Federal learning model leakage tracing method based on model structure confusion

Abstract

The invention discloses a federal learning model leakage traceability method based on model structure confusion, and the method comprises an initialization step: S1, a server copies an initial model for subsequent structure comparison, and generates a unique binary user identity (UID) for each client; a UID embedding step S2, before each round of training is started, independently executing structure confusion for each client model by the server, embedding a client UID into a model structure, and then issuing the model to the client; a model structure recovery step S3, when one round of training is finished, the server executes structure recovery on each client model, and then executes model aggregation; and S4, when a model ownership owner doubts that a model with an unknown source comes from leakage in a training process, the structure of the model is detected, and a suspicious UID is extracted through structure comparison with an initial model so as to find a leakage person. The method has the characteristics of no negative influence on the performance of the original model, low embedding time overhead, high robustness and the like.

Description

Technical Field

[0001] The present invention relates to the field of federated learning, and in particular to a method for tracing the leakage of a federated learning model based on model structure obfuscation. Background Art

[0002] Artificial intelligence (AI) models have become a vital asset for many companies due to their powerful capabilities and high training costs. However, these models face significant risks of intellectual property infringement. Previous research has revealed that models can be illegally leaked during distribution and use. Therefore, intellectual property protection for AI models is of paramount importance.

[0003] With the recent rise of federated learning (FL), protecting model ownership in distributed machine learning scenarios has attracted considerable attention. As a privacy-preserving machine learning approach, FL enables collaborative model training without sharing client data. However, because the FL process requires the participation of a large number of clients and allows participating clients to access the model, it carries a higher risk of model leakage than traditional centralized training. Therefore, developing a reasonable solution to effectively trace leakers has become an urgent task.

[0004] Existing solutions use model watermarking or fingerprinting to track model leakers. Specifically, these methods use feature-based or backdoor-based approaches to embed a fingerprint or unique watermark in the model for each client participating in the federated learning process. When a model leak occurs, the model owner can trace the leaker's identity by extracting the watermark or fingerprint from the model.

[0005] However, existing methods for tracing malicious model leakers still face the following challenges:

[0006] 1. First, existing tracing methods require modifying the valid data of the model weights to embed watermarks or fingerprints, which may have a negative impact on the performance of the original model and reduce the model's usability.

[0007] 2. Secondly, most existing tracing methods require the server to perform separate fine-tuning training for each client model before each round of training, resulting in a large training time overhead.

[0008] 3. Finally, most existing attack methods against model watermarks and fingerprints involve modifying the valid data of model weights. Since traditional tracing methods require embedding identity information in the weight data, this information may become blurred or invalid after the attack. Summary of the Invention

[0009] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a method for tracing back malicious leakers of federated learning models, which does not require embedding information in the valid data of the model weights, has low time overhead, and is highly robust against traditional attacks.

[0010] To solve the above technical problems, the present invention proposes a technical solution: a method for tracing the source of a federated learning model leak based on model structure obfuscation, comprising the following steps:

[0011] S1: Before training begins, the server copies an unmodified initial model for subsequent model structure recovery and model structure comparison when tracing back malicious leakers.

[0012] S2, the server generates a unique binary user identification (UID) of a specific length for each client based on the number of convolutional layers of the initial model and the client's decimal ID, and stores the UID information locally;

[0013] S3: Before each round of training, the server randomly selects a linear layer of the global model to perform model structure obfuscation;

[0014] S4: For each model copy to be sent to the client, the server performs model structure obfuscation on different convolutional layer combinations based on the corresponding client's binary UID, thereby embedding the identity information used for tracing, and then sends the model to the client for training;

[0015] S5: The client trains the received model locally and uploads the model parameters to the server after training.

[0016] S6, after receiving the client model, the server compares the model structure with the initial model for each client model, finds the confused convolution layer and performs structural recovery on it;

[0017] S7, after the server performs model aggregation, it detects the linear layers of the global model, finds and restores the obfuscated layers.

[0018] S8, when the model owner suspects that a model comes from a leak during the training process, by comparing the model structure of the suspicious model and the initial model, the suspicious UID string is extracted, and the most suspicious malicious client is further found.

