Self-adaptive poisoning interval model attack method and device under asynchronous federated learning

Abstract

The invention provides a self-adaptive poisoning interval model attack method and device under asynchronous federated learning, and relates to the technical field of information security, and the method comprises the steps: distributing a global model to all participating nodes through an aggregation management end, and enabling the participating nodes to generate benign update according to the global model; acquiring an attacker model, dividing participating nodes into malicious nodes and benign nodes according to the attacker model, and uploading benign update of the benign nodes to an aggregation management end; according to the benign update of the malicious node, constructing a constrained malicious model through a collusion network generated by an attacker model, and generating malicious update through the malicious model; and acquiring attack scores according to the malicious updates, mapping the attack scores into poisoning intervals of the malicious nodes, and uploading the malicious updates to the aggregation management end by the malicious nodes according to the poisoning intervals. The malicious update is uploaded to the aggregation management end through the malicious node according to the poisoning interval, the convergence precision of the global model is continuously reduced, and long-term interference on the global model is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a model attack method and device for adaptive poisoning interval under asynchronous federated learning. BACKGROUND

[0002] Model poisoning attack is a common attack method against asynchronous federated learning system. The model poisoning attack interferes with the convergence process of the global model by uploading tampered model updates, and reduces the model accuracy. The current model poisoning attack against the asynchronous federated learning system has the defects of inconsistent attack direction of multiple malicious nodes, poor concealment, and rigid poisoning interval, resulting in poor attack effect.

[0003] The multiple malicious nodes of the existing model poisoning attack method lack a unified coordination mechanism, and often generate malicious updates independently. Due to the differences in local data distribution and computing environment of each malicious node, the attack direction generated by each malicious node has strong randomness, and is easily counteracted in the global model aggregation process, resulting in poor interference effect.

[0004] The malicious update generated by the existing model poisoning attack method often has too large difference with the benign update in the parameter space, and is easily identified by the defense mechanism of the asynchronous federated learning system, making it difficult for the malicious node to lurk in the system for a long time, and the sustainability of the attack is seriously insufficient.

[0005] The existing model poisoning attack method often uploads malicious updates at a fixed interval, and cannot dynamically adjust the poisoning interval according to the attack effect, making it difficult to achieve long-term effective interference to the global model. SUMMARY

[0006] In order to solve the above problems, the present application provides a model attack method for adaptive poisoning interval under asynchronous federated learning, comprising:

[0007] An asynchronous federated learning network is constructed, which includes an aggregation management end and a plurality of participating nodes;

[0008] A global model is obtained, and the global model is distributed to all participating nodes through the aggregation management end, and the participating nodes generate benign updates according to the global model;

[0009] An attacker model is obtained, and the participating nodes are divided into malicious nodes and benign nodes according to the attacker model, and the benign updates of the benign nodes are uploaded to the aggregation management end;

[0010] According to the benign updates of the malicious nodes, a constrained malicious model is constructed through a conspiracy network generated by the attacker model, and a malicious update is generated through the malicious model;

[0011] The attack score is obtained based on the malicious update, and the attack score is mapped to the poisoning interval of the malicious node. The malicious node uploads the malicious update to the aggregation management terminal according to the poisoning interval.

[0012] Optionally, the participating nodes generate benign updates based on the global model, including:

[0013] Obtain the local data set of the participating node, and construct the objective function of the participating node on the local data set based on the global model and the local data set;

[0014] Obtain the local gradient of the global model, and adjust the parameters of the objective function based on the local gradient using the stochastic gradient descent algorithm to obtain the benign update.

[0015] Optionally, the step of constructing a constrained malicious model based on the benign updates of malicious nodes through the collusion network generated by the attacker model, and generating malicious updates through the malicious model, includes:

[0016] Each malicious node exchanges benign updates through the collusion network generated by the attacker model, and calculates the attack direction based on the benign updates;

[0017] Based on the attack direction, construct attack constraints for malicious nodes, and construct the constrained malicious model based on the attack constraints.

[0018] A scaling factor is generated using the constrained malicious model, and the scaling factor is used to reverse the benign updates of the malicious node to obtain the malicious update.

[0019] Optionally, the attack constraint is that the L2 norm distance between the malicious update and the benign update of the malicious node is less than the preset maximum norm distance.

