Federal learning model attack method and device, electronic equipment and storage medium

Abstract

The invention provides a federated learning model attack method and device, electronic equipment and a storage medium, and the method comprises the steps: extracting a symbol vector and an absolute value vector of an original model parameter vector, and carrying out the descending sorting of all elements in the absolute value vector; determining norm constraint loss according to each element ranked in the first N and a preset target norm value, and updating each element by adopting a gradient descent method based on the norm constraint loss; mapping each updated element to a corresponding position of a preset all-zero vector, and recovering a symbol of each element according to a symbol vector to obtain a first substitution model parameter vector of the original model parameter vector; the cosine similarity between the first substitute model parameter vector and the original model parameter vector is greater than or equal to a preset threshold value; and uploading the first substitution model parameter vector to a federal learning server for global model updating. According to the method, the convergence of the federal learning model can be effectively destroyed on the premise of keeping high concealment.

Description

Technical Field

[0001] This invention relates to the field of federated learning technology, and in particular to a method, apparatus, electronic device, and storage medium for attacking federated learning models. Background Technology

[0002] Federated learning employs a distributed collaborative training architecture, enabling multiple participants to jointly optimize machine learning models without sharing local raw data, providing a feasible path for joint modeling in privacy-sensitive scenarios. However, the non-independent and identically distributed nature of data in real-world environments, along with the presence of potentially malicious nodes, presents federated learning systems with multiple security challenges. Among these, model attacks, by directly tampering with gradient updates or local model weights, aim to reduce global model accuracy or implant backdoors, severely compromising the usability and security of federated learning.

[0003] In the field of federated learning security, existing defense mechanisms are mainly built around robust aggregation methods, such as the Krum algorithm which filters updates based on distance metrics, FLTrust which uses cosine similarity to detect directional consistency, and FLAME which combines clustering and noise injection to identify anomalies. However, existing model attacks (such as gradient ascent and sign flipping) usually target only a single detection dimension, making it difficult to simultaneously satisfy both directional alignment and amplitude consistency. For example, large parameter perturbations are easily detected by norm-based defenses, while simple direction forgery is unlikely to generate sufficient destructive power, resulting in a low success rate of attacks against composite defense mechanisms.

[0004] Therefore, how to provide a method that can simultaneously circumvent direction and magnitude detection mechanisms and effectively disrupt the convergence of federated learning models while maintaining high concealment has become an urgent problem to be solved in this field. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for attacking federated learning models, in order to solve the technical problem of how to effectively disrupt the convergence of federated learning models while maintaining high stealth.

[0006] This invention provides a method for attacking federated learning models, comprising: Obtain the original model parameter vector generated by the federated learning client during local training, extract the sign vector and absolute value vector of the original model parameter vector, and sort the elements in the absolute value vector in descending order. The norm constraint loss is determined based on the top N elements and the preset target norm value, and the elements are updated using gradient descent based on the norm constraint loss; N is a positive integer and is less than the dimension of the original model parameter vector. The updated elements are mapped to their corresponding positions in a preset all-zero vector, and the signs of the elements are restored according to the sign vector to obtain a first alternative model parameter vector of the original model parameter vector; the cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to a preset threshold. The parameter vector of the first alternative model is uploaded to the federated learning server for global model update.

[0007] According to the federated learning model attack method provided by the present invention, the target norm value includes sub-target values ​​corresponding to each order of P norm; The step of determining the norm constraint loss based on the top N elements and the preset target norm value includes: Calculate the p-norm of each of the elements; Calculate the squared difference between the p-norm and the corresponding sub-target value; The norm constraint loss is obtained by summing the squared differences corresponding to each p-norm.

[0008] According to the federated learning model attack method provided by the present invention, the step of updating each element using gradient descent based on the norm-constrained loss includes: Calculate the gradient of the norm-constrained loss with respect to each element; Calculate the product of the gradient of each element and the preset learning rate; The updated elements are obtained by subtracting the product from the elements before the update.

[0009] According to the federated learning model attack method provided by the present invention, after updating each element using gradient descent based on the norm-constrained loss, and before mapping the updated elements to the corresponding positions of a preset all-zero vector, the method further includes: If the updated top N elements are less than zero, then set the top N elements that are less than zero to zero.

