Gradient inversion attack method, system and medium in federated learning

Abstract

Embodiments of the present application disclose a gradient inversion attack method and system in federated learning and a medium. The method comprises the following steps: a server end sends an initial weight matrix and an initial bias vector after initialization and a pre-designed convolution kernel parameter to a client end; the client end trains a convolutional neural network model by using local training data according to the initial weight matrix, the initial bias vector and the convolution kernel parameter, and uploads model parameter gradients obtained after training to the server end, wherein the convolution kernel parameter is used to perform a locking operation on the local training data in the training process; the server end reconstructs intermediate feature representations in the client end according to weight gradients and bias gradients in the model parameter gradients, and performs an unlocking operation on the intermediate feature representations by using a pre-designed convolution kernel inverse operation to reconstruct the local training data. The embodiments of the present application improve the concealment and reconstruction quality of the gradient inversion attack.

Description

Technical Field

[0001] This invention relates to the field of federated learning technology, and in particular to a gradient inversion attack method, system, and medium in federated learning. Background Technology

[0002] Federated Learning (FL) is a framework for collaborative modeling without aggregating raw data. Each participant independently trains its model on local data and uploads model updates (such as gradients or parameter updates) to a server, which then aggregates them to obtain a global model. This mechanism reduces the privacy and compliance risks associated with data centralization while alleviating the "data silo" problem, and has gained application attention in scenarios such as mobile terminals, medical imaging, and financial risk control.

[0003] However, recent research indicates that merely sharing gradients or parameter differences does not equate to complete isolation of privacy risks. Gradients contain statistical characteristics of input samples and labels, which attackers can use to launch gradient inversion attacks (GIAs). Under certain conditions, attackers can reconstruct approximate content of samples or infer corresponding labels, thereby threatening the privacy and security of federated learning systems.

[0004] Existing federated learning gradient inversion attacks mainly include two methods: the first method is an optimization method, which uses randomly initialized pseudo-samples as variables to construct an objective function consistent with the observed gradient and approximates the original data through iterative optimization; the second method is an analytical method, which performs analytical decomposition or constraint solving of the gradient based on the network structure and forward / backward propagation relationship, sometimes supplemented by special settings for model structure, activation function or parameters.

[0005] Although the above methods have demonstrated the existence of privacy leakage channels from the gradient side, their application in real-world large-scale, complex federated learning environments still faces several significant challenges and limitations: 1. Insufficient adaptability to high-resolution and complex distribution scenarios: Optimization methods exhibit unstable reconstruction quality on high-resolution images (such as face data), are highly sensitive to initialization and hyperparameters, and are prone to getting trapped in local optima or producing artifacts; 2. Obvious detectability and interpretability: Some analytical methods rely on modifications to the model structure, parameter sparsification / zeroing, or the setting of special forward paths. These "explicit modifications" are easily detected by client integrity checks, model consistency checks, gradient statistics monitoring, and other mechanisms, thereby reducing the stealth and usability of attacks; 3. High computational and communication overhead: To compensate for unstable reconstruction quality, optimization methods often require multiple iterations and multiple forward and backward computations, resulting in high attack costs; in federated scenarios with multiple clients and large-scale aggregation, attack efficiency and scalability are limited. Summary of the Invention

[0006] This invention provides a gradient inversion attack method, system, and medium in federated learning, aiming to solve the problems of low concealment and poor reconstruction quality in existing gradient inversion attacks.

[0007] In a first aspect, embodiments of the present invention provide a gradient inversion attack method in federated learning, comprising: The server initializes the weight matrix and bias vector to obtain the initial weight matrix and initial bias vector, and then sends the initial weight matrix, the initial bias vector, and the pre-designed convolution kernel parameters to the client. The client trains the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolution kernel parameters, and uploads the resulting model parameter gradients to the server. The convolution kernel parameters are used to lock the local training data during training, and the model parameter gradients include the weight gradients and bias gradients of the fully connected layers in the convolutional neural network model. The server reconstructs the intermediate feature representation in the client based on the received weight gradient and bias gradient, and uses a pre-designed convolution kernel inverse operation to unlock the intermediate feature representation in order to reconstruct the local training data.

