Security federal learning method capable of verifying and resisting poisoning attacks of large number of false clients

Abstract

The invention discloses a secure federated learning method capable of verifying and resisting poisoning attacks of a large number of false clients, and belongs to the technical field of federated learning and privacy protection. Firstly, a self-adaptive clustering algorithm based on the Euclidean distance selects clustering points for local model updating and clusters the local model updating, then the difference of local model updating among different categories is analyzed, false local model updating is screened out, and the robustness of global model aggregation is improved. Secondly, a verifiable scheme based on zero knowledge proof utilizes Zk-SNARKs to map an adaptive clustering scheme based on Euclidean distance into a first-order circuit constraint, during conversion, floating-point numbers are mapped into integers, after calculation is completed, the floating-point numbers are restored, and the Euclidean distance is converted into a square of the floating-point numbers. According to the invention, under the threat of a malicious server, poisoning attacks of a large number of false clients can be effectively resisted, and the security of an existing federal learning scheme is effectively improved.

Description

Technical Field

[0001] This invention relates to the technical field of federated learning and privacy protection, specifically to a secure federated learning method that is verifiable and resistant to attacks from a large number of fake clients. Background Technology

[0002] Federated Learning (FL) is an emerging distributed machine learning paradigm that aims to jointly train data distributed across multiple clients while maintaining data privacy. In this process, clients collaboratively train a shared global model without transferring local data to the server. A classic federated learning framework mainly performs the following three steps: the server sends the global model to each client; each client trains its local model using its local data and calculates its local model update, then sends the local model update back to the server; the server aggregates the received local model updates according to predefined aggregation rules and updates the global model.

[0003] However, due to the distributed nature of federated learning, it is vulnerable to various attacks, such as poisoning attacks. Malicious clients can use poisoned data to train local models or arbitrarily tamper with local model parameters to create poisoned models, and then upload these poisoned models to the server, thereby affecting the overall performance of the global model. Poisoning attacks based on fake clients are one of the most vulnerable attacks to federated learning. During the training phase, adversaries can first inject fake clients into the federated learning system using open-source projects or robot simulators, and then use complete control of these fake clients to create fake local model updates to launch a poisoning attack. During the model inference phase, the global model will classify clean samples as incorrect categories. Compared to an adversary controlling a real client, injecting fake clients is much cheaper for the adversary. Furthermore, the adversary can have complete control over the injected fake clients. Therefore, poisoning attacks based on fake clients are more consistent with the attack conditions of adversaries in real-world scenarios and are more likely to occur in real-world situations.

[0004] Defending against poisoning attacks in federated learning has become a hot research topic. Existing defenses against poisoning attacks mainly rely on Byzantine robust methods or anomaly detection methods. These methods ensure that even if some malicious clients are malicious, the federated learning system can still learn a globally accurate model. Byzantine robust methods aim to carefully select local model updates uploaded by clients, ensuring that the global model remains unaffected by the presence of malicious clients. These methods typically design robust aggregation rules to extract the most representative information from numerous updates, such as by sorting, truncating, or voting on local updates, thereby filtering out outliers that deviate from the normal distribution. They have shown a certain degree of robustness in both theory and practice. Furthermore, some improved methods introduce weight adjustment mechanisms to dynamically adjust the client's contribution based on its historical performance, further enhancing the defense effect. Anomaly detection methods aim to identify and eliminate malicious clients by comparing the similarity of local model updates uploaded by clients or by using auxiliary datasets. These methods focus on discovering "abnormal patterns" in uploaded updates. For example, they use similarity metrics such as Euclidean distance and cosine similarity for cluster analysis to identify individuals whose updates differ significantly from those of most clients. Alternatively, a clean auxiliary validation set can be introduced to test and score each client's local model updates, and different weights can be assigned during aggregation based on the scoring results.

