Advanced backdoor attack method based on federal element learning

Abstract

The invention discloses an adversarial backdoor attack method based on federal element learning, and the method comprises the steps: a client obtains a system parameter, and a malicious client obtains an attack parameter; initializing a global model and an attack component; executing federal element training circulation: cooperatively executing each round of element training according to server-side outer circulation and client-side inner circulation, and completing backdoor implantation in the inner circulation by the malicious client-side; aggregating and updating the global model of the server side; and verifying attack validity in the meta-test stage. According to the method, the data of the malicious client is poisoned in the meta-training stage, and a hidden back door is implanted, so that the global model keeps normal performance for a clean task in the meta-testing stage, however, target misclassification is generated when a trigger mode appears, and meanwhile, a defense mechanism based on gradient anomaly can be avoided.

Description

Technical Field

[0001] This invention belongs to the field of network security, specifically relating to a method for implementing backdoor attacks in a few-sample federated learning scenario. Background Technology

[0002] With the widespread application of artificial intelligence technology in distributed scenarios, data privacy and model security are receiving increasing attention. Traditional Federated Learning (FL) achieves collaborative training of a global model without sharing raw data by training locally on the client and aggregating the model on the server, thus protecting user privacy. However, in practical applications, client data often exhibits non-independent and identically distributed (Non-IID) characteristics, leading to a significant performance degradation of the model in statistically heterogeneous environments. To overcome this limitation, Federated Meta Learning (FML) introduces a meta-learning mechanism, aiming to train a meta-model with fast adaptive properties, requiring only a small number of local updates to adapt to the personalized data distribution of each client. Therefore, it has significant application value in scenarios such as customized medical services and edge intelligence.

[0003] Despite its advantages in privacy protection and personalized modeling, federated meta-learning still faces significant security threats, particularly backdoor attacks. In such attacks, malicious clients poison local data by injecting specific trigger patterns, causing the model to be misled into the attacker's target category when processing inputs containing those triggers, while maintaining prediction accuracy for normal samples. This makes it highly stealthy and difficult to detect. Existing research indicates that while federated meta-learning carries the risk of backdoor injection, its meta-learning mechanism endows the model with rapid adaptive capabilities, offering some defensive potential. During the meta-testing phase, the model undergoes minor fine-tuning based on clean client data, which may mitigate the harmful effects of malicious data to some extent. However, current methods still lack effective protection mechanisms for the meta-learning training process, making it difficult to ensure the secure and reliable implementation of personalized federated learning in highly heterogeneous environments with potential adversaries. Summary of the Invention

[0004] The purpose of this invention is to provide an adversarial backdoor attack method based on federated meta-learning. This method poisons the data of malicious clients during the meta-training stage to implant a hidden backdoor, so that the global model maintains normal performance for clean tasks during the meta-testing stage, but causes target misclassification when the triggering mode occurs. At the same time, it can circumvent defense mechanisms based on gradient anomalies.

[0005] The technical solution to achieve the purpose of this invention is: an adversarial backdoor attack method based on federated meta-learning, comprising the following steps:

[0006] (10) The client obtains system parameters, and the malicious client obtains attack parameters;

[0007] (20) Initialize the global model and attack components;

[0008] (30) Execute the federated meta-training loop: Each round of meta-training is executed in coordination between the server-side outer loop and the client-side inner loop. The malicious client implants the backdoor in the inner loop.

[0009] (40) Server-side global model aggregation update;

[0010] (50) Verify the effectiveness of the attack during the meta-testing phase.

[0011] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0012] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the above-described method.

[0013] A computer program product includes a computer program that, when executed by a processor, implements the above-described method.

[0014] Compared with the prior art, the present invention has the following significant advantages: (1) The present invention designs a backdoor attack method for federated meta-learning systems. By simultaneously poisoning the support set and query set, and utilizing the cross-task adaptation mechanism of meta-learning, the backdoor remains effective for unseen tasks during the meta-testing phase, achieving a task-independent attack effect. (2) The present invention combines adversarial sample generation and trigger mode optimization. It enhances the robustness of backdoor embedding through the PGD method and improves the concealment and attack success rate of the backdoor by iteratively updating the trigger mode. (3) The present invention introduces a stochastic gradient scaling mechanism. By randomly scaling the magnitude of malicious gradients, it circumvents anomaly detection defenses based on gradient magnitude, thereby improving the concealment and persistence of the attack. Attached Figure Description

[0015] Figure 1 This is a diagram of the backdoor attack framework in this invention.

