Model poisoning recovery method in federal learning scene

Abstract

The invention discloses a model poisoning recovery method in a federated learning scene, which divides a recovery strategy into three steps, namely a window division stage, an update compression stage and a rollback recovery stage. In the window division stage, the research firstly introduces a window concept, the whole federation training process turn is divided into a plurality of windows, the window density of the previous training turn is larger, and the window density of the later training turn is smaller. In the updating and compressing stage, all client models participating in training are updated by taking a window as a unit and are clustered and stored so as to be recovered later. And in the rollback recovery stage, the server side completes an adaptive rollback strategy through the attack related information provided by the detection defense method. According to the method, the recovery time delay and the recovery storage occupation are remarkably reduced, and the recovery accuracy is improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for recovering from model poisoning in a federated learning scenario. Background Technology

[0002] Federated learning, as a type of collaborative learning, is widely known for its privacy protection and distributed training characteristics. However, the inherent nature of federated learning makes it highly vulnerable to poisoning attacks, and various detection and defense methods exist to mitigate their negative impact. While existing detection methods perform well in certain real-world scenarios, they still suffer from detection lag, especially when attackers launch adaptive attacks. Specifically, detection often requires a certain delay to trigger, and this delay can leave the federated system in a high-risk state, undoubtedly increasing security risks. Therefore, efficient and high-performance poisoning recovery strategies are urgently needed to further ensure the secure operation of federated training architectures.

[0003] As a supplement to poisoning detection and defense methods, existing poisoning recovery strategies still suffer from problems such as prolonged recovery time, high server-side storage consumption, and poor recovery results. Existing federated poisoning recovery strategies can be broadly classified into two categories: simulated federated forgetting learning strategies and model update approximation estimation methods. Specifically, the simulated federated forgetting learning process essentially transforms the poisoning recovery problem into a process of forgetting the attacker's training contributions within a training round. The model update approximation estimation method essentially uses the stored historical model updates combined with the currently trained model updates to calibrate the uploaded model updates to re-complete the rollback federated learning training. However, both of these recovery strategies have certain drawbacks. For the federated forgetting learning strategy, it introduces significant communication time overhead during the recovery of the accurate model, and in some methods, it requires the server to provide some clean data to assist the forgetting learning process, which clearly does not conform to the federated learning training specifications. For approximate estimation methods for model updates, the most common are Fedrecovery and Crab. For Fedrecovery, the recovery process requires retraining all recovery rounds, which obviously introduces unacceptable time and storage overhead. At the same time, Fedrecovery's approximate Hessian matrix estimation strategy requires the participation of all participating clients, which is obviously not suitable for cross-device scenarios in federated learning. As for Crab, experiments have shown that it performs poorly in the face of highly destructive random attacks without a target, and it still has some storage space that can be further saved.

[0004] Therefore, a federated learning poisoning recovery strategy is needed to supplement existing poisoning defense and detection methods in scenarios with different client data distributions, so as to ensure the security and effectiveness of the federated system and reduce the excessive storage and time overhead of the recovery process.

[0005] CN121071642A discloses a dynamic heterogeneous sensing federated forgetting method and system, proposing an efficient federated forgetting method in heterogeneous data distribution scenarios. This method first designs a KL divergence-aware heterogeneous weighting mechanism, dynamically calculates the aggregated training weights for each round based on KL divergence, and adopts a dynamic interval slow start forgetting method to improve the problem of excessive or insufficient participation in calibration in existing forgetting methods, thereby further improving the forgetting effect.

[0006] CN120822640A discloses a differential privacy-preserving federated forgetting learning method and system based on residual updates, proposing a forgetting strategy based on residual computation and importance weighting. When the forgetting strategy is activated, this method recalculates the residuals of historical model updates and the corresponding weights assigned to those residuals, and uses the computation results to reconstruct the model update. Through the core concept of "residual updates," this method transforms the complex problem of "data forgetting" into a clear problem of "model contribution quantification and removal."

[0007] CN120471190A discloses a prototype-based federated forgetting learning method and system. It proposes treating the forgetting process as a process that doesn't directly manipulate gradients or parameter history, but rather adjusts the model's "prototype" representation in the feature space. Specifically, the entire forgetting process is divided into two phases: a forgetting phase and a recovery phase. A loss function is set so that during the forgetting phase, the updates of other client models move away from the prototype of the forgotten client model. Similarly, a loss function is set so that during the recovery phase, the updates of other client models align with the aggregation results of the other client model updates.