[0005] However, the aforementioned schemes assume the server is always trustworthy, thus failing to guarantee the verifiability and executability of the defense mechanism in real-world deployments. When the server is unreliable, it may falsely claim to follow a predefined protocol, making it difficult for clients to effectively verify its behavior, resulting in compromised system robustness. To address this, existing solutions propose an anomaly detection scheme based on zero-knowledge proofs. This scheme employs two rounds: cross-round detection and cross-client detection. First, cross-round detection checks for attack occurrence. If an attack occurs, cross-client detection eliminates poisoned local models, ensuring the accuracy of the learned global model. Furthermore, zero-knowledge proofs map the cross-round detection and cross-client detection processes into first-order circuit constraints, enabling the server to generate proofs for client verification, ensuring the server correctly executes the predefined defense scheme. However, this scheme assumes only a small number of malicious clients exist in the federated learning system; when a large number of fake clients exist, the method loses its robustness.

[0006] Therefore, existing solutions are unable to effectively defend against a large number of malicious client attacks when threatened by malicious servers. Summary of the Invention

[0007] The purpose of this invention is to design a secure federated learning method that is verifiable and resistant to attacks from a large number of fake clients, thereby solving the problem that existing solutions are unable to effectively resist attacks from a large number of fake clients under the threat of malicious servers, and thus improving the security of existing federated learning solutions.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0009] A secure federated learning method with verifiability and resistance to large-scale fake client poisoning attacks is proposed. The framework of the secure federated learning method consists of adaptive clustering based on Euclidean distance and a verifiable scheme based on zero-knowledge proof.

[0010] In the Euclidean distance-based adaptive clustering, firstly, clustering points are selected for local model updates based on Euclidean distance, and local model updates are clustered; then, by analyzing the differences in local model updates between different categories, false local model updates are filtered out, thereby improving the robustness of global model aggregation.

[0011] In the verifiable scheme based on zero-knowledge proof, Zk-SNARKs are used to map the adaptive clustering scheme based on Euclidean distance into first-order circuit constraints. During the conversion, floating-point numbers are mapped to integers, and after the calculation is completed, they are restored. The Euclidean distance is also converted into its square. This allows the server to generate proofs for the client to verify, thereby ensuring the correct execution of the defense mechanism.

[0012] Furthermore, the secure federated learning method proposed in this invention, which is verifiable and resistant to attacks from a large number of fake client malware, specifically includes the following steps:

[0013] Step 1: The trusted institution runs the zero-knowledge proof initialization protocol and issues a public key to the server. Send private key to client The server sends the initialized global model to the client;

[0014] Step 2, in the In each iteration, the server executes an adaptive clustering algorithm based on Euclidean distance to remove spurious local model updates, resulting in an updated global model. and generate proof ;

[0015]

[0016] Step 3: The server distributes the global model. and proof For the client;

[0017] Step 4: The client receives the global model sent by the server. and proof and using the private key Verification is required;

[0018]

[0019] Step 5, upon successful verification, the client... Use local data Perform local model training;

[0020]

[0021] Step 6, the client calculates the... Local model update Then it was uploaded to the server.

[0022] As a preferred technical solution of the present invention, in steps 2 and 4, the server first uses zero-knowledge proof to generate a proof for the adaptive clustering algorithm based on Euclidean distance, and the client verifies the correctness of the proof to ensure that the server honestly executes the predefined defense mechanism.

[0023] This invention proposes a secure federated learning method that is verifiable and resistant to attacks from a large number of fake clients. Under the threat of malicious servers, it effectively defends against attacks from numerous fake clients. Compared with existing solutions, the main advantages of this invention are:

[0024] 1. To defend against attacks from numerous fake clients, this invention employs an adaptive clustering algorithm based on Euclidean distance. It uses Euclidean distance to perform clustering analysis on local model updates, and then filters out fake local model updates by analyzing the differences in local model updates between different categories, thus improving the robustness of global model aggregation. Unlike traditional clustering methods, this invention proposes an adaptive clustering scheme that reduces the complexity of traditional clustering methods, allowing it to be mapped to a first-order circuit.