[0008] Secondly, embodiments of the present invention also provide a gradient inversion attack system in federated learning, including an initialization and reconstruction unit configured on the server side, and a training upload unit configured on the client side, wherein: The initialization and distribution unit is used by the server to initialize the weight matrix and bias vector to obtain the initial weight matrix and initial bias vector, and then distribute the initial weight matrix, the initial bias vector, and the pre-designed convolution kernel parameters to the client. The training upload unit is used by the client to train the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolution kernel parameters, and upload the model parameter gradient obtained after training to the server. The convolution kernel parameters are used to lock the local training data during the training process, and the model parameter gradient includes the weight gradient and bias gradient of the fully connected layer in the convolutional neural network model. The reconstruction unit is used by the server to reconstruct the intermediate feature representation in the client based on the received weight gradient and bias gradient, and to perform an unlocking operation on the intermediate feature representation using a pre-designed convolution kernel inverse operation to reconstruct the local training data.

[0009] Thirdly, embodiments of the present invention also provide a gradient inversion attack system in federated learning, including a server and a client. Both the server and the client include a memory and a processor. The memory stores a computer program, which can implement the above method when executed by multiple processors.

[0010] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0011] This invention provides a gradient inversion attack method, system, and medium in federated learning. The method includes: a server initializing a weight matrix and a bias vector to obtain an initial weight matrix and an initial bias vector, and then sending the initial weight matrix, the initial bias vector, and pre-designed convolutional kernel parameters to a client; the client training a convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolutional kernel parameters, and uploading the resulting model parameter gradients to the server, wherein the convolutional kernel parameters are used to lock the local training data during training, and the model parameter gradients include the weight gradients and bias gradients of the fully connected layers in the convolutional neural network model; the server reconstructing intermediate feature representations in the client based on the received weight gradients and bias gradients, and then using the pre-designed convolutional kernel inverse operation to unlock the intermediate feature representations to reconstruct the local training data. The technical solution of this invention involves the client training a convolutional neural network model using local training data based on the initial weight matrix, initial bias vector, and pre-designed convolutional kernel parameters sent by the server. During training, the local training data is locked using the convolutional kernel parameters, and the gradient of the trained model parameters is uploaded to the server. The server reconstructs the intermediate feature representation in the client based on the received weight gradient and bias gradient, and unlocks the intermediate feature representation using the pre-designed convolutional kernel inverse operation to reconstruct the local training data. This effectively avoids explicit modifications and multiple rounds of iterative calculations during reconstruction, improving not only the concealment and reconstruction quality of gradient inversion attacks but also the attack efficiency. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is an overall schematic diagram of a gradient inversion attack method in federated learning provided by an embodiment of the present invention; Figure 2 A flowchart illustrating a gradient inversion attack method in federated learning provided by an embodiment of the present invention; Figure 3 A schematic diagram of the convolution kernel configuration provided in an embodiment of the present invention; Figure 4 A schematic diagram of a sub-process of a gradient inversion attack method in federated learning provided by an embodiment of the present invention; Figure 5 A schematic diagram illustrating the covert and perfect reconstruction provided in an embodiment of the present invention; Figure 6 A schematic block diagram of a gradient inversion attack system in federated learning provided for an embodiment of the present invention; Figure 7 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0016] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0017] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0018] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0019] Please see Figure 1 , Figure 1 This is a schematic diagram of a gradient inversion attack method in federated learning provided by an embodiment of the present invention. The gradient inversion attack method in federated learning of this embodiment is applied to a gradient inversion attack system in federated learning, which includes a server and a client. Understandably, the gradient inversion attack method in federated learning can be implemented by configuring corresponding software programs on the server and client, thereby improving the stealth of the gradient inversion attack and the reconstruction quality. It should be noted that, in this embodiment, as... Figure 1 As shown, forward propagation is performed on the client side, while the reconstruction process is performed on the server side. The server and client communicate with each other. The server sends the initialized initial weight matrix, initial bias vector, and pre-designed convolutional kernel parameters to the client. The client trains the convolutional neural network model using local training data based on the initial weight matrix, initial bias vector, and convolutional kernel parameters, and uploads the resulting model parameter gradients to the server. The server then reconstructs the local training data based on these gradients. The entire reconstruction process does not require the client to modify the training routine and does not rely on explicit structural anomalies, thus improving the stealth of gradient inversion attacks and the reconstruction quality. It should also be noted that in this embodiment, when the client trains the convolutional neural network model using local training data, it locks the local training data using the convolutional kernel parameters to obtain intermediate feature representations; during the data reconstruction process, it unlocks these intermediate feature representations to reconstruct the local training data.