[0010] According to a federated learning model attack method provided by the present invention, the cosine similarity between the second alternative model parameter vector and the original model parameter vector is less than the preset threshold, and the second alternative model parameter vector is obtained based on the top N-1 elements.

[0011] According to the federated learning model attack method provided by the present invention, before obtaining the original model parameter vector generated by the federated learning client during local training, extracting the sign vector and absolute value vector of the original model parameter vector, and sorting the elements in the absolute value vector in descending order, and before determining the norm constraint loss based on the top N elements and a preset target norm value, and updating the elements using a gradient descent method based on the norm constraint loss, the method further includes: Initialize k=0; The process is repeated iteratively until N = nk, where n is the dimension of the original model parameter vector: The current alternative model parameter vector is obtained based on the top nk elements of the original model parameter vector. If the cosine similarity between the current alternative model parameter vector and the original model parameter vector is greater than or equal to the preset threshold, then let k = k + 1.

[0012] The present invention also provides a federated learning model attack apparatus, comprising: The first module is used to obtain the original model parameter vector generated by the federated learning client during local training, extract the sign vector and absolute value vector of the original model parameter vector, and sort the elements in the absolute value vector in descending order. The second module is used to determine the norm constraint loss based on the top N elements and the preset target norm value, and to update the elements using the gradient descent method based on the norm constraint loss; N is a positive integer and is less than the dimension of the original model parameter vector. The third module is used to map the updated elements to the corresponding positions of the preset all-zero vector, and to recover the signs of the elements according to the sign vector to obtain the first alternative model parameter vector of the original model parameter vector; the cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to a preset threshold. The fourth module is used to upload the first alternative model parameter vector to the federated learning server for global model updates.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the federated learning model attack methods described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the federated learning model attack method as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the federated learning model attack methods described above.

[0016] The federated learning model attack method, apparatus, electronic device, and storage medium provided by this invention ensure the high deceptiveness of the model attack parameter vector in direction through cosine similarity constraints and ensure the statistical normality of the model attack parameter vector in amplitude through norm constraints. Thus, it can simultaneously evade dual defense detection based on direction and amplitude, has strong concealment, and can effectively reduce the model convergence speed or prevent the model from converging. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the federated learning model attack method provided by the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the principle of the federated learning model attack method provided by this invention.

[0020] Figure 3 This is a schematic diagram of the structure of the federated learning model attack device provided by the present invention.

[0021] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] Here, we will first further introduce the background technology of this invention.

[0024] In a typical federated learning architecture, a central server coordinates the training process, distributes the global model, and aggregates parameter updates submitted by each client. In a fully decentralized deployment, participants exchange and integrate model updates directly through peer-to-peer communication, gradually approaching the global optimum through multiple rounds of communication. However, the non-independent and identically distributed nature of data in real-world environments, along with the existence of potentially malicious nodes, presents multiple security challenges to federated learning systems.

[0025] Attacks are one of the main threats in federated learning and can be divided into two main categories: data attacks that manipulate training samples and model attacks that directly tamper with gradient updates or local model weights. During the local training phase, malicious clients may strategically deploy these attacks, either by polluting the training data to carry out data attacks or by injecting biased parameters to carry out model attacks.

[0026] Data attacks involve malicious clients manipulating local training data by means of system misclassification (such as label flipping based on a preset class permutation matrix) or adversarial perturbation injection to maintain sample perceptibility, ultimately leading to a decrease in global model accuracy or training non-convergence. Among them, backdoor attacks are particularly covert. This attack implants hidden triggers in the model, so that when activated, it can produce the output specified by the attacker, while maintaining normal performance on clean data. This covertness and targeting make backdoor attacks more difficult to detect than non-targeted attacks. Advanced backdoor techniques enhance covertness through malicious-benign update hybrid or distributed trigger deployment, specifically including: (1) training a clean model and a backdoor model separately, and then generating a hybrid model by parameter weighted averaging; (2) constrained scaling backdoors by adding to the objective function Norm penalty term, while minimizing the loss of a specific task, limits the deviation between the parameters of the malicious model and the benign model, thereby optimizing the malicious model; (3) Distributed backdoors distribute different trigger fragments to colluding clients, and combine them into a complete trigger pattern through model aggregation. These implementation schemes retain the core attack mechanism, while simplifying the synchronization protocol and reducing the risk of being detected in the aggregation stage.