[0008] However, the aforementioned prior art has the following drawbacks:

[0009] (1) The forgetting process introduces significant latency overhead and requires additional data to facilitate the forgetting process: There are many types of existing forgetting recovery operations, such as using small models to perform fixed-point client knowledge distillation to isolate forgotten clients and complete knowledge transfer, and using asynchronous clustering aggregation mechanisms to filter model updates that cluster clients to be forgotten into one class and aggregate the remaining model updates. Although these methods perform well in some practical scenarios, they suffer significant performance losses in large-scale federated scenarios such as cross-device scenarios. In addition, some forgetting processes require providing additional privacy data to the server to complete, which obviously does not comply with federated privacy guidelines.

[0010] (2) Approximate estimation model update for recovery: Existing strategies for recovery through approximate model update mainly utilize streamlined recovery architecture or crab recovery architecture. Streamlined recovery architecture needs to run through every training round during the recovery process, while crab recovery architecture has limited calibration capability when facing highly destructive untargeted random attacks. Summary of the Invention

[0011] This invention addresses the shortcomings of existing technologies by proposing a model poisoning recovery method in federated learning scenarios, which significantly reduces recovery latency and storage usage, and improves recovery accuracy.

[0012] To achieve the above objectives, the present invention provides the following technical solution:

[0013] A method for recovering a poisoned model in a federated learning scenario includes the following steps:

[0014] S1. Window partitioning: The concept of windowing is introduced first, and the entire federated training process is divided into multiple windows, with a large window density in the early training rounds and a small window density in the later training rounds.

[0015] S2, Update Compression: Cluster and store all client models involved in training in units of windows for later recovery;

[0016] S3. Rollback and Recovery: The server performs an adaptive rollback strategy by detecting attack-related information provided by the defense methods.

[0017] Furthermore, in step S1, the threshold for each window division... It is adaptive, calculated based on the similarity within the current window. The specific calculation formula is as follows:

[0018]

[0019] in, This represents the CosineSimilarity value between the global model being iterated over and the first global model in the current window, where m represents the iteration number. This indicates the current window size; that is, if the current frame is... The value is lower than the current window value. Average at round If the value is zero, it means that a new window needs to be created and the current historical global model needs to be aggregated and saved, as shown in the following formula:

[0020]

[0021] This formula represents the first... The first global model within the window No. The last global model within the window Aggregate and save to Saved as a global model for the window.

[0022] Furthermore, the global model in this round is relative to the first historical model in the current window. The formula for calculating the similarity (cs) between them is as follows:

[0023]

[0024]

[0025] in, Indicates the current The global model of rounds, This represents the first global model in the current window. This represents the total number of parameters that the local model update has.

[0026] Furthermore, in step S2, the model updates submitted by all clients participating in training within the current window are aggregated, and all aggregation results are clustered and saved to further reduce the required storage overhead, as shown in the following formula:

[0027]

[0028] in Indicates for window Internal Client The aggregation model used for storage updates. Display window Internal Client All uploaded model updates; at this point, obtain the collection of historical model updates. .

[0029] Furthermore, in step S2, the historical model update set is statically clustered and saved, divided into... There are several classes, as shown in the following formula:

[0030]

[0031] thus The model that needs to be saved in the window needs to be updated. The required storage overhead is from Descending to ,in Represents the total number of windows and satisfies and .

[0032] Furthermore, in step S3, for the recovery of targeted poisoning attacks, the traditional crab-style recovery strategy is used to achieve better recovery results for targeted poisoning attacks, thereby completing the model update recovery and the global model recovery, as shown in the following formula:

[0033]

[0034] in Indicates corresponding to The retrained model is updated. Indicates the learning rate. This indicates the federated learning aggregation method.

[0035] Furthermore, in step S3, for the recovery of untargeted poisoning attacks, the saved data for each window is used. Internal dimensions An improved streamlined recovery strategy was completed, which optimized the recovery algorithm and eliminated the requirement for retraining the streamlined recovery architecture in each round, as shown in the following formula:

[0036]

[0037] in, Indicates corresponding to The retrained model is updated. Indicates the improved learning rate. This indicates the federated learning aggregation method. This represents a list that stores all window sizes.

[0038] The model poisoning recovery method in federated learning scenarios provided by this invention has the following advantages compared with existing technologies:

[0039] 1. Window Partitioning Design: This invention is the first to propose storing historical information in units of windows during the historical information storage stage to aid in the model recovery process. Specifically, this invention utilizes the Cosine Similarity method to partition windows and performs subsequent model compression and adaptive rollback recovery processes in units of windows. This significantly reduces storage overhead by selectively saving repeated rounds in the recovery strategy.

[0040] 2. Model update compression design: The model update compression strategy proposed in this invention further aggregates and statically clusters historical model updates in the window-based storage strategy, thus completing the function of historical model update compression storage from two perspectives: saving historical rounds and saving historical model updates.