[0019] Furthermore, the UID generation method in step S2 includes: obtaining the number of convolutional layers in the model as the length of the generated client UID, and then generating a unique binary string for each client as its UID; repeating this step multiple times to generate multiple sets of UID combinations.

[0020] Furthermore, the method for obfuscating the linear layer structure described in step S3 includes creating a pair of pseudo-inverse matrices, and using these and the parameters of the original linear layer to create a pair of adjacent linear layer combinations, so that the outputs of the new linear layers in the model are equivalent to the original linear layers. The new linear layer combinations are used to replace the original linear layers in the model.

[0021] Furthermore, the method for obfuscating the convolutional layer structure described in step S4 includes: creating a new convolutional layer such that the first and second dimensions of its convolution kernel weight tensor are the same as the first and second dimensions of the original convolution kernel weight tensor, and the third and fourth dimensions of its convolution kernel weight tensor are expanded based on the third and fourth dimensions of the original convolution kernel weight tensor and padded with zeros or random numbers with small absolute values. The new convolutional layer is used to replace the original convolutional layer in the model.

[0022] Furthermore, the method described in step S4 for embedding identity information by obfuscating different combinations of convolutional layers includes: corresponding each binary bit in the client UID to each convolutional layer in the model, and obfuscating the corresponding convolutional layer when the UID bit is "1".

[0023] Furthermore, the method for restoring the convolutional layer structure described in step S6 includes: creating a new convolutional layer so that the size of its convolution kernel weight tensor is the same as the weight tensor of the layer before obfuscation. Its first and second dimensions are the same as the first and second dimensions of the convolution kernel weight tensor after obfuscation, and its third and fourth dimensions are the same as the central effective portion of the third and fourth dimensions of the convolution kernel weight tensor after obfuscation and padding. The new convolutional layer is used to replace the obfuscated convolutional layer in the model.

[0024] Furthermore, the method for restoring the linear layer structure described in step S7 includes: using the parameters of the adjacent linear layer combination that has been obfuscated in the model, creating a new linear layer whose output in the model is equivalent to the original obfuscated linear layer combination, and using the new linear layer to replace the obfuscated linear layer combination in the model.

[0025] Furthermore, the suspicious UID extraction method described in step S8 includes: traversing all convolutional layers in the suspicious model, obtaining the arrangement order of the obfuscated and non-obfuscated convolutional layers, and restoring a binary string from the arrangement order as the extracted suspicious UID.

[0026] Furthermore, the method for further finding the most suspicious malicious client described in step S8 includes: traversing all UID combinations, and finding the real UID that is most similar to the suspicious UID, and treating the client corresponding to the real UID as the most suspicious client.

[0027] Compared with the prior art, the advantages of the present invention are:

[0028] 1. This invention is the first method for tracing malicious model leakers in federated learning based on model structure obfuscation. Compared with existing tracing solutions, this invention does not require modifying the valid data of model weights to embed watermarks or fingerprints, and therefore does not negatively impact the performance of the original model.

[0029] 2. This paper embeds the client's UID into the model structure through convolutional layer obfuscation. Compared with existing tracing solutions, it does not require fine-tuning the client model in each round of training, thus greatly improving the FL training efficiency.

[0030] 3. The present invention also introduces structural obfuscation for the linear layer of the model. When used in conjunction with the existing global model watermarking method, it can effectively enhance the robustness of the model watermark against detection attacks.

[0031] 4. Most existing attack methods against model watermarks and fingerprints involve modifying the effective data of the model weights. The location where the attack occurs is different from the location where the client UID is embedded in the present invention. Therefore, the present invention can effectively resist most attacks against model watermarks and fingerprints. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Schematic diagram of the FL training process according to a specific embodiment of the present invention.

[0033] Figure 2 The figure is a schematic diagram of the malicious leaker tracing process according to a specific embodiment of the present invention.

[0034] Figure 3 This is a schematic diagram of the impact of convolutional layer confusion on the usability of the original model in a specific embodiment of the present invention.

[0035] Figure 4 The following is a comparison of the tracing success rate and embedding efficiency between the specific embodiment of the present invention and the existing solution (FedTracker).

