Method for defending local differential private data poisoning attack

Abstract

The invention relates to a method for defending local differential private data poisoning attack. The method comprises the following steps: S1, receiving data uploaded by a user; s2, estimating first data distribution and calculating an initial log-likelihood value, and taking the initial log-likelihood value as a first element of a log-likelihood chain; s3, performing disturbance on a synthetic data set formed by sampling from the first data distribution for a plurality of times, calculating average data distribution and an average log-likelihood value by using an expectation maximization algorithm, and adding the average log-likelihood value into a log-likelihood chain; s4, performing replacement resampling inspection to obtain empirical distribution, and calibrating the average data distribution to obtain calibrated data distribution; s5, repeating the steps S3-S4 until the length of the log-likelihood chain reaches a preset length; and S6, carrying out stationarity test and residual analysis on the log-likelihood chain, and judging whether pollution data exists in the data uploaded by the user or not. According to the invention, accurate and general identification of LDP data poisoning attacks is realized.

Description

Technical Field

[0001] This invention belongs to the field of big data and privacy computing technology, specifically relating to a method for defending against local differential privacy data poisoning attacks. Background Technology

[0002] With the rapid development of big data and privacy computing, Local Differential Privacy (LDP) has gradually become a mainstream technical approach in data collection and analysis. LDP avoids dependence on trusted data collectors by randomly perturbing data locally on the user's end, protecting individual privacy while still ensuring statistically significant data availability. In recent years, protocols such as Generalized Random Response (GRR), Optimal Unary Coding (OUE), and Optimal Local Hash (OLH) have been widely applied to tasks such as frequency estimation, mean calculation, and distribution reconstruction, driving large-scale data collection in internet services, mobile computing, and IoT environments.

[0003] Against this backdrop, LDP exhibits three driving forces: compliance-driven, industry-driven, and technology-driven. However, LDP also faces new security challenges in its application. Because the perturbation mechanism inherently introduces statistical noise, attackers can forge data through methods such as data poisoning attacks and adaptive pattern attacks (APA), significantly distorting the overall estimation results. Meanwhile, existing detection methods often rely on single-point features, making it difficult to maintain stable detection performance in scenarios with low attack rates and high concealment. More seriously, in practical industrial applications, attacks may target specific values, leading to systematic biases in data distribution and posing potential threats to critical business functions such as recommendation systems and risk modeling.

[0004] The current research ecosystem is showing a two-way trend: on the one hand, the academic community is constantly proposing new protocol mechanisms (such as segmentation mechanism PM and square wave mechanism SW) to reduce estimation errors and enhance practicality; on the other hand, the "adversarial evolution" between attack and defense has exposed the limitations of traditional detection methods.

[0005] Existing research mainly proposes the following detection techniques for data poisoning attacks under the LDP protocol: Malicious User Detection (MUD), Anomaly Statistical Detection (ASD), and Zero-shot Detection. However, existing detection methods for data poisoning attacks under the LDP protocol generally have the following shortcomings: (1) Limited scope of application: Existing detection methods usually depend on specific protocols and task scenarios. For example, MUD and ASD are only applicable to frequency estimation of categorical data, while zero-shot detection is only applicable to distribution estimation of numerical data, lacking the ability to adapt to different tasks and protocols. (2) Limited attack types to resist: Some methods (such as zero-shot detection) fail to make full use of the underlying data distribution characteristics, especially skewed or complex distribution information, resulting in limited detection accuracy when facing mixed or diversified attacks, and lacking applicability and generalization ability to different data distributions and attack patterns. (3) Poor detection of covert attacks: Most methods rely solely on surface-level statistical indicators, such as frequency anomalies or distribution differences, making it difficult to effectively identify attackers using covert attack strategies or when the number of attackers is limited. This results in significantly insufficient detection accuracy for small-scale and covert attacks, with substantial deficiencies in overall detection sensitivity and coverage. (4) Poor noise resistance: Existing detection schemes typically use different detection indicators to measure the anomalies of user-uploaded data. When privacy budgets are limited, the large amount of random noise introduced by the LDP mechanism itself can interfere with the detection indicators, causing a significant decrease in the discrimination performance of existing methods. This makes it easy for false positives and false negatives to coexist, making it difficult to maintain stability and reliability in high-noise scenarios.

