Method and system for judging security of federated learning communication link based on watermark

Abstract

The invention belongs to the technical field of federated learning, and particularly relates to a method and system for judging the security of a federated learning communication link based on watermarks. The method comprises the following steps: after a client obtains a parameter update quantity of a trained local new model compared with a to-be-trained model, embedding an arrangement watermark into the parameter update quantity to obtain a model update quantity; meanwhile, the client side embeds a hidden watermark into the sample set based on a histogram shift reversible image watermarking algorithm to obtain a watermark image set; the client sends the watermark image set and the model update quantity back to the central server; the central server verifies the watermark image set copy based on the received model update quantity copy, and if verification succeeds, it is judged that the current communication link is safe; otherwise, sending an alarm that the communication link is threatened to the technician. According to the invention, the security of the federal learning communication link can be judged efficiently and accurately.

Description

Technical Field

[0001] This invention belongs to the field of federated learning technology, and in particular relates to a method and system for determining the security of federated learning communication links based on watermarking. Background Technology

[0002] Federated learning (FL), as an emerging machine learning technology, allows multiple participants to collaboratively train models without sharing the original data, effectively solving data privacy and security issues, and has broad application prospects in many fields such as healthcare, finance, and the Internet of Things.

[0003] Federated learning involves a large amount of data interaction between clients and a central server. During data transmission, the channel is highly vulnerable to various attacks. Malicious attackers often employ man-in-the-middle attacks, a common cybersecurity threat. Attackers insert themselves between the communicating parties (such as the client and the central server), secretly intercepting and modifying the data before retransmitting it. This attack method is highly covert; the communicating parties are usually unaware that their data has been stolen and altered.

[0004] For example, an attacker could intercept model parameters transmitted over the channel when the central server distributes them or when the client uploads them, then tamper with and corrupt these parameters before retransmitting them. The client or central server could then perform local training or aggregation operations on the received abnormal model parameters, thereby affecting the overall model accuracy. Therefore, ensuring the security of the communication link between the client and the central server has become a pressing issue in the field of federated learning technology. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for judging the security of federated learning communication links based on watermarking. This method can efficiently and accurately judge the security of federated learning communication links and prevent the central server from using communication data tampered with by attackers.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A method for determining the security of federated learning communication links based on watermarking includes the following steps: S1. After the client obtains the trained local new model, it generates a sample set. The results of the local new model's prediction of all samples in the sample set are output in the order of the samples in the sample set, which is the arrangement watermark. S2, after the client obtains the parameter update amount of the trained local new model compared with the model to be trained, it embeds the permutation watermark into the parameter update amount to obtain the model update amount; at the same time, the client embeds the hidden watermark into the sample set based on the histogram shift reversible image watermarking algorithm to obtain the watermarked image set. S3, the client sends the watermarked image set and the model update amount back to the central server; S4, the central server verifies the watermark image set copy based on the received model update copy. If the verification is successful, the current communication link is determined to be secure; otherwise, an alarm is issued to the technical personnel that the communication link is under threat.

[0007] Preferably, S1 also includes the following: The client uses generator G to generate a sample set X that simultaneously meets the following three requirements: Requirement 1: The number of samples in the sample set X is equal to the number of binary bits in the permutation watermark S; Requirement 2: All samples in sample set X must have a predicted label of 0 or 1; Requirement 3: Feed the samples of sample set X into the local new model in the order of arrangement for prediction, and the corresponding prediction result set Y is the arrangement watermark S.

[0008] Preferably, the sample set X also needs to meet requirement four: Requirement four, the samples in the sample set X are close to the decision boundary of the classification model of the model to be trained.

[0009] Preferably, before using the generator G: after training the generator G, optimize the generator G in the direction of decreasing the gradient of the comprehensive loss function L; ; ; ; in, This represents the first loss function; n represents the number of samples in the sample set X; This represents the i-th prediction result in the prediction result set corresponding to the current sample set; This represents the binary value of the i-th bit in the current watermark arrangement; α represents the first weight coefficient; β represents the second loss function; β represents the second weighting coefficient.