[0020] Optionally, the expression for the malicious update is:

[0021]

[0022] Where i represents the ID of the malicious node, and t represents the update round of the global model. This represents the malicious update of malicious node i in round t. This represents the benign update of malicious node i in round t. The scaling factor representing the malicious node i. Indicates a positive update L2 norm, Indicates the direction of attack.

[0023] Optionally, the step of obtaining an attack score based on the malicious update and mapping the attack score to the poisoning interval of the malicious node includes:

[0024] Will Attack score as malicious node i Get the maximum number of uploads by malicious node i. The steepness of the control curve (a) and the center position of the control curve (b);

[0025] Based on the maximum number of uploads The steepness 'a' and center position 'b' of the control curve are used to score the attack using the Sigmoid function. Mapped to the poisoning interval of malicious node i , .

[0026] Optionally, after the malicious node uploads the malicious update to the aggregation management terminal according to the poisoning interval, the method further includes:

[0027] The aggregation management terminal generates the version number for the next update round based on the benign updates uploaded by the benign nodes and the malicious updates uploaded by the malicious nodes.

[0028] Based on the difference between the version number of the next update round and the version number of the current update round, the contribution weight of each participating node is adjusted, and the global model is updated using an asynchronous weighted strategy.

[0029] This invention also provides a model attack device for adaptive poisoning interval under asynchronous federated learning, used to implement the aforementioned model attack method for adaptive poisoning interval under asynchronous federated learning, the device comprising:

[0030] An asynchronous federated learning network construction module is used to build an asynchronous federated learning network, which includes an aggregation management terminal and multiple participating nodes;

[0031] A benign update generation module is used to distribute the global model to all participating nodes through the aggregation management terminal, and the participating nodes generate benign updates based on the global model;

[0032] The benign update upload module is used to obtain the attacker model, divide the participating nodes into malicious nodes and benign nodes according to the attacker model, and upload the benign updates of the benign nodes to the aggregation management terminal.

[0033] The malicious update generation module is used to construct a constrained malicious model based on the benign updates of malicious nodes through the collusion network generated by the attacker model, and to generate malicious updates through the malicious model.

[0034] The malicious update upload module is used to obtain an attack score based on the malicious update, map the attack score to the poisoning interval of the malicious node, and upload the malicious update to the aggregation management terminal according to the poisoning interval.

[0035] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the model attack method for adaptive poisoning interval under asynchronous federated learning.

[0036] The present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the model attack method for adaptive poisoning interval under asynchronous federated learning.

[0037] The present invention has the following beneficial effects:

[0038] 1. Based on the attacker model, participating nodes are divided into malicious and benign nodes. Malicious nodes exchange benign updates through a collusion network to construct a consistent attack direction. By constructing a constrained malicious model, it is ensured that malicious updates are highly similar to benign updates in the parameter space, allowing attacks to circumvent asynchronous defense mechanisms and improving attack stealth. Attack scores are obtained based on malicious updates, and these scores are mapped to the poisoning interval of malicious nodes. Through adaptive adjustment of the poisoning interval, malicious nodes are prevented from being marked by the system due to high-frequency uploads or fixed behavioral patterns, thus improving the effectiveness of the attack. Malicious nodes upload malicious updates to the aggregation management terminal according to the poisoning interval, continuously reducing the convergence accuracy of the global model and achieving long-term interference with the global model.

[0039] 2. Malicious nodes exchange benign updates through a collusion network. Based on the common characteristics of global benign updates, a consistent attack direction is calculated to avoid the characteristic anomalies caused by the random attack direction of a single malicious node. The attack effect is maximized by multiple malicious nodes with consistent attack directions.

[0040] 3. Using the L2 norm distance between malicious and benign updates being less than the preset maximum norm distance as an attack constraint, the malicious and benign updates are highly similar, preventing malicious updates from being filtered by the aggregation management end due to excessive parameter deviation, thus achieving long-term stable interference to the global model. The constrained malicious model will generate a scaling factor that matches the attack direction and constraint conditions. The scaling factor is used to reverse the interference of benign updates to obtain malicious updates, ensuring that the malicious updates can guarantee the effectiveness of the attack without exposing malicious nodes due to abnormal disturbances, thus achieving an effective and covert sustainable attack.