[0006] Therefore, existing methods typically rely on frequency statistics or outlier identification to detect poisoning attacks. While effective in some scenarios, their detection performance often degrades significantly in low-attack-rate, covert attack, or zero-shot environments. Furthermore, existing detection mechanisms lack a global perspective and cannot systematically capture the statistical relationship between perturbed data and the true distribution, leading to unstable detection results and failing to meet the security requirements of large-scale data collection and analysis. How to achieve highly robust attack identification in zero-shot detection scenarios lacking prior knowledge of real data has become a pressing issue for the industry. Summary of the Invention

[0007] To address the aforementioned problems in the existing technology, this invention provides a method for defending against local differential privacy data poisoning attacks. The technical problem to be solved by this invention is achieved through the following technical solution: This invention provides a method for defending against local differential privacy data poisoning attacks, comprising the following steps: S1. Receive user-uploaded data; S2. Use the expectation-maximization algorithm to estimate the first data distribution of the user-uploaded data and calculate the initial log-likelihood value, and use the initial log-likelihood value as the first element of the log-likelihood chain; S3. The synthetic dataset formed by sampling from the first data distribution is perturbed several times. The expected maximum algorithm is used to estimate the data distribution for each perturbed result and calculate the log-likelihood value. Then, the average data distribution is calculated for several data distributions, and the average log-likelihood value is calculated for several log-likelihood values. The average log-likelihood value is added to the log-likelihood chain. S4. Perform a permutation resampling test on the perturbation results of the user-uploaded data and the average data distribution to obtain an empirical distribution, calculate the probability of extreme cases occurring in the empirical distribution, and calibrate the average data distribution according to the probability to obtain a calibrated data distribution; S5. Sample from the calibrated data distribution to generate a new synthetic dataset, and repeat steps S3 to S4 until the length of the log-likelihood chain reaches the preset length. S6. Perform a stationarity test on the log-likelihood chain; if the log-likelihood chain fails the stationarity test, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test; perform residual analysis on the log-likelihood chain that passes the stationarity test, and determine whether there is contaminated data in the user-uploaded data based on the residual analysis results.

[0008] In one embodiment of the present invention, step S2 includes: Initialize user upload data The estimated distribution is of length . histogram ,in, The range of data that users can upload; The probability coefficient of the user-uploaded data is obtained by calculating the estimated data distribution after perturbation. ,in, This indicates that the LDP protocol will fall under the first... The numbers in each histogram cell are mapped to... The probability, This indicates that the value among all user-uploaded data is equal to Number of data points Histogram The Middle One value, Histogram The Middle One value, This indicates that the LDP protocol will fall under the first... The numbers in each histogram cell are mapped to... The probability of; According to the probability coefficient Calculate the values ​​in the histogram ,in, Indicates the first The probability coefficients corresponding to each histogram cell; loop iteration and The calculation continues until the iteration termination condition is met, resulting in the first data distribution. ; According to the first data distribution Calculate the initial log-likelihood value ,in, Indicates a given In the case of obtaining The probability; and the initial log-likelihood value Add to the log-likelihood chain middle.

[0009] In one embodiment of the present invention, step S3 includes: From the first data distribution A certain amount of data was sampled from the dataset to obtain a synthetic dataset. ; For synthetic datasets After performing several LDP perturbations, several sets of perturbation results are obtained. Each set of perturbation results is represented as follows: ,in, arrive , Indicates the number of perturbations. Indicates the number of iterations. ; The expectation-maximization algorithm is used to process each set of perturbation results. Estimate the data distribution and calculate the log-likelihood value Then, calculate the average data distribution for several sets of data distributions. Calculate the mean log-likelihood value for several sets of log-likelihood values. ; and will Add to the log-likelihood chain middle.

[0010] In one embodiment of the present invention, step S4 includes: Data uploaded by the user and the perturbation results of the average data distribution N samples are drawn from each sample to obtain the first group of samples and the second group of samples. The data from the first and second groups of samples are randomly rearranged. Each time, a pre-defined test method is used to calculate a pre-defined statistic based on the arrangement results of the two groups of samples. The preset verification method is determined based on the type of data uploaded by the user. According to the preset test statistic Calculate the probability of extreme cases occurring in the empirical distribution of the observed values. ,in, For the pre-defined test method and The calculation results For indicator functions, when When true, the indicator function value is 1; otherwise, it is 0. For indicator functions, when When true, the indicator function value is 1; otherwise, it is 0. When judging the probability When the value is less than or equal to a preset threshold, the first data distribution is used. Replace the average data distribution The calibrated data distribution is obtained.

[0011] In one embodiment of the present invention, the preset threshold is 0.05.

[0012] In one embodiment of the present invention, when the user uploads data of numerical data, the preset verification method includes the KS test method; The statistic for the KS test is: ,in, Representing data The cumulative distribution function in The value of this point, Indicates that it follows a distribution Using LDP perturbation function on the data The result obtained later Indicates the result of the perturbation The cumulative distribution function in The value of this point, The function represents the information about The upper bound.

[0013] In one embodiment of the present invention, when the user uploads data of categorized data, the preset verification method includes the chi-square test method; The statistic for the chi-square test is: ,in, The result of the disturbance Includes Number of data points express Includes The number of data points.

[0014] In one embodiment of the present invention, step S6 involves performing a stationarity test on the log-likelihood chain; if the log-likelihood chain fails the stationarity test, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test, including: The stationarity of the log-likelihood chain was tested using the ADF test. If the ADF test statistic is greater than the critical value corresponding to the significance level of 0.05, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test.