[0027] Model attacks manipulate gradients or model updates through geometric transformations of the parameter space. For example, gradient ascent attacks intentionally reverse the gradient direction by applying a sign inversion operator in the local optimization step to maximize the curvature of the loss function. Norm attacks manipulate gradients by perturbing them. The aggregation rules based on norms ensure that Byzantine gradients are selected during the aggregation process. Median shift and Krum median shift attacks construct malicious updates using Gaussian distribution parameters. While maintaining the original variance, their mean is maximized relative to the standard deviation of benign parameters, thus subtly distorting the aggregation process.

[0028] In the field of federated learning security, existing defense mechanisms are mainly built around robust aggregation methods, aiming to identify and defend against attacks launched by malicious clients. These technologies can be divided into two development stages: classic solutions and novel frameworks.

[0029] In classic defense schemes, Geo-Median effectively reduces the impact of outliers on the global model by calculating the geometric median of updated parameters. The Krum algorithm uses a distance metric to select client updates with the smallest overall distance to other updates. The Trimmed-means method, through statistical analysis, directly removes extreme updates with the largest deviations before aggregation. These methods lay the foundation for the basic framework of federated learning security defense.

[0030] The new generation of defense mechanisms has made significant innovations based on classic schemes. FLTrust proposes a trust-weighted aggregation framework that enhances defense capabilities through a dual detection mechanism: first, it calculates the cosine similarity between the client's update and the server's reference gradient, and then dynamically assigns aggregation weights based on the similarity result. This innovation provides a new technical approach for Byzantine-robust federated learning. The FLAME framework introduces clustering-based filtering techniques and, combined with noise injection methods, establishes an anomaly model identification mechanism. The DFLDual scheme further develops the dual-domain client clustering method, achieving the detection and exclusion of malicious clients through a trust bootstrapping mechanism.

[0031] Classic aggregation schemes suffer from a fundamental flaw due to their reliance on prior knowledge, resulting in significantly weakened protection against sophisticated and meticulously crafted attacks. While newer defense frameworks offer innovations in detection mechanisms, they each possess key weaknesses: FLTrust's dependence on clean server-side datasets limits its applicability in real-world scenarios; FLAME's defense scope is limited to backdoor attacks, lacking comprehensive protection capabilities; and methods like DFLDual, which rely on similarity metrics, are susceptible to being deceived by malicious updates with high similarity scores.

[0032] The following is combined with Figures 1 to 4 This invention describes the federated learning model attack method, apparatus, electronic device, and storage medium.

[0033] Figure 1 This is a flowchart illustrating the federated learning model attack method provided by the present invention, as follows: Figure 1 As shown, the method includes, but is not limited to, steps S1, S2, S3 and S4.

[0034] Step S1: Obtain the original model parameter vector generated by the federated learning client during local training, extract the sign vector and absolute value vector of the original model parameter vector, and sort the elements in the absolute value vector in descending order.

[0035] The original model parameter vector can be the true gradient or weight vector obtained by a malicious client performing normal stochastic gradient descent training locally, used to update the global model. The original model parameter vector is a benign model parameter vector.

[0036] Mathematical operations can be used to extract sign vectors, which represent the positive or negative sign of each model parameter. Absolute value vectors represent the magnitude of each model parameter.

[0037] Sorting algorithms (such as quicksort) can be used to sort the elements in the absolute value vector in descending order of their numerical values. The purpose is to identify the key parameters (large values) that have the greatest impact on the model and the redundant parameters (small values) that have a smaller impact.

[0038] Step S2: Determine the norm constraint loss based on the top N elements and the preset target norm value, and update the top N elements using gradient descent based on the norm constraint loss; N is a positive integer and is less than the dimension of the original model parameter vector.

[0039] The top N elements are the N elements with the largest magnitudes in the absolute value vector, and these N elements carry the main information for model updates.

