Label reasoning defense method and device for longitudinal segmentation federal learning system
By reconstructing the output of the segmentation layer through a causal confusion mechanism and a variational autoencoder, the problem of label inference attack in the vertical segmentation federated learning system is solved, achieving effective privacy protection and model performance preservation in different task scenarios.
Patent Information
- Application Number
- CN202511248991.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-03
- Publication Date
- 2026-01-13
AI Technical Summary
Existing vertical segmentation federated learning systems have limited defensive capabilities against label inference attacks, especially in complex scenarios where model accuracy declines and adaptability is lacking, making it unable to effectively protect label privacy.
A causal obfuscation mechanism is introduced, which reconstructs the output of the cutting layer through a variational autoencoder and uses temperature scaling technology to blur the labels, thereby constructing an obfuscated causal path, weakening the availability of label information, and distinguishing the training modes of active and passive participants.
Significantly reduces the risk of tag leakage, improves defense strength and model performance, adapts to different data types and task scenarios, and maintains the availability and robustness of the model.
Smart Images
Figure CN121328653A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to a label inference defense technology based on a causal confusion longitudinal segmentation federated learning system and belongs to the technical field of data privacy protection. BACKGROUND
[0002] With the increasing strictness of data privacy protection regulations and the continuous enhancement of people's awareness of information privacy protection, federated learning (FL) as a distributed collaborative modeling framework has gradually attracted widespread attention due to its ability to realize model training without directly sharing original data. The vertical split federated learning (VSFL) technology is suitable for a scenario in which multiple participants coincide in a sample space but complement each other in feature dimensions, and has been widely applied in multiple fields and scenarios.
[0003] Although the vertical split federated learning technology has advantages in protecting the privacy of original data, it still faces various privacy leakage risks during the training process, especially label inference attacks (LIA). In a typical vertical split federated learning system, only the active participant has label information, while other passive participants can infer the label content by accessing the model intermediate output or updating gradient during the training process through statistical analysis, attack models and other means, thereby seriously threatening the privacy security of users.
[0004] Existing label inference attack defense methods include a defense strategy based on gradient perturbation and a defense strategy based on regularization. The defense strategy based on gradient perturbation perturbs the gradient sent to the passive participant to mask the label information in the gradient, thereby reducing the ability of the attacker to infer the label by analyzing the gradient. However, such methods generally have problems such as accuracy decline and poor adaptability to attack methods, and the protection ability is still insufficient when facing more complex attack methods that tamper with the training process. The defense strategy based on regularization introduces a regularization term in the model training process to constrain the intermediate representation in the model learning process, so as to weaken the dependence on the label, thereby reducing the leakage of label information during transmission. The core idea of such a method is to increase a loss term for privacy protection in the optimization objective of model training, so that the model maintains the prediction performance while suppressing the encoding ability of sensitive information. However, although the mutual information regularization method has shown good privacy defense effect on multiple image data sets, its adaptability in more complex scenarios such as different data types and large-scale classification tasks is still insufficient.
[0005] Therefore, the existing defense mechanism usually realizes the privacy protection of the label at the cost of sacrificing the accuracy of the task model, and the defense effect is still limited when facing a strong attacker with the ability to tamper with the training process, and lacks adaptability to different data types and task scenarios, and has limitations in model availability, defense effectiveness and task universality.
[0006] Therefore, how to effectively resist label inference attacks while ensuring model performance and improve the adaptability and robustness of defense methods in different tasks is a technical problem that needs to be solved in the field at present. SUMMARY
[0007] The purpose of the present application is to solve the problems and deficiencies of the prior art, and to solve the problem of effectively defending against label inference attacks in a vertically partitioned federated learning system, and to creatively provide a vertically partitioned federated learning system label inference defense method and device based on causal confusion.
[0008] First, the passive participant calculates the cut layer output based on the local data set using the underlying model, and the active participant uses the variational autoencoder to reconstruct the cut layer output of the passive participant. Then, the label is reconstructed by the variational autoencoder, and the distribution is further smoothed by the temperature scaling technology. Finally, the original label is used for training and updating the model of the active participant, and the blurred label is used for training and updating the model of the passive participant.