[0015] In one embodiment of the present invention, the critical value corresponding to the significance level of 0.05 is -3.50.

[0016] In one embodiment of the present invention, step S6 involves performing residual analysis on the log-likelihood chain that has passed the stationarity test, and determining whether contaminated data exists in the user-uploaded data based on the residual analysis results, including: Construct a higher-order polynomial based on the log-likelihood chain. ,in, The parameters to be solved are... , Let be the length of the log-likelihood chain; The size of the construction is matrix , where the matrix The Middle The value of the row is ; calculate The parameters to be solved are obtained, where, For length is The vector, for The transpose of the matrix, express The inverse matrix, Representing vectors Transpose of; Calculate the residual vector ,in For a length of ; When the residual vector The first value is If the value is the largest among all values, then the user-uploaded data is determined to contain contaminated data; otherwise, the user-uploaded data is determined not to contain contaminated data.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention constructs a log-likelihood chain based on log-likelihood values, combining the data-irrelevant statistic of log-likelihood with a chain structure design, thus eliminating the dependence of existing detection methods on specific LDP protocol algorithm characteristics; it can simultaneously adapt to frequency estimation of categorical data and mean-variance estimation and distribution estimation of numerical data, breaking through task and data type limitations, realizing unified detection, solving the limitation of "one type of detection for one type of task" in traditional schemes, and significantly improving the versatility of detection; 2. This invention performs stationarity testing and residual analysis on log-likelihood chains. Under the attack signal propagation mechanism of log-likelihood chains, even in covert attack scenarios where forged data is evenly distributed, it can still capture attack characteristics through chain stationarity disruption and residual abnormalities, effectively identify covert attacks, and reduce the risk of missed detection. 3. This invention estimates the data distribution of multiple sets of perturbation results, calculates the log-likelihood value, and calculates the average data distribution and average log-likelihood value. Then, it performs a permutation resampling test to calibrate the average data distribution. By adopting an averaging strategy and a substitution strategy, and by taking the mean value through multiple LDP protocols, the variance of the log-likelihood calculation is reduced. The distribution estimation bias is calibrated by permutation resampling, which effectively offsets the cumulative effect of LDP noise. This solves the detection fluctuation problem caused by noise in traditional methods and ensures detection stability. 4. The method of this invention constructs detection logic based on the correlation between LDP input and output, eliminating the need for the server to obtain real data as a benchmark and avoiding the reliance of existing methods on the unrealistic assumption of "known clean data". At the same time, it avoids the utility loss caused by protocol modification, achieving attack detection while ensuring the strength of privacy protection and data utility, and significantly reducing deployment costs. 5. The method of the present invention maintains stable detection performance even when parameters such as privacy budget, proportion of malicious users, and number of target items vary over a wide range. It performs well in scenarios with uniform and sparse data distribution, has strong environmental adaptability, and can adapt to parameter changes in multiple scenarios. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a method for defending against local differential privacy data poisoning attacks provided in an embodiment of the present invention; Figure 2 This is a flowchart of the user-side data generation process provided in an embodiment of the present invention; Figure 3 A flowchart of server-side data reconstruction and likelihood calculation provided in an embodiment of the present invention; Figure 4 This is a flowchart of the log-likelihood chain construction and iteration provided in an embodiment of the present invention; Figure 5 This is a flowchart of anomaly detection and attack determination provided in an embodiment of the present invention. Detailed Implementation

[0019] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0020] Example 1 Please see Figure 1 , Figure 1 This is a flowchart illustrating a method for defending against local differential privacy data poisoning attacks, provided by an embodiment of the present invention.

[0021] This embodiment of the method for defending against local differential privacy data poisoning attacks is implemented on the server side, with the aim of detecting poisoned data uploaded by user clients. User clients include real users and malicious users: real users generate noisy data by locally perturbing the original data based on the LDP protocol, while malicious users bypass the LDP protocol and directly forge false data. Together, they form the LDP perturbation result and upload it to a remote server. After receiving the mixed data, the server reconstructs the data distribution using the EM algorithm, calculates the initial log-likelihood value, and constructs a log-likelihood chain through multiple iterations to capture the perturbation characteristics of the data distribution caused by the attack. Finally, through stationarity checks and residual analysis, it achieves accurate detection of poisoning attacks under various LDP protocols for both classification and numerical data. The method specifically includes the following steps: S1. Receive data uploaded by users.

[0022] Please see Figure 2 , Figure 2 This is a flowchart illustrating the user-side data generation process provided in this embodiment of the invention. The server receives LDP perturbation result data uploaded by a user (the user-uploaded perturbation result data can be in various formats, including but not limited to a number, a vector, or a tuple of a number and a mapping function). This data may be maliciously poisoned by a user, with the purpose of interfering with the server's collection of all user data. Attackers possess various methods for constructing poisoned data, capable of generating poisoned data with arbitrary content, and the format of the poisoned data is the same as that of the user-uploaded data.