[0010] Preferably, in S2, the client embeds a hidden watermark into the sample set X based on the histogram shift reversible image watermarking algorithm, and also includes the following: S21, Draw the corresponding gray-level histogram based on the gray-level graphs of each sample in the sample set X; the sample is the original image; S22, obtain the maximum point on the grayscale histogram; S23. Based on the maximum point of each grayscale histogram, modify the pixel value of each pixel in each sample to complete the embedding of the hidden watermark in all samples in the sample set X.

[0011] Preferably, S23 also includes the following: Let the i-th sample in the sample set X be ? ,sample The maximum point on the grayscale histogram is denoted as The largest point on the grayscale histogram refers to the pixel value with the most pixels. For the sample Scanning proceeds sequentially from left to right and top to bottom, one pixel at a time. Pixels that have already been scanned are not scanned again. The currently scanned pixel is recorded as the scan point. If the pixel value of the scan point is... Then, after modifying the pixel values ​​of the scanned points as follows, the sample will be completed. Embed a hidden watermark to obtain the corresponding watermark image. : ;in, Indicates sample In the middle, the pixel value of the scan point Modified pixel values; This represents the binary value of the i-th bit in the currently arranged watermark; the watermark image set corresponding to the sample set X is denoted as... .

[0012] Preferably, S4 also includes the following: S41, the central server receives a copy of the model update and a copy of the watermarked image set. Then, watermark extraction is performed on the model update copy to obtain the parameter update copy. and arrange watermark copies ; S42, the central server is based on a copy of the watermarked image set. The process involves scanning each pixel in each watermark image copy to obtain the maximum point of the grayscale histogram corresponding to each watermark image copy, and then arranging the watermark copies accordingly. After modifying the pixel values ​​of each scan point in each watermarked image copy as follows, the operation of removing the hidden watermark from the watermarked image copy is completed. Obtain the corresponding sample copy: ;in, Indicates a copy of the watermarked image In the middle, the pixel value of the scan point Modified pixel values; Indicates the current arrangement of watermark copies The binary value at the i-th bit; a sample set copy consisting of all sample copies. ; S43, Central Server uses parameter update quantity replicas After optimizing the model to be trained, a test model is obtained, and then a copy of the sample set is created. The sample copies are sequentially fed into the test model for label prediction in the order they are arranged, resulting in corresponding prediction result set copies. If the prediction result set is a copy With arrangement of watermark copies If the bit error rate between the two points does not exceed the set threshold, the verification is successful, the current communication link is secure, and the central server uses a replica of the parameter update amount. After optimizing the parameters of the training model stored in the central server, a new global model is obtained; otherwise, the verification fails, and an alert is issued to the technical staff that there is a threat to the communication link between the central server and the corresponding client.

[0013] This invention also provides a system for determining the security of a federated learning communication link based on watermarking, comprising: a sample set generation module, a packaging module, an uploading module, and a verification module; the sample set generation module, packaging module, and uploading module are all located on the client; the verification module is located on a central server; the sample set generation module generates a sample set on the client and sends it to the packaging module; the packaging module packages the client's parameter update quantity and the sample set into a model update quantity and a watermark image set and sends it to the uploading module; the uploading module uploads the model update quantity and the watermark image set to the verification module of the central server via the communication link; the verification module verifies the watermark image set copy based on the received model update quantity copy and determines whether the current communication link is secure; each module is programmed or configured to perform the steps of the method for determining the security of a federated learning communication link based on watermarking as described above.

[0014] The present invention also provides a computer-readable storage medium storing a computer program programmed or configured to perform a method for determining the security of a federated learning communication link based on watermarking as described above.

[0015] The present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the method described above for determining the security of a federated learning communication link based on watermarking.

[0016] The beneficial effects of this invention are as follows: (1) The present invention provides a method for judging the security of federated learning communication links based on watermarks, which can efficiently and accurately judge the security of federated learning communication links, especially whether the information transmitted on the communication link has been tampered with, and decide whether to take the corresponding parameter update amount uploaded by the client based on the security of the current communication link.