[0025] 2. To ensure the honest behavior of the server, this invention uses zero-knowledge proof technology to generate a proof by having the server execute an adaptive clustering algorithm based on Euclidean distance, which is then verified by the client. This forces the server to correctly execute predefined defense mechanisms. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of a secure federated learning method proposed in this invention, which is verifiable and can resist attacks from a large number of fake clients.

[0027] Figure 2This is a comparison chart showing the test accuracy of various defense methods against non-targeted poisoning attacks based on fake clients under a 60% fake client ratio (a: MNIST, b: Fashion-MNIST).

[0028] Figure 3 This is a comparison chart showing the test accuracy of various defense methods against non-targeted poisoning attacks based on fake clients under a 70% fake client ratio (a: MNIST, b: Fashion-MNIST).

[0029] Figure 4 This is a comparison chart showing the test accuracy of various defense methods against non-targeted poisoning attacks based on fake clients under an 80% fake client ratio (a: MNIST, b: Fashion-MNIST). Detailed Implementation

[0030] This invention proposes a secure federated learning method that is verifiable and resistant to attacks from a large number of fake clients. The framework of the secure federated learning method consists of adaptive clustering based on Euclidean distance and a verifiable scheme based on zero-knowledge proof.

[0031] In the Euclidean distance-based adaptive clustering, firstly, clustering points are selected for local model updates based on Euclidean distance, and local model updates are clustered; then, by analyzing the differences in local model updates between different categories, false local model updates are filtered out, thereby improving the robustness of global model aggregation.

[0032] In the verifiable scheme based on zero-knowledge proof, Zk-SNARKs are used to map the adaptive clustering scheme based on Euclidean distance into first-order circuit constraints. During the conversion, floating-point numbers are mapped to integers, and after the calculation is completed, they are restored. The Euclidean distance is also converted into its square. This allows the server to generate proofs for the client to verify, thereby ensuring the correct execution of the defense mechanism.

[0033] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings.

[0034] Example 1

[0035] A secure federated learning method that is verifiable and resistant to attacks from a large number of fake client poisoning attacks:

[0036] The entity consists of the following components: a trusted institution, a server (Server, S), N real clients, and M fake clients, as shown in the appendix. Figure 1 As shown. The specific functions of each entity are as follows:

[0037] Trusted Institution: Responsible for generating public keys for S ,for Generate private key And generate initial circuit constraints for the system.

[0038] Server (S): Responsible for receiving all The local model is uploaded and updated. Then, the local model updates from each round are aggregated and the global model is updated. Proofs are generated for the predefined defense mechanisms. Finally, the proofs and the updated global model are distributed.

[0039] Real client: client It refers to individuals or organizations with certain computing power collaborating to train a unified model under the coordination of server S. Client Having a private dataset First, verify the certificate issued by the server. After successful verification, utilize the local private dataset. Train a global model, then calculate the local model update and upload it to the server.

[0040] Fake Client: The fake client receives the global model sent by the server. It then updates and uploads a fake local model to the server to launch a poisoning attack.

[0041] The federated learning training process of this invention includes three stages: system initialization, model aggregation, and local training. The detailed steps are as follows:

[0042] (1) System initialization

[0043] During the system initialization phase, the trusted institution runs a zero-knowledge proof initialization protocol to generate circuit constraints for predefined defense mechanisms and generates key pairs. The public key The server holds the private key, which is used to generate proofs. All clients hold proofs used to verify the server-issued credentials. The server then randomly initializes the global model. And broadcast to all clients. Because It's server initialization, the client is in the... No verification or proof is required in the process; it can be used directly. Continue with the first round of local model training.

[0044] (2) Model aggregation

[0045] In the In each iteration, the server first accepts the local model update set uploaded by the client. Subsequently, the server randomly selects an L2 paradigm updated from the local model as the first cluster point. (Defaults to the first local model update). Since Zk-SNARKs only support integer operations, while model parameters are typically floating-point numbers, this invention uses fixed-point numbers for conversion. Let the scaling factor be... , floating-point number Mapped to integers.

