Attack method, device and equipment of decentralized federated learning system and medium

Abstract

The application relates to the technical field of federated learning, and discloses an attack method, device, equipment and medium for a decentralized federated learning system. The method comprises the following steps: connecting the network identifier of a malicious client and the network identifier of each benign client to obtain a communication graph; restoring the image proportion of each benign client according to the gradient information of each benign client, determining state data in a simulation environment based on the image proportion of each benign client and the communication graph; determining a current attack model in the simulation environment based on a reinforcement learning mode and the state data; obtaining the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training based on the current attack model; and determining an attack report of the decentralized federated learning system based on attack benefits. Through the attack report, the attack mode can be identified, and the anti-attack capability of the decentralized federated learning system can be improved.

Description

Technical Field

[0001] The present application relates to the field of federated learning technology, and in particular to attack methods, devices, equipment, and media for decentralized federated learning systems. Background Art

[0002] Traditional federated learning faces the risk of central server attacks. To address this, a decentralized federated learning system has been proposed. This system eliminates the risk of central server attacks by eliminating the need for a centralized server.

[0003] However, the process of obtaining attack reports from existing decentralized federated learning systems is cumbersome, hindering efficiency. This is because existing technologies primarily rely on manual acquisition to obtain attack reports from decentralized federated learning systems. This manual acquisition consumes significant human and time resources, increases the time required to obtain attack reports from decentralized federated learning systems, and is susceptible to manual intervention, hindering efficiency. Summary of the Invention

[0004] The embodiments of the present application provide a method, apparatus, device, and medium for attacking a decentralized federated learning system to solve the technical problem that the acquisition process of attack reports in the existing decentralized federated learning system is cumbersome and is not conducive to improving the efficiency of acquiring attack reports.

[0005] In a first aspect, an embodiment of the present application provides an attack method for a decentralized federated learning system, which is applied to an electronic device. The attack method for a decentralized federated learning system includes:

[0006] Access the decentralized federated learning system of the medical data platform, obtain the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, connect the network identifier of the malicious client with the network identifier of each benign client, and obtain a communication graph;

[0007] According to the gradient information of each benign client, the image ratio of each benign client is restored, and based on the image ratio and communication graph of each benign client, the state data in the simulation environment is determined;

[0008] Determine the current attack model in the simulation environment based on reinforcement learning methods and state data;

[0009] Derive the current attack model from the simulation environment. Based on the current attack model, obtain the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round.

[0010] Based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit.

[0011] In a possible implementation of the first aspect, accessing the decentralized federated learning system of the medical data platform, obtaining the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, and connecting the network identifier of the malicious client with the network identifier of each benign client to obtain a communication graph includes:

[0012] Access the decentralized federated learning system of the medical data platform and obtain the communication logs of malicious clients in the decentralized federated learning system;

[0013] The network identifier of the malicious client and the network identifier of each benign client with which the malicious client directly communicates are obtained from the communication log, and the network identifier of the malicious client and the network identifier of each benign client are connected to obtain a communication graph.

[0014] In a possible implementation of the first aspect, restoring the image ratio of each benign client according to the gradient information of each benign client, and determining the state data in the simulation environment based on the image ratio of each benign client and the communication graph include:

[0015] Collect the gradient information of each benign client, use the gradient inversion tool to restore the image ratio of each benign client based on the gradient information of each benign client, and obtain the dataset corresponding to the image ratio of each benign client;

[0016] Create a simulation node for each benign client and a simulation node for each malicious client. According to the communication graph, connect the simulation node of each benign client with the simulation node of the malicious client to obtain the simulation environment of the decentralized federated learning system.

[0017] In the simulation environment, a data set corresponding to the image ratio of each benign client is used to train the model of the simulation node of each benign client, and the benign model parameters output by the simulation node of each benign client are obtained. The benign model parameters output by the simulation node of each benign client and the communication graph are combined to form the state data in the simulation environment.

[0018] In a possible implementation of the first aspect, determining the current attack model in the simulation environment based on the reinforcement learning method and state data includes:

[0019] Obtain the original attack parameters output by the original attack model based on the state data, select the original attack parameters as action data, select the success rate of the original attack parameters as reward data, and combine the state data, action data, and reward data into training data;

[0020] The value network and the policy network in the original attack model are trained using the training data until the value network and the policy network are in a converged state, the converged value network and the converged policy network are saved, and the converged value network and the converged policy network are combined to form the current attack model in the simulation environment.