[0017] (2) If the watermarked image set and model update amount sent back to the central server by the client of this invention are intercepted and tampered with by an attacker in the communication link and then sent to the central server, no matter how small the tampering is, it will cause the tampered information to fail to be verified at the central server. Once the communication link is insecure, the central server will immediately be aware of the verification failure, and the attacker will not be able to use the tampered information to perform malicious operations on the model that is being trained and optimized in the central server (because the parameter update amount in the information of the verification failure will not be used by the central server at all).

[0018] (3) The client of the present invention still does not need to disclose any local samples to the central server. Instead, it can ensure the communication security of the entire federated learning process through the sample set X, which is meaningless in itself, without destroying the inherent advantage of federated learning in protecting the privacy of client data.

[0019] (4) The central server of the present invention must verify the received information before it will use the parameter update amount in the information. This will prevent the central server from directly using the received information, further thwarting the attacker's attempt to bypass the watermarking mechanism and interfere with the model optimization within the central server by sending malicious information directly to the central server. It also ensures the security of the central server in the process of using federated learning to optimize the model.

[0020] (5) The core of the present invention for determining the security of communication links lies in watermarks. Watermarks with good concealment can induce attackers on the current communication link to expose themselves as soon as possible. In the present invention, whether watermarks are arranged or hidden, they are well concealed in the model update amount and watermark image set.

[0021] (6) The watermark embedding method of the present invention will not significantly increase the computational load of the central server, nor will it cause the accuracy of the parameter update uploaded by the client to be compromised when extracted by the central server. Furthermore, the present invention will not have a negative impact on the central server's optimization model while ensuring the data transmission security of the communication link during the federated learning process. That is, compared with the central server directly optimizing the model based on the federated learning model, the present invention will not reduce the effectiveness and efficiency of the central server's optimization model.

[0022] (7) The process of obtaining the sample set and watermark image set in this invention will not interfere with the client's training of the model distributed by the central server using local samples; the verification process of the central server is also independent of the process of the central server using the parameter update amount uploaded by the client to optimize the model; this also confirms that this invention will not interfere with the central server's optimization of the model based on federated learning. Attached Figure Description

[0023] Figure 1This is a flowchart of a method for determining the security of a federated learning communication link based on watermarking, according to the present invention. Detailed Implementation

[0024] To make the technical solution of the present invention clearer and more explicit, the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Solutions derived by those skilled in the art through equivalent substitution and conventional reasoning of the technical features of the present invention without creative effort all fall within the protection scope of the present invention.

[0025] The federated learning mentioned in this invention is used to train a model for classifying images, so the samples mentioned in this invention are the original images.

[0026] like Figure 1 As shown, this invention provides a method for determining the security of federated learning communication links based on watermarking, comprising the following steps: Step 1: The central server distributes the model to be trained in this round to the client; the client uses local samples to train the model to be trained in this round and obtains the new local model trained in this round.

[0027] Step 2: The client generates a sample set; the results of all samples in the sample set being predicted by the local new model are output in the order of the samples in the sample set, which is the arrangement watermark.

[0028] Step 3: After obtaining the parameter update amount of the local new model trained in this round compared with the model to be trained in this round, the client embeds the permutation watermark into the parameter update amount to obtain the model update amount; at the same time, the client embeds the hidden watermark into the sample set based on the histogram shift reversible image watermarking algorithm to obtain the watermarked image set.

[0029] Step 4: The client sends the watermarked image set and the model update amount back to the central server.

[0030] Step 5: The central server verifies the watermark image set copy based on the received model update copy. If the verification is successful, the current communication link is determined to be secure, and the central server uses the parameter update amount in the model update copy to update the parameters; otherwise, an alarm is issued to the technical personnel that there is a threat to the communication link.

[0031] The central server uses parameter update amounts to optimize the parameters of the current training model stored on the central server, resulting in a new global model. When the central server uses more than one parameter update amount for the current training model, it will integrate the parameter update amounts from each client to optimize the parameters of the current training model and obtain a new global model.

[0032] Subsequently, the central server uses a public test set to test and evaluate the new global model. If the evaluation is satisfactory, the training ends; if the evaluation is unsatisfactory, the current new global model is used as the model to be trained in the next round, distributed to each client, and the above steps 1 to 5 are repeated to continue training. That is, watermarking technology is used to ensure the security of federated learning training during the federated learning training process.