[0009] The present application also provides a vertically partitioned federated learning system label inference defense device based on causal confusion, comprising a memory and one or more processors, the memory storing executable code, and the one or more processors executing the executable code to implement the vertically partitioned federated learning system label inference defense method based on causal confusion.
[0010] The present application also provides a computer readable storage medium having a program stored thereon, which is executed by a processor to implement the vertically partitioned federated learning system label inference defense method based on causal confusion.
[0011] The present method starts from the perspective of causality, effectively weakens the causal relationship between the intermediate output of the model and the label by introducing a causal confusion mechanism, prevents the passive participant without a label from inferring the label content through the intermediate representation or model update information, improves the label privacy protection capability of the vertically partitioned federated learning system, enhances the system security, and at the same time maintains the model precision and universality.
[0012] The application deeply analyzes the causal path of label information leakage in the longitudinal split federated learning system, models the causal dependence relationship between the output of the cutting layer and the label, and reveals the risk mechanism of the cutting layer output gradually accumulating label information in the training process. The causal confusion mechanism is introduced into the longitudinal split federated learning model training, intervenes the information propagation path, effectively confuses the direct causal relationship between the cutting layer output and the label, weakens the availability of the label information, and realizes effective protection of the label privacy.
[0013] Advantages
[0014] Compared with the prior art, the application has the following advantages:
[0015] 1. The application effectively weakens the causal dependence relationship between the intermediate representation of the passive participant and the label by introducing a defense mechanism based on causal confusion, fundamentally blocking the leakage path of label information in the longitudinal split federated learning process. Compared with traditional defense methods such as disturbance and regularization, the application further improves the protection strength of label privacy while ensuring the usability of the model, and significantly reduces the risk of label privacy leakage.
[0016] 2. The application realizes the effectiveness of label privacy defense while ensuring the model performance through the joint design of causal path analysis and causal confusion mechanism. Compared with existing label inference defense methods, the application effectively counteracts various label inference attacks while minimizing the negative impact on model performance, ensuring the usability and robustness of the longitudinal split federated learning system in actual business deployment.
[0017] 3. The application can implement label inference defense on various tasks covering image, text, table and other different data modalities, and has good task universality. The method is verified by using four data sets of CIFAR10, TinyImageNet, Breast Cancer and YahooAnswers, which significantly reduces the success rate of label inference attacks. BRIEF DESCRIPTION OF DRAWINGS
[0018] Figure 1 is the main process schematic diagram of the method of the application.
[0019] Figure 2 is a schematic diagram of the causal path of the longitudinal split federated learning before introducing the confusion factor.
[0020] Figure 3 is a schematic diagram of the causal path of the longitudinal split federated learning after introducing the confusion factor. DETAILED DESCRIPTION
[0021] For the purpose of better illustrating the present application and its advantages thereof, further details of the present application will be described below in conjunction with the drawings and examples. It should be noted that the implementation of the present application is not limited to the following examples, and any form of variation or change made to the present application will fall within the scope of protection of the present application.
[0022] As shown in Figure 1 A label inference defense method based on a longitudinal split federated learning system with causal confusion includes the following steps:
[0023] Step 1: Construct a causal graph based on the model training process in the longitudinal split federated learning system, identify the label leakage path through variable modeling and causal relationship analysis, and introduce a confusion factor to realize the extension of the causal graph structure and the modeling of the potential confusion path.
[0024] Specifically, it includes the following steps:
[0025] Step 1.1: As shown in Figure 2 , the causal path in the longitudinal split federated learning system without introducing a confusion factor is constructed, wherein the information flow starts from the local data features, passes through the cut layer output, and finally reaches the label.
[0026] The causal relationship of the whole process is represented as follows:
[0027] X→C→Y
[0028] Where X represents data features, C represents cut layer output, and Y represents label. X→C represents the mapping from the original input features to the cut layer output, and C→Y represents the label prediction learning process based on correlation. The model attempts to predict the label based on the cut layer output. In this case, the attacker can use the cut layer output to infer the label information.