[0041] 4. The attack score is used as a quantitative indicator of the perturbation strength and effectiveness. The attack score is mapped to the poisoning interval of the malicious node through the Sigmoid function, so that the attack score and the poisoning interval are strongly correlated. The attack effect is maximized by adjusting the poisoning interval. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart of a method according to an embodiment of the present invention;

[0044] Figure 2 This is a structural diagram of the device according to an embodiment of the present invention. Detailed Implementation

[0045] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0046] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to and includes any or all possible combinations of one or more of the listed items.

[0047] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0048] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0049] Reference Figure 1This invention provides a model attack method with adaptive poisoning interval under asynchronous federated learning, comprising:

[0050] Construct an asynchronous federated learning network, which includes an aggregation management terminal and multiple participating nodes;

[0051] In some embodiments, Federated Learning (FL) is a distributed machine learning paradigm whose core lies in coordinating participating nodes distributed across various locations to collaboratively train a global model without sharing the original data. This method demonstrates high training efficiency in privacy-sensitive applications, thereby driving widespread research and application exploration of privacy-preserving distributed machine learning in academia and industry. In traditional Federated Learning (FL) frameworks, the training process typically employs a synchronous update mechanism. Specifically, in each communication cycle, the aggregation management end first distributes the current global model parameters to all participating nodes. Subsequently, each participating node performs several rounds of gradient updates based on its local private data and uploads the updated model parameters to the aggregation management end. The aggregation management end must wait for all participating nodes to complete their local training and return the update results before performing a global aggregation operation to generate a new round of global model. This design makes training efficiency dependent on "stragglers," especially in environments with heterogeneous computing power or network conditions, where the extended waiting time leads to a significant decrease in resource utilization. Furthermore, the communication overhead during synchronization increases exponentially with the number of participating nodes, fundamentally limiting its scalability in large-scale real-world scenarios. To overcome these limitations, Asynchronous Federated Learning (AFL) was proposed to eliminate global synchronization barriers. In AFL, participating nodes can immediately upload their models to the aggregation management terminal after completing local training. The aggregation management terminal continuously receives and aggregates available local models while distributing the latest global model to participating nodes. By introducing an asynchronous parameter update mechanism, AFL can effectively reduce coordination overhead and alleviate performance degradation caused by slow or faulty nodes.

[0052] Compared to synchronous federated learning, asynchronous federated learning networks do not require all participating nodes to upload their local updates before performing global aggregation. This feature allows malicious nodes to upload tainted updates more frequently, thereby increasing the effectiveness of malicious attacks.

[0053] Obtain the global model and distribute it to all participating nodes through the aggregation management terminal. The participating nodes generate positive updates based on the global model.

[0054] In some embodiments, the aggregation management terminal is in A global model will be initialized at that time. Then, the initialized model is distributed to all participating nodes, and for each participating node... The model version number t accepted by the logger i =0. In subsequent communication processes, i.e., t i When >0, the aggregation management terminal receives data from participating nodes. After uploading the local gradient update, immediately update the current global model. The participating node is sent back as the base model for the next round of training, and its version record is updated synchronously. i =t.

[0055] In some embodiments, participating nodes generate benign updates based on the global model, including:

[0056] Obtain the local data set of the participating nodes, and construct the objective function of the participating nodes on the local data set based on the global model and the local data set;

[0057] Obtain the local gradient of the global model, and adjust the parameters of the objective function based on the local gradient using the stochastic gradient descent algorithm to obtain a benign update.

[0058] In some embodiments, the loss is calculated for participating node i and backpropagated to obtain the average gradient, expressed as:

[0059]

[0060] in, represents the average gradient calculated over t iterations; B represents the number of data samples used in the local training of the global model; Indicates the number of data samples used in a single gradient calculation; This represents the loss function, used to measure the difference between the model's predictions and the true labels; This represents the regularization coefficient, which controls the degree of constraint on the difference between client parameters and the global model. This represents the local model of node i participating in iteration t-1; This represents sample data and label data; Represents the reference model;

[0061] In an asynchronous federated learning scenario, suppose there is an aggregation management endpoint and... It consists of several participating nodes, where the service utilizes the local datasets and computing resources of the participating nodes to collaboratively train a global model, and obtains the participating nodes in the average gradient. The benign update is expressed as:

[0062]

[0063] in, This represents the local dataset of participating node i, each Contains a feature vector x j With the corresponding label y j The global model for round t is denoted as , Represents the gradient. Indicates participating nodes Local data collection The objective function defined above, Indicates the first The data distribution of each node is as follows: Expectations.