[0036] Figure 5 These are the robustness test results of a specific embodiment of the present invention under model fine-tuning attack, model pruning attack, and watermark overwriting attack. DETAILED DESCRIPTION

[0037] The present invention will be further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the scope of protection of the present invention is not limited thereby.

[0038] like Figure 1 and Figure 2As shown in the figure, the method for tracing malicious model leakers in federated learning based on model structure obfuscation in this embodiment includes a client and a server. The client is responsible for normal participation in the federated learning process, training locally using the model distributed by the server, and uploading the trained model to the server. The server is responsible for hosting the federated learning process and completing tasks such as client UID generation, model structure obfuscation, model structure recovery, and tracing malicious leakers.

[0039] In the tracing method for malicious model leaks in federated learning based on model structure obfuscation in this embodiment, in the initialization step, the server copies an unmodified initial model M o . Then, the server generates multiple sets of unique UIDs for each client. The UID generation method includes: (1) obtaining the number of convolutional layers in the model as the generated UID length S; (2) for each client, converting its decimal ID into binary and calculating the number of "1" bits N in the binary ID, and then generating a unique binary string of length S containing N bits of "1" as its UID; (3) repeating step (2) multiple times to generate multiple sets of client UID combinations.

[0040] In this embodiment, the server and the client perform the federated learning training process normally. Before sending each round of models to the client, the server first performs a global model M g A linear layer is randomly selected for structural confusion, and then a copy of the global model is copied for each client as the client model, and then the convolutional layer structural confusion is performed on each client model.

[0041] The method of linear layer structure confusion includes: (1) the weight matrix W of the original linear layer F is known l Size is x l ×y l ; Generate a pair of sizes y l ×x l and x l ×y l The matrices H1 and H2 satisfy W l =H2×H1×W l ; (2) Create two new adjacent linear layers F1 and F2, transforming H1×W l As the weight matrix of F1, H2 as the weight matrix of F2, and the bias β of the original linear layer as the bias of F2; (3) Use the combination of F1 and F2 to replace the original linear layer F in the model.

[0042] In this embodiment, the original linear layer F can be expressed as:

[0043] F(δ)=W l ×δ+β(1)

[0044] The calculation method in this embodiment is shown in formula (2):

[0045]

[0046] In this embodiment, the method for embedding identity information by obfuscating different convolutional layer combinations includes: (1) before obfuscating the convolutional layer structure in each round of training, randomly selecting a set of previously generated UID combinations for this round of obfuscation; (2) obtaining the binary UID corresponding to the client to which the model belongs in the combination; (3) traversing all convolutional layers of the model and each bit of the UID simultaneously in a top-down and left-to-right order, and when the UID bit is "1", obfuscating the currently traversed convolutional layer.

[0047] In this embodiment, the method for confusing a specific convolution layer structure includes: (1) the first and second dimensions of the original convolution kernel weight tensor are known to be the matrix W c(1,2) , the third and fourth dimensions are of size x c ×y c The matrix W c(3,4) ; Create a new first and second dimension and W c(1,2) Same, the third and fourth dimensions are (x c +2)×(y c +2) tensor W c_padded , where the outer edges of the third and fourth dimensional matrices are filled with zeros or random numbers with smaller absolute values, and the center is filled with W c(3,4) Fill with the value of; (2) Create a new convolutional layer, using W c_padded As its convolution kernel weight, and use this convolution layer to replace the original convolution layer in the model.

[0048] After the server completes the linear and convolutional layer obfuscation steps, it sends the model to the client participating in the training. After receiving the model, the client begins local training for this round. After the client completes training, it uploads the local model to the server.

[0049] In this embodiment, the server receives the local model M uploaded by the client. i After that, you need to i Perform convolution layer structure recovery. Server top-down comparison M i With the initial model M o The structural differences of all convolutional layers are calculated, all the obfuscated convolutional layers are found, and then the obfuscated convolutional layers are restored.