[0033] In step 1, the client can use all or some of the local samples to train the model to be trained in this round.

[0034] Step 2 also includes the following: The client uses generator G to generate a sample set X that simultaneously meets the following three requirements: Requirement 1: The number of samples in the sample set X is equal to the number of binary bits in the permutation watermark S; Requirement 2: All samples in sample set X must have a predicted label of 0 or 1; Requirement 3: Feed the samples of sample set X into the local new model in the order of arrangement for prediction, and the corresponding prediction result set Y is the arrangement watermark S.

[0035] The generator G can be obtained by training a Progressive Generative Adversarial Network (PGAN); obtaining the generator G is a current technique (see the paper Progressive Growing of GANs for Improved Quality, Stability, and Variation), and will not be elaborated here.

[0036] Optionally, the samples in the sample set X selected by generator G must also meet requirement four: Requirement 4: The samples in the sample set X are close to the decision boundary of the classification model of the model to be trained in this round.

[0037] The following explains "Requirement 4": To ensure trigger sensitivity, we want the sample set X selected by the generator G to better utilize the decision boundary properties of the classification model being trained in this round. This property means that if the classification model being trained in this round is tampered with or attacked, the classification boundary will change, and the prediction results corresponding to samples at the classification boundary will also change (for example, the prediction result of a sample after being predicted by the local new model should be 0, but because the model being trained in this round is attacked, the prediction result corresponding to that sample becomes 1). Furthermore, because the samples in sample set X are close to the decision boundary of the classification model being trained in this round, if the samples in sample set X are tampered with during transmission, it is highly likely that the prediction results corresponding to the tampered samples will be different from those of the original samples.

[0038] During the training of the generator G, selecting a sample set that simultaneously satisfies requirements one and two is relatively easy. However, if the predicted result set Y obtained from the sample set selected by the current generator G is not equal to the permutation watermark S, then we need to continuously iterate and optimize the generator G. A satisfactory X not only needs to ensure that the predicted result set output by the local new model is equal to S, but also needs to guarantee trigger sensitivity. For trigger sensitivity, we utilize the decision boundary property of the classification model (corresponding to requirement four). This property means that once the model is tampered with or attacked, the classification boundary will change, and the prediction result for the sample will also change. Therefore, X is a sample close to the decision boundary of the classification model and whose predicted result set output by the local new model is S. Based on this, we calculate the comprehensive loss function L and optimize the generator G in the direction of decreasing gradient of the comprehensive loss function L. This ensures that the generator G, after final optimization, can generate a sample set X that simultaneously satisfies all four requirements, while minimizing the number of iterations required to optimize the generator G. L consists of two parts, L1 and L2, and their formulas are expressed as follows: ; ; ; This represents the first loss function; n represents the number of samples in the sample set X; This represents the i-th prediction result in the prediction result set corresponding to the current sample set; This represents the binary value of the i-th bit in the current watermark arrangement; α represents the first weight coefficient; β represents the second loss function; β represents the second weighting coefficient.

[0039] This reflects the difference between the sample set obtained during the training of generator G, the prediction result set obtained after prediction by the local new model, and the permutation watermark calculated by generator G. We use cross-entropy loss to calculate the distance between the prediction result set and the permutation watermark. In this way, during the optimization of generator G, we can ensure as much as possible that the prediction result set obtained after prediction by the local new model on the sample set selected by generator G is consistent with the permutation watermark.

[0040] This reflects the difference in probability distribution between the sample set selected by generator G and the prediction results obtained after prediction by the local new model across different predicted labels; thus, during the optimization of generator G, it can be ensured that the samples selected by generator G are those located on the decision boundary of the classification model. In the calculation formula, each prediction result is converted into a value between 0 and 1, and the sum of the converted values ​​of all elements is 1, thus forming a probability distribution. Technicians can increase the sensitivity of the sample set to the local new model by increasing the value of β, which helps the central server detect whether the model to be trained distributed to the client has been tampered with, achieving the effect of fragile model watermarking. We use variance to measure the difference in probability distribution of prediction results across different prediction labels. Adding this regularization term makes the sample set selected by the generator G closer to the decision boundary of the classification model, ensuring the sensitivity of the sample set to the model to be trained.