[0020] Please see Figure 2 , Figure 2 This is a flowchart illustrating a gradient inversion attack method in federated learning provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110-S130.

[0021] S110. The server initializes the weight matrix and bias vector to obtain the initial weight matrix and initial bias vector, and sends the initial weight matrix, the initial bias vector, and the pre-designed convolution kernel parameters to the client.

[0022] In this embodiment of the invention, the server initializes the weight matrix and bias vector to obtain an initial weight matrix and an initial bias vector. Specifically, the server uses a pseudo-random initialization strategy to initialize the weight matrix to obtain the initial weight matrix; the server uses a sequential initialization strategy to initialize the bias vector to obtain the initial bias vector. More specifically, the server uses a sequential initialization strategy to initialize the bias vector to obtain the initial bias vector, including: the server initializes the bias vector in descending order, and the values ​​of the bias vector are derived from a standard Gaussian distribution or a Laplace distribution. It should be noted that in this embodiment, the reason for initializing the weight matrix and bias vector on the server side is to allow different local training data to activate different neurons, thereby reconstructing the corresponding training data by analyzing the activation patterns of each neuron. It should also be noted that the gradient inversion attack method in this embodiment mainly includes two processes: cryptic perfect reconstruction and input penetration. Cryptic perfect reconstruction establishes an analytic relationship between the input, weight gradients, and bias gradients on a minimal structure of fully connected layers and ReLU activations, constructing a solvable system of equations to reconstruct the local training data. Simultaneously, a pseudo-randomization initialization strategy significantly reduces the probability of being detected by manual or rule-based methods while maintaining solvability. Input penetration utilizes the duality (invertibility) of convolutional kernels to encode the core information of the local training data into intermediate feature representations. This is combined with convolutional kernel filters to suppress channels that do not carry real information, ensuring that the "useful signal" has stronger traceability and solvability in subsequent links. Cryptic perfect reconstruction is the cornerstone of gradient inversion attacks. If the gradient information of the weight matrix W and bias vector b can be obtained, accurate reconstruction of the local training data can be achieved. However, traditional methods are easily detected by client-side integrity checks, model consistency checks, gradient statistics monitoring, and other mechanisms, thus reducing the stealth and usability of the attack. The gradient inversion attack method in this embodiment relies on only a fully connected layer and the ReLU activation function. The forward propagation of the fully connected layer can be written as y = ReLU(Wx + b), where W ∈ R k×m b∈R k k represents the output dimension (number of neurons) of the fully connected layer, m represents the input dimension (feature dimension of the previous layer) of the fully connected layer, and x is... Figure 1The output of the convolutional layer is y, which is the output of the ReLU activation function. For ease of understanding and explanation, W is first initialized as a tensor of all 1s, so Wx can be simplified to x. Therefore, the forward propagation of the fully connected layer can be simplified to: y = ReLU(x + b). Considering the characteristics of the ReLU activation function (positive numbers are retained, negative numbers are set to zero), the bias vector is initialized in descending order (it can be taken from a standard Gaussian distribution or a Laplace distribution). As the bias vector b gradually decreases from positive to negative, the output of y = ReLU(x + b) will also change from positive to negative. Based on this, several "activation intervals" are divided from the Gaussian or Laplace distribution. When the value of Wx falls into these activation intervals, the local training data can be successfully reconstructed.