[0046] (1)

[0047] After the calculation is complete, then the results are... Restored to:

[0048] (2)

[0049] Furthermore, since Zk-SNARKs do not support nonlinear operations (such as open operations), this invention performs an equivalent transformation on the Euclidean distance calculation, using the square of the L2 norm to replace the original square root operation.

[0050] (3)

[0051] This transformation does not change the relative distance relationship between data points, that is, for any two local model updates and ,have:

[0052] (4)

[0053] Assuming the federated learning system, the first There are N local model updates in a round, denoted as Then the first cluster point It can be represented as

[0054] (5)

[0055] in, It is the dimension of the model parameters. This indicates the first local model update. One parameter.

[0056] Next, calculate the square of the L2 norm of each of the other local models, using the following formula:

[0057] (6)

[0058] Then, with Compare and select with The local model update with the largest discrepancy was used as the second cluster point. ,Right now:

[0059] (7)

[0060] This invention considers that, since the L2 paradigm of spurious local model updates differs significantly from that of normal local model updates, this method of selection... and These will be used as cluster points for normal local model updates and spurious local model updates, respectively.

[0061] Two cluster points were selected. and Next, adaptive clustering is performed, assigning each local model update to the cluster closest to it. The specific steps are as follows:

[0062] First, for each local model update Calculate the square of its L2 normal form and the sum of the two cluster points. and Distance:

[0063] (8)

[0064] (9)

[0065] Secondly, each local model is updated based on its distance. Assign them to clusters that are closer in distance:

[0066] (10)

[0067] Since normal local model updates exhibit high similarity, and spurious local model updates also show strong similarity, the above clustering assignment can effectively distinguish between normal and spurious local model updates. Next, normal local model updates need to be selected and the global model updated. The specific steps are as follows:

[0068] Calculate the mean of the squared L2 norm for each category. For each category... Calculate the mean of the squared L2 norm of all local model updates. :

[0069] (11)

[0070] in, Indicates category The number of local model updates It is the first Round The local model updates the square of the L2 paradigm.

[0071] Since fake local model updates enhance the attack effect by significantly expanding their L2 norm, the mean of the squared L2 norm of the category containing the fake local model update will be greater than the mean of the squared L2 norm of the category containing the normal local model update. Therefore, the category with the smaller mean of the squared L2 norm is selected as the category containing the normal local model update, i.e.:

[0072] (12)

[0073] in, This indicates the cluster in which a normal local model update occurs.

[0074] use The local model update in the process is used to update the global model.

[0075] (13)

[0076] (3) Local training

[0077] In the At the start of each iteration, each client first receives the global model sent by the server. and proof and using the private key Verification required:

[0078] (14)

[0079] If the verification passes, it proves the data is valid, and the client uses local data. Perform local model training.

[0080] (15)

[0081] And calculate the first Local model update Then it is uploaded to the server. If verification fails, the client considers it a global model. It may be maliciously tampered with, training will be terminated, and local model updates will be refused.

[0082] Example 2

[0083] Comparative experiment

[0084] This invention is compared with the TrimmedMean and Kick schemes. TrimmedMean is a classic Byzantine robust aggregation algorithm, while Kick is a scheme proposed in the paper "KICK BAD GUYS OUT! ZERO-KNOWLEDGE-PROOF-BASEDANOMALY DETECTION IN FEDERATED LEARNING". This invention reproduces the CROSS-CLIENT ANOMALY DETECTION algorithm used to eliminate malicious clients in that paper and is abbreviated as Kick.

[0085] To verify the superiority of this invention, this experiment constructs a standard non-targeted poisoning attack based on a fake client. The non-targeted poisoning attack aims to reduce the prediction accuracy of all classes. The classic MPAF (Multi-Client Awareness Assist) non-targeted poisoning attack scheme is used to attack the federated learning system to evaluate the defense scheme. For the MPAF attack, in the... During the iteration, the fake client generates its own fake local model update. , It is a random model chosen by the attacker. It is the first The global model of the wheel It's the scaling factor, the default setting. .