[0040] Norm-constrained loss is an optimization objective function used to measure the difference between the statistical distribution of N elements and a benign distribution (target norm value). Gradient descent involves calculating the gradient of the loss function with respect to these N elements and iteratively adjusting the values ​​of the N elements along the reverse direction of the gradient until the norm characteristics of the N elements approach the preset target. Determining the norm-constrained loss based on the N elements and the target norm value, and then using gradient descent based on the norm-constrained loss to update the N elements, is equivalent to imposing a norm constraint on the update of the N elements. This allows control over the magnitude of the model update and avoids defense schemes based on outlier detection.

[0041] Step S3: Map each updated element to the corresponding position of the preset all-zero vector, and restore the sign of each element according to the sign vector to obtain the first alternative model parameter vector of the original model parameter vector; the cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to the preset threshold.

[0042] The all-zero vector is a vector with all elements equal to 0, sharing the same dimensions as the original model parameter vector. The first alternative model parameter vector is the model attack parameter vector. Restoring the sign ensures that the orientation of the model attack parameter vector in the principal dimensions is consistent with that of the benign model parameter vector.

[0043] For example, assuming the original model parameter vector is [-4, 3, 1, 2] and N=3, the sign vector is [-, +, +, +] and the absolute value vector is [4, 3, 1, 2]. The top N elements are 4, 3, and 2. Assuming the updated top N elements are 4.01, 3.01, and 2.01, after mapping each updated element to the corresponding position of the preset all-zero vector, we get [4.01, 3.01, 0, 2.01]. After restoring the sign of each element according to the sign vector, we get the first alternative model parameter vector [-4.01, 3.01, 0, 2.01].

[0044] Cosine similarity is an index used to measure the degree of similarity between two vectors in direction. Its value range is [-1, 1], and it is obtained by calculating the cosine of the angle between the two vectors. The closer the cosine similarity is to 1, the more consistent the directions of the two vectors are. In federated learning defense, servers often use it to evaluate whether a client's update is consistent with the direction of a trusted update (such as an update calculated by the server itself), thereby determining whether the client is suspicious.

[0045] The cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to a preset threshold (usually set according to the tolerance of the defense system, such as 0.9). This cosine similarity constraint on the model attack parameter vector can ensure that the model attack parameter vector is consistent with the benign model parameter vector in direction, maintain the alignment of the model update direction, and deceive the defense system's detection mechanism based on direction consistency.

[0046] Understandably, this invention sets model parameters with smaller absolute values ​​to zero and updates model parameters with larger absolute values ​​with the goal of aligning the direction of the attack parameter vector with that of the benign model parameter vector. This achieves sparsity processing of model parameters. On the one hand, it can significantly change the model structure; on the other hand, since the least important parameters are removed, the impact on the normal function of the model is relatively small, thus helping the attack remain covert. Model parameters can be perturbed while maintaining model functionality. The number of model parameters set to zero can be changed by setting N. The more model parameters set to zero, the easier it is to expose the attack and the greater the attack strength; the fewer model parameters set to zero, the more covert the attack and the lower the attack strength.

[0047] Step S4: Upload the first alternative model parameter vector to the federated learning server for global model update.

[0048] Finally, the disguised attack model parameter vector is uploaded to the server, replacing the benign model parameter vector that the client should have submitted during the aggregation phase. Although the first substitute model parameter vector has been maliciously modified numerically, it is still highly similar to the benign model parameter vector in direction and magnitude. This allows it to be disguised as a normal update to bypass detection, thereby reducing the model's convergence speed and forcing the model to require more rounds to reach the expected accuracy; or, more extremely, completely preventing the model from converging, making it unable to learn effective patterns, ultimately causing the global model to fail.

[0049] Defense mechanisms based on cosine similarity and those based on Norm distance constitutes the main defense paradigm of current federated learning. This invention ensures the high deceptiveness of the model attack parameter vector in direction through cosine similarity constraint and ensures the statistical normality of the model attack parameter vector in amplitude through norm constraint. Thus, it can simultaneously avoid dual defense detection based on direction and amplitude, which has strong concealment and can effectively reduce the model convergence speed or prevent the model from converging.

[0050] In one embodiment, the target norm value of the present invention may include sub-target values ​​corresponding to each order of P norm; In step S2, determining the norm constraint loss based on the top N elements and the preset target norm value can further include: Calculate the p-norm of each element; Calculate the squared difference between the p-norm and the corresponding sub-target value; The norm constraint loss is obtained by summing the squared differences corresponding to each p-norm.