[0023] S2. Use the expectation-maximization algorithm to estimate the first data distribution of the user-uploaded data and calculate the initial log-likelihood value. Use the initial log-likelihood value as the first element of the log-likelihood chain.

[0024] Please see Figure 3 , Figure 3 This is a flowchart illustrating the server-side data reconstruction and likelihood calculation process provided in this embodiment of the invention. The server first initializes a vector. As a log-likelihood chain, it receives data uploaded by all users. Then, the server reconstructs the distribution of the perturbed data using the Expectation-Maximization (EM) algorithm to obtain the data distribution. .

[0025] First, initialize the user-uploaded data. The estimated distribution is a distribution of length . histogram ,in, The range of data that users can upload. The total includes Each element.

[0026] Then, the algorithm performs a loop iteration, with each iteration containing two steps: The first step is to calculate the probability coefficient of user-uploaded data after the estimated data distribution is perturbed by LDP. ;in, This indicates that the LDP protocol will fall under the first... The numbers in each histogram cell are mapped to... The probability, for example, for The LDP protocol will have a probability of 0.1. Change it to 2, with a probability of 0.2. Modified to Then there is , ; This indicates that the value among all user-uploaded data is equal to Number of data points Histogram The Middle One value, Histogram The Middle One value, This indicates that the LDP protocol will fall under the first... The numbers in each histogram cell are mapped to... The probability of.

[0027] The second step is to determine the probability coefficient. Calculate the values ​​in the histogram ,in, Indicates the first The probability coefficients corresponding to each histogram cell.

[0028] loop iteration and The calculation continues until the iteration termination condition is met, resulting in the first data distribution. For example, the iteration termination condition is when the number of iterations reaches 10,000.

[0029] Next, based on the conditional probability between the input and estimated data, according to the first data distribution Calculate the initial log-likelihood value ,in, Indicates a given In the case of obtaining The probability; and the initial log-likelihood value Add to the log-likelihood chain In this context, the initial value is used as the initial value for the chain evolution.

[0030] S3. Perturb the synthetic dataset formed by sampling from the first data distribution several times, use the expectation-maximization algorithm to estimate the data distribution for each perturbation result and calculate the log-likelihood value, then calculate the average data distribution for several data distributions, calculate the average log-likelihood value for several log-likelihood values, and add the average log-likelihood value to the log-likelihood chain.

[0031] S4. Perform permutation resampling test on the perturbation results of user-uploaded data and average data distribution to obtain the empirical distribution, calculate the probability of extreme cases occurring in the empirical distribution, and calibrate the average data distribution according to the probability to obtain the calibrated data distribution. Please see Figure 4 , Figure 4 The flowchart for constructing and iterating the log-likelihood chain is provided for an embodiment of the present invention.

[0032] The server first starts from the first data distribution A certain amount of data is sampled from the user data, for example, 100,000 data entries. The data format is the same as the user data. The entire set of sampled data is called the synthetic dataset. Sampling refers to sampling according to a given distribution. Random numbers are generated in a probabilistic form.

[0033] Then proceed Round iteration ( Up to 40). Two steps (steps S3 and S4) are performed in each iteration to make the obtained likelihood values ​​more accurate: The first step is to execute the average policy step. This involves applying the synthetic dataset generated in the previous round. Perform k LDP perturbations to obtain k sets of perturbation results ,in, arrive , Indicates the number of perturbations. For example, each... It contains 100,000 perturbation results data.

[0034] For each set of perturbation results, the data distribution is estimated using the EM algorithm. And calculate the log-likelihood value. Then, calculate the average log-likelihood value for several groups of log-likelihood values. Calculate the average distribution of several sets of data. ,Will Add to vector middle.

[0035] The second step is to execute the permutation resampling replacement strategy.

[0036] First, from user-uploaded data Perturbation results of the average data distribution N samples are drawn from each sample to obtain the first group of samples and the second group of samples.

[0037] Then the data from the first and second groups of samples are randomly rearranged. Second-rate( Each permutation utilizes a pre-defined test method, calculating a pre-defined statistic based on the permutation results of the two groups of samples. The preset verification method is divided into two cases based on the user-uploaded data.

[0038] When users upload numeric data (numeric data refers to data containing continuous real numbers, such as 0.5, 1.1, etc.), the KS test is used to calculate the KS statistic: ,in, Representing data The cumulative distribution function in The value of this point, Indicates that it follows a distribution Using LDP perturbation function on the data The result obtained later Indicates the result of the perturbation The cumulative distribution function in The value of this point, The function represents the information about The upper bound.

[0039] When users upload categorical data (categorical data includes, but is not limited to, discrete category label values; for example, in mobile app stores, different software can be labeled, such as WeChat labeled as 1, QQ labeled as 2, etc., where 1 and 2 are categorical data), the chi-square test method is used to calculate the chi-square statistic: ,in, The result of the disturbance Includes Number of data points express Includes The number of data points.

