Federal learning backdoor defense method based on pruning and fine tuning

Abstract

The invention discloses a federated learning backdoor defense method based on pruning and fine tuning in the technical field of artificial intelligence and network security, the method realizes defense through two core mechanisms of dynamic pruning and gradient constraint fine tuning, and the method comprises the following steps: firstly, calculating a sensitivity score based on a neuron activation frequency and a weight outlier degree; dynamically identifying and cutting redundant neurons utilized by a backdoor, and blocking an abnormal activation path; secondly, gradient direction consistency detection and amplitude constraint are introduced in the fine tuning stage, and a malicious client is inhibited from reconstructing a back door through an abnormal gradient; the server continuously purifies model parameters and enhances robustness by cyclically executing pruning, fine tuning and aggregation operations; the method does not need to depend on an extra clean data set, strictly follows a federated learning privacy protection principle, reduces communication overhead through lightweight pruning, maintains main task performance in combination with gradient constraint, is suitable for a federated learning scene in which edge equipment participates, and effectively balances a defense effect and model stability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence and network security, and particularly relates to a federated learning backdoor defense method based on pruning and fine-tuning. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, federated learning as a distributed machine learning framework is widely used in medical, financial and other scenarios that require data privacy protection. Its core idea is that each participant trains the model locally and uploads the parameters to the central server for aggregation and update without centralizing the original data, effectively avoiding the risk of data leakage. However, due to the decentralization of the model training process and the uncontrollable nature of the client, federated learning systems face more complex security challenges.

[0003] In recent years, backdoor attacks have gradually become one of the main means to harm the security of federated learning models. This type of attack injects malicious information with specific trigger conditions into training data or model parameters, so that the model remains unchanged under normal input, but outputs errors or specified results under the trigger mode input set by the attacker. This attack has strong concealment and persistence, and is often activated after the model is deployed, causing more serious damage.

[0004] Existing federated learning backdoor defense techniques mainly focus on the following two aspects:

[0005] 1. Pre-aggregation defense mechanism: This type of method detects abnormality in local model parameters or gradients uploaded by clients to identify malicious participants, common means include Euclidean distance-based anomaly detection, clustering-based voting filtering mechanism, robust aggregation algorithm (such as Krum, Trimmed Mean, etc.). However, due to the attacker's ability to reduce the detectability of updates through multi-round poisoning strategies, trigger feature dilution, etc., pre-aggregation detection has high false negative rate and poor stability.

[0006] 2. Post-aggregation defense mechanism: It is mainly divided into two categories: one is the reverse engineering method based on model behavior analysis, such as neural inversion or activation backpropagation, which restores or reversely generates attack patterns through trigger samples; the second is to improve model robustness through adversarial training, model distillation or feature compression, etc. These methods often rely on clean samples or attack examples, not only have large computational overhead, but also it is difficult to obtain clean global data in actual deployment.

[0007] However, existing work often ignores the dynamic characteristics of parameter evolution in federated learning systems. Previous studies have shown that backdoor attackers tend to exploit redundant neuron structures to inject abnormal activation paths, which remain silent in normal inputs and exhibit significant activation characteristics in trigger inputs. On the other hand, benign updates exhibit gradient convergence and activation stability characteristics during long-term iterations. If these abnormal activation paths can be dynamically identified without relying on external data sets, and structural pruning or update constraints are applied, it may effectively cut off the backdoor path and achieve model self-purification.

[0008] In summary, the existing method has the following shortcomings in backdoor defense: (1) Lack of aggregated parameter purification mechanism, unable to repair the embedded backdoor path in the model; (2) Inadequate use of redundant neuron structures and gradient abnormal directions, lack of modeling and utilization of parameter space dynamic evolution characteristics; (3) Over-reliance on clean validation data, which violates the original design goal of federated learning.