[0050] The method of recovering the convolutional layer structure includes: (1) the weight tensor W of the convolutional layer after the confusion is known c_padded The size of ′ is i×j×k×l and the initial model M oThe corresponding convolutional layer weight tensor size is i×j×(k-2)×(l-2); create a new tensor W of size i×j×(k-2)×(l-2) c_re , where the first and second dimensions are related to W c_padded The first and second dimensions of ′ are the same, and the third and fourth dimensions are the same as W c_padded The third and fourth dimensions of ′ are the same as the effective center part after removing the confusion filling edge; (2) Create a new convolution layer and use W c_re As its convolution kernel weight, and use this convolution layer to replace the confused convolution layer in the model.

[0051] After the server completes the convolutional layer structure recovery operation for all client models, it performs the normal federated learning model aggregation step to aggregate the models uploaded by all clients to obtain a new global model M g ′.

[0052] In this embodiment, the server M g ′Perform the linear layer structure recovery operation, first traverse all linear layers of the global model from top to bottom, find the confused layer, and then perform the recovery operation on it.

[0053] The method of restoring the linear layer structure includes: (1) the weight matrix of the known confused linear layer combination F1′ and F2′ is W l1 ′ and W l2 ′, where W l2 The size of ′ is x l ′×y l ', the bias of F2' is β'; create a new linear layer F re , whose weight matrix is ​​W l2 ′×W l1 ′, bias is β′; (2) Use F re Replace the linear layer combination F1′ and F2′ in the model. The calculation method in this embodiment is shown in formula (3):

[0054] F re (δ)=W l2 ′×W l1 ′×δ+β′ (3)

[0055] After completing the linear layer structure recovery operation, the server decides to start the next round of training or end the training according to the pre-set settings.

[0056] In this embodiment, when the model owner suspects that a model is leaked from the training process, the owner can s and the initial model M oThe model structure is compared, suspicious UID strings are extracted from the confused convolutional layer combination order, and the most suspicious malicious client is further found.

[0057] The suspicious UID extraction method includes: (1) declaring an empty string s m_uid ; (2) Traverse all convolution layers of the suspicious model, and whenever the structure of the convolution kernel weight is found to be the same as that of the initial model M o When the corresponding convolutional layers are different, m_uid Add a "1" to the end of the value, otherwise add a "0".

[0058] The method of further finding the most suspicious malicious client includes: (1) traversing each real UID in all UID combinations and calculating its difference with s m_uid (2) Find the Hamming distance between s through the Hamming distance m_uid The client with the most similar real UID is regarded as the most suspicious client.

[0059] In this embodiment, the technical solution is verified by simulation experiments, and PyTorch is used for model training. In the simulation experiment, the system consists of an aggregation server and multiple (10, 20, 30, 50) client devices, and is set to select all clients for training in each round of training. In this embodiment, the Resnet-18 model (containing 25 convolutional layers) with an insert watermark is selected for testing on the CIFAR-10 and CIFAR-100 datasets. The datasets are all set to be non-independent and identically distributed. The simulation experiment is carried out on a physical machine containing an AMD Ryzen 75800X CPU and an NVIDIA GeForce RTX3090 graphics card.

[0060] In this simulation experiment, the effect of convolutional layer structure confusion on the usability of the original model was tested. Figure 3 It can be seen that after confusing different numbers of convolutional layers, the original task accuracy of the original model is negligibly affected and can still be maintained at more than 50% of the initial level, proving that this technical solution will not have a negative impact on the usability of the original model.

[0061] In this simulation experiment, a certain proportion of malicious clients are set in the client to simulate the situation where the model is leaked during the training process. Figure 4 It can be seen that under the settings of different numbers of clients and different data sets, this technical solution can maintain a 100% tracing success rate, achieving the same reliability as the existing baseline solution FedTracker.

[0062] In this simulation experiment, we also tested the time required for the server to perform model structure obfuscation in each round under different client numbers and different data sets. Figure 4 As can be seen, the time required to perform model structure obfuscation increases with the number of clients. However, regardless of the two methods used for convolution kernel structure obfuscation, the time required is significantly lower than the time required by the baseline solution FedTracker to embed unique fingerprints for all client models, demonstrating that this technical solution is more efficient than existing solutions.

[0063] In this simulation experiment, a malicious client attempts to remove or blur the identity information embedded in the client model by using traditional attack methods targeting backdoors and feature watermarks. Figure 5 As shown in the figure, model fine-tuning attack, model pruning attack and watermark overwriting attack cannot significantly reduce the success rate of tracing back malicious leakers, indicating that this technical solution has a good defense effect against traditional watermark attacks.