[0040] It's understandable that each permutation calculation... or The value is denoted as .

[0041] Next, based on the preset test statistic... Calculate the probability of extreme cases occurring in the empirical distribution of the observed values. ,in, It is twice the probability of the observed value occurring in the extreme case of the empirical distribution. For the pre-defined test method and The calculation results For indicator functions, when When true, the indicator function value is 1; otherwise, it is 0. For indicator functions, when When true, the indicator function value is 1; otherwise, it is 0.

[0042] Finally, when judging the probability When the value is less than or equal to a preset threshold, the first data distribution is used. Replace the average data distribution This yields the calibrated data distribution. For example, the preset threshold is 0.05, that is, when... Then use replace .

[0043] S5. Sample from the calibrated data distribution to generate a new synthetic dataset, and repeat steps S3 to S4 until the length of the log-likelihood chain reaches the preset length.

[0044] Specifically, from the calibrated distribution New synthetic datasets are generated by sampling from the middle. Used for the next iteration, until the vector The length reaches the preset length. For example, the preset length is 40.

[0045] In this embodiment, steps S3, S4, and S5 perform LDP and EM iterations multiple times based on the estimated data to obtain multiple sets of reconstruction results and corresponding log-likelihood values; the influence of random noise is reduced by averaging strategy and the stability of the results is ensured by substitution strategy, thereby forming a multi-round iterative log-likelihood chain.

[0046] This embodiment uses log-likelihood as the core attack indicator. By measuring the adaptability of LDP reports to the underlying data distribution, it accurately captures the perturbation effect of attacks on data skewness characteristics. This indicator is data-independent and can be used across classification and numerical data scenarios, solving the problems of weak signals and poor adaptability of traditional indicators. By characterizing the correlation between input and output through the log-likelihood indicator, it systematically utilizes the underlying distribution characteristics to achieve robust detection of diverse poisoning patterns. Furthermore, a chain structure is constructed through an iterative process of "distribution estimation - log-likelihood calculation - LDP result reproduction" to associate user reports with benign results to amplify the attack signal. By introducing averaging and substitution strategies, the cumulative effect of LDP noise is effectively offset, ensuring the stability of the chain, accurately reflecting the attack status, and effectively enhancing the sensitivity to identify covert attacks.

[0047] S6. Perform a stationarity test on the log-likelihood chain; if the log-likelihood chain fails the stationarity test, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test; perform residual analysis on the log-likelihood chain that passes the stationarity test, and determine whether there is contaminated data in the user-uploaded data based on the residual analysis results.

[0048] Please see Figure 5 , Figure 5 This is a flowchart of anomaly detection and attack determination provided in an embodiment of the present invention.

[0049] Anomaly detection and attack determination include two stages: The first stage uses the ADF test to determine the stationarity of the log-likelihood chain. Specifically, for vectors... Each likelihood value in Decompose to obtain ,in , All are constants to be solved; calculate the statistics. If the ADF test statistic is greater than the critical value corresponding to a significance level of 0.05, for example, the critical value corresponding to a significance level of 0.05 is -3.50, then... If the data uploaded by the user is found to contain malicious data and is considered contaminated, then the log-likelihood chain passes the stationarity test and proceeds to the second stage.

[0050] In the second stage, higher-order polynomials are first constructed based on the log-likelihood chain. ,in, The parameters to be solved are... , Let the length of the log-likelihood chain be an example. It is 40. Higher-order polynomials In the log-likelihood, each term corresponds one-to-one with each value in the log-likelihood.

[0051] In order to solve for the parameters to be solved The size of the structure is matrix , where the matrix The Middle The value of the row is Then calculate The parameters to be solved are obtained, where, For length is The vector, for The transpose of the matrix, express The inverse matrix, Representing vectors transpose of vector; The Middle The value is The solution results are as follows.

[0052] Finally, calculate the residual vector. ,in For a length of The vector. When the residual vector The first value is If the value is the largest among all values, it is determined that there is contaminated data in the user's uploaded data; otherwise, it is determined that there is no contaminated data in the user's uploaded data.

[0053] Furthermore, the server ultimately outputs a binary detection result: "contaminated" or "uncontaminated," and can selectively record performance metrics such as the F1 score for this detection for monitoring purposes. The detection results can be used to determine whether to reject the batch of data or trigger further data cleaning processes. The formula for calculating the F1 score is: ,in, Precision refers to the percentage of results detected as poisoning attacks that are actually results of poisoning. Recall rate refers to the percentage of all poisoning attacks that are detected.

[0054] This embodiment employs a two-layer detection logic based on the stationarity test and residual analysis of the log-likelihood chain: The first stage uses the ADF test to determine the overall stability of the chain and quickly identify significant attacks; the second stage performs multinomial regression fitting on the stationary chain and locates covert attacks using the residual extreme value characteristics of the first log-likelihood value. This mechanism reduces noise variance and bias, balancing detection efficiency and accuracy, effectively identifying covert attacks, and maintaining detection stability and reliability even in high-noise scenarios.