[0009] Based on this, the present application designs a federated learning backdoor defense method based on pruning and fine-tuning to solve the above problems. SUMMARY

[0010] The present application aims to propose a federated learning backdoor defense method based on pruning and fine-tuning, which effectively identifies and prunes redundant neuron parameters exploited by backdoor attacks without relying on additional clean data sets, while suppressing backdoor feature reconstruction through gradient constraint strategies in the fine-tuning stage, achieving the purpose of enhancing model robustness and security.

[0011] To achieve the above purpose, the present application provides the following technical solutions:

[0012] A federated learning backdoor defense method based on pruning and fine-tuning, comprising the following steps:

[0013] Step S1, dynamic pruning based on neuron sensitivity: this step identifies redundant neurons exploited by backdoors in the model by calculating the activation frequency and parameter weight of neurons under normal tasks, and performs pruning operations on the server side;

[0014] Step S2, abnormal update constraint fine-tuning based on gradient direction and amplitude: introduce gradient direction consistency detection and amplitude limitation in the client fine-tuning stage to prevent backdoor updates from being injected into the global model again through the fine-tuning stage;

[0015] Step S3, global model update and cyclic execution: integrate the optimized gradients of the clients through a secure aggregation mechanism to generate a backdoor-resistant global model, and form a dynamic defense system through iterative execution.

[0016] Preferably, step S1 specifically includes the following sub-steps:

[0017] S11: Neuron activation intensity calculation

[0018] For each client n, the local average activation intensity of the i-th neuron in the l-th layer Calculated by the client in the local sample:

[0019]

[0020] Where, is the activation value of the neuron under the k-th sample input; is the average activation value of the i-th neuron in the l-th layer in the n-th client; m n is the number of local training samples of client n.

[0021] The server collects from all N clients Calculate the global average activation intensity:

[0022]

[0023] S12: Neuron weight outlier calculation

[0024] Calculate the deviation between the current round weight norm of each neuron i and the mean value of the layer, and get the weight outlier

[0025]

[0026] Where, represents the weight L2 norm of neuron i, μ||W l || represents the mean value of the L2 norm of all neuron weights in the l-th layer, and ∈ is a small constant to prevent division by zero.

[0027] S13: Construction of neuron sensitivity score

[0028] The sensitivity score function is defined as follows:

[0029]

[0030] Where λ is the adjustment parameter, the higher the value represents more attention to structural anomalies.

[0031] S14: Pruning decision and operation

[0032] The server determines to prune the top ρ l ·N l neurons in the l-th layer according to the score ranking. Where N l is the total number of neurons in the l-th layer, and ρ l is the pruning ratio of the l-th layer. Then perform pruning operation on the target layer through weight mask matrix M lThe weights of pruned neurons are set to zero, and the pruning process is as follows:

[0033]

[0034] where the mask matrix M l satisfies:

[0035]

[0036] The operation will rank the top ρ l ·N l neuron weights to zero, and the rest remain unchanged, and the model W pruned .

[0037] Preferably, step S2 specifically comprises the following sub-steps:

[0038] Step S21: global gradient main direction initialization

[0039] The server initializes the main direction vector d global , and the initial value is the average value of the historical gradient direction of the global model;

[0040] Step S22: client local fine-tuning and gradient collection

[0041] Each client receives the pruned global model W pruned and performs local training, and after training, uploads its own update direction vector d c to the server;

[0042] S23: Abnormal direction identification

[0043] The server calculates the cosine similarity cos global between the update direction of each client and d c :

[0044]

[0045] According to the calculated cosine similarity value, using the DBSCAN clustering algorithm, the abnormal client deviating far from the global gradient main direction is identified by boundary division, and the client is divided into a normal set C beg and an abnormal set C mal ;

[0046] S24: Direction projection and amplitude constraint

[0047] For the client marked as abnormal, the gradient update is subjected to direction constraint, and the gradient vector d c is projected to the subspace of the global gradient main direction d global , thereby eliminating the abnormal components deviating from the main task optimization in the gradient direction:

[0048]

[0049] At the same time, in order to prevent malicious clients from affecting the global model through gradient amplification, the gradient amplitude of all clients is constrained, and the specific constraint is:

[0050]

[0051] Wherein, Median represents the median of the amplitude of the gradient of all clients;

[0052] S25: master direction update

[0053] After the end of each round of fine-tuning, the server updates the master direction vector d based on the gradient of the trusted client global , and the calculation method is:

[0054]

[0055] Ensure that the global gradient master direction can reflect the gradient information of the trusted client.