[0041] The sample set X generated by generator G consists of meaningless raw images, or even gibberish images, and is unrelated to the client's local samples.

[0042] In step 3, the sample is the original image; the client embeds a hidden watermark into the sample set X based on the histogram shift reversible image watermarking algorithm, which also includes the following: Step 31: Draw the corresponding gray-level histogram based on the gray-level graphs of each sample in the sample set X. Step 32: Obtain the maximum point and left-shifted histogram from the grayscale histogram; Step 33: Based on the maximum point of the grayscale histogram, modify the pixel values ​​of the pixels in the sample to complete the embedding of the hidden watermark in all samples in the sample set X.

[0043] Step 32 also includes the following: Let the i-th sample in the sample set X be ? ;sample The maximum point on the grayscale histogram is denoted as The maximum point on the grayscale histogram refers to the pixel value with the highest number of pixels, and the maximum point is... The total number of points is denoted as K; the sample Medium pixel value less than Shifting a pixel to the left by l units, and simultaneously reducing the pixel value corresponding to the shifted pixel by 1, this sample is denoted as... Then the sample The corresponding pixel value in the left-shifted histogram is The number of dots is 0; this is the space we prepare for hiding the watermark. (Sample) The maximum point on the grayscale histogram is still .

[0044] Step 33 also includes the following: For the sample Scanning proceeds sequentially from left to right and top to bottom, one pixel at a time. Pixels that have already been scanned are not scanned again. The currently scanned pixel is recorded as the scan point. If the pixel value of the scan point is... Then, after modifying the pixel values ​​of the scanned points as follows, the sample will be completed. Embed a hidden watermark to obtain the corresponding watermark image. : ; in, Indicates sample In the middle, the pixel value of the scan point Modified pixel values; This represents the binary value of the i-th bit in the current watermark arrangement. In other words, if... =0, then the sample All pixel values ​​in The pixel values ​​of the scanned points remain unchanged, and the sample It's a watermark image. ;if =1, then the sample All (K) pixels have a value of The watermark image is obtained by subtracting 1 from the pixel value of each scan point. .

[0045] Let the watermarked image set corresponding to sample set X be denoted as .

[0046] Step 5 also includes the following: Step 51: The central server receives a copy of the model update and a copy of the watermarked image set. Then, watermark extraction is performed on the model update copy to obtain the parameter update copy. and arrange watermark copies .

[0047] Step 52, the central server, based on the copy of the watermarked image set... The pixels in each watermark image copy are scanned sequentially to obtain the maximum point of the grayscale histogram corresponding to each watermark image copy. Then, based on the arrangement of the watermark copies... After modifying the pixel values ​​of each scan point in each watermarked image copy as follows, the process of creating the watermarked image copy is complete. The process of removing the hidden watermark yields a sample copy. : ; in, Indicates a copy of the watermarked image In the middle, the pixel value of the scan point Modified pixel values; Indicates the current arrangement of watermark copies The binary value at the i-th bit in the array.

[0048] All sample copies constitute a sample set copy. .

[0049] Step 53, the central server uses the parameter update quantity replica. After optimizing the model to be trained in this round, the test model for this round is obtained, and then a copy of the sample set is generated. The sample copies are sequentially fed into the test model in this round for label prediction, resulting in corresponding prediction result set copies. If the prediction result set is a copy With arrangement of watermark copies If the error rate between the two sets of data does not exceed the set threshold, the verification is successful, and the central server uses a replica of the parameter update amount. Conversely, if the verification fails, an alert is issued to technical personnel indicating a threat to the communication link between the central server and the corresponding client.

[0050] In step 53, the bit error rate is calculated using the following formula: ; ; in, Represents a copy of the prediction result set With arrangement of watermark copies The bit error rate between; Represents a copy of the prediction result set The i-th prediction result copy in the; This represents the binary value of the i-th bit in the sequence of watermark copies; This represents a function for judging similarities and differences.