[0064] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed above based on preferred embodiments, it is not intended to limit the present invention. Therefore, any simple modifications, equivalent variations, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A method for tracing the leakage of a federated learning model based on model structure obfuscation, characterized by: include: S1, before training begins, the server copies an unmodified initial model M o , used for subsequent model structure recovery and model structure comparison when tracing malicious leakers; S2, the server generates a unique binary user identification (UID) of a specific length for each client based on the number of convolutional layers of the initial model and the client's decimal ID, and stores the UID information locally; S3: Before each round of training, the server randomly selects a linear layer of the global model to perform model structure obfuscation; S4: For each model copy to be sent to the client, the server performs model structure obfuscation on different convolutional layer combinations based on the corresponding client's binary UID, thereby embedding the identity information used for tracing, and then sends the model to the client for training; S5: The client trains the received model locally and uploads the model parameters to the server after training. S6, after receiving the client model, the server compares the model structure with the initial model for each client model, finds the confused convolution layer and performs structural recovery on it; S7, after the server performs model aggregation, it detects the linear layers of the global model, finds and restores the obfuscated layers; S8, when the model owner suspects that a model comes from a leak during the training process, by comparing the model structure of the suspicious model and the initial model, the suspicious UID string is extracted, and the most suspicious malicious client is further found.

2. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1 is characterized in that: The UID generation method described in step S2 includes: obtaining the number of convolutional layers in the model as the length of the generated client UID, and then generating a unique binary string for each client as its UID; repeating this step multiple times to generate multiple sets of UID combinations.

3. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1 is characterized in that: The method for confusing the linear layer structure described in step S3 includes: creating a pair of pseudo-inverse matrices, and using them and the parameters of the original linear layer to create a pair of adjacent linear layer combinations, so that the output of the new linear layer in the model is equivalent to the original linear layer, and using the new linear layer combination to replace the original linear layer in the model.

4. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1 is characterized in that: The method for confusing the convolutional layer structure described in step S4 includes: creating a new convolutional layer so that the first and second dimensions of its convolution kernel weight tensor are the same as the first and second dimensions of the original convolution kernel weight tensor, and its third and fourth dimensions are expanded on the basis of the third and fourth dimensions of the original convolution kernel weight tensor and filled with zero or random numbers with a small absolute value, and the new convolutional layer is used to replace the original convolutional layer in the model.

5. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1, characterized in that: The method described in step S4 for embedding identity information by obfuscating different combinations of convolutional layers includes: corresponding each binary bit in the client UID to each convolutional layer in the model, and obfuscating the corresponding convolutional layer when the UID bit is "1".

6. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1, characterized in that: The method for restoring the convolution layer structure described in step S6 includes: creating a new convolution layer so that the size of the weight tensor of its convolution kernel is the same as the weight tensor of the layer before confusion, the data of its first and second dimensions are the same as the first and second dimensions of the convolution kernel weight tensor after confusion, and the data of its third and fourth dimensions are the same as the central effective part of the third and fourth dimensions of the convolution kernel weight tensor after confusion after removing the confusion filling edge, and using the new convolution layer to replace the confused convolution layer in the model.

7. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1, characterized in that: The method for restoring the linear layer structure described in step S7 includes: using the parameters of the adjacent linear layer combination that has been confused in the model, creating a new linear layer so that its output in the model is equivalent to the original pair of confused linear layer combinations, and using the new linear layer to replace the confused linear layer combination in the model.

8. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1, characterized in that: The suspicious UID extraction method described in step S8 includes: traversing all convolution layers in the suspicious model, obtaining the arrangement order of the obfuscated and non-obfuscated convolution layers, and restoring a binary string from the arrangement order as the extracted suspicious UID.

9. The method for tracing malicious model leakers in federated learning based on model structure obfuscation according to claim 1, characterized in that: The method for further finding the most suspicious malicious client described in step S8 includes: traversing all UID combinations, and finding the real UID most similar to the suspicious UID, and treating the client corresponding to the real UID as the most suspicious client.

Images