[0056] Preferably, step S3 specifically comprises the following sub-steps:

[0057] S31: model aggregation and update

[0058] The server receives the client gradient processed by pruning and direction constraint, aggregates the global model, and generates an updated model:

[0059] W t = W pruned + Aggregate ({d' C})

[0060] S32: iterative execution and dynamic defense

[0061] Repeat the execution of S1 and S2 two modules when entering the next training round, realize the continuous detection and correction of backdoor attack.

[0062] Compared with the prior art, the beneficial effects of the present application are:

[0063] (1) The entire defense process of the present application does not need to rely on trusted data set, and the method is only based on parameter space analysis and optimization process constraint, and strictly follows the data privacy protection principle.

[0064] (2) The pruning strategy is directed to remove redundant parameters, avoiding excessive pruning leading to model performance degradation; gradient constraint inhibits abnormal update, maintains master task accuracy, and the combination of the two can effectively block the backdoor path and maintain the stability of the model, realizing the balance of defense effect and performance.

[0065] (3) The dynamic pruning module only needs the client to upload the neuron activation strength and weight statistical information, the communication overhead is extremely low, and the pruning operation directly reduces the model parameter quantity, especially suitable for bandwidth-limited low-power federated learning scenarios with the participation of edge devices, and realizes lightweight defense. BRIEF DESCRIPTION OF DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0067] Figure 1 The flow chart of the federated learning backdoor defense method based on pruning and fine-tuning in the embodiment of the present application;

[0068] Figure 2 The flow chart of the dynamic pruning in the embodiment of the present application;

[0069] Figure 3 The flow chart of the model fine-tuning process in the embodiment of the present application. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0071] Please refer to the drawings, the present application provides a technical solution:

[0072] A federated learning backdoor defense method based on pruning and fine-tuning, running on the server side in the federated learning system and interacting with the client side to execute, assuming that the participants include N client devices C1, C1,..., C N , the server performs defensive optimization on the aggregated model after each round of training, as shown in Figure 1 , specifically including the following steps:

[0073] S1, neuron sensitivity evaluation;

[0074] S11, data collection and preprocessing: this embodiment adopts CIFAR-10 standard image classification dataset as benchmark test data; contains 60,000 32x32 pixel RGB color images, covering 10 categories (airplanes, cars, etc.), of which 50,000 are training sets and 10,000 are test sets. Normalize the input image:

[0075]

[0076] This operation linearly maps the pixel value from the original range [0, 1] to [-1, 1], and the same mean and standard deviation are used for the three channels (RGB); then the training set is divided into N = 100 client local data sets in a non-independent and identically distributed (Non-IID) manner, and each client is assigned 2 categories (to simulate the edge device data skew scenario), the specific process is as follows:

[0077] (1) Sample the 10 categories according to Dirichlet distribution (Dirichlet Distribution, α = 0.5) to generate the category proportion vector.

[0078] (2) Randomly assign samples to clients according to the proportion vector, ensuring that each client contains the same number of images.

[0079] S12, neuron activation value calculation: the server issues the current global model W to all clients after each round of federal aggregation, and each client calculates the activation value of the lth layer neuron in its neural network after completing one round of local model training, and calculates the average activation intensity on its local data set. The formula is as follows:

[0080]

[0081] Where, is the average activation value of the i th neuron in the l th layer in the n th client; m n is the number of local training samples of client C n ; is the activation output of the k th sample on this neuron.

[0082] S13, global activation intensity calculation, the server collects all the uploaded by the clients and calculates the global average activation value:

[0083]

[0084] At the same time, the server extracts the weight parameters W l of each layer of the global model, and calculates the weight outliers:

[0085]

[0086] where, represents the L2 norm of the weight of neuron i, μ||W l represents the average of the L2 norm of the weight of all neurons in the lth layer, ∈ = 1e -8 is a small constant to prevent division by zero.