[0064] Obtain the attacker model, divide the participating nodes into malicious nodes and benign nodes based on the attacker model, and upload the benign updates of benign nodes to the aggregation management terminal.

[0065] In some embodiments, attackers can typically control a subset of participating nodes and dynamically select malicious nodes based on factors such as computing power, data distribution characteristics, and network latency. For example, they may prioritize nodes with larger data volumes or significantly different data distributions from the global data distribution to enhance the attack's effectiveness. The attacker's model rules are distributed to the target nodes via an encrypted channel, ensuring that only the selected malicious nodes are aware of their roles, preventing benign nodes from detecting the attack intent. Subsequent selected malicious participating nodes will then further manipulate the originally trained benign updates into a malicious model.

[0066] All participating nodes register their identity information, such as node ID, device identifier, and data sample size, with the aggregation management terminal. This information is then synchronized to the attacker model. Node characteristics are input into the attacker model, which uses an SVM classifier to identify nodes with high attack value. The attacker model then hijacks these high-attack-value nodes as malicious nodes.

[0067] After successful local training, benign nodes automatically trigger the upload process without waiting for other nodes or external instructions. The benign node packages its positive updates and auxiliary information into an upload data packet, which is then sent to the aggregation management terminal via the standard communication interface of the federated learning system. Upon receiving the packet, the aggregation management terminal first verifies the metadata, such as whether the version number matches the node registration information; then it performs lightweight validation, such as checking whether the L2 norm of the benign update is within the normal range to avoid obvious outliers; after successful validation, the data is stored in the aggregation buffer for global model updates.

[0068] Based on the benign updates of malicious nodes, a constrained malicious model is constructed through the collusion network generated by the attacker model, and malicious updates are generated through the malicious model;

[0069] In some embodiments, based on benign updates from malicious nodes, a constrained malicious model is constructed through a collusion network generated by an attacker model, and malicious updates are generated through the malicious model, including:

[0070] Each malicious node exchanges benign updates through a collusion network generated by the attacker model, and calculates the attack direction based on the benign updates;

[0071] In some embodiments, in a multi-malicious node scenario, if each node generates its attack direction independently, the attack directions may be dispersed due to differences in local data distribution, ultimately canceling each other out during global aggregation and failing to form effective interference. By exchanging benign updates from all malicious nodes through a collusion network, a unified attack direction can be determined based on the statistical characteristics of these updates. For example, all malicious nodes may attack in the opposite direction of the benign update, or inject perturbations into the most sensitive parameter dimension of the global model. This consistency ensures that the malicious updates from multiple malicious nodes overlap in the same direction in the parameter space, significantly amplifying the interference to the global model.

[0072] Based on the attack direction, construct attack constraints for malicious nodes, and based on the attack constraints, construct a constrained malicious model.

[0073] In some embodiments, the attack constraint is that the L2 norm distance between a malicious update and a benign update of a malicious node is less than a preset maximum norm distance.

[0074] In some embodiments, existing defense schemes for asynchronous federated learning, such as FedBuff, AsyncFilter, and FLDetector, often rely on outlier filtering logic. This involves calculating the L2 norm, residuals, or clustering features of all participating node updates to identify and discard malicious updates that significantly deviate from the benign update distribution. This constraint, by limiting the L2 norm distance between malicious and benign updates to ≤ a preset maximum norm distance, ensures that the parameter perturbation amplitude of malicious updates falls entirely within the normal statistical range of benign updates. This guarantees that malicious updates are highly similar to benign updates in the parameter space, fundamentally circumventing the aforementioned detection logic based on amplitude anomalies.

[0075] A scaling factor is generated by a constrained malicious model. This scaling factor is then used to reverse the benign updates of malicious nodes, thereby obtaining malicious updates.