[0021] In a possible implementation of the first aspect, deriving the current attack model from the simulation environment, and obtaining, based on the current attack model, a loss value of each benign client in the tth round of training and a loss value of each benign client in the next round of training after the tth round, includes:

[0022] Export the current attack model from the simulation environment, control the malicious client to load the current attack model, and determine whether the current time is the authorized time;

[0023] When the current time is the authorization time, obtain the current attack parameters output by the current attack model in the tth round of training, send the current attack parameters to each benign client through the malicious client, and obtain the loss value of each benign client in the tth round of training from the update information returned by each benign client based on the current attack parameters;

[0024] When a malicious client participates in the next round of training in round t of the centralized federated learning system, the next attack parameter output by the current attack model in the next round of round t is obtained, the next attack parameter is sent to each benign client via the malicious client, and the loss value of each benign client in the next round of training in round t is obtained from the update information returned by each benign client based on the next attack parameter. In a possible implementation of the first aspect, the attack benefit obtained by the malicious client using the current attack model is generated based on a predefined attack benefit function, the loss value of each benign client in the training in round t, and the loss value of each benign client in the next round of round t, and the attack report of the decentralized federated learning system is determined based on the attack benefit, including:

[0025] Generate the attack benefit obtained by the malicious client using the current attack model based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round;

[0026] Obtain the attack level corresponding to the attack benefit, write the attack benefit, attack level and attack time into the attack template, and obtain the attack report of the decentralized federated learning system.

[0027] In a possible implementation manner of the first aspect, the malicious client refers to a hospital client that performs malicious attacks in the decentralized federated learning system, the benign client refers to a hospital client that does not perform malicious attacks in the decentralized federated learning system, and the image ratio is a ratio of lesion images in the local data distribution to normal images in the local data distribution.

[0028] In a second aspect, an embodiment of the present application provides an attack device of a decentralized federated learning system, applied to an electronic device, and including:

[0029] The first obtaining module is configured to access a decentralized federated learning system of a medical data platform, obtain network identifiers of malicious clients and network identifiers of each benign client in the decentralized federated learning system, connect the network identifiers of the malicious clients and the network identifiers of each benign client, and obtain a communication graph.

[0030] The restoring module is configured to restore an image ratio of each benign client according to gradient information of each benign client, and determine state data in a simulation environment based on the image ratio of each benign client and the communication graph.

[0031] The determining module is configured to determine a current attack model in the simulation environment based on a reinforcement learning manner and the state data.

[0032] The second obtaining module is configured to export the current attack model from the simulation environment, and obtain a loss value of each benign client in the t th round of training and a loss value of each benign client in the next round of training in the t th round based on the current attack model.

[0033] The attack module is configured to generate an attack benefit of the malicious client using the current attack model according to a predefined attack benefit function, the loss value of each benign client in the t th round of training, and the loss value of each benign client in the next round of the t th round, and determine an attack report of the decentralized federated learning system based on the attack benefit.

[0034] In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the attack method of the decentralized federated learning system in the first aspect when executing the computer program.

[0035] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the attack method of the decentralized federated learning system in the first aspect.

[0036] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the attack method of the decentralized federated learning system in the first aspect above.

[0037] The beneficial effects of the embodiments of the present application lie in two aspects. On the one hand, based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit, thereby reducing the time for obtaining the attack report of the decentralized federated learning system and helping to improve the efficiency of obtaining the attack report of the decentralized federated learning system; on the other hand, through the attack report, the vulnerabilities and attack modes of the decentralized federated learning system can be identified, so as to develop targeted defense mechanisms and enhance the anti-attack capabilities of the decentralized federated learning system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 An application scenario diagram of the attack method for the decentralized federated learning system provided in an embodiment of the present application;

[0040] Figure 2 1 is a flowchart of an attack method for a decentralized federated learning system provided in an embodiment of the present application;

[0041] Figure 3 A flowchart for obtaining an attack report provided in an embodiment of the present application;

[0042] Figure 4 A schematic block diagram of an attack device for a decentralized federated learning system provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of this application more clear, the present application is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0045] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0046] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0047] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0048] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0049] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0050] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0051] In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0052] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined, or partially merged, so the actual execution order may vary depending on the actual situation.