[0051] The target norm can be a set containing multiple p-norms of different orders (e.g., L1 norm, L2 norm, etc.) of the benign model parameter vector or other reference vector.

[0052] First, for the variables in the current optimization process (i.e., the vector consisting of the top N elements), calculate their current p-norm. Then, calculate and square the difference between the current p-norm and the target sub-objective value. Squaring is used to eliminate positive and negative differences and to impose a larger penalty on larger deviations. Finally, sum the squared differences for all orders to obtain the norm-constrained loss. This loss function quantifies the overall deviation of the attack vector from the benign vector in terms of statistical shape. Norm-Constrained Loss The calculation formula is as follows: ; in, Let N be the vectors consisting of the top N elements. Let p be the i-th order p norm. Let be the sub-target value corresponding to the i-th order p-norm.

[0053] This invention constructs a composite loss function by introducing a multi-order p-norm (e.g., simultaneously constraining L1 and L2 norms), enabling the identification of statistical features of the attack vector from multiple dimensions. This ensures that the generated model attack parameter vector not only matches the benign vector in energy (L2) but also closely fits its distribution density (L1). This deep statistical camouflage renders malicious updates indistinguishable from normal updates to various distance-based defense algorithms, significantly enhancing the survivability and stealth of attacks.

[0054] In one embodiment, step S2, updating each element using gradient descent based on norm-constrained loss, may further include: Calculate the gradient of the norm-constrained loss with respect to each element; Calculate the product of the gradient of each element and the preset learning rate; The updated elements are obtained by subtracting the product from the elements before the update.

[0055] Gradient descent moves each element along the direction of the steepest descent of the loss function, iteratively approaching the optimal solution that satisfies the target norm. Employing gradient-based numerical optimization methods, it can efficiently and accurately handle complex nonlinear norm-constrained problems. Regardless of the stringency of the target norm requirement, gradient descent guides the parameters to find a local optimum in multidimensional space, ensuring that the statistical indices of the attack vector precisely align with the target value. This method is computationally efficient and suitable for running on resource-constrained federated learning clients, guaranteeing the real-time nature and feasibility of the attack.

[0056] In one embodiment, after updating each element using gradient descent with norm-constrained loss, and before mapping the updated elements to the corresponding positions of a preset all-zero vector, the method of the present invention may further include: If the updated top N elements are less than zero, then set the top N elements that are less than zero to zero.

[0057] In physics and mathematics, each element of an absolute value vector represents the magnitude of a model parameter and must be non-negative (≥0). However, during gradient descent updates (i.e., subtracting the gradient product), due to the directionality of the gradient, the values ​​of some elements may be reduced to less than zero. Without handling, these negative values ​​will cause a reversal of direction when subsequently combined with the sign vector, disrupting the expected cosine similarity. Therefore, setting the top N elements less than zero to zero can forcibly correct logical errors caused by numerical calculations, ensuring that the optimization variables always remain within their valid domain.

[0058] This invention introduces a nonnegativity constraint to ensure the mathematical rigor of the optimization process. It guarantees that the N elements are always valid magnitude representations, thus ensuring the correctness of the subsequent sign recovery step. This step is crucial for maintaining high cosine similarity and is a necessary condition for the attack algorithm to generate effective and covert model attack parameter vectors.

[0059] In one embodiment, the cosine similarity between the second alternative model parameter vector and the original model parameter vector is less than a preset threshold, and the second alternative model parameter vector is obtained based on the top N-1 elements.

[0060] The attack process of this invention is an iterative process of finding the optimal sparsity (i.e., the optimal N value). The first alternative model parameter vector refers to the model attack parameter vector generated based on the first N elements, which satisfies the cosine similarity requirement. The second alternative model parameter vector is the model attack parameter vector obtained based on the first N-1 elements. Here, N-1 means fewer retained model parameters than N, i.e., higher sparsity (more model parameters are set to zero). As the number of retained parameters decreases (sparseness increases), the cosine similarity between the model attack parameter vector and the original model parameter vector monotonically decreases. When the algorithm attempts to further reduce the number of retained parameters to N-1, the cosine similarity corresponding to the generated second alternative model parameter vector falls below the preset threshold, indicating that retaining N-1 model parameters is no longer sufficient to maintain the directional consistency of the vector, which easily triggers the alarm of the defense system.