[0076] In some embodiments, for a malicious node i, the value of the scaling factor is continuously optimized using a binary search method to obtain the optimal scaling factor, and a reference scaling factor is set. Initial upper limit Initial lower limit and threshold ;

[0077] Calculate scaling factor The expression is:

[0078]

[0079] when At that time, if Then let , Otherwise, ;in This represents the maximum L2 norm distance between two nodes that have undergone benign updates.

[0080] Repeat the calculation of the scaling factor until Not greater than The optimal scaling factor is obtained, and then the malicious update is calculated using the scaling factor. The expression for the malicious update is:

[0081]

[0082] Where i represents the ID of the malicious node, and t represents the update round of the global model. This represents the malicious update of malicious node i in round t. This represents the benign update of malicious node i in round t. The scaling factor representing the malicious node i. Indicates a positive update L2 norm, Indicates the direction of attack.

[0083] In some embodiments, the constrained malicious model generates a scaling factor that matches the attack direction and constraints. The magnitude of the scaling factor directly determines the strength of the reverse interference, avoiding excessively strong or weak perturbations.

[0084] Attack direction calculation, constraint construction, and scaling factor generation are all completed locally on the malicious nodes. Malicious updates are generated based on the benign updates from the malicious nodes, the attack direction, and the scaling factor. This allows each malicious node to independently evaluate the perturbation direction and intensity without frequent communication or centralized control. A unified perturbation scaling mechanism coordinates the updates of the malicious models generated by all participating nodes. This mechanism significantly reduces the computational and communication overhead of collaborative construction by participating nodes, ensuring efficient collaboration even in resource-constrained or high-latency asynchronous environments.

[0085] The attack score is obtained based on the malicious update, and the attack score is mapped to the poisoning interval of the malicious node. The malicious node uploads the malicious update to the aggregation management terminal according to the poisoning interval.

[0086] In some embodiments, an attack score is obtained based on a malicious update, and the attack score is mapped to the poisoning interval of a malicious node, including:

[0087] Will Attack score as malicious node i Get the maximum number of uploads by malicious node i. The steepness of the control curve (a) and the center position of the control curve (b);

[0088] Based on the maximum number of uploads The steepness 'a' and center position 'b' of the control curve are used to score the attack using the Sigmoid function. Mapped to the poisoning interval of malicious node i , .

[0089] In some embodiments, the aggregation strategy can be flexibly adjusted using three adjustable parameters: maximum number of uploads, steepness, and center position. If nodes in the system upload frequently, r can be increased. max Increase the coverage of malicious updates; if the system's defense mechanism is sensitive to high-frequency uploads, the upload frequency can be controlled by adjusting 'a' or 'b'. If the system is sensitive to sudden changes in upload frequency, 'a' can be reduced to make the interval change more gradual; if it is necessary to quickly increase the upload frequency when achieving high scores, 'a' can be increased to achieve precise and non-abrupt attacks, ensuring a balance between effective interference and stealthy behavior, and avoiding triggering system alerts.

[0090] Attack score is essentially a quantitative indicator of the strength and effectiveness of malicious update perturbations. When the attack score is high, As the value decreases, the poisoning interval approaches r. max Malicious nodes shorten the poisoning interval and increase the number of uploads, allowing efficient perturbations to participate in aggregation first, maximizing the disruption to the global model convergence. When the attack score is low, As the value increases, the poisoning interval decreases. Malicious nodes extend the poisoning interval, reduce invalid uploads, avoid consuming bandwidth and computing resources, and reduce the probability of being marked by the system due to frequent low-quality uploads.

[0091] The attack score-based poisoning interval decision scheme improves the collusion-based malicious model generation mechanism. By mapping the attack score through a non-linear sigmoid function, a non-linear mathematical relationship is established between the poisoning effect and the poisoning interval. The poisoning interval of the malicious model is dynamically adjusted, enabling malicious participating nodes to dynamically and adaptively select the upload time according to the system, thereby maximizing the attack benefits, minimizing the accuracy of the global model, and controlling the detection risk below the security threshold.