[0053] The attack method for the decentralized federated learning system provided in the embodiments of the present application can be applied to electronic devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). The embodiments of the present application do not impose any restrictions on the specific types of electronic devices.

[0054] For example, the electronic device may be a station (STAION, ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a vehicle networking terminal, a computer, a laptop computer, a handheld communication device, a handheld computing device, a satellite wireless device, a wireless modem card, a TV set-top box (STB), customer premise equipment (CPE) and / or other devices for communicating on a wireless system and a next-generation communication system, such as a mobile terminal in a 5G network or a mobile terminal in a future evolved Public Land Mobile Network (PLMN) network.

[0055] See also Figure 1 , Figure 1 The application scenario diagram of the attack method for the decentralized federated learning system provided in the embodiment of this application is detailed as follows:

[0056] The electronic device accesses the decentralized federated learning system of the medical data platform and obtains the network identification of the malicious client and the network identification of each benign client from the decentralized federated learning system.

[0057] Among them, malicious clients refer to hospital clients that carry out malicious attacks in the decentralized federated learning system.

[0058] Among them, benign clients refer to hospital clients that do not carry out malicious attacks in the decentralized federated learning system.

[0059] In an embodiment of the present application, an electronic device accesses a decentralized federated learning system of a medical data platform and can quickly obtain the network identification of a malicious client and the network identification of each benign client.

[0060] See also Figure 2 , Figure 2 This is a flowchart of an attack method for a decentralized federated learning system provided in an embodiment of the present application, which can be applied to electronic devices. Figure 2 As shown, the attack method of the decentralized federated learning system provided in the embodiment of the present application includes the following steps, which are detailed as follows:

[0061] S201, accessing the decentralized federated learning system of the medical data platform, obtaining the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, and connecting the network identifier of the malicious client with the network identifier of each benign client to obtain a communication graph;

[0062] The decentralized federated learning system of the medical data platform is accessed, the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system are obtained, and the network identifier of the malicious client and the network identifier of each benign client are connected to obtain a communication graph, including:

[0063] Access the decentralized federated learning system of the medical data platform and obtain the communication logs of malicious clients in the decentralized federated learning system;

[0064] The network identifier of the malicious client and the network identifier of each benign client with which the malicious client directly communicates are obtained from the communication log, and the network identifier of the malicious client and the network identifier of each benign client are connected to obtain a communication graph.

[0065] Among them, malicious clients refer to hospital clients that carry out malicious attacks in the decentralized federated learning system, and benign clients refer to hospital clients that do not carry out malicious attacks in the decentralized federated learning system.

[0066] S202, restoring the image ratio of each benign client according to the gradient information of each benign client, and determining the state data in the simulation environment based on the image ratio of each benign client and the communication graph;

[0067] The method of restoring the image ratio of each benign client according to the gradient information of each benign client, and determining the state data in the simulation environment based on the image ratio of each benign client and the communication graph includes:

[0068] Collect the gradient information of each benign client, use the gradient inversion tool to restore the image ratio of each benign client based on the gradient information of each benign client, and obtain the dataset corresponding to the image ratio of each benign client;

[0069] Create a simulation node for each benign client and a simulation node for each malicious client. According to the communication graph, connect the simulation node of each benign client with the simulation node of the malicious client to obtain the simulation environment of the decentralized federated learning system.

[0070] In the simulation environment, the model of each benign client simulation node is trained using a data set corresponding to the image ratio of each benign client, and the benign model parameters output by each benign client simulation node are obtained. The benign model parameters output by each benign client simulation node and the communication graph form the state data in the simulation environment.

[0071] Wherein, the image ratio is the ratio of the lesion image in the local data distribution to the normal image in the local data distribution.

[0072] Wherein, the lesion image refers to an image containing pathological features, such as an image containing a tumor, an image containing pneumonia.

[0073] Wherein, the normal image refers to an image without pathological features.

[0074] For the sake of illustration, the following examples are given:

[0075] For example, there are multiple benign clients, and the multiple benign clients are benign client 1, benign client 2, and benign client 3, respectively.

[0076] The image ratio of benign client 1 is 2:8, that is, the ratio of the lesion image in the local data distribution of benign client 1 to the normal image in the local data distribution of benign client 1 is 2:8.

[0077] The image ratio of benign client 2 is 3:7, that is, the ratio of the lesion image in the local data distribution of benign client 2 to the normal image in the local data distribution of benign client 1 is 3:7.