[0051] It should be noted here that: In step 5, the central server cannot confirm whether there is a threat of tampering with the communication link until the verification is successful. Therefore, we refer to all information received and extracted by the central server as "copies". If the central server successfully verifies the data, it means that all copies are identical to the original (e.g., watermarked copies). If the watermark (S) is the same as the watermark (S), it means that the current communication link is secure and the information transmitted on the communication link has not been tampered with.

[0052] Under secure communication link conditions, a copy of the prediction result set obtained from the test model is stored in the central server. There may also be a very small number of prediction results that differ from the client's prediction results, which directly leads to the duplication of the prediction result set. With arrangement of watermark copies Not entirely the same, so in step 53, we determine whether the verification is successful by whether the bit error rate exceeds a set threshold, rather than directly by judging the copy of the prediction result set. With arrangement of watermark copies Whether the two are directly identical is used to determine whether the communication link is secure.

[0053] The present invention provides a method for determining the security of federated learning communication links based on watermarking. This method can efficiently and accurately determine the security of federated learning communication links, especially whether the information transmitted on the communication link has been tampered with, and decide whether to update the parameters uploaded by the corresponding client based on the current security status of the communication link.

[0054] In this invention's method for determining the security of federated learning communication links based on watermarking, the client only needs to use a generator G to select several samples from local samples and arrange them in a specific way to form a sample set X. Subsequent generation of watermarks, hidden watermarks, watermark image sets, and model updates are all based on and tightly coupled with sample set X. Therefore, if any of the following generated by the client in this round—sample set X, watermark arrangement, hidden watermark, watermark image set, or model updates—is tampered with by an attacker, the coupling relationship will be broken, meaning a single change can have far-reaching consequences. Thus, if the watermark image set and model updates sent back to the central server by the client are intercepted and tampered with by an attacker in the communication link and then sent back to the central server, no matter how small the tampering, the tampered information will fail to be verified at the central server. Once the communication link is insecure, the central server will immediately detect it due to the verification failure, and the attacker will be unable to use the tampered information to maliciously manipulate the model being trained and optimized on the central server (because the parameter updates in the verification failure information will not be used by the central server).

[0055] The client of this invention still does not need to disclose any local samples to the central server. Instead, it can ensure communication security throughout the federated learning process using a sample set X that is meaningless in itself, without compromising the inherent advantage of federated learning in protecting client data privacy.

[0056] The central server of this invention must verify the received information before adopting the parameter update amount in the information. This prevents the central server from directly using the received information, further thwarting attackers' attempts to bypass the watermarking mechanism and interfere with the model optimization within the central server by directly sending malicious information. It also ensures the security of the central server during the process of optimizing the model using federated learning.

[0057] The core of this invention for determining communication link security lies in watermarking. A well-concealed watermark can more easily lure attackers on the current communication link to expose themselves (for example, it can make attackers believe that they can interfere with the central server's model optimization by tampering with the information intercepted in the communication link and then sending it out). In this invention, whether arranging or hiding watermarks, they are well concealed within the model update volume and the watermark image set.

[0058] The watermarked image set embedded with hidden watermarks in this invention is used only for the verification process and will not interfere with the model update data containing parameter update values. Under secure communication link conditions, the central server can easily obtain the plaintext parameter update values ​​and permutation watermark directly from the model update data (because the model update data is simply the parameter update values ​​with the permutation watermark embedded). This parameter update data is directly used by the central server for subsequent parameter optimization of its own training model. Therefore, the watermark embedding method of this invention not only does not significantly increase the computational load of the central server, but also does not cause the parameter update data uploaded by the client to be extracted by the central server, thus preventing accuracy loss. Furthermore, this invention ensures secure data transmission through the communication link during federated learning without negatively impacting the central server's model optimization; that is, compared to the central server directly optimizing the model based on federated learning, this invention does not reduce the effectiveness and efficiency of the central server's model optimization.