[0023] Further, in this embodiment, the server-side uses a pseudo-random initialization strategy to initialize the weight matrix to obtain the initial weight matrix, including: the server-side randomly selects a row from the weight matrix as the target row and randomly initializes the target row to obtain the initialized target row; generates a set of random numbers and calculates the product of the random numbers and the target row to obtain the random row; copies the random row to all rows in the weight matrix except the target row to obtain the copied weight matrix; and randomly selects a preset logarithmic adjacent weights in each row of the copied weight matrix and swaps them to obtain the initial weight matrix. It should be noted that setting all parameters of the weight matrix W to 1 or the same constant is a simple case, but for a vigilant user, a simple manual inspection of the parameter design of the weight matrix W is sufficient to easily detect this attack, thus preventing subsequent attacks from proceeding. Therefore, to improve the stealth of the attack, the weight matrix initialization in this embodiment includes three steps: the first step is to randomly select a row from the weight matrix W, denoted as... And initialize it randomly, and denote it as R( The second step is to generate a set of random numbers K, and then... Multiply by K and copy the result to the other rows of the weight matrix W, representing it as Copy(R( The third step is to randomly select n pairs of adjacent weights for each row of the weight matrix W and swap them, which can be represented as Swap(Copy(R( This three-step initialization not only retains the core concept of the original method—activating different neurons for different inputs—but also significantly improves the stealth of the attack. It should also be noted that in this embodiment, precise replication of the local training data is achieved through adjustments to the weight matrix and bias vector. By introducing multi-layered randomness and local perturbations, a seemingly random but actually carefully designed weight matrix is ​​created. This weight matrix can effectively confuse both human and machine detection because it is virtually indistinguishable from a normally randomly initialized matrix, thus reducing the detection risk. The pseudo-random initialization strategy of the weight matrix W not only greatly improves the randomness of the weights W but also ensures their effectiveness.

[0024] Furthermore, in this embodiment, the convolutional kernel parameters are designed at specific locations within one or more convolutional kernels in the convolutional layer to possess reversibility, enabling locking and unlocking operations on the local training data. The convolutional neural network model includes the convolutional layer. It should be noted that, to make stealthy imitation attacks more difficult to detect, the convolutional kernel camouflage technique in this embodiment makes the designed convolutional kernels indistinguishable from normal convolutional kernels under normal inspection. Under specific conditions, when the convolutional kernel parameters are known, the local training data can be recovered from the intermediate feature representation through deconvolution operations. This process can be vividly described as "locking" and "unlocking." The locking process involves transforming the local training data through a set of specially designed convolutional kernels to generate intermediate feature representations. This set of convolutional kernels can be considered a "lock," denoted as lock(x). The unlocking process uses the inverse operation of the convolutional kernels to restore the intermediate feature representation to the local training data. The deconvolution operation is denoted as unlock(lock(x)). Understandably, each different convolutional kernel corresponds to a unique deconvolution operation. The design of a lock is related to the attacker's needs. Let's take a simple example to illustrate the construction rules and corresponding unlocking rules. Assume the input local training data has a dimension of 4×4, and the convolution kernel has a dimension of 3×3. The local training data X, after being processed by the convolution kernel, yields the corresponding output data Y. In an attack scenario, the local training data remains unchanged, so the output data Y only depends on the design of the convolution kernel. When the convolution kernel has the simplest design of 0 around the edges and 1 in the center, then the local training data X equals the output data Y, such as... Figure 3 As shown in (a); when the middle and top left of the convolution kernel are 1, and the rest are 0, the output data Y and the local training data X are significantly different, as shown in (a). Figure 3 As shown in (b); when a more complex situation arises, with the center, top, and top left of the convolution kernel being zero and the rest being zero, the gap between the output data Y and the local training data X widens further, as shown in (b). Figure 3 As shown in (c) above. The unlocking rule is the inverse operation of the locking rule; for the simplest... Figure 3In case (a), the output data is consistent with the local training data X, and no inverse operation is required; for Figure 3 In case (b), this convolution operation can be considered as a specific implementation as shown in formula (1): (1) Therefore, the corresponding deconvolution operation can be deduced, which holds true when i=1 or y=1. When i≠1 or y≠1, it is as shown in formula (2): (2) for Figure 3 Similarly, in case (c), the convolution operation can be modeled as shown in equation (3): (3) When i=1, we have When i≠1, the deconvolution operation is as shown in formula (4): (4) As illustrated by the above example, an attacker can lock the local training data X according to their own initialization habits, and only the attacker can unlock it and reconstruct the local training data.