[0078] The image ratio of benign client 2 is 4:6, that is, the ratio of the lesion image in the local data distribution of benign client 2 to the normal image in the local data distribution of benign client 1 is 4:6.

[0079] Wherein, the model of benign client 1 simulation node is trained using a data set corresponding to the image ratio of benign client 1, and since the benign client 1 simulation node can learn the local data distribution of benign client 1 through the image ratio of benign client 1, the benign client 1 simulation node can generate model parameters highly matched with the local data distribution of benign client 1.

[0080] Wherein, the model of benign client 2 simulation node is trained using a data set corresponding to the image ratio of benign client 2, and since the benign client 2 simulation node can learn the local data distribution of benign client 2 through the image ratio of benign client 2, the benign client 2 simulation node can generate model parameters highly matched with the local data distribution of benign client 2.

[0081] Among them, a data set corresponding to the image ratio of benign client 3 is used to perform model training on the simulation node of benign client 3. Since the simulation node of benign client 3 can learn the local data distribution of benign client 3 through the image ratio of benign client 3, the simulation node of benign client 3 can generate model parameters that are highly matched with the local data distribution of benign client 3.

[0082] S203, determining a current attack model in the simulation environment based on the reinforcement learning method and state data;

[0083] The method of determining the current attack model in the simulation environment based on the reinforcement learning method and state data includes:

[0084] Obtain the original attack parameters output by the original attack model based on the state data, select the original attack parameters as action data, select the success rate of the original attack parameters as reward data, and combine the state data, action data, and reward data into training data;

[0085] The value network and the policy network in the original attack model are trained using the training data until the value network and the policy network are in a converged state, the converged value network and the converged policy network are saved, and the converged value network and the converged policy network are combined to form the current attack model in the simulation environment.

[0086] The value network accurately estimates the long-term returns of actions taken under different conditions, providing a reliable reference for decision-making. The policy network directly outputs the optimal action strategy based on the value network's evaluation. Combining a convergent value network and a convergent policy network into a current attack model in a simulation environment significantly improves the accuracy and stability of the attack model's decisions.

[0087] S204, deriving the current attack model from the simulation environment, and obtaining the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round based on the current attack model;

[0088] Among them, compared with real attack experiments, the simulation environment significantly reduces manpower, time and legal compliance costs, and the current attack model can be exported from the simulation environment to quickly obtain the current attack model.

[0089] The step of deriving the current attack model from the simulation environment and obtaining the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round based on the current attack model includes:

[0090] Export the current attack model from the simulation environment, control the malicious client to load the current attack model, and determine whether the current time is the authorized time;

[0091] When the current time is the authorization time, obtain the current attack parameters output by the current attack model in the tth round of training, send the current attack parameters to each benign client through the malicious client, and obtain the loss value of each benign client in the tth round of training from the update information returned by each benign client based on the current attack parameters;

[0092] When a malicious client participates in the next round of training of the centralized federated learning system in round t, it obtains the next attack parameter output by the current attack model in the next round of round t, sends the next attack parameter to each benign client through the malicious client, and obtains the loss value of each benign client in the next round of training in round t from the update information returned by each benign client based on the next attack parameter.

[0093] Among them, the authorization time is the time of authorized attack. For example, the authorization time is 2:00-4:00 in the morning. At this time, the defense shortcomings of the centralized federated learning system in a specific period of time can be exposed.

[0094] S205, based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, generate the attack benefit obtained by the malicious client using the current attack model, and determine the attack report of the decentralized federated learning system based on the attack benefit.

[0095] Among them, the attack benefit function is defined as follows:

[0096] ;

[0097] in, is the attack benefit obtained by the malicious client using the current attack model;

[0098] It is The loss value of a benign client in the tth round of training;

[0099] It is The loss value of a benign client in the next round of round t.

[0100] t is the number of training rounds, is the serial number of the benign client, and m is the number of benign clients; Indicates a benign client, Represents the loss function. The value range of t is a positive integer.

[0101] For ease of explanation, the following examples are given:

[0102] For example, there are multiple benign clients, namely benign client 1, benign client 2, and benign client 3;

[0103] When t is 1, the attack benefit function adds the loss value of benign client 1 in the first round of training, the loss value of benign client 2 in the first round of training, the loss value of benign client 3 in the first round of training, the loss value of benign client 1 in the second round of training, the loss value of benign client 2 in the second round of training, and the loss value of benign client 3 in the second round of training to obtain the attack benefit obtained by the malicious client using the current attack model.