[0059] The process of obtaining the sample set and watermark image set in this invention will not interfere with the client's training of the model distributed by the central server using local samples; the verification process of the central server is also independent of the process of the central server using the parameter update amount uploaded by the client to optimize the model; this also confirms that this invention will not interfere with the central server's optimization of the model based on federated learning.

[0060] Whether the training model distributed by the central server to a client is tampered with by an attacker, or the watermarked image set and model update amount uploaded by the client to the central server are tampered with by an attacker, both situations indicate that the communication link between the client and the central server is insecure. This will inevitably lead to the central server failing to verify the watermarked image set copy and the model update amount copy, thus making the central server aware that the communication link is insecure.

[0061] If the training model distributed by the central server to a client is tampered with by an attacker, it will result in a copy of the prediction result set output by the test model obtained by the central server based on the parameter updates uploaded by that client. With arrangement of watermark copies The discrepancy was too large, leading to the failure of the verification.

[0062] The present invention also provides a system for determining the security of federated learning communication links based on watermarking, comprising: a sample set generation module, a packaging module, an uploading module, and a verification module; The sample set generation module, packaging module, and upload module are all located on the client side; the verification module is located on the central server. The sample set generation module is used to generate a sample set on the client side and then send it to the packaging module. The packaging module is used to package the client's current round of parameter updates and sample set into the current round of model updates and watermark image set, and then send them to the upload module. The upload module is used to upload the current model update and watermark image set to the verification module of the central server via the communication link; The verification module verifies the watermarked image set copy based on the received model update copy and determines whether the current communication link is secure.

[0063] Each module is programmed or configured to perform the steps of the above-described method for determining the security of federated learning communication links based on watermarking.

[0064] The present invention also provides a computer-readable storage medium storing a computer program programmed or configured to perform the above-described method for determining the security of a federated learning communication link based on watermarking.

[0065] The present invention also provides a computer program product, including a computer program / instructions, which are executed by a processor to implement the steps of the above-described method for determining the security of a federated learning communication link based on watermarking.

[0066] The technologies, shapes, and structures not described in detail in this invention are all well-known technologies. It should also be noted that the above are merely preferred embodiments of this invention and are not intended to limit the scope of the invention. The components or steps in the embodiments of this invention can be decomposed and / or recombined, and these decompositions and / or recombinations should be considered equivalent solutions to this application and should all fall within the protection scope of this invention.

Claims

1. A method for determining the security of federated learning communication links based on watermarking, characterized in that, Includes the following steps: S1, After the client obtains the trained local new model, it generates a sample set; The result of the local new model predicting all samples in the sample set, and output in the order of the sample set, is the arrangement watermark. S2, after the client obtains the parameter update amount of the trained local new model compared with the model to be trained, it embeds the permutation watermark into the parameter update amount to obtain the model update amount; at the same time, the client embeds the hidden watermark into the sample set based on the histogram shift reversible image watermarking algorithm to obtain the watermarked image set. S3, the client sends the watermarked image set and the model update amount back to the central server; S4, the central server verifies the watermark image set copy based on the received model update copy. If the verification is successful, the current communication link is determined to be secure; otherwise, an alarm is issued to the technical personnel that the communication link is under threat.

2. The method for determining the security of a federated learning communication link based on watermarking according to claim 1, characterized in that, S1 also includes the following: The client uses generator G to generate a sample set X that simultaneously meets the following three requirements: Requirement 1: The number of samples in the sample set X is equal to the number of binary bits in the permutation watermark S; Requirement 2: All samples in sample set X must have a predicted label of 0 or 1; Requirement 3: Feed the samples of sample set X into the local new model in the order of arrangement for prediction, and the corresponding prediction result set Y is the arrangement watermark S.

3. The method for determining the security of a federated learning communication link based on watermarking according to claim 2, characterized in that, The sample set X must also meet requirement four: the samples in the sample set X are close to the decision boundary of the classification model of the model to be trained.

4. The method for determining the security of a federated learning communication link based on watermarking according to claim 3, characterized in that, Before using generator G: After training generator G, optimize generator G in the direction of decreasing gradient of the comprehensive loss function L; ； ； ； in, This represents the first loss function; n represents the number of samples in the sample set X; This represents the i-th prediction result in the prediction result set corresponding to the current sample set; This represents the binary value of the i-th bit in the current watermark arrangement; α represents the first weight coefficient; β represents the second loss function; β represents the second weighting coefficient.