[0029] Step 1.2: As shown in Figure 3 , a confusion factor D is introduced, and a constructed confusion path C←D→Y is introduced to artificially create a pseudo-correlation path based on the original causal path X→C→Y.
[0030] The confusion factor D is introduced between the cut layer output and the label, and simultaneously acts on the cut layer output and the label, so that the original direct causal path is broken or weakened, thereby misleading the attacker to learn the wrong causal relationship when inferring the label.
[0031] Step 2: Reconstruct the cut layer output to realize causal confusion D→C, break the direct dependency between the cut layer output and the label while ensuring the performance of the model.
[0032] Specifically, it includes the following steps:
[0033] Step 2.1: Use a self-encoder to generate a cut layer output containing a small amount of label information.
[0034] To achieve lower model accuracy loss and ensure that the cut output contains less label information, this invention further designs the loss function L of the autoencoder. VAE The details are as follows:
[0035] L VAE =MSE(C,C rec )+λMI(C rec ,Y)
[0036] Where C represents the original cut layer output, C rec Y represents the output of the reconstructed cut layer, and λ represents the label. MSE represents the mean squared error, and MI represents the mutual information between the output of the reconstructed cut layer and the label.
[0037] The designed loss function contains two terms, which are used to ensure model accuracy and reduce the expressive power of label information, respectively.
[0038] The first term measures the difference between the original cut layer output C and the reconstructed cut layer output C. rec The difference between the two is measured using Mean Squared Error (MSE). This loss aims to minimize the difference in the output of the cut layer before and after reconstruction, thereby ensuring that the model can retain the necessary discriminative information and that the final task performance is not significantly affected.
[0039] The second loss term is used to measure the output C of the reconstructed cutting layer. rec Mutual information between label Y and the label Y. By minimizing this term, the scheme reduces the amount of label-related information carried in the cut layer output as much as possible, fundamentally weakening the feasibility of label inference attacks.
[0040] To achieve an effective trade-off between model utility and privacy protection, this invention introduces a weighting factor λ to control the balance between the two losses mentioned above. During training, the weighting factor λ can be dynamically adjusted.
[0041] Step 2.2: Select the Variational Autoencoder (VAE) as the basic model for the reconstruction model to simultaneously meet multiple requirements such as generation capability, distribution modeling and mutual information estimation.
[0042] Specifically, considering that the optimization objective includes the label Y, to simplify the final derived loss expression and achieve effective modeling of mutual information, firstly, the variational autoencoder takes the label Y as input to the encoder and outputs its latent variable representation. Then, using this latent variable as input to the decoder, it outputs the reconstructed label Y. rec The latent space representation generated by the encoder is the output C of the reconstructed cutting layer. recTherefore, the constructed variational autoencoder ensures that Y and C rec While satisfying the requirements of the posterior distribution, a defensive reconstruction slicing layer output C is generated. rec .
[0043] Step 2.3: Use variational approximation to estimate the upper bound of mutual information to solve the problem of accurately calculating the mutual information between two variables in deep learning.
[0044] Specifically, by constructing the form of its upper bound, the mutual information minimization problem is transformed into a problem of minimizing its upper bound, as follows:
[0045] MI(C rec ,Y)=MI(Y,C rec )≤E p(y) [D KL (p(c rec |y)||q(c rec ))]
[0046] The upper bound is transformed into the form of KL divergence (Kullback-Leibler Divergence), q(c rec ) represents an attempt to approximate the distribution p(c) rec The variational approximation of |y). Where, E p(y) This represents the expectation under the true label distribution p(y), used to measure the conditional distribution p(c) for each label y. rec |y) and its variational approximate distribution q(c rec The average magnitude of the KL divergence between D and ). KL This represents the KL divergence. Y represents the label. C rec This indicates the output of the reconstructed cutting layer.
[0047] Step 2.4: After obtaining the upper bound of mutual information expressed in KL divergence, the problem is reformulated as minimizing KL divergence. To obtain the final form of the mutual information term, further optimization is performed:
[0048]
[0049] Where p(y) represents the distribution of label y.