[0104] When t is 2, the attack benefit function adds the loss value of benign client 1 in the second round of training, the loss value of benign client 2 in the second round of training, the loss value of benign client 3 in the second round of training, the loss value of benign client 1 in the third round of training, the loss value of benign client 2 in the third round of training, and the loss value of benign client 3 in the third round of training to obtain the attack benefit obtained by the malicious client using the current attack model.

[0105] Among them, saving attack reports of centralized federated learning systems can predict potential threats in advance and promote the active evolution of defense technologies. This is a key link in building an active security system for centralized federated learning systems.

[0106] For ease of explanation, the following examples are given:

[0107] For example, a hospital's medical data platform uses a decentralized federated learning system. Through attack reports from the centralized federated learning system, the hospital discovered attack patterns against the decentralized federated learning system, allowing the hospital to strengthen the centralized federated learning system of the medical data platform in advance to ensure the reliability of the centralized federated learning system of the medical data platform.

[0108] The beneficial effects of the embodiments of the present application lie in two aspects. On the one hand, based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit, thereby reducing the time for obtaining the attack report of the decentralized federated learning system and helping to improve the efficiency of obtaining the attack report of the decentralized federated learning system; on the other hand, through the attack report, the vulnerabilities and attack modes of the decentralized federated learning system can be identified, so as to develop targeted defense mechanisms and enhance the anti-attack capabilities of the decentralized federated learning system.

[0109] See also Figure 3 , Figure 3The flowchart for obtaining an attack report provided in the embodiment of the present application is detailed as follows:

[0110] S301, generating the attack benefit obtained by the malicious client using the current attack model based on a predefined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round;

[0111] S302, obtaining the attack level corresponding to the attack benefit, writing the attack benefit, attack level and attack time into the attack template, and obtaining an attack report of the decentralized federated learning system.

[0112] In the embodiment of the present application, since the attack report of the decentralized federated learning system is automatically obtained and will not be affected by human intervention, it is beneficial to improve the reliability of the attack report of the decentralized federated learning system.

[0113] For the attack method corresponding to the decentralized federated learning system described in the above embodiment, please refer to Figure 4 , Figure 4 A schematic block diagram of an attack device for a decentralized federated learning system provided in an embodiment of the present application. Figure 4 The attack device 400 of the decentralized federated learning system shown can be applied to Figure 1 The electronic device in the application scenario diagram shown below takes the electronic device as an example. Figure 4 The attack device 400 of the decentralized federated learning system shown in FIG. 4 is described in detail. The attack device 400 of the decentralized federated learning system may include a first acquisition module 401 , a restoration module 402 , a determination module 403 , a second acquisition module 404 , and an attack module 405 .

[0114] A first acquisition module 401 is configured to access the decentralized federated learning system of the medical data platform, obtain the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, and connect the network identifier of the malicious client with the network identifier of each benign client to obtain a communication graph;

[0115] Restoration module 402, configured to restore the image ratio of each benign client according to the gradient information of each benign client, and determine the state data in the simulation environment based on the image ratio of each benign client and the communication graph;

[0116] A determination module 403 is configured to determine a current attack model in a simulation environment based on a reinforcement learning approach and state data;

[0117] A second acquisition module 404 is configured to derive a current attack model from the simulation environment, and based on the current attack model, acquire a loss value of each benign client in the tth round of training and a loss value of each benign client in the next round of training after the tth round;

[0118] Attack module 405 is used to generate an attack benefit obtained by a malicious client using the current attack model based on a predefined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, and determine an attack report of the decentralized federated learning system based on the attack benefit.

[0119] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referenced to each other.

[0120] The beneficial effects of the embodiments of the present application lie in two aspects. On the one hand, based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit, thereby reducing the time for obtaining the attack report of the decentralized federated learning system and helping to improve the efficiency of obtaining the attack report of the decentralized federated learning system; on the other hand, through the attack report, the vulnerabilities and attack modes of the decentralized federated learning system can be identified, so as to develop targeted defense mechanisms and enhance the anti-attack capabilities of the decentralized federated learning system.

[0121] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0122] like Figure 5 As shown, Figure 5 The electronic device 2 includes: at least one processor 20, a memory 21, and a computer program 22 stored in the memory 21 and executable on the at least one processor 20, wherein the processor 20 implements the steps of any of the above-mentioned method embodiments when executing the computer program 22.