5. The method for determining the security of a federated learning communication link based on watermarking according to claim 1, characterized in that, In S2, the client embeds a hidden watermark into the sample set X based on the histogram-shifted reversible image watermarking algorithm. Includes the following: S21, Draw the corresponding gray-level histogram based on the gray-level graphs of each sample in the sample set X; the sample is the original image; S22, obtain the maximum point on the grayscale histogram; S23. Based on the maximum point of each grayscale histogram, modify the pixel value of each pixel in each sample to complete the embedding of the hidden watermark in all samples in the sample set X.

6. The method for determining the security of a federated learning communication link based on watermarking according to claim 5, characterized in that, S23 also includes the following: Let the i-th sample in the sample set X be ? ,sample The maximum point on the grayscale histogram is denoted as The largest point on the grayscale histogram refers to the pixel value with the most pixels. For the sample Scanning proceeds sequentially from left to right and top to bottom, one pixel at a time. Pixels that have already been scanned are not scanned again. The currently scanned pixel is recorded as the scan point. If the pixel value of the scan point is... Then, after modifying the pixel values ​​of the scanned points as follows, the sample will be completed. Embed a hidden watermark to obtain the corresponding watermark image. : ； in, Indicates sample In the middle, the pixel value of the scan point Modified pixel values; This represents the binary value of the i-th bit in the current arrangement of the watermark; Let the watermarked image set corresponding to sample set X be denoted as .

7. The method for determining the security of a federated learning communication link based on watermarking according to claim 6, characterized in that, S4 also includes the following: S41, the central server receives a copy of the model update and a copy of the watermarked image set. Then, watermark extraction is performed on the model update copy to obtain the parameter update copy. and arrange watermark copies ; S42, the central server is based on a copy of the watermarked image set. The process involves scanning each pixel in each watermark image copy to obtain the maximum point of the grayscale histogram corresponding to each watermark image copy, and then arranging the watermark copies accordingly. After modifying the pixel values ​​of each scan point in each watermarked image copy as follows, the operation of removing the hidden watermark from the watermarked image copy is completed. Obtain the corresponding sample copy: ； in, Indicates a copy of the watermarked image In the middle, the pixel value of the scan point Modified pixel values; Indicates the current arrangement of watermark copies The binary value of the i-th bit; All sample copies constitute a sample set copy. ; S43, Central Server uses parameter update quantity replicas After optimizing the model to be trained, a test model is obtained, and then a copy of the sample set is created. The sample copies are sequentially fed into the test model for label prediction in the order they are arranged, resulting in corresponding prediction result set copies. If the prediction result set is a copy With arrangement of watermark copies If the bit error rate between the two points does not exceed the set threshold, the verification is successful, the current communication link is secure, and the central server uses a replica of the parameter update amount. After optimizing the parameters of the training model stored in the central server, a new global model is obtained; otherwise, the verification fails, and an alert is issued to the technical staff that there is a threat to the communication link between the central server and the corresponding client.

8. A system for determining the security of federated learning communication links based on watermarking, characterized in that, include: The system includes a sample set generation module, a packaging module, an upload module, and a verification module. The sample set generation module, packaging module, and upload module are all located on the client side. The verification module is located on the central server. The sample set generation module generates a sample set on the client side and then sends it to the packaging module. The packaging module packages the client's parameter update data and the sample set into a model update data set and a watermark image set before sending it to the upload module. The upload module is used to upload the model update and the watermark image set to the verification module of the central server via the communication link; The verification module verifies the watermarked image set copy based on the received model update copy and determines whether the current communication link is secure; each module is programmed or configured to perform the steps of a method for determining the security of a federated learning communication link based on watermarks as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program that is programmed or configured to perform a method for determining the security of a federated learning communication link based on watermarking as described in any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instruction is executed by the processor, it implements the steps of a method for determining the security of a federated learning communication link based on watermarking as described in any one of claims 1-7.

Images