[0025] Furthermore, the convolutional layer includes a convolutional kernel filter. This filter sets the weights of convolutional kernels that haven't been designed with specific location parameters, ensuring that their outputs are non-positive. It's important to note that convolutional layers typically contain multiple kernels to extract various features from local training data. When the local training data is a 3×224×224 image, at least three kernels are needed to extract information from the RGB color channels. Additional kernels produce invalid information. To more accurately extract intermediate feature representations, a convolutional kernel filter effectively filters out intermediate feature representations generated by other kernels that don't carry image information. The kernel filter's function is to set the values ​​of kernels that don't transmit image information to negative numbers or to make the sum negative. Negative kernels produce negative intermediate feature representations, which are difficult to pass through the ReLU activation function; therefore, they can be filtered out using the activation function. Understandably, in order to make the intermediate feature representation with invalid image data negative, considering that images are generally smooth and the differences between adjacent pixel values ​​are usually small, it is assumed that the size of two adjacent pixel values ​​is... , Then there is We can assign relatively large negative values ​​-a and small positive values ​​b to adjacent parts of the convolution kernel, where a > b, to obtain... The pixel values ​​represented by the intermediate features are thus negative after being processed by the designed convolution kernel, and are effectively filtered by the ReLU activation function. It should also be noted that in this embodiment, since the convolutional layer is a custom-designed "lock," a "unlocking" operation is required for the intermediate feature representation. The "unlocking" operation is the inverse of the "locking" operation, which is the reverse process of the convolution operation.

[0026] S120. The client trains the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolution kernel parameters, and uploads the resulting model parameter gradients to the server. The convolution kernel parameters are used to lock the local training data during training, and the model parameter gradients include the weight gradients and bias gradients of the fully connected layers in the convolutional neural network model.

[0027] In this embodiment of the invention, after the client receives the initial weight matrix, the initial bias vector, and the convolution kernel parameters sent by the server, it trains the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolution kernel parameters, and uploads the model parameter gradients obtained after training to the server. The model parameter gradients include the weight gradients and bias gradients of the fully connected layers in the convolutional neural network model.

[0028] S130. The server reconstructs the intermediate feature representation in the client based on the received weight gradient and bias gradient, and uses a pre-designed convolution kernel inverse operation to unlock the intermediate feature representation in order to reconstruct the local training data.