[0123] The electronic device 2 may include, but is not limited to, a processor 20 and a memory 21. Those skilled in the art will appreciate that Figure 5 This is merely an example of the electronic device 2 and does not constitute a limitation on the electronic device 2 . The electronic device 2 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 2 may also include input and output devices, network access devices, etc.

[0124] The processor 20 is configured to run a computer program 22 stored in the memory 21 and implement the following steps when executing the computer program 22:

[0125] Access the decentralized federated learning system of the medical data platform, obtain the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, connect the network identifier of the malicious client with the network identifier of each benign client, and obtain a communication graph;

[0126] According to the gradient information of each benign client, the image ratio of each benign client is restored, and based on the image ratio and communication graph of each benign client, the state data in the simulation environment is determined;

[0127] Determine the current attack model in the simulation environment based on reinforcement learning methods and state data;

[0128] Derive the current attack model from the simulation environment. Based on the current attack model, obtain the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round.

[0129] Based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit.

[0130] In some embodiments, the processor 20 is configured to implement:

[0131] Access the decentralized federated learning system of the medical data platform and obtain the communication logs of malicious clients in the decentralized federated learning system;

[0132] The network identifier of the malicious client and the network identifier of each benign client with which the malicious client directly communicates are obtained from the communication log, and the network identifier of the malicious client and the network identifier of each benign client are connected to obtain a communication graph.

[0133] In some embodiments, the processor 20 is configured to implement:

[0134] Collect the gradient information of each benign client, use the gradient inversion tool to restore the image ratio of each benign client based on the gradient information of each benign client, and obtain the dataset corresponding to the image ratio of each benign client;

[0135] Create a simulation node for each benign client and a simulation node for each malicious client. According to the communication graph, connect the simulation node of each benign client with the simulation node of the malicious client to obtain the simulation environment of the decentralized federated learning system.

[0136] In the simulation environment, a data set corresponding to the image ratio of each benign client is used to train the model of the simulation node of each benign client, and the benign model parameters output by the simulation node of each benign client are obtained. The benign model parameters output by the simulation node of each benign client and the communication graph are combined to form the state data in the simulation environment.

[0137] In some embodiments, the processor 20 is configured to implement:

[0138] Obtain the original attack parameters output by the original attack model based on the state data, select the original attack parameters as action data, select the success rate of the original attack parameters as reward data, and combine the state data, action data, and reward data into training data;

[0139] The value network and the policy network in the original attack model are trained using the training data until the value network and the policy network are in a converged state, the converged value network and the converged policy network are saved, and the converged value network and the converged policy network are combined to form the current attack model in the simulation environment.

[0140] In some embodiments, the processor 20 is configured to implement:

[0141] Export the current attack model from the simulation environment, control the malicious client to load the current attack model, and determine whether the current time is the authorized time;

[0142] When the current time is the authorization time, obtain the current attack parameters output by the current attack model in the tth round of training, send the current attack parameters to each benign client through the malicious client, and obtain the loss value of each benign client in the tth round of training from the update information returned by each benign client based on the current attack parameters;

[0143] When a malicious client participates in the next round of training of the centralized federated learning system in round t, it obtains the next attack parameter output by the current attack model in the next round of round t, sends the next attack parameter to each benign client through the malicious client, and obtains the loss value of each benign client in the next round of training in round t from the update information returned by each benign client based on the next attack parameter.

[0144] In some embodiments, the processor 20 is configured to implement:

[0145] Generate the attack benefit obtained by the malicious client using the current attack model based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round;

[0146] Obtain the attack level corresponding to the attack benefit, write the attack benefit, attack level and attack time into the attack template, and obtain the attack report of the decentralized federated learning system.

[0147] In some embodiments, a malicious client refers to a hospital client that conducts malicious attacks in a decentralized federated learning system, a benign client refers to a hospital client that does not conduct malicious attacks in a decentralized federated learning system, and the image ratio is the ratio of pathological images in the local data distribution to normal images in the local data distribution.

[0148] The processor 20 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors, field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0149] In some embodiments, the memory 21 may be an internal storage unit of the electronic device 2, such as a hard disk or memory of the electronic device 2. In other embodiments, the memory 21 may also be an external storage device of the electronic device 2, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. equipped on the electronic device 2. Furthermore, the memory 21 may include both an internal storage unit of the electronic device 2 and an external storage device. The memory 21 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory 21 may also be used to temporarily store data that has been output or is about to be output.