[0092] Each malicious node calculates the difference between its malicious local model and its benign local model, resulting in an attack score. This score is then processed by a sigmoid function to determine the poisoning interval, enabling dynamic adjustment of the attack time. Specifically, a non-linear sigmoid function maps the attack score to the poisoning interval, allowing malicious nodes to adaptively adjust their upload pace based on the perturbation intensity. Compared to traditional fixed poisoning interval uploads, this mechanism prioritizes introducing efficient perturbations during the model aggregation phase, improving model offset efficiency while avoiding resource waste and detection risks caused by frequent uploads of inefficient perturbations. In the sigmoid function-based mapping formula, when the attack score exceeds a pre-set threshold, malicious nodes increase the poisoning interval of their malicious models to accelerate interference with the global model during high-impact attack phases. Conversely, when the attack score falls below the threshold, they maintain a normal poisoning interval to prevent resource exhaustion, balancing attack intensity with operational sustainability.

[0093] In some embodiments, after the malicious node uploads the malicious update to the aggregation management terminal according to the poisoning interval, the method further includes:

[0094] The aggregation management terminal generates the version number for the next update round based on benign updates uploaded by benign nodes and malicious updates uploaded by malicious nodes.

[0095] Based on the difference between the version number of the next update round and the version number of the current update round, the contribution weight of each participating node is adjusted, and the global model is updated using an asynchronous weighted strategy.

[0096] In some embodiments, the aggregation management terminal, during the aggregation process, determines the version t recorded in the basic model of the participating nodes. i Differences between the current global model version t and the current global model version t Dynamically adjust the contribution weight of each participating node's local model. And adopt an asynchronous weighted strategy. To update the global model, where This is the learning rate of the global model. Finally, the aggregation management terminal updates the global model version number to t+1 to mark the generation of a new round of models.

[0097] Reference Figure 2 This invention provides a model attack device 20 for adaptive poisoning interval under asynchronous federated learning, used to implement a model attack method for adaptive poisoning interval under asynchronous federated learning. The device includes:

[0098] Asynchronous federated learning network building module 21 is used to build an asynchronous federated learning network, which includes an aggregation management terminal and multiple participating nodes;

[0099] The benign update generation module 22 is used to distribute the global model to all participating nodes through the aggregation management terminal, and the participating nodes generate benign updates based on the global model;

[0100] The benign update upload module 23 is used to obtain the attacker model, divide the participating nodes into malicious nodes and benign nodes according to the attacker model, and upload the benign updates of the benign nodes to the aggregation management terminal.

[0101] The malicious update generation module 24 is used to construct a constrained malicious model based on the benign updates of malicious nodes through the collusion network generated by the attacker model, and to generate malicious updates through the malicious model.

[0102] The malicious update upload module 25 is used to obtain attack scores based on malicious updates, map the attack scores to the poisoning interval of malicious nodes, and upload malicious updates to the aggregation management terminal according to the poisoning interval.

[0103] This application provides an electronic device, including a processor and a memory; the memory stores a computer program, wherein the computer program, when executed by the processor, implements a model attack method for adaptive poisoning interval under asynchronous federated learning of any of the above schemes.

[0104] Specifically, the processor may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor may also include onboard memory for caching purposes. The processor may be a single processing unit or multiple processing units for performing different actions of the method flow according to embodiments of this application.

[0105] Memory can be any medium capable of containing, storing, transmitting, propagating, or transmitting instructions. For example, memory can include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, instruments, or propagation media. Specific examples of memory include: magnetic storage devices such as magnetic tape or hard disk drives (HDDs); optical storage devices such as optical discs (CD-ROMs); and also random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0106] This application also provides a computer-readable medium storing a computer program that, when executed by a processor, implements a model attack method for adaptive poisoning intervals under asynchronous federated learning, as described above. This computer-readable medium may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into that device / apparatus / system. The aforementioned computer-readable medium carries one or more programs, which, when executed, implement the method as described in the embodiments of this application.

[0107] According to embodiments of this application, a computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wired, optical fiber, radio frequency signals, etc., or any suitable combination thereof.

[0108] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments and / or claims of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application. Therefore, the scope of this application should not be limited to the above embodiments, but should be defined not only by the appended claims, but also by their equivalents. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A model attack method with adaptive poisoning interval under asynchronous federated learning, characterized in that, include: Construct an asynchronous federated learning network, which includes an aggregation management terminal and multiple participating nodes; Obtain the global model and distribute it to all participating nodes through the aggregation management terminal. The participating nodes generate benign updates based on the global model. Obtain the attacker model, and divide the participating nodes into malicious nodes and benign nodes based on the attacker model. Upload the benign updates of the benign nodes to the aggregation management terminal. Based on the benign updates of malicious nodes, a constrained malicious model is constructed through the collusion network generated by the attacker model, and malicious updates are generated through the malicious model; The attack score is obtained based on the malicious update, and the attack score is mapped to the poisoning interval of the malicious node. The malicious node uploads the malicious update to the aggregation management terminal according to the poisoning interval.