[0029] In this embodiment of the invention, the server reconstructs the intermediate feature representation in the client based on the weight gradient and bias gradient uploaded by the client. Specifically, as shown below... Figure 4As shown, step S130 specifically includes steps S131-S133: S131, the server extracts gradient components corresponding to two different neurons from the received weight gradient, denoted as the first weight gradient and the second weight gradient, and calculates the difference between the first weight gradient and the second weight gradient to obtain the weight gradient difference, wherein the fully connected layer in the convolutional neural network model includes the neurons; S132, the server extracts the gradient components corresponding to the corresponding neurons from the bias gradient, denoted as the first bias gradient and the second bias gradient, and calculates the difference between the first bias gradient and the second bias gradient to obtain the bias gradient difference; S133, the quotient of the weight gradient difference and the bias gradient difference is calculated to obtain the intermediate feature representation in the client. It should be noted that the intermediate feature representation will activate the preceding neurons sequentially from top to bottom. Assuming the intermediate feature representation... i neurons were activated from top to bottom, and the intermediate feature representation... Activating j neurons (j>i), the hidden perfect reconstruction is as follows: Figure 5 As shown, the expression is as shown in formula (5).

[0030] (5) In formula (5), The first weight gradient, The second weight gradient, The first bias gradient, This is the second bias gradient.

[0031] After obtaining the intermediate feature representation, the intermediate feature representation is unlocked using the inverse operation of the pre-designed convolution kernel to reconstruct the local training data.

[0032] In summary, this embodiment achieves a balance between concealment, reconstruction quality, and attack efficiency by allowing key information from the input local training data to be penetrated and reconstructed without altering the explicit structure of the model or excessively introducing suspicious parameter forms. This verifies and quantifies the potential privacy exposure of federated learning, providing a basis for subsequent protection design. Specifically, this application reduces the probability of being identified by mechanisms such as integrity verification, model consistency checks, and gradient statistics monitoring by not relying on explicit structural modifications, large-scale parameter zeroing, or specific forward paths, thus improving the concealment of the attack. Through the "lock-unlock" of convolutional kernel duality, effective information is allowed to penetrate to the intermediate feature representation in analytical form, reducing the dependence of reconstruction on high-iteration optimization, especially exhibiting more stable reconstruction quality on high-resolution data such as faces. The main reconstruction link is based on analytical relationships and linear iterations, significantly reducing the number of iterations and improving attack efficiency.

[0033] Figure 6This is a schematic block diagram of a gradient inversion attack system 200 in federated learning provided by an embodiment of the present invention. Figure 6 As shown, corresponding to the gradient inversion method in federated learning applied to the server 10 and client 20 described above, the gradient inversion attack system 200 in federated learning includes a unit for executing the gradient inversion method in federated learning described above. Specifically, please refer to... Figure 6 The gradient inversion attack system 200 in the federated learning includes an initialization distribution unit 101 and a reconstruction unit 102 configured on the server side 10, and a training upload unit 201 configured on the client side 20.

[0034] The initialization sending unit 101 is used by the server to initialize the weight matrix and bias vector to obtain an initial weight matrix and an initial bias vector, and then sends the initial weight matrix, the initial bias vector, and the pre-designed convolutional kernel parameters to the client. The training uploading unit 201 is used by the client to train the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolutional kernel parameters, and then uploads the resulting model parameter gradients to the server. The convolutional kernel parameters are used to lock the local training data during training, and the model parameter gradients include the weight gradients and bias gradients of the fully connected layers in the convolutional neural network model. The reconstruction unit 102 is used by the server to reconstruct the intermediate feature representation in the client based on the received weight gradients and bias gradients, and then uses the pre-designed convolutional kernel inverse operation to unlock the intermediate feature representation to reconstruct the local training data.

[0035] In some embodiments, such as this one, the initialization sending unit 101 includes a first initialization unit and a second initialization unit.