[0150] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0151] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0152] The computer readable storage medium stores program code, and the program code can be invoked by the processor to execute the attack method of the decentralized federated learning system described in the above method embodiments.

[0153] The computer readable storage medium has storage space for program code.

[0154] The program code includes code of any step in the attack method of the decentralized federated learning system described in the above method embodiments.

[0155] For example, the program code is invoked by the processor, and the following steps can be executed:

[0156] Access the decentralized federated learning system of the medical data platform, obtain the network identity of the malicious client and the network identity of each benign client in the decentralized federated learning system, connect the network identity of the malicious client and the network identity of each benign client, and obtain a communication graph;

[0157] According to the gradient information of each benign client, restore the image proportion of each benign client, and based on the image proportion of each benign client and the communication graph, determine state data in the simulation environment;

[0158] Determine the current attack model in the simulation environment based on the reinforcement learning mode and the state data;

[0159] Export the current attack model from the simulation environment, and based on the current attack model, obtain the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training in the tth round;

[0160] According to the pre-defined attack benefit function, the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training in the tth round, generate the attack benefit obtained by the malicious client using the current attack model, and determine the attack report of the decentralized federated learning system based on the attack benefit.

[0161] The specific implementation of each operation can be referred to the foregoing embodiments, which will not be described here.

[0162] The computer readable storage medium can also be an external storage device of the attack device or electronic equipment of the decentralized federated learning system, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, a non-volatile computer readable storage medium, etc.

[0163] Since the computer program stored in the computer-readable storage medium can execute any of the attack methods for a decentralized federated learning system provided in the embodiments of the present application, the computer-readable storage medium can achieve the beneficial effects that can be achieved by any of the attack methods for a decentralized federated learning system provided in the embodiments of the present application. For details, please refer to the previous embodiments and will not be repeated here.

[0164] An embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the above-mentioned attack method of the decentralized federated learning system.

[0165] The computer program product is loaded into the electronic device and can execute the following steps:

[0166] Access the decentralized federated learning system of the medical data platform, obtain the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, connect the network identifier of the malicious client with the network identifier of each benign client, and obtain a communication graph;

[0167] According to the gradient information of each benign client, the image ratio of each benign client is restored, and based on the image ratio and communication graph of each benign client, the state data in the simulation environment is determined;

[0168] Determine the current attack model in the simulation environment based on reinforcement learning methods and state data;

[0169] Derive the current attack model from the simulation environment. Based on the current attack model, obtain the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round.

[0170] Based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit.

[0171] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0172] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0173] Based on this understanding, the present application implements all or part of the processes in the above-described method embodiments by instructing the relevant hardware through a computer program. The computer program may be stored in a computer-readable storage medium. When executed by a processor, the computer program may implement the steps of each of the above-described method embodiments. The computer program includes computer program code, which may be in source code form, object code form, an executable file, or some intermediate form. The computer-readable medium may include at least: any entity or device capable of carrying computer program code to an electronic device, a recording medium, computer memory, read-only memory (ROM), random access memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium. Examples include a USB flash drive, a removable hard drive, a magnetic disk, or an optical disk.

[0174] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0175] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for attacking a decentralized federated learning system, characterized in that: Applied to electronic devices, the attack methods of the decentralized federated learning system include: Access the decentralized federated learning system of the medical data platform, obtain the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, connect the network identifier of the malicious client with the network identifier of each benign client, and obtain a communication graph; According to the gradient information of each benign client, the image ratio of each benign client is restored, and based on the image ratio and communication graph of each benign client, the state data in the simulation environment is determined; Determine the current attack model in the simulation environment based on reinforcement learning methods and state data; Derive the current attack model from the simulation environment. Based on the current attack model, obtain the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round. Based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, the attack benefit obtained by the malicious client using the current attack model is generated, and the attack report of the decentralized federated learning system is determined based on the attack benefit.

2. The attack method according to claim 1, characterized in that: The decentralized federated learning system of the medical data platform is accessed, the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system are obtained, and the network identifier of the malicious client and the network identifier of each benign client are connected to obtain a communication graph, including: Access the decentralized federated learning system of the medical data platform and obtain the communication logs of malicious clients in the decentralized federated learning system; The network identifier of the malicious client and the network identifier of each benign client with which the malicious client directly communicates are obtained from the communication log, and the network identifier of the malicious client and the network identifier of each benign client are connected to obtain a communication graph.