[0087] S14, sensitivity score generation, the server integrates the global activation strength of neurons and the weight dispersion to calculate the sensitivity score:

[0088]

[0089] where, λ = 0.5, balancing the contribution of activation strength and weight dispersion.

[0090] S2, pruning decision and execution:

[0091] S21, pruning target layer selection: according to experimental verification, selecting the fully connected layer (related to classification decision) and the last convolutional layer (related to high-level semantic feature) as the pruning target layer, in the CIFAR-10 dataset and ResNet-18 model, the pruning target layer is the last convolutional block (Conv5_x) and the fully connected layer (fc).

[0092] S22, pruning ratio setting: the server presets the pruning ratio of each layer, setting the pruning ratio of the last convolutional layer of the ResNet-18 model ρ l = 40%, and the pruning ratio of the fully connected layer ρ l = 60%.

[0093] S23, mask matrix generation and pruning: the server sorts the neurons of the last convolutional layer and the fully connected layer in descending order according to the sensitivity score , determines the pruning threshold according to , and then generates the mask matrix respectively:

[0094]

[0095] The pruning operation is performed in turn

[0096]

[0097] The top ρ l ·N l neuron weights are set to zero, and the rest are retained. After pruning the last convolutional layer and the fully connected layer, the model W pruned is obtained.

[0098] S24, pruning model distribution: the server distributes the pruned model W pruned to all clients as the initial model for the next round of training.

[0099] S3, Gradient constraint fine-tuning

[0100] S31, Global gradient main direction initialization: Server collects the gradient update directions of normal clients in the previous T rounds (e.g., T = 5), and calculates the mean value as the initial global gradient main direction d global :

[0101]

[0102] where, represents the gradient update direction of the previous several rounds of normal clients, and if the historical data is insufficient, the gradient mean value of all clients in the first round can be used for initialization.

[0103] S32, Client local fine-tuning and gradient upload: The client receives the pruned model W pruned , fine-tunes (trains 1 epoch) on the local dataset, calculates the parameter update gradient d c , and then uploads it to the server.

[0104] S33, Cosine similarity calculation: The server calculates the cosine similarity cos c of each client gradient d global and d c :

[0105]

[0106] S34, Abnormal client classification: Use the DBSCAN clustering algorithm to cluster all cos c , set the neighborhood radius r = 0.2 and the minimum sample number min_samples = 3, divide the normal cluster C beg and the abnormal cluster C mal .

[0107] S35, Gradient projection and amplitude constraint: For abnormal clients, project the gradient d c to the direction of d global :

[0108]

[0109] At the same time, in order to prevent malicious clients from affecting the global model through gradient amplification, the gradient amplitude of all clients is constrained to ensure that the gradient amplitude is not too large, and the specific constraint is:

[0110]

[0111] where Median represents the median of the gradient amplitudes of all clients.

[0112] S36 Global model update and master direction iteration: server aggregates the gradient and updates the global model:

[0113]

[0114] The server updates the master direction vector d based on the gradient of the trusted client global The calculation method is as follows:

[0115]

[0116] The process of steps S1-S3 is repeated until a preset ending condition is met, such as a specified fine-tuning round is reached, i.e., the training is completed.

[0117] In the description of the present specification, the description referring to the terms "one embodiment", "an example", "a specific example" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0118] The preferred embodiments of the application disclosed above are only used to illustrate the application. The preferred embodiments do not describe all the details and limit the application to the specific embodiments described. Obviously, many modifications and variations can be made according to the content of the present specification. The present specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the application, so that those skilled in the art can well understand and utilize the application. The application is limited only by the claims and their full scope and equivalents.