[0036] The first initialization unit is used by the server to initialize the weight matrix using a pseudo-random initialization strategy to obtain the initial weight matrix. Specifically, the server randomly selects a row from the weight matrix as the target row and randomly initializes the target row to obtain the initialized target row; generates a set of random numbers and calculates the product of the random numbers and the target row to obtain the random row; copies the random row to all rows in the weight matrix except the target row to obtain the copied weight matrix; and randomly selects a preset logarithmic adjacent weights in each row of the copied weight matrix and swaps them to obtain the initial weight matrix. The second initialization unit is used by the server to initialize the bias vector using a sequential initialization strategy to obtain the initial bias vector. Specifically, the server initializes the bias vector in descending order, and the value of the bias vector is derived from a standard Gaussian distribution or a Laplace distribution.

[0037] In some embodiments, such as this one, the reconstruction unit 102 includes a first extraction unit, a second extraction unit, and a calculation unit.

[0038] The first extraction unit is used by the server to extract gradient components corresponding to two different neurons from the received weight gradient, denoted as the first weight gradient and the second weight gradient, and to calculate the difference between the first weight gradient and the second weight gradient to obtain the weight gradient difference, wherein the fully connected layer in the convolutional neural network model includes the neurons; the second extraction unit is used by the server to extract the gradient components corresponding to the corresponding neurons from the bias gradient, denoted as the first bias gradient and the second bias gradient, and to calculate the difference between the first bias gradient and the second bias gradient to obtain the bias gradient difference; the calculation unit is used to calculate the quotient of the weight gradient difference and the bias gradient difference to obtain the intermediate feature representation in the client.

[0039] The specific implementation of the gradient inversion attack system 200 in federated learning in this embodiment of the invention corresponds to the gradient inversion attack method in federated learning described above, and will not be repeated here.

[0040] The gradient inversion attack system in federated learning described above can be implemented as a computer program, which can, for example... Figure 7 It runs on the computer device shown.

[0041] Please see Figure 7 , Figure 7 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 300 is the device where the aforementioned server or client is located.

[0042] See Figure 7The computer device 300 includes a processor 302, a memory, and a network interface 305 connected via a system bus 301. The memory may include a storage medium 303 and internal memory 304.

[0043] The storage medium 303 may store an operating system 3031 and a computer program 3032. When the computer program 3032 is executed, it causes the processor 302 to execute a gradient inversion attack method in federated learning.

[0044] The processor 302 provides computing and control capabilities to support the operation of the entire computer device 300.

[0045] The internal memory 304 provides an environment for the execution of the computer program 3032 in the storage medium 303. When the computer program 3032 is executed by the processor 302, the processor 302 can execute a gradient inversion attack method in federated learning.

[0046] This network interface 305 is used for network communication with other devices. Those skilled in the art will understand that... Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 300 to which the present application is applied. The specific computer device 300 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0047] The processor 302 is used to run a computer program 3032 stored in a memory to implement any embodiment of the gradient inversion attack method in federated learning described above.

[0048] It should be understood that in the embodiments of this application, the processor 302 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0049] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0050] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform any embodiment of the gradient inversion attack method in the above-described federated learning.

[0051] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0052] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0053] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0054] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0055] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0056] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0057] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0058] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for gradient inversion attack in federated learning, characterized in that, include: The server initializes the weight matrix and bias vector to obtain the initial weight matrix and initial bias vector, and then sends the initial weight matrix, the initial bias vector, and the pre-designed convolution kernel parameters to the client. The client trains the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolution kernel parameters, and uploads the resulting model parameter gradients to the server. The convolution kernel parameters are used to lock the local training data during training, and the model parameter gradients include the weight gradients and bias gradients of the fully connected layers in the convolutional neural network model. The server reconstructs the intermediate feature representation in the client based on the received weight gradient and bias gradient, and uses a pre-designed convolution kernel inverse operation to unlock the intermediate feature representation in order to reconstruct the local training data. The server-side initializes the weight matrix and bias vector to obtain the initial weight matrix and initial bias vector, including: The server uses a pseudo-random initialization strategy to initialize the weight matrix to obtain the initial weight matrix; The server uses a sequential initialization strategy to initialize the bias vector to obtain the initial bias vector. The server uses a pseudo-random initialization strategy to initialize the weight matrix to obtain the initial weight matrix, including: The server randomly selects a row from the weight matrix as the target row and performs random initialization on the target row to obtain an initialized target row; Generate a set of random numbers, and calculate the product of the random numbers and the target row to obtain a random row; The random row is copied to all rows in the weight matrix except the target row to obtain the copied weight matrix; The initial weight matrix is ​​obtained by randomly selecting a preset number of adjacent weights in each row of the replicated weight matrix and swapping them.