[0050] Since the label Y is given and logp(y) is a constant term, minimizing the KL divergence means minimizing the first two terms in the above equation.
[0051] Step 2.5: Obtain the final form of the mutual information term optimization.
[0052] Further derivation is performed on the first two terms in the above formula:
[0053]
[0054] The final optimized form of the mutual information term consists of two terms. The first term is considered as the reconstruction loss of the variational autoencoder, and the second term is used to control the label information contained in the reconstructed cutting layer output.
[0055] Step 3: Introduce a causal obfuscation path D→Y through label fuzzing, and further construct an obfuscation factor to weaken the direct causal dependency between the label and the output of the cutting layer.
[0056] Specifically, the steps include the following:
[0057] Step 3.1: Reconstruct the tags.
[0058] Similar to the output reconstruction of the cutting layer, label reconstruction employs a variational autoencoder, and the original loss function L for label reconstruction is... label as follows:
[0059] L label =MSE(Y,Y rec )
[0060] Where Y represents the original label, Y rec This represents the reconstructed label. The reconstruction loss is measured using mean squared error to minimize the difference between the original label and the reconstructed label.
[0061] Step 3.2: Use the same variational autoencoder to reconstruct the tags.
[0062] Because the first term in the final optimized form of the mutual information term Considered as reconstruction loss, this term uses the mean squared error, such as MSE(Y,Y). rec Therefore, the same variational autoencoder is used to simultaneously reconstruct the cut layer output and the label, where the encoder's output is the reconstructed cut layer output and the decoder's output is the reconstructed label. Finally, the optimized loss function L of the designed variational autoencoder is... VAE The final form is as follows:
[0063] L VAE =MSE(C,C rec )+λ(MSE(Y,Y rec )-D KL (q(c rec )||p(c rec )))
[0064] Step 3.3: To further smooth and blur the reconstructed labels, a temperature scaling mechanism is used for the given reconstructed label Y. rec Perform the following operations:
[0065]
[0066] Among them, Y soft This indicates the label after blurring. Represents the reconstructed label vector Y rec The score corresponds to the i-th category. T is a temperature parameter that controls the smoothness. When T = 1.0, the output of the Softmax function maintains the original probability distribution. When T > 1.0, the output of the Softmax function tends to be smooth, thereby reducing the model's confidence in a single category.
[0067] Step 4: After training the longitudinal segmentation federated learning model, introduce the causal confusion mechanism and perform selective differential training on the models of active participants and passive participants respectively, introduce the difference in label versions, and achieve effective protection of label privacy.
[0068] Specifically, since the active participants have access to the real labels, they continue to train their top-level model using the original labels Y, thereby ensuring the accuracy and generalization ability of the entire federated model in the label prediction task. The blurred label Y soft This is used for model training of passive participants, where fuzzy labels constructed by active participants are used to replace the true label information. During training, passive participants rely solely on their local data and the received fuzzy label Y. soft The gradients are trained to update the underlying model.
[0069] By intervening in the information propagation path, the direct causal relationship between the output of the segmentation layer and the labels is effectively obscured, weakening the usability of label information and achieving effective protection of label privacy. Introducing differences in label versions during the model training phase can effectively distinguish the training modes for active participant models and passive participant models, achieving synergistic optimization of privacy enhancement and performance assurance.
[0070] The present invention further provides a label inference defense device for a vertical segmentation federated learning system based on causal confusion, including a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the above-mentioned label inference defense method for a vertical segmentation federated learning system based on causal confusion.
[0071] The present invention further provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the above-described label inference defense method for a longitudinal segmentation federated learning system based on causal confusion.