[0016] Figure 2 The accuracy and success rate of traditional attack methods under different internal learning rates.

[0017] Figure 3 This illustrates the impact of different attacker percentages on attack efficiency in embodiments of the present invention.

[0018] Figure 4 This invention illustrates the impact of more fine-tuning rounds on attack sustainability during the federated meta-testing phase. Detailed Implementation

[0019] like Figure 1 As shown, the Federated Meta-Learning (FML) system comprises a central server and multiple distributed clients, consisting of two nested optimization processes: a server-side outer loop and a client-side inner loop. This invention provides an adversarial backdoor attack method based on Federated Meta-Learning. Using the adversarial backdoor attack framework AAFML, a persistent, effective, and stealthy backdoor is implanted into the global model without affecting normal task performance. The specific steps are as follows:

[0020] (10) The client obtains system parameters, and the malicious client obtains attack parameters:

[0021] System parameters include: total number of meta-training rounds T, number of clients selected in each round M, proportion of malicious clients (default 20%), and set of all client IDs. Inner loop learning rate (Omniglot and CIFAR-FS are set to 0.1, Mini-ImageNet is set to 0.01), outer loop learning rate (Omniglot and Mini-ImageNet are set to 0.001, and CIFAR-FS is set to 0.005).

[0022] Dataset parameters: Task settings for the Omniglot / Mini-ImageNet / CIFAR-FS datasets (N-way K-shot, i.e., N classes per task, K support set samples per class), support sets and query set Sample format and dimensions;

[0023] Attack parameters include: a backdoor trigger (the same size as the data sample, masked so that the effective area is the lower right corner of the image), and the attack target label. (The first class in the meta-training task is the default target class);

[0024] PGD ​​adversarial example generation parameters: step size Iteration steps E, perturbation boundary (Default 0.1); Stochastic gradient scaling factor The sampling interval is [0,1]; the learning rate of the trigger-optimized Adam-optimizer (default 0.1).

[0025] (20) Initialize the global model and attack components:

[0026] Initialize global model parameters We use CNN networks adapted to each dataset (Omniglot has 4 convolutional blocks + linear classifier, Mini-ImageNet has 32-channel convolution + pooling layers, and CIFAR-FS has 3-layer convolution with padding + pooling layers).

[0027] The backdoor trigger is initialized with a random pixel pattern, and the effective area is limited by a mask.

[0028] Initialize client state: Mark benign clients and malicious clients; malicious clients load clean datasets and prepare to perform poisoning operations.

[0029] (30) Execute the federated meta-training loop (including attack implantation): Each round of meta-training is executed in conjunction with the server-side outer loop and the client-side inner loop. The malicious client implants the backdoor in the inner loop. The specific process is as follows:

[0030] (31) Server-side outer loop initialization:

[0031] In round t (t=1,2,...,T), the server randomly selects M client subsets from all clients and sets the current global model parameters. Distribute to all selected clients;

[0032] The server waits to receive the query set loss gradient feedback uploaded by all clients. This is used for subsequent global model updates.

[0033] (32) Client-side loop execution (differentiated operations between benign and malicious clients):

[0034] Benign client operation: based on local support set The model is optimized for two epochs using stochastic gradient descent (SGD), with the i-th client updating the local model parameters according to the inner loop learning rate. :

[0035]

[0036] This represents the gradient of the loss value of the global model on the local support set.

[0037] Calculate the query set loss gradient and upload it to the server:

[0038]

[0039] This represents the gradient of the loss value of the fine-tuned model on the query set.

[0040] Malicious client poisoning and backdoor embedding: Malicious clients support a wide range of data sets. and query set Simultaneous poisoning, specifically including:

[0041] (321) Generate PGD adversarial examples: For each sample ∈ ∪ Adversarial examples are generated through iterative optimization using Projected Gradient Descent (PGD). ,satisfy And the pixel value range is [0,1], the formula is:

[0042]

[0043] (322) Embed and optimize the trigger: superimpose the adversarial example with the current trigger to obtain a backdoor sample.