[0055] Therefore, this embodiment, based on the general statistical properties of log-likelihood and chain structure design, achieves unified detection of multiple types of LDP protocol attacks, including GRR, OUE, and OLH frequency estimation algorithms for categorical data, and PM mean-variance estimation and SW distribution estimation algorithms for numerical data. It eliminates the need to adjust the detection logic for specific protocols, solving the technical pain point of strong task dependence in existing methods. It not only provides an accurate LDP attack detection method but also constructs a detection system that is universal, robust, and practical, filling the technical gap in cross-task attack detection and covert attack identification in current LDP scenarios. This has significant industrial value and application prospects for improving the security of distributed privacy protection systems.

[0056] Example 2 Based on Example 1, this example provides a method for detecting data frequency estimation attacks by a server against the GRR mechanism in LDP, including the following steps: S1. Receive data uploaded by users.

[0057] On the server side, categorized data reports from 80,000 users, perturbed using the GRR protocol, are collected. The privacy budget is set to 0.5, and the data field size is 42. The perturbation probability parameters for the GRR protocol are set as follows: approximately 51.4% probability of maintaining the original value, and approximately 1.2% probability of changing to any other arbitrary value. All users' perturbation reports are aggregated to form an initial set of noisy data reports.

[0058] S2. Initial distribution estimation and log-likelihood calculation.

[0059] S3, Construction and Iterative Generation of Log-Likelihood Chains.

[0060] First, from the first data distribution A synthetic dataset containing 100,000 records is generated by sampling from the middle. Then, the log-likelihood chain length is set to 40, and the mean number of iterations is 10. For each iteration, the following operations are performed: Average policy execution: For the synthetic dataset generated in the previous round, ten independent perturbations are performed using the same GRR protocol, resulting in ten sets of noisy reports. For each set of reports, the expected value-maximization algorithm is used to estimate its corresponding distribution, and the log-likelihood value is calculated. The average log-likelihood value for this round is then calculated and appended to the log-likelihood chain. Simultaneously, the average distribution is calculated.

[0061] Alternative strategy implementation: Calculate the frequency of each category in the initial estimated distribution and the result after applying a perturbation to the current average distribution; then perform a permutation test: randomly rearrange the group labels for the samples from the two distributions ten thousand times, calculating the chi-square test statistic each time to form an empirical distribution. Finally, calculate the probability of extreme cases occurring in the empirical distribution, i.e., the rate. Value. If If the value is less than or equal to 0.05, then the initial estimated distribution is used. Replace the distribution estimated in this round .

[0062] Finally, a new synthetic dataset is generated by sampling from the calibrated distribution for the next iteration, until the length of the log-likelihood chain reaches 40.

[0063] S4. Anomaly Detection and Attack Judgment. After generating a complete log-likelihood chain, a two-stage attack detection process, namely ADF test and residual analysis, is performed to effectively detect covert attacks and output a binary detection result: "contaminated" or "uncontaminated".

[0064] For the specific execution process of steps S2 to S4, please refer to steps S2 to S6 in Example 1. This example will not repeat the process.

[0065] Example 3 Based on Embodiment 1, this embodiment provides a method for detecting data frequency estimation attacks by a server against the square wave mechanism in LDP, including the following steps: S1. Receive data uploaded by users.

[0066] On the server side, numerical data reports are collected from 2,189,968 users after perturbation using a square wave mechanism. The privacy budget is set to 0.5.

[0067] S2. Initial distribution estimation and log-likelihood calculation.

[0068] Specifically, the numerical domain is discretized into 512 equal-width bins using the expectation-maximization and smoothing algorithm, forming a histogram of length 512. And estimate the initial data distribution from the noise report. And based on data distribution Calculate the initial log-likelihood value .

[0069] S3, Construction and Iterative Generation of Log-Likelihood Chains.

[0070] First, from the first data distribution A synthetic dataset containing 100,000 records is generated by sampling from the middle. Then, the log-likelihood chain length is set to 40, and the mean number of iterations is 10. For each iteration, the following operations are performed: Average policy execution: The synthetic dataset generated in the previous round is perturbed ten times using the same square wave mechanism, resulting in ten sets of noise reports. For each set of reports, the expected value-maximization algorithm is used to estimate its corresponding distribution, and the log-likelihood value is calculated. The average log-likelihood value for this round is then calculated and appended to the log-likelihood chain. Simultaneously, the average distribution is calculated.

[0071] Alternative strategy implementation: Calculate the frequency of each category in the initial estimated distribution and the result after applying a perturbation to the current average distribution; then perform a permutation test: randomly rearrange the group labels for the samples from the two distributions ten thousand times, calculating the KS test statistic each time to form an empirical distribution. Finally, calculate the probability of extreme cases occurring in the empirical distribution, i.e., the rate. Value. If If the value is less than or equal to 0.05, then the initial estimated distribution is used. Replace the distribution estimated in this round .