[0072] Example verification
[0073] In this embodiment, publicly available datasets CIFAR10, TinyImageNet, Breast Cancer, and Yahoo Answers are used, covering three main data modalities: images, text, and structured tables. Specifically, the CIFAR10 dataset contains 10 classes of 32×32 color images, with a training set of 50,000 images and a test set of 10,000 images, and the attacker has 4 known labels per class. The TinyImageNet dataset contains 200 classes of 64×64 color images, with a training set of 100,000 images and a test set of 10,000 images, and the attacker has 3 known labels per class. The Breast Cancer dataset contains 2 classes of 30 continuous features related to breast tumor cells, with a training set of 426 images and a test set of 143 images, and the attacker has 10 known labels per class. The Yahoo Answers dataset contains 10 classes of text data, with a training set of 50,000 images and a test set of 20,000 images, and the attacker has 3 known labels per class.
[0074] For small-scale image classification tasks based on CIFAR10, the bottom-level model uses ResNet-20, and the top-level model is designed as a fully connected neural network with 4 linear layers. For large-scale multi-class image classification tasks based on TinyImageNet, the bottom-level model uses ResNet-56, and the top-level model is a fully connected neural network with 3 linear layers. For binary classification tasks based on Breast Cancer data, the bottom-level model is a fully connected neural network with 3 linear layers, and the top-level model is a fully connected neural network with 2 linear layers. For large-scale text classification tasks based on Yahoo Answers, the bottom-level model uses the pre-trained language model BERT, and the top-level model is a fully connected neural network with 4 linear layers.
[0075] The defense method of this invention is implemented based on various datasets. First, the passive participant calculates the cut-out layer output using the underlying model based on the local dataset, while the active participant reconstructs the passive participant's cut-out layer output using a variational autoencoder. Then, the labels are reconstructed using the variational autoencoder and further smoothed using a temperature scaling technique. Finally, the original labels are used for training and updating the active participant's model, while the blurred labels are used for training and updating the passive participant's model.
[0076] Five state-of-the-art label inference defense methods were selected for comparison (DP, GS, DiscreteSGD, PPDL, MID). For the CIFAR10 and Yahoo Answers datasets, Top-1 accuracy was used as the evaluation metric; for the TinyImageNet dataset, Top-5 accuracy was used; and for the Breast Cancer dataset, F1 score was used.
[0077] For label inference attacks on passive model completion initiated by honest and curious passive participants, the performance of this invention and five other defense methods was evaluated on four mainstream datasets. The results are shown in Table 1.
[0078] Table 1. Experimental results of different label-based inference defense methods against passive model completion.
[0079]
[0080]
[0081] As shown in Table 1, this invention demonstrates a significant advantage over other defense methods in resisting passive model completion attacks. On the CIFAR10 dataset, this invention reduces the attack success rate from 0.6267 in the undefended state to 0.0982, a reduction of 84.3%. On the TinyImageNet dataset, this invention reduces the attack success rate to 0.0250. On the structured tabular dataset Breast Cancer, the attack F1 score of this invention is 0.5333, a decrease of 32.3% compared to 0.7879 in the undefended state. On the text dataset Yahoo Answers, the attack success rate of this invention is 0.3169, a reduction of 43.3% compared to 0.5587 in the undefended state.
[0082] This paper evaluates the defensive performance of the present invention and five other defensive methods against label inference attacks involving active model completion initiated by malicious passive participants on four datasets. The results are shown in Table 2.
[0083] Table 2. Experimental results of different label inference defense methods against active model completion.
[0084] CIFAR10 TinyImageNet Breast Cancer Yahoo Answers Unprotected 0.7199 0.2546 0.7955 0.5283 DP 0.7480 0.0971 0.7755 0.4249 GS 0.7280 0.2383 0.7778 0.5071 DiscreteSGD 0.7590 0.3352 0.7816 0.4071 PPDL 0.1000 0.0532 0.7816 0.4798 MID 0.1441 0.0318 0.7731 0.5240 The invention 0.1000 0.0312 0.6494 0.3493
[0085] As shown in Table 2, this invention demonstrates excellent defense performance against active model completion attacks. On the CIFAR10 dataset, the invention significantly reduces the attack success rate to 0.1000, a decrease of 86.1% compared to 0.7199 without defense. On the TinyImageNet dataset, the invention reduces the attack success rate to 0.0312, outperforming existing methods and demonstrating effective protection against privacy attacks in high-dimensional image large-scale classification scenarios. On the structured table dataset Breast Cancer, the invention reduces the attack success rate from 0.7955 without defense to 0.6494, a reduction of 18.4%. On the text dataset Yahoo Answers, the invention reduces the attack success rate from 0.5283 to 0.3493, outperforming existing mainstream defense methods.