[0061] This invention, by comparing the parameter vectors of a first alternative model (meeting the threshold) and a second alternative model (not meeting the threshold), enables the algorithm to accurately pinpoint the critical point. This proves that the first alternative model parameter vector represents the attack vector with the highest sparseness achievable without triggering a defense alarm. This ensures that attackers can launch maximum attacks at the edge of the defense system's tolerance limits, achieving an optimal balance between attack strength and stealth.

[0062] In one embodiment, after step S1 and before step S2, the method of the present invention may further include: Initialize k=0; The process is repeated iteratively until N = nk, where n is the dimension of the original model parameter vector: The current alternative model parameter vector is obtained based on the top nk elements of the original model parameter vector. If the cosine similarity between the current alternative model parameter vector and the original model parameter vector is greater than or equal to a preset threshold, then let k = k + 1.

[0063] This invention provides an algorithm for finding the optimal value of N.

[0064] Initialization: Set k=0. k represents the number of model parameters set to zero, and the number of model parameters retained is N=nk. In the initial state, k=0 means that all model parameters are retained. At this time, the replacement model parameter vector is the original model parameter vector itself, and the cosine similarity is 1.

[0065] Iterative process: Establish a loop with the condition N = nk. In each iteration: Generate the parameter vector of the current alternative model: Based on the current k value, select the top nk elements and generate the parameter vector of the alternative model through norm constraint optimization, sign recovery and other steps.

[0066] Judgment and Increment: Calculate the cosine similarity between the alternative model parameter vector and the original model parameter vector. If it is greater than or equal to a preset threshold, it means that the current sparsity is safe, so let k = k + 1. That is, try to remove the smallest model parameter.

[0067] Termination and rollback: The iteration continues until the cosine similarity of a generated vector is less than a preset threshold. At this point, the loop terminates, and the algorithm returns the result of the previous successful iteration, which is the vector corresponding to k-1 or the first N elements.

[0068] This invention provides a greedy search strategy that does not require prior knowledge of the model's specific distribution. Instead, it dynamically iterates, tentatively and gradually increasing the attack strength (increasing the k-value). This mechanism gives the attack algorithm extremely strong adaptability and robustness. Regardless of the training stage or the distribution of model parameters, the algorithm can always automatically find the most effective attack scheme (i.e., the maximum k-value) that can pass the defense detection in the current state, thereby continuously and stably outputting high-quality attack updates throughout the entire federated learning lifecycle.

[0069] Based on the above, we can conclude that... Figure 2 The schematic diagram shown below illustrates the principle, and the complete algorithm of this invention is as follows: Input: Original model parameter vector Preset threshold Target range value Learning rate Maximum number of iterations ; Output: Alternative model parameter vector ; ; / / extract The symbol vector s; / / Get absolute value vector ; / / Sort by absolute value in descending order; : / / Retrieve previous The element with the largest absolute value; initialization ; : / / Calculate the norm constraint loss; / / Gradient descent update; / / Ensure non-negativity; / / Initialize the all-zero vector ; Will Map back The corresponding position in; / / Restore the signs of the preserved model parameters; / / Calculate cosine similarity ; Return to the previous valid round Values ​​and their corresponding alternative model parameter vectors ; ; ; ; / / If no feasible solution is found, return the original vector.

[0070] The following section provides some theoretical proof of the present invention, demonstrating that the technical solution of the present invention can be realized.

[0071] Theorem 1: Consider the following optimization problem: The constraints are satisfied: in , If the objective norm is given, then the optimization problem is solvable, meaning there exists at least one local minimum. This is sufficient for the application of this invention.

[0072] Proof: First, note the objective function about It is continuously differentiable. Although the function may be non-convex, standard gradient-based optimization methods can still be used to find local minima.

[0073] The objective function is about The gradient is calculated as follows: To solve Follow these steps. Then there is .then, Therefore, the gradient of the objective function is: Given Furthermore, since the initial value is positive, this invention can use the gradient descent method for iterative updating. After each iteration, this invention projects any possible negative components to zero to ensure that the following conditions are met. The constraints.