[0044]

[0045] (323) Optimize the trigger by minimizing the target label loss, so that the trigger "learns to learn" and adapts to the model update. The update formula is:

[0046]

[0047] For the predicted values ​​of the data with backdoors, The loss value is the sum of the predicted value and the attack target label. The gradient of the backdoor trigger on this loss value;

[0048] (324) Poisoning Model Training: Based on Poisoning Support Set Update the local model and compute the poisoning query set. The loss gradient;

[0049] (325) Malicious client gradient random scaling: To circumvent server-side anomaly detection, a random scaling factor is applied to the poisoning gradient. (Sampling uniformly from [0,1]), the processed gradient is uploaded to the server to ensure that the amplitude distribution of malicious gradients is consistent with that of benign gradients, thereby improving stealth:

[0050]

[0051]

[0052] (40) Server-side global model aggregation update:

[0053] The server receives gradient feedback from all clients (benign and malicious). }, based on the learning rate of the outer loop element Aggregate and update the global model :

[0054]

[0055] Let M represent the set of M clients selected in the t-th round;

[0056] Repeat steps (30)-(40) until 3000 rounds of training are completed (the attack starts from round 1500, and the backdoor is implanted after the model converges).

[0057] (50) Meta-testing phase verification and attack effectiveness:

[0058] During meta-testing, the client retrieves the updated global model. Fine-tune 10 epochs on the new task;

[0059] Input samples with backdoor triggers were stably misclassified as the target label by the fine-tuned model. An attack is considered successful if the success rate (ASR) exceeds 90%.

[0060] Even with benign input samples, the classification accuracy remains high, achieving the attack objective of "normal tasks are unaffected, and the backdoor takes effect immediately upon triggering".

[0061] Example

[0062] In this embodiment, the federated meta-learning system is trained for a total of T = 3000 rounds, and the attack is initiated after 1500 rounds. Each round, M = 10 clients are randomly selected to participate in training, with malicious clients comprising 20% ​​(i.e., 2 clients). Each client's task is a 5-way 5-shot classification task. The inner layer learning rate for model training... = 0.1, outer learning rate = 0.001. Maximum constraint of the PGD perturbation used in the attack. = 0.1, the trigger mode is applied to the lower right corner of the image through a mask and updated using the Adam optimizer with a learning rate of 0.1. Based on the above experimental conditions, the adversarial backdoor attack method (AAFML) proposed in this invention is verified.

[0063] Figure 2 The simulation demonstrates the attack performance of traditional backdoor attacks (BadNets) under different internal learning rates. In this simulation, the backdoors implanted in the meta-model are eliminated as the internal learning rate increases, thus requiring the design of a more powerful adversarial backdoor attack.

[0064] Under the optimized algorithm, by changing the proportion of malicious clients, the convergence of the attack success rate can be improved from... Figure 3 As shown in Figures (a) to (c), the accuracy and attack success rate of the Omniglot, Mini-ImageNet, and CIFAR-FS datasets change with the proportion of malicious clients, respectively. By comparing the cases where the proportion of malicious clients is 10%, 20%, and 30%, we can see that as the proportion of malicious clients increases, the attack success rate at convergence also increases. Therefore, while maintaining stealth, appropriately increasing the proportion of malicious clients can enhance the attack effect.

[0065] exist Figure 4 The figure shows the change in attack success rate of the proposed algorithm after different rounds of fine-tuning during the meta-testing stage. Figures (a) to (c) show the changes in accuracy and attack success rate of the Omniglot, Mini-ImageNet, and CIFAR-FS datasets as a result of different rounds of fine-tuning during the meta-testing stage, respectively. As can be seen from the figure, the attack success rate only decreases slowly with the increase of the number of fine-tuning rounds, indicating that the backdoor implanted by this method has significant persistence.

[0066] Table 1 compares the performance of the method of this invention (AAFML) with existing mainstream backdoor attack methods on three datasets: Omniglot, Mini-ImageNet, and CIFAR-FS.

[0067] Table 1

[0068]

[0069] The results show that, without significantly affecting the accuracy of the primary task (ACC), the attack success rate (ASR) of this method is significantly better than other baseline methods, with ASR exceeding 95% in most settings.

[0070] Table 2 analyzes the contribution of each module in the method of this invention through ablation experiments.

[0071] Table 2

[0072]

[0073] As can be seen from Table 2, removing the Trigger Update module or the Stochastic Gradient Scaling module will cause a sharp drop in the attack success rate, which verifies the necessity and effectiveness of the core module design of the method of the present invention.