Claims

1. A pruning and fine-tuning based federated learning backdoor defense method, characterized in that, The method comprises the following steps: Step S1, dynamic pruning based on neuron sensitivity: by calculating the activation frequency of neurons under normal tasks and the degree of parameter weight outliers, redundant neurons exploited by backdoors in the model are identified, and pruning operation is performed on the server side; Step S2, abnormal update constraint fine-tuning based on gradient direction and amplitude: gradient direction consistency detection and amplitude limitation are introduced in the client fine-tuning stage to prevent backdoor updates from being injected into the global model again through the fine-tuning stage; Step S3, global model updating and cyclic execution: through the secure aggregation mechanism, the optimized gradients of the clients are integrated to generate a global model resistant to backdoors, and a dynamic defense system is formed through iterative execution.

2. The pruning and fine-tuning based federated learning backdoor defense method of claim 1, wherein, Step S1 specifically comprises: S11, Neuron activation intensity calculation: For each client n, the local average activation intensity of the i-th neuron of the l-th layer computed by the client in the local sample: wherein, is the activation value of the neuron for the kth sample input; is the average activation value of the ith neuron in the lth layer in the nth client; m n is the number of local training samples of the client n; The server collects from all N clients Compute the global average activation strength: S12, neuron weight outlier degree calculation: calculate the deviation between the weight norm of each neuron i in the current round and the mean value of the layer to obtain the weight outlier degree wherein, represents the L2 norm of the weights of neuron i, μ||W l || represents the average of the L2 norm of the weights of all neurons in layer l, and ∈ is a small constant to prevent division by zero; S13, neuron sensitivity score construction: the sensitivity score function is defined as follows: Where λ is the adjustment parameter, the higher the value represents more attention to structural abnormalities; S14, Pruning decision and operation: The server determines to prune the top N l ·N l neurons according to the score ranking. Wherein N l is the total number of neurons in the lth layer, and p l is the pruning ratio of the lth layer. Then perform pruning operation on the target layer, set the weight of the pruned neuron to zero through the weight mask matrix M l , and the pruning process is as follows: where the mask matrix M l satisfies: The operation will rank the top p l • N l The neuron weights of the top p are set to zero, and the rest remain unchanged, which can be obtained after pruning the last layer of convolutional layer and fully connected layer, respectively, to obtain the model W pruned .

3. The pruning and fine-tuning based federated learning backdoor defense method of claim 1, wherein, Step S2 specifically comprises: Step S21, global gradient main direction initialization: the server initializes the main direction vector d global with an initial value being the average of the historical gradient directions of the global model; Step S22, local fine-tuning and gradient collection of the client: each client receives the pruned global model W pruned Local training is performed, and after the training is completed, the own update direction vector d c to the server; S23, Abnormal direction recognition: the server calculates the cosine similarity cos global of the cosine similarity cos c of the cosine similarity cos c : According to the calculated cosine similarity value, an abnormal client deviating far from the main direction of the global gradient is identified by boundary division using a DBSCAN clustering algorithm, and the client is divided into a normal set C beg and an abnormal set C mal ; S24, Directional projection with magnitude constraint: For the clients marked as anomalies, impose a directional constraint on their gradient updates, projecting their gradient vector d c to the subspace of global gradient principal directions d global thus eliminating the anomalous components in the gradient direction that deviate from the principal task optimization: At the same time, in order to prevent malicious clients from affecting the global model through gradient amplification, the gradient amplitudes of all clients are constrained, and the specific constraint is: Where Median represents the median of the gradient amplitudes of all clients; S25, master direction update: after each round of fine-tuning, the server updates the master direction vector d based on the gradients of the trustworthy clients global The calculation method is: Ensure that the main direction of the global gradient can reflect the gradient information of the trusted clients.

4. The pruning and fine-tuning based federated learning backdoor defense method of claim 1, wherein, Step S3 specifically comprises: S31, model aggregation and updating: the server receives the client gradients processed by pruning and direction constraint, aggregates the global model, and generates the updated model: W t = W pruned + Aggregate({d' c}) S32, iterative execution and dynamic defense: repeat the execution of S1 and S2 two modules when entering the next training round, realize the continuous detection and correction of backdoor attacks.

Images