[0072] Finally, a new synthetic dataset is generated by sampling from the calibrated distribution for the next iteration, until the length of the log-likelihood chain reaches 40.

[0073] S4. Anomaly Detection and Attack Judgment. After generating a complete log-likelihood chain, a two-stage attack detection process, namely ADF test and residual analysis, is performed to effectively detect covert attacks and output a binary detection result: "contaminated" or "uncontaminated".

[0074] For the specific execution process of steps S2 to S4, please refer to steps S2 to S6 in Example 1. This example will not repeat the process.

[0075] This invention constructs an LDP data poisoning attack detection framework based on log-likelihood chains, achieving attack detection for various statistical tasks involving both classification and numerical data without relying on real data. Compared to existing technologies, it offers the following beneficial technical effects: This invention constructs a log-likelihood chain based on log-likelihood values, combining the data-irrelevant statistic of log-likelihood with a chain structure design. This eliminates the dependence of existing detection methods on the specific characteristics of LDP protocol algorithms. It can simultaneously adapt to frequency estimation of categorical data and mean-variance estimation and distribution estimation of numerical data, breaking through the limitations of task and data type, realizing unified detection, solving the limitation of "one type of detection for one type of task" in traditional schemes, and significantly improving the versatility of detection.

[0076] This invention performs stationarity tests and residual analysis on log-likelihood chains. Under the attack signal propagation mechanism of log-likelihood chains, even in covert attack scenarios where forged data is evenly distributed, it can still capture attack characteristics through chain stationarity disruption and residual abnormalities. Under the stringent conditions of 2.5% malicious users and ε=0.2, the F1 score remains above 0.9, which is 0.25 higher than the existing best solution, effectively identifying covert attacks and reducing the risk of missed detections.

[0077] This invention estimates the data distribution of multiple sets of perturbation results, calculates the log-likelihood value, and calculates the average data distribution and average log-likelihood value. Then, it performs a permutation resampling test to calibrate the average data distribution. By employing an averaging strategy and a substitution strategy, and by taking the average value through multiple LDP protocols, the variance of the log-likelihood calculation is reduced. The distribution estimation bias is calibrated by permutation resampling, effectively offsetting the cumulative effect of LDP noise. Even in high-noise environments, the F1 score can still be maintained above 0.85, solving the detection fluctuation problem caused by noise in traditional methods and ensuring detection stability.

[0078] The method of this invention constructs detection logic based on the correlation between LDP input and output, eliminating the need for servers to obtain real data as a benchmark and avoiding the reliance of existing methods on the unrealistic assumption of "known clean data". At the same time, it avoids the utility loss caused by protocol modification, achieving attack detection while ensuring the strength of privacy protection and data utility, and significantly reducing deployment costs.

[0079] The method of this invention maintains stable detection performance even when parameters such as privacy budget ε, malicious user ratio β, and number of target items r vary over a wide range. It achieves an F1 score of over 0.96 against attacks using different protocols such as GRR and OUE. It performs well in both uniform and sparse data distribution scenarios, exhibits strong environmental adaptability, and is compatible with parameter variations in multiple scenarios.

[0080] Therefore, this invention constructs a detection framework based on log-likelihood chains to capture the inherent correlation between LDP protocol inputs and outputs, breaking through the dependence of existing detection methods on specific tasks and real data, and achieving accurate and universal identification of LDP data poisoning attacks.

[0081] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for defending against local differential privacy data poisoning attacks, characterized in that, Including the following steps: S1. Receive user-uploaded data; S2. Use the expectation-maximization algorithm to estimate the first data distribution of the user-uploaded data and calculate the initial log-likelihood value, and use the initial log-likelihood value as the first element of the log-likelihood chain; S3. The synthetic dataset formed by sampling from the first data distribution is perturbed several times. The expected maximum algorithm is used to estimate the data distribution for each perturbed result and calculate the log-likelihood value. Then, the average data distribution is calculated for several data distributions, and the average log-likelihood value is calculated for several log-likelihood values. The average log-likelihood value is added to the log-likelihood chain. S4. Perform a permutation resampling test on the perturbation results of the user-uploaded data and the average data distribution to obtain an empirical distribution, calculate the probability of extreme cases occurring in the empirical distribution, and calibrate the average data distribution according to the probability to obtain a calibrated data distribution; S5. Sample from the calibrated data distribution to generate a new synthetic dataset, and repeat steps S3 to S4 until the length of the log-likelihood chain reaches the preset length. S6. Perform a stationarity test on the log-likelihood chain; if the log-likelihood chain fails the stationarity test, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test. Residual analysis is performed on the log-likelihood chain that has passed the stationarity test, and the results of the residual analysis are used to determine whether there is contaminated data in the user-uploaded data.