3. The attack method according to claim 1, characterized in that: The method of restoring the image ratio of each benign client according to the gradient information of each benign client and determining the state data in the simulation environment based on the image ratio of each benign client and the communication graph includes: Collect the gradient information of each benign client, use the gradient inversion tool to restore the image ratio of each benign client based on the gradient information of each benign client, and obtain the dataset corresponding to the image ratio of each benign client; Create a simulation node for each benign client and a simulation node for each malicious client. According to the communication graph, connect the simulation node of each benign client with the simulation node of the malicious client to obtain the simulation environment of the decentralized federated learning system. In the simulation environment, a data set corresponding to the image ratio of each benign client is used to train the model of the simulation node of each benign client, and the benign model parameters output by the simulation node of each benign client are obtained. The benign model parameters output by the simulation node of each benign client and the communication graph are combined to form the state data in the simulation environment.

4. The attack method according to claim 1, characterized in that: The method based on reinforcement learning and state data to determine the current attack model in the simulation environment includes: Obtain the original attack parameters output by the original attack model based on the state data, select the original attack parameters as action data, select the success rate of the original attack parameters as reward data, and combine the state data, action data, and reward data into training data; The value network and the policy network in the original attack model are trained using the training data until the value network and the policy network are in a converged state, the converged value network and the converged policy network are saved, and the converged value network and the converged policy network are combined to form the current attack model in the simulation environment.

5. The attack method according to claim 1, characterized in that: The method of deriving the current attack model from the simulation environment and obtaining the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round based on the current attack model includes: Export the current attack model from the simulation environment, control the malicious client to load the current attack model, and determine whether the current time is the authorized time; When the current time is the authorization time, obtain the current attack parameters output by the current attack model in the tth round of training, send the current attack parameters to each benign client through the malicious client, and obtain the loss value of each benign client in the tth round of training from the update information returned by each benign client based on the current attack parameters; When a malicious client participates in the next round of training of the centralized federated learning system in round t, it obtains the next attack parameter output by the current attack model in the next round of round t, sends the next attack parameter to each benign client through the malicious client, and obtains the loss value of each benign client in the next round of training in round t from the update information returned by each benign client based on the next attack parameter.

6. The attack method according to claim 1, characterized in that: The method generates an attack benefit obtained by a malicious client using the current attack model based on a predefined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, and determines an attack report of the decentralized federated learning system based on the attack benefit, including: Generate the attack benefit obtained by the malicious client using the current attack model based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round; Obtain the attack level corresponding to the attack benefit, write the attack benefit, attack level and attack time into the attack template, and obtain the attack report of the decentralized federated learning system.

7. The attack method according to any one of claims 1 to 6, characterized in that: Malicious clients refer to hospital clients that conduct malicious attacks in the decentralized federated learning system, and benign clients refer to hospital clients that do not conduct malicious attacks in the decentralized federated learning system. The image ratio is the ratio of pathological images in the local data distribution to normal images in the local data distribution.

8. An attack device for a decentralized federated learning system, characterized in that: Used in electronic equipment, including: A first acquisition module is configured to access the decentralized federated learning system of the medical data platform, obtain the network identifier of the malicious client and the network identifier of each benign client in the decentralized federated learning system, and connect the network identifier of the malicious client with the network identifier of each benign client to obtain a communication graph; A restoration module is used to restore the image ratio of each benign client according to the gradient information of each benign client, and determine the state data in the simulation environment based on the image ratio and communication graph of each benign client; A determination module, used to determine the current attack model in the simulation environment based on the reinforcement learning method and state data; The second acquisition module is used to derive the current attack model from the simulation environment, and based on the current attack model, obtain the loss value of each benign client in the tth round of training and the loss value of each benign client in the next round of training after the tth round; The attack module is used to generate the attack benefit obtained by the malicious client using the current attack model based on the pre-defined attack benefit function, the loss value of each benign client in the tth round of training, and the loss value of each benign client in the next round after the tth round, and determine the attack report of the decentralized federated learning system based on the attack benefit.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the attack method of the decentralized federated learning system according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the attack method of the decentralized federated learning system according to any one of claims 1 to 7 is implemented.

Images