2. The model attack method for adaptive poisoning interval under asynchronous federated learning according to claim 1, characterized in that, The participating nodes generate benign updates based on the global model, including: Obtain the local data set of the participating node, and construct the objective function of the participating node on the local data set based on the global model and the local data set; Obtain the local gradient of the global model, and adjust the parameters of the objective function based on the local gradient using the stochastic gradient descent algorithm to obtain the benign update.

3. The model attack method for adaptive poisoning interval under asynchronous federated learning according to claim 1, characterized in that, The step of constructing a constrained malicious model based on the benign updates of malicious nodes through the collusion network generated by the attacker model, and generating malicious updates through the malicious model, includes: Each malicious node exchanges benign updates through the collusion network generated by the attacker model, and calculates the attack direction based on the benign updates; Based on the attack direction, construct attack constraints for malicious nodes, and construct the constrained malicious model based on the attack constraints. A scaling factor is generated using the constrained malicious model, and the scaling factor is used to reverse the benign updates of the malicious node to obtain the malicious update.

4. The model attack method with adaptive poisoning interval under asynchronous federated learning according to claim 3, characterized in that, The attack constraint is that the L2 norm distance between the malicious update and the benign update of the malicious node is less than the preset maximum norm distance.

5. The model attack method for adaptive poisoning interval under asynchronous federated learning according to claim 3, characterized in that, The expression for the malicious update is: Where i represents the ID of the malicious node, and t represents the update round of the global model. This represents the malicious update of malicious node i in round t. This represents the benign update of malicious node i in round t. The scaling factor representing the malicious node i. Indicates a positive update L2 norm, Indicates the direction of attack.

6. The model attack method for adaptive poisoning interval under asynchronous federated learning according to claim 5, characterized in that, The step of obtaining an attack score based on the malicious update and mapping the attack score to the poisoning interval of the malicious node includes: Will Attack score as malicious node i Get the maximum number of uploads by malicious node i. The steepness of the control curve (a) and the center position of the control curve (b); Based on the maximum number of uploads The steepness 'a' and center position 'b' of the control curve are used to score the attack using the Sigmoid function. Mapped to the poisoning interval of malicious node i , .

7. The model attack method with adaptive poisoning interval under asynchronous federated learning according to claim 1, characterized in that, After the malicious node uploads the malicious update to the aggregation management terminal according to the poisoning interval, it also includes: The aggregation management terminal generates the version number for the next update round based on the benign updates uploaded by the benign nodes and the malicious updates uploaded by the malicious nodes. Based on the difference between the version number of the next update round and the version number of the current update round, the contribution weight of each participating node is adjusted, and the global model is updated using an asynchronous weighted strategy.

8. A model attack apparatus for adaptive poisoning interval under asynchronous federated learning, used to implement the model attack method for adaptive poisoning interval under asynchronous federated learning as described in any one of claims 1 to 7, characterized in that, The device includes: An asynchronous federated learning network construction module is used to build an asynchronous federated learning network, which includes an aggregation management terminal and multiple participating nodes; A benign update generation module is used to distribute the global model to all participating nodes through the aggregation management terminal, and the participating nodes generate benign updates based on the global model; The benign update upload module is used to obtain the attacker model, divide the participating nodes into malicious nodes and benign nodes according to the attacker model, and upload the benign updates of the benign nodes to the aggregation management terminal. The malicious update generation module is used to construct a constrained malicious model based on the benign updates of malicious nodes through the collusion network generated by the attacker model, and to generate malicious updates through the malicious model. The malicious update upload module is used to obtain an attack score based on the malicious update, map the attack score to the poisoning interval of the malicious node, and upload the malicious update to the aggregation management terminal according to the poisoning interval.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the model attack method for adaptive poisoning interval under asynchronous federated learning as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the model attack method for adaptive poisoning interval under asynchronous federated learning as described in any one of claims 1 to 7.

Images