[0086] For label-based inference attacks based on gradient orientation scores initiated by honest and curious passive participants, the model performance and defense performance of this invention and five other defense methods are evaluated on the Breast Cancer dataset. The results are shown in Table 3:
[0087] Table 3. Experimental results of different label-based reasoning defense methods against directional score attacks.
[0088]
[0089]
[0090] As shown in Table 3, this invention demonstrates strong defense against directional score attacks on binary classification tasks while maintaining model usability. Compared to the undefended attack F1 score of 0.9009, the method of this invention significantly reduces the attack F1 score to 0.6604, a decrease of 26.7%, effectively weakening the attacker's reasoning ability regarding label information. While achieving superior defense, this method has virtually no impact on model performance, maintaining an F1 score of 0.8901, completely consistent with the undefended approach.
[0091] The embodiments of the present invention have been described above in conjunction with the accompanying drawings and examples. However, those skilled in the art can make several improvements without departing from the principles of the present invention, and these improvements are also considered to fall within the scope of protection of the present invention.
Claims
1. A label-based reasoning defense method for a vertically segmented federated learning system, characterized in that, Includes the following steps: Step 1: Construct a causal graph based on the model training process in the longitudinal segmentation federated learning system, identify label leakage paths through variable modeling and causal relationship analysis, and introduce a confusion factor to expand the causal graph structure and model potential confusion paths; Step 1.1: Construct the causal path in the vertical segmentation federated learning system without introducing a confusion factor, where the information flow starts from local data features, passes through the segmentation layer output, and finally reaches the label; The causal relationship of the entire process is expressed as follows: X→C→Y Where X represents the data features, C represents the output of the cutting layer, and Y represents the label; X→C represents the mapping from the original input features to the output of the cutting layer, and C→Y represents the label prediction learning process based on correlation, in which the model attempts to predict the label based on the output of the cutting layer. Step 1.2: Introduce a confounding factor D. By introducing a constructed confounding path C←D→Y, an artificial pseudo-correlation path is created on the basis of the original causal path X→C→Y. The confusion factor D is introduced between the cut layer output and the label, and acts on both the cut layer output and the label, which interrupts or weakens the original direct causal path, thereby misleading the attacker to learn the wrong causal relationship when reasoning about the label. Step 2: Achieve causal confusion D→C by reconstructing the cut layer output, breaking the direct dependency between the cut layer output and the label while ensuring model performance; Step 3: Introduce a causal obfuscation path D→Y through label fuzzing, and further construct an obfuscation factor to weaken the direct causal dependency between the label and the output of the cutting layer; Step 4: After training the longitudinal segmentation federated learning model, introduce the causal confusion mechanism and perform selective differential training on the models of active participants and passive participants respectively, introduce the difference in label versions, and achieve effective protection of label privacy.
