) Figure 2 (Step corresponding to label ⑥ in the text)

[0118] Two data clusters and The remaining unlabeled samples, i.e. and The input samples are fed into a local substitution model and an estimated detector, and then optimized using the projective gradient descent algorithm to generate four malicious samples. and .

[0119] Step 22, malicious vertical federated reasoning (see Figure 2 Step 22, malicious vertical federated reasoning (see

[0120] The four malicious samples generated in step 21 and are input into the global vertical federated model, and the predicted results are 0, 0, 0, 0. Finally, the attack success rate of the attacker is 5 / 6 = 83.3%.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by programs instructing related hardware, and the programs can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), etc.

[0122] The above is only a preferred specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims. The information disclosed in the background section of this document is only intended to deepen the understanding of the overall background of the present application, and should not be regarded as acknowledging or implying in any form that the information constitutes prior art known to those skilled in the art.

Claims

1. A method for attacking target labels in a vertical federated reasoning system, characterized in that, Vulnerability verification in longitudinal federated reasoning systems with detector enhancements includes: The attacker's reasoning process can be divided into the following two stages: During the preparation phase, the attacker executes the vertical federated inference process normally, accumulates the inference results fed back from the global vertical federated model of the federated inference system as pseudo-labels, and uses the pseudo-labels to train a local alternative model locally, while estimating the detectors in the global vertical federated inference system. During the attack phase, the projected gradient descent method is used to optimize the features of the input samples to generate malicious samples. The generated malicious samples are then input into the global vertical federated model of the federated inference system to perform target label attacks. During the preparation phase of the method, the attacker executes the vertical federated inference process normally in the following manner, accumulating the inference results fed back from the global vertical federated model as pseudo-labels, including: Step 11, Semi-supervised clustering: The attackers used a semi-supervised clustering algorithm to divide the complete test set into multiple data clusters; Step 12, Sample Selection: The attacker calculates the expressive power value of the unlabeled samples in each data cluster, and selects unlabeled samples in each data cluster based on the accuracy of the local substitution model and the expressive power value of the unlabeled samples. Step 13, Standard Vertical Federated Reasoning: The attacker inputs all the unlabeled samples selected in step 12 into the global vertical federated model for the standard vertical federated inference process. The attacker receives the inference results returned by the global vertical federated model and uses the inference results as pseudo-labels for the corresponding unlabeled samples. Step 14, update pseudo-label information: The attacker uses the pseudo-labels of unlabeled samples to update the clustering results in step 11, resulting in multiple updated data clusters; The attacker uses the updated multiple data clusters to obtain the inference result of each unlabeled sample in steps 12 and 13, and then uses it as the pseudo-label of the unlabeled sample. The attacker also combines the local sample features to generate pseudo-labeled samples to update the pseudo-label information.

2. The target label attack method for vertical federated inference systems according to claim 1, characterized in that, In step 11, the semi-supervised clustering method used is the Constrained Seed KMeans clustering algorithm.

3. The target label attack method for vertical federated inference systems according to claim 1, characterized in that, In step 12, the attacker calculates the unlabeled samples within each data cluster in the following manner. expressive ability value ,include: By distance similarity and probability uncertainty Identify unlabeled samples expressive ability value This determines unlabeled samples expressive ability value The calculation formula is: ； in, To balance distance similarity and probability uncertainty Hyperparameters of these two metrics; distance similarity The calculation formula is: Probability uncertainty The calculation formula is: Among them, distance similarity Used to measure unlabeled samples With the samples that have been inferred and have obtained pseudo-labels The distance size, Larger unlabeled samples With the samples that have been inferred and have obtained pseudo-labels The smaller the distance, the fewer the unlabeled samples. Their expressive abilities are stronger; Let i be the set of pseudo-label samples, where i represents the index of the pseudo-label sample in the set. For the attacker's local model; probabilistic uncertainty Used to measure unlabeled samples Probabilistic uncertainty in local substitution models The larger the value, the greater the uncertainty, indicating unlabeled samples. Their expressive abilities are stronger; A local alternative model for attackers; () represents the entropy of a vector; () represents the function used to calculate the classification probability vector.

4. The target label attack method for vertical federated inference systems according to claim 3, characterized in that, In step 12, unlabeled samples are selected within each data cluster based on the accuracy of the local substitution model combined with the expressive power value of the unlabeled samples, including: when the accuracy of the local substitution model is below 50%, the attacker reduces the probability uncertainty of all unlabeled samples. Sort the values ​​in descending order and select those with uncertain probabilities. The k largest samples are selected, where k is a preset value, and hyperparameters for balancing are also set. Value less than 0.5; When the accuracy of the local surrogate model is above 50%, the attacker calculates the distance similarity of all unlabeled samples. Sort by descending order and select by distance similarity. Select the k largest samples and set the hyperparameters for balancing. The value is greater than 0.

5.

5. The target label attack method for vertical federated inference systems according to any one of claims 1-4, characterized in that, In the preparation phase of the method, the attacker trains a local substitution model locally using pseudo-labels while simultaneously estimating detectors in the global longitudinal federated inference system, including: Step 15: The attacker uses pseudo-labeled samples with pseudo-labels to build an estimated detector and a local alternative model locally. This local alternative model shares the same bottom model as the global longitudinal federated model, but uses a randomly initialized inference head model. The attacker trains the estimated detector and the local alternative model using the pseudo-labeled samples. The training process will stop when the model accuracy reaches a threshold set by the attacker.

6. The target label attack method for vertical federated inference systems according to any one of claims 1-4, characterized in that, In the attack phase of the method, the attacker uses the projective gradient descent method to optimize the features of the input samples to generate malicious samples in the following manner, and then inputs the generated malicious samples into the global vertical federated model of the federated inference system to perform a target label attack, including: Step 21, generate malicious sample: The attacker uses the local substitute model and estimated detector obtained during the preparation phase to iteratively optimize the inference samples using the projective gradient descent algorithm to generate the final malicious sample. Step 22, Malicious Vertical Federated Reasoning: The attacker inputs the generated malicious sample into the global vertical federated inference system, causing the global vertical federated model to predict any sample feature input by other participants as the attacker's target label.

7. The target label attack method for vertical federated inference systems according to claim 6, characterized in that, In step 21, the attacker uses the local substitute model trained in the preparation phase and the estimated detector to iteratively optimize the inference samples using the projective gradient descent algorithm to generate the final malicious sample, including: The attacker inputs the remaining unlabeled samples from the test set into the local substitution model and the locally estimated detector, and iteratively optimizes them using the projective gradient descent algorithm. The first optimization sub-objective is to make the local substitution model predict the unlabeled sample as the target label with a high confidence level that meets a predetermined confidence threshold. The second optimization sub-objective is to simultaneously ensure that the malicious samples generated after optimization can still be identified as normal samples by the locally estimated detector. The specific optimization objective function is... for: ； in, This indicates unlabeled samples; Represents the cross-entropy loss function; Indicates the attacker's target label; Indicates the detector with local estimation; These are hyperparameters used to balance the two optimization sub-objectives during the optimization process.

8. A processing apparatus, characterized in that, include: At least one memory for storing one or more programs; At least one processor is capable of executing one or more programs stored in the memory, such that when the one or more programs are executed by the processor, the processor can perform the method according to any one of claims 1-7.

9. A readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it can implement the method described in any one of claims 1-7.

Images