[0086] To evaluate the performance of this invention against non-targeted poisoning attacks, this experiment used test accuracy. Higher test accuracy indicates a better defense against non-targeted poisoning attacks.

[0087] This invention evaluates the test accuracy of non-targeted poisoning attacks under different proportions of large numbers of fake clients to assess the effectiveness of each scheme. (See attached...) Figure 2 , 3 As can be seen from Figures 4 and 5, the defense scheme proposed in this invention can effectively resist non-targeted poisoning attacks with a large proportion of fake clients. In contrast, the TrimmedMean and Kick schemes cannot resist non-targeted poisoning attacks with a large proportion of fake clients.

[0088] First, since the effectiveness of TrimmedMean defense relies on the proportion of fake clients, its robustness significantly decreases when the actual attack ratio exceeds a preset threshold and the server cannot accurately estimate the proportion of fake clients, making it ineffective against non-targeted poisoning attacks under a large number of fake clients. Furthermore, Kick also fails to work against non-targeted poisoning attacks under a large number of fake clients. This is mainly because it assumes that the number of malicious clients in federated learning is less than 50% and relies on the MultiKrum method to calculate an approximate average model as a baseline model, subsequently removing malicious clients based on this average model. However, when the number of fake clients exceeds 50%, the average model calculated by the MultiKrum algorithm will approach the attacker's model, causing the global model to ultimately deviate from the normal local model. Moreover, during training, MPAF causes abnormal parameters in the global model's output layer, leading to abnormal parameters in the baseline model calculated in Kick, resulting in the removal of all clients during aggregation. In contrast, this invention effectively identifies and removes fake clients by comparing the size differences in local model updates.

[0089] The core advantage of this method is that it does not rely on the estimation of the proportion of fake clients and can maintain a high test accuracy even when a high proportion of fake clients are present, thereby significantly improving the robustness of the federated learning system under non-targeted poisoning attacks based on fake clients.

[0090] The above description is merely an example and illustration of the concept of the present invention and is not intended to limit the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in the claims, all of which should fall within the protection scope of the present invention.

Claims

1. A secure federated learning method that is verifiable and resistant to attacks from a large number of fake client malware, characterized in that, The framework for a secure federated learning method consists of adaptive clustering based on Euclidean distance and a verifiable scheme based on zero-knowledge proof. In the Euclidean distance-based adaptive clustering, firstly, clustering points are selected for local model updates based on Euclidean distance, and local model updates are clustered; then, by analyzing the differences in local model updates between different categories, false local model updates are filtered out, thereby improving the robustness of global model aggregation. In the verifiable scheme based on zero-knowledge proof, Zk-SNARKs are used to map the adaptive clustering scheme based on Euclidean distance into first-order circuit constraints. During the conversion, floating-point numbers are mapped to integers, and after the calculation is completed, they are restored. The Euclidean distance is also converted into its square. This allows the server to generate proofs for the client to verify, thereby ensuring the correct execution of the defense mechanism.

2. The secure federated learning method as described in claim 1, characterized in that, Specifically, the following steps are included: Step 1: The trusted institution runs the zero-knowledge proof initialization protocol and issues a public key to the server. Send private key to client The server sends the initialized global model to the client; Step 2, in the In each iteration, the server executes an adaptive clustering algorithm based on Euclidean distance to remove spurious local model updates, resulting in an updated global model. and generate proof ; Step 3: The server distributes the global model. and proof For the client; Step 4: The client receives the global model sent by the server. and proof and using the private key Verification is required; Step 5, upon successful verification, the client... Use local data Perform local model training; Step 6, the client calculates the... Local model update Then it was uploaded to the server.

3. The secure federated learning method as described in claim 2, characterized in that, In steps 2 and 4, the server first uses zero-knowledge proofs to generate proofs for the Euclidean distance-based adaptive clustering algorithm. The client verifies the correctness of the proofs to ensure that the server honestly executes the predefined defense mechanisms.

Images