2. The method of claim 1, wherein, The server-side uses a sequential initialization strategy to initialize the bias vector to obtain the initial bias vector, including: The server initializes the bias vector in descending order, and the values ​​of the bias vector are derived from a standard Gaussian distribution or a Laplace distribution.

3. The method of claim 1, wherein, The convolution kernel parameters are designed to be reversible at specific locations in one or more convolution kernels in a convolutional layer, enabling locking and unlocking operations on the local training data. The convolutional neural network model includes the convolutional layer.

4. The method of claim 3, wherein, The convolutional layer is provided with a convolutional kernel filter, which is used to set the weights of the convolutional kernel that has not been designed with specific positional parameters, so that the output of the convolutional kernel that has not been designed with specific positional parameters is non-positive.

5. The method of claim 3, wherein, The server reconstructs the intermediate feature representation in the client based on the received weight gradient and bias gradient, including: The server extracts gradient components corresponding to two different neurons from the received weight gradient, denoted as the first weight gradient and the second weight gradient, and calculates the difference between the first weight gradient and the second weight gradient to obtain the weight gradient difference. The fully connected layer in the convolutional neural network model includes the neurons. The server extracts the gradient components corresponding to the corresponding neurons from the bias gradient, denoted as the first bias gradient and the second bias gradient, and calculates the difference between the first bias gradient and the second bias gradient to obtain the bias gradient difference. The intermediate feature representation in the client is obtained by calculating the quotient of the weight gradient difference and the bias gradient difference.

6. A gradient inversion attack system in federated learning, characterized in that, This includes the initialization and refactoring units configured on the server side, and the training and uploading unit configured on the client side, wherein: The initialization and distribution unit is used by the server to initialize the weight matrix and bias vector to obtain the initial weight matrix and initial bias vector, and then distribute the initial weight matrix, the initial bias vector, and the pre-designed convolution kernel parameters to the client. The training upload unit is used by the client to train the convolutional neural network model using local training data based on the initial weight matrix, the initial bias vector, and the convolution kernel parameters, and upload the model parameter gradient obtained after training to the server. The convolution kernel parameters are used to lock the local training data during the training process, and the model parameter gradient includes the weight gradient and bias gradient of the fully connected layer in the convolutional neural network model. The reconstruction unit is used by the server to reconstruct the intermediate feature representation in the client based on the received weight gradient and bias gradient, and to perform an unlocking operation on the intermediate feature representation using a pre-designed convolution kernel inverse operation to reconstruct the local training data. The initialization sending unit includes: The first initialization unit is used to initialize the weight matrix on the server side using a pseudo-random initialization strategy to obtain the initial weight matrix; The second initialization unit is used to initialize the bias vector on the server side using a sequential initialization strategy to obtain the initial bias vector; The first initialization unit is specifically used for: The server randomly selects a row from the weight matrix as the target row and performs random initialization on the target row to obtain an initialized target row; Generate a set of random numbers, and calculate the product of the random numbers and the target row to obtain a random row; The random row is copied to all rows in the weight matrix except the target row to obtain the copied weight matrix; The initial weight matrix is ​​obtained by randomly selecting a preset number of adjacent weights in each row of the replicated weight matrix and swapping them.

7. A gradient inversion attack system in federated learning, characterized in that, It includes a server and a client, both of which include a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a plurality of processors, can implement the method as described in any one of claims 1-5.

Images