[0074] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for a federated meta-learning based adversarial backdoor attack, characterized in that, Comprise: (10) The client obtains system parameters, and the malicious client obtains attack parameters; (20) Initialize the global model and attack component; (30) Execute the federated meta-training cycle: each round of meta-training is executed in cooperation with the server-side outer loop and the client-side inner loop, and the malicious client completes the backdoor implantation in the inner loop; (40) Server-side global model aggregation update; (50) Verify the effectiveness of the attack in the meta-test phase.

2. The federated meta-learning based adversarial backdoor attack method according to claim 1, characterized in that, The client obtains system parameters, and the system parameters comprise: a total number of meta-training rounds T, a number of selected clients M in each round, a malicious client proportion, and a whole client number set ; an inner loop learning rate , an outer loop meta-learning rate .

3. The federated meta-learning based adversarial backdoor attack method according to claim 2, characterized in that, The malicious client obtains attack parameters, the attack parameters including: a backdoor trigger, an attack target label, PGD adversarial sample generation parameters, a random gradient scaling factor, and an Adam-optimizer learning rate optimized by the trigger, wherein the PGD adversarial sample generation parameters include a step size, a number of iteration steps E, and a disturbance boundary. ​​​​ 4. The federated meta-learning based adversarial backdoor attack method of claim 3, wherein, Initialize the global model and attack component, including: Initialize global model parameters ; Initialize the backdoor trigger trigger to a random pixel pattern, and limit the effective action area through a mask; Initialize the client state: mark the benign client and the malicious client, and the malicious client loads the clean dataset and prepares the poisoning operation.

5. The federated meta-learning based adversarial backdoor attack method according to claim 4, characterized in that, Execute the federated meta-training cycle: each round of meta-training is executed in cooperation with the server-side outer loop and the client-side inner loop, and the malicious client completes the backdoor implantation in the inner loop, specifically including: (31) Server-side outer loop initialization: In the t-th round, n = 1, 2,..., T, the server randomly selects M client subsets from all clients, and distributes the current global model parameters to all selected clients. The server waits to receive all client uploaded query set loss gradient feedback for subsequent global model updates; (32) Client-side inner loop execution: Benign client operations: based on local support set , by SGD optimizing 2 epochs, the i-th client updates the local model parameters by inner loop learning rate : ， a gradient of a loss value of the global model on the local support set; Calculate the query set loss gradient and upload to the server: ， to fine-tune the gradient of the loss value of the post-model on the query set; Malicious client poisoning and backdoor embedding: malicious clients poison the support set and query set Poisoning simultaneously, including in particular: (321) Generating PGD adversarial samples: for each sample ∈ ∪ , generating adversarial samples by PGD iterative optimization , satisfying and the pixel value range [0, 1], the formula is: ， (322) Embed and optimize the trigger: superimpose the adversarial sample and the current trigger to obtain a backdoor sample ， (323) Optimize the trigger by minimizing the target label loss, so that the trigger "learns to learn" to adapt to model updates, and the update formula is: ， a predicted value for the data of the backdoor sample, a loss value for the predicted value and the attack target label, a gradient of the backdoor trigger trigger on the loss value; (324) Poisoning model training: based on poisoning support set Update local model and compute poisoning query set loss gradient; (325) Malicious client gradient random scaling: apply random scaling factor to poisoned gradient Upload processed gradient to server, ensuring malicious gradient has same magnitude distribution as benign gradients: ， 。 6. The federated meta-learning based adversarial backdoor attack method according to claim 5, characterized in that, Server-side global model aggregation update, specifically: The server receives gradient feedback from all clients } with an outer loop meta-learning rate Aggregates to update the global model : ； M denotes a set of M clients selected in the tth round; Repeat steps (30)-(40) until 3000 rounds of meta-training are completed, the attack starts from 1500 rounds, and the backdoor is implanted after the model converges.

7. The federated meta-learning based adversarial backdoor attack method according to claim 6, characterized in that, Verify the effectiveness of the attack in the meta-test phase, specifically: At meta-test time, the client gets the updated global model Fine-tune on new task for 10 epochs; Input samples with backdoor trigger are misclassified as target label by fine-tuned model , considered as attack success.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the method of any one of claims 1-7.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1-7.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-7.

Images