[0041] 3. Adaptive Recovery Strategy: This invention explores the impact of different recovery architectures on different types of attacks. For potential untargeted attacks, the improved streamlined recovery architecture effectively enhances the accuracy of the main task of the final global model after recovery. At the same time, for potential targeted attacks, the improved crab-style recovery architecture effectively utilizes the recovery information provided by historical model updates to improve the accuracy of the main task of the recovery model while reducing the accuracy of the target task. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0043] Figure 1 A flowchart illustrating the model poisoning recovery method in a federated learning scenario provided in this embodiment of the invention. Detailed Implementation

[0044] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0045] This invention provides a method for recovering a poisoned model in a federated learning scenario, such as... Figure 1 As shown, it includes three main steps: window partitioning, update compression, and rollback recovery.

[0046] S1. Window Partitioning: The concept of windows is introduced first, dividing the entire federated training process into multiple windows, with a high window density in the earlier training rounds and a low window density in the later training rounds.

[0047] Specifically, in step S1, the threshold for each window division... It is adaptive, calculated based on the similarity within the current window. The specific calculation formula is as follows:

[0048]

[0049] in, This represents the CosineSimilarity value between the global model being iterated over and the first global model in the current window, where m represents the iteration number. This indicates the current window size; that is, if the current frame is... The value is lower than the current window value. Average at round If the value is zero, it means that a new window needs to be created and the current historical global model needs to be aggregated and saved, as shown in the following formula:

[0050]

[0051] This formula represents the first... The first global model within the window To the The last global model within the window Aggregate and save to Saved as a global model for the window.

[0052] Furthermore, the global model in this round is relative to the first historical model in the current window. The formula for calculating the similarity (cs) between them is as follows:

[0053]

[0054]

[0055] in, Indicates the current The global model of rounds, This represents the first global model in the current window. This represents the total number of parameters that the local model update has.

[0056] S2, Update Compression: Cluster and store all client models involved in training in windows for later recovery.

[0057] Once the window partitioning is complete, the model needs to be updated, compressed, and saved immediately based on the window partitioning results. Specifically, the model updates submitted by all clients participating in training within the current window are aggregated, and all aggregation results are clustered and saved to further reduce the required storage overhead, as shown in the following formula:

[0058]

[0059] in Indicates for window Internal Client The aggregation model used for storage updates. Display window Internal Client All uploaded model updates; at this point, obtain the collection of historical model updates. .

[0060] Furthermore, the historical model update set is statically clustered and stored, divided into... There are several classes, as shown in the following formula:

[0061]

[0062] thus The model that needs to be saved in the window needs to be updated. The required storage overhead is from Descending to ,in Represents the total number of windows and satisfies and .

[0063] S3. Rollback and Recovery: The server performs an adaptive rollback strategy by detecting attack-related information provided by the defense methods.

[0064] Finally, the recovery process needs to be completed by invoking the corresponding recovery strategy based on the attack-related information provided by the detection and defense methods. For the recovery of targeted poisoning attacks, the traditional crab-style recovery strategy, which has a superior recovery effect for targeted poisoning attacks, is used to complete the model update recovery and the global model recovery, as shown in the following formula:

[0065]

[0066] in Indicates corresponding to The retrained model is updated. Indicates the learning rate. This indicates the federated learning aggregation method.

[0067] For recovery from indiscriminate poisoning attacks, borrow the saved data for each window. Internal dimensions An improved streamlined recovery strategy was completed, which optimized the recovery algorithm and eliminated the requirement for retraining the streamlined recovery architecture in each round, as shown in the following formula:

[0068]

[0069] in, Indicates corresponding to The retrained model is updated. Indicates the improved learning rate. This indicates the federated learning aggregation method. This represents a list that stores all window sizes.

[0070] This invention provides a specific embodiment, in which the efficiency of the recovery strategy and the accuracy of the final global model are experimentally demonstrated during testing. The specific steps include:

[0071] Step 1: Before starting the experiment, define the specific implementation scenarios. First, the federated training architecture constructed in this proposal will be tested in two different federated training scenarios: cross-silo and cross-device, with a total of 50 training rounds and 3 fixed rounds of local model training, where the total number of participating clients is 10 and 100. The selected datasets include MNIST, FMNIST, and Cifar10. A Dirichlet distribution will be used to simulate the actual data distribution scenario of the clients, dividing the training set in the dataset into 10 and 100 parts according to the number of clients, with a training batch size of 64.