2. The label reasoning defense method for a vertically segmented federated learning system as described in claim 1, characterized in that, Step 2 includes the following steps: Step 2.1: Use an autoencoder to generate a segmentation layer output containing label information; Using the loss function L of an autoencoder VAE The details are as follows: L VAE =MSE(C,C rec )+λMI(C rec ,Y) Where C represents the output of the cut layer, C rec Y represents the output of the reconstructed cut layer; λ represents the weighting factor; MSE represents the mean squared error; and MI represents the mutual information between the output of the reconstructed cut layer and the label. The designed loss function contains two terms, one to ensure model accuracy and the other to reduce the expressive power of label information. The first term measures the difference between the original cut layer output C and the reconstructed cut layer output C. rec The difference between them is measured using mean squared error, and the second loss term is used to measure the output C of the reconstructed cutting layer. rec Mutual information between the label Y and the target Y; the balance between the two losses is controlled by introducing a weight factor λ, which can be dynamically adjusted during training; Step 2.2: Select a variational autoencoder as the base model for the reconstruction model; First, the variational autoencoder takes the label Y as input to the encoder and outputs its latent variable representation; then, it uses this latent variable as input to the decoder and outputs the reconstructed label Y. rec The latent space representation generated by the encoder is the output C of the reconstructed cutting layer. rec The constructed variational autoencoder ensures that Y and C rec While satisfying the requirements of the posterior distribution, a defensive reconstruction slicing layer output C is generated. rec ; Step 2.3: Use variational approximation to estimate the upper bound of mutual information to solve the problem of accurately calculating the mutual information between two variables in deep learning. By constructing the form of its upper bound, the mutual information minimization problem is transformed into a problem of minimizing its upper bound, as follows: MI(C rec ,Y)=MI(Y,C rec )≤E p(y) [D KL (p(c rec |y)||q(c rec ))] The upper bound is transformed into the form of KL divergence, q(c rec ) represents an attempt to approximate the distribution p(c) rec The variational approximation of |y); where, E p(y) This represents the expectation under the true label distribution p(y), used to measure the conditional distribution p(c) for each label y. rec |y) and its variational approximate distribution q(c rec The average magnitude of the KL divergence between ) and D; KL Y represents the KL divergence; C represents the label; rec This indicates the output of the reconstructed cutting layer; Step 2.4: After obtaining the upper bound of mutual information expressed in KL divergence, the problem is reformulated as minimizing KL divergence; to obtain the final form of the mutual information term, further optimization is performed: E p(y) [D KL (p(c rec |y)||q(c rec ))]=∫q(c rec )logp(y|c rec )p(c rec )dc rec -∫q(c rec )logq(c rec )dc rec -logp(y) Where p(y) represents the distribution of label y; Since the label Y is given, and logp(y) is a constant term, minimizing the KL divergence means minimizing the first two terms in the above equation; Step 2.5: Obtain the final form of the mutual information term optimization; Further derivation is performed on the first two terms in the above formula: The final optimized form of the mutual information term consists of two terms: the first term is regarded as the reconstruction loss of the variational autoencoder, and the second term is used to control the label information contained in the reconstructed cutting layer output.
3. The label reasoning defense method for a vertically segmented federated learning system as described in claim 1, characterized in that, Step 3 includes the following steps: Step 3.1: Reconstruct the tags; Label reconstruction employs a variational autoencoder, and the original loss function for label reconstruction is L. label as follows: L label <MSE(Y,Y rec ) Where Y represents the original label, Y rec The reconstructed labels are represented; the reconstruction loss is measured by mean squared error to minimize the difference between the original labels and the reconstructed labels. Step 3.2: Reconstruct the tags using the same variational autoencoder; This term uses the mean squared error, such as MSE(Y,Y). rec The calculation employs the same variational autoencoder to simultaneously reconstruct the cut-out layer output and the label, where the encoder's output is the reconstructed cut-out layer output, and the decoder's output is the reconstructed label; the optimized loss function L of the designed variational autoencoder is... VAE The final form is as follows: L VAE =MSE(C,C rec )+λ(MSE(Y,Y rec )-D KL (q(c rec )||p(c rec ))) Step 3.3: Employ a temperature scaling mechanism to reconstruct the given label Y. rec Perform the following operations: Among them, Y soft This indicates the label after blurring. Represents the reconstructed label vector Y rec The score corresponding to the i-th category; T is a temperature parameter that controls the smoothness. When T = 1.0, the output of the Softmax function maintains the original probability distribution. When T > 1.0, the output of the Softmax function tends to be smooth, thereby reducing the model's confidence in a single category.
4. A label reasoning defense device for a vertically segmented federated learning system implementing the method as described in claim 1, characterized in that, It includes a memory and one or more processors, the memory storing executable code, and the one or more processors executing the executable code to implement the label inference defense method for a vertically segmented federated learning system as described in claims 1-3.
5. A computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the label inference defense method for a vertically segmented federated learning system as described in claims 1-3.