2. The method for defending against local differential privacy data poisoning attacks according to claim 1, characterized in that, Step S2 includes: Initialize user upload data The estimated distribution is of length . histogram ,in, The range of data that users can upload; The probability coefficient of the user-uploaded data is obtained by calculating the estimated data distribution after perturbation. ,in, This indicates that the LDP protocol will fall under the first... The numbers in each histogram cell are mapped to... The probability, This indicates that the value of all user-uploaded data is equal to Number of data points Histogram The Middle One value, Histogram The Middle One value, This indicates that the LDP protocol will fall under the first... The numbers in each histogram cell are mapped to... The probability of; According to the probability coefficient Calculate the values ​​in the histogram ,in, Indicates the first The probability coefficients corresponding to each histogram cell; loop iteration and The calculation continues until the iteration termination condition is met, resulting in the first data distribution. ; According to the first data distribution Calculate the initial log-likelihood value ,in, Indicates a given In the case of obtaining The probability; and the initial log-likelihood value Add to the log-likelihood chain middle.

3. The method for defending against local differential privacy data poisoning attacks according to claim 1, characterized in that, Step S3 includes: From the first data distribution A certain amount of data was sampled from the dataset to obtain a synthetic dataset. ; For synthetic datasets After performing several LDP perturbations, several sets of perturbation results are obtained. Each set of perturbation results is represented as follows: ,in, arrive , Indicates the number of perturbations. Indicates the number of iterations. ; The expectation-maximization algorithm is used to process each set of perturbation results. Estimate the data distribution and calculate the log-likelihood value Then, calculate the average data distribution for several sets of data distributions. Calculate the mean log-likelihood value for several sets of log-likelihood values. ; and will Add to the log-likelihood chain middle.

4. The method for defending against local differential privacy data poisoning attacks according to claim 1, characterized in that, Step S4 includes: Data uploaded by the user and the perturbation results of the average data distribution N samples are drawn from each sample to obtain the first group of samples and the second group of samples. The data from the first and second groups of samples are randomly rearranged. Each time, a pre-defined test method is used to calculate a pre-defined statistic based on the arrangement results of the two groups of samples. The preset verification method is determined based on the type of data uploaded by the user. According to the preset test statistic Calculate the probability of extreme cases occurring in the empirical distribution of the observed values. ,in, For the pre-defined test method and The calculation results For indicator functions, when When true, the indicator function value is 1; otherwise, it is 0. For indicator functions, when When true, the indicator function value is 1; otherwise, it is 0. When judging the probability When the value is less than or equal to a preset threshold, the first data distribution is used. Replace the average data distribution The calibrated data distribution is obtained.

5. The method for defending against local differential privacy data poisoning attacks according to claim 4, characterized in that, The preset threshold is 0.

05.

6. The method for defending against local differential privacy data poisoning attacks according to claim 4, characterized in that, When the user uploads data of numerical data, the preset verification method includes the KS test method; The statistic for the KS test is: ,in, Representing data The cumulative distribution function in The value of this point, Indicates that it follows a distribution Using LDP perturbation function on the data The result obtained later Indicates the result of the perturbation The cumulative distribution function in The value of this point, The function represents the information about The upper bound.

7. The method for defending against local differential privacy data poisoning attacks according to claim 4, characterized in that, When the user uploads categorized data, the preset testing method includes the chi-square test method; The statistic for the chi-square test is: ,in, The result of the disturbance Includes Number of data points express Includes The number of data points.

8. The method for defending against local differential privacy data poisoning attacks according to claim 1, characterized in that, In step S6, a stationarity test is performed on the log-likelihood chain. If the log-likelihood chain fails the stationarity test, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test, including: The stationarity of the log-likelihood chain was tested using the ADF test. If the ADF test statistic is greater than the critical value corresponding to the significance level of 0.05, it is determined that there is contaminated data in the user-uploaded data; otherwise, the log-likelihood chain passes the stationarity test.

9. The method for defending against local differential privacy data poisoning attacks according to claim 8, characterized in that, The critical value corresponding to the significance level of 0.05 is -3.

50.

10. The method for defending against local differential privacy data poisoning attacks according to claim 7, characterized in that, In step S6, residual analysis is performed on the log-likelihood chain that has passed the stationarity test. Based on the residual analysis results, it is determined whether there is contaminated data in the user-uploaded data, including: Construct a higher-order polynomial based on the log-likelihood chain. ,in, The parameters to be solved are... , Let be the length of the log-likelihood chain; The size of the construction is matrix , where the matrix The Middle The value of the row is ; calculate The parameters to be solved are obtained, where, For length is The vector, for The transpose of the matrix, express The inverse matrix, Representing vectors Transpose of; Calculate the residual vector ,in For a length of ; When the residual vector The first value is If the value is the largest among all values, then the user-uploaded data is determined to contain contaminated data; otherwise, the user-uploaded data is determined not to contain contaminated data.

Images