[0072] Step 2: Set a fixed 20% of the participating clients to be malicious attackers. Specifically, we set attackers to be able to launch two different types of attacks: random attacks without a target, which are obviously highly destructive and denial-of-service, and targeted backdoor attacks, which are obviously covert.

[0073] Step 3: To ensure the effectiveness of the recovery strategy and adapt to different real-world scenarios, we set hyperparameters. The values ​​for untargeted attacks and targeted attacks are 0.3 and 0.98 respectively, while the value is fixed. It is 5.

[0074] Step 4: Demonstrate the relative advantages of this proposal by measuring the runtime latency, storage usage, and accuracy of the main task and the target task in the face of targeted attacks.

[0075] To verify the accuracy of the method of this invention, adversarial experiments were conducted on Cifar10, MNIST, Fmnist datasets and in IID, noIID (β=5), noIID (β=0.5) and cross-silo and cross-device federated scenarios, including random untargeted attacks and backdoor targeted attacks. The results showed that the accuracy of the main task was improved by up to 74% compared to existing recovery strategies, and the accuracy of the target task was reduced by up to nearly 10% compared to existing recovery strategies.

[0076] Under the same experimental conditions, compared with other existing recovery methods, the method of this invention reduces the latency overhead by up to 17.9 times, which is far superior to the traditional approximate estimation model update method. We speculate that this is due to the unsatisfactory prediction effect of the traditional approximate estimation model update method and the time cost of the recovery algorithm itself.

[0077] Under the same experimental conditions, on average, compared with other existing recovery methods, the method of this invention reduces storage usage by 86.09% in cross-device scenarios and by at least 40% in cross-silo scenarios.

[0078] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. However, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for recovering a poisoned model in a federated learning scenario, characterized in that, Includes the following steps: S1. Window partitioning: The concept of windowing is introduced first, and the entire federated training process is divided into multiple windows, with a large window density in the early training rounds and a small window density in the later training rounds. S2, Update Compression: Cluster and store all client models involved in training in units of windows for later recovery; S3. Rollback and Recovery: The server performs an adaptive rollback strategy by detecting attack-related information provided by the defense methods.

2. The model poisoning recovery method in a federated learning scenario according to claim 1, characterized in that, In step S1, the threshold for each window division It is adaptive, calculated based on the similarity within the current window. The specific calculation formula is as follows: ， in, This represents the Cosine Similarity value between the global model iterated to and the first global model in the current window, where m represents the iteration number. This indicates the current window size; that is, if the current frame is... The value is lower than the current window value. average at rounds If the value is zero, it means that a new window needs to be created and the current historical global model needs to be aggregated and saved, as shown in the following formula: ， This formula represents the first... The first global model within the window To the The last global model within the window Aggregate and save to Saved as a global model for the window.

3. The model poisoning recovery method in a federated learning scenario according to claim 2, characterized in that, The global model in this round is relative to the first historical model in the current window. The formula for calculating the similarity (cs) between them is as follows: ， in, Indicates the current The global model of rounds, This represents the first global model in the current window. This represents the total number of parameters in each global model.

4. The model poisoning recovery method in a federated learning scenario according to claim 1, characterized in that, In step S2, the model updates submitted by all clients participating in training within the current window are aggregated, and all aggregation results are clustered and saved to further reduce the required storage overhead, as shown in the following formula: ， in Indicates for window Internal Client The aggregation model used for storage is updated. Display window Internal Client All uploaded model updates; at this point, obtain the collection of historical model updates. .

5. The model poisoning recovery method in a federated learning scenario according to claim 1, characterized in that, In step S2, the historical model update set is statically clustered and saved, and divided into... There are several classes, as shown in the following formula: ， thus The model that needs to be saved in the window needs to be updated. The required storage overhead is from Descending to ,in Represents the total number of windows and satisfies and .

6. The model poisoning recovery method in a federated learning scenario according to claim 1, characterized in that, In step S3, for the recovery of targeted poisoning attacks, the traditional crab-style recovery strategy is used to achieve better recovery results for targeted poisoning attacks, thus completing the model update recovery and the global model recovery, as shown in the following formula: ， ， in Indicates corresponding to The retrained model is updated. Indicates the learning rate. This indicates the federated learning aggregation method.

7. The model poisoning recovery method in a federated learning scenario according to claim 1, characterized in that, In step S3, for the recovery of untargeted poisoning attacks, the saved data for each window is used. Internal dimensions An improved streamlined recovery strategy was completed, which optimized the recovery algorithm and eliminated the requirement for retraining the streamlined recovery architecture in each round, as shown in the following formula: ， ， in, Indicates corresponding to The retrained model is updated. Indicates the improved learning rate. This indicates the federated learning aggregation method. This represents a list that stores all window sizes.

Images