[0074] Although the optimization problem may be non-convex, local minima are sufficient to meet the requirements for the application scenario of this invention. In practical calculations, gradient-based optimization algorithms can effectively find such solutions, thereby helping this invention to construct an alternative model parameter vector that adequately approximates the target norm constraint. .

[0075] Theorem 2: Let It is a non-zero vector. This is the cosine similarity threshold. Assume this invention will... The components are arranged in descending order of their absolute values, and the smallest value is selected by... Set each component to zero and optimize the remaining components according to Theorem 1. Use each component to construct a vector sequence So, cosine similarity Will follow The increase is monotonically decreasing. Therefore, for all There exists a largest integer. Make: ; Proof: This invention needs to prove that with... The increase, Monotonically decreasing.

[0076] First, explicitly state the cosine similarity: ; Because when hour Therefore, the numerator and denominator can be simplified to: ; ; along with As the value increases, the number of non-zero terms increases. This corresponding decrease means that the number of terms in the summation of both the numerator and denominator is decreasing. Regarding the numerator, consider... and Differences in time. Definition: ; The differences between the two are: ; Due to the reconstruction process And with The signs are the same, therefore the product is... Therefore, we can conclude that: ; For the denominator, the present invention defines it similarly: ; because ,Will Substitution From the definition, we can obtain: ; Therefore, when the number of zeroed elements is When the cosine similarity is equal to 1, its corresponding cosine similarity can be expressed as: ; Will Substituting into the definition, according to the Cauchy-Schwarz inequality, we get: ; When When one component is set to zero, the present invention has and This means: ; Therefore, cosine similarity satisfies: ; In summary, this invention concludes that: with The increase, Monotonically decreasing. Because... Get the maximum value and follow Since the integers increase while decreasing, there must exist a largest integer that satisfies the condition in Theorem 2. .

[0077] In summary, the advantages of this invention are as follows: (1) Existing attacks mostly target a single detection dimension, while this invention avoids attacks based on cosine similarity and... The composite defense based on norms can significantly improve the success rate of attacks.

[0078] (2) Traditional attacks are easily detected due to excessive parameter perturbation. This invention uses parameter sparsity technology to juxtapose key parameters with small perturbations and zero redundant parameters, which can better maintain the statistical characteristics of the model.

[0079] (3) The present invention can balance attack strength and concealment by dynamically adjusting the preset threshold and the number of zeroed model parameters, and adapt to different defense environments.

[0080] (4) Compared with the explosive destruction of traditional attacks, the present invention can adopt a progressive attack strategy, slowly injecting malicious updates in multiple rounds of training to avoid triggering abnormal alarms.

[0081] (5) This invention does not depend on specific model structures or dataset features and can be widely applied to various federated learning scenarios, with better universality and transferability.

[0082] The following describes the federated learning model attack apparatus provided by the present invention. The federated learning model attack apparatus described below can be referred to in correspondence with the federated learning model attack method described above.

[0083] like Figure 3 As shown, the federated learning model attack apparatus provided by the present invention includes: The first module is used to obtain the original model parameter vector generated by the federated learning client during local training, extract the sign vector and absolute value vector of the original model parameter vector, and sort the elements in the absolute value vector in descending order. The second module is used to determine the norm constraint loss based on the top N elements and the preset target norm value, and to update each element using the gradient descent method based on the norm constraint loss; N is a positive integer and is less than the dimension of the original model parameter vector. The third module is used to map each updated element to the corresponding position of the preset all-zero vector, and to restore the sign of each element according to the sign vector to obtain the first alternative model parameter vector of the original model parameter vector; the cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to the preset threshold. The fourth module is used to upload the parameter vector of the first alternative model to the federated learning server for global model updates.

[0084] Figure 4The diagram illustrates the physical structure of an electronic device, which may include a processor, a communications interface, memory, and a communication bus. The processor, communications interface, and memory communicate with each other via the communication bus. The processor can invoke logical instructions from the memory to execute federated learning model attack methods.

[0085] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0086] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the federated learning model attack methods provided by the above methods.

[0087] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the federated learning model attack methods provided by the methods described above.

[0088] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0089] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for attacking a federated learning model, characterized in that, include: Obtain the original model parameter vector generated by the federated learning client during local training, extract the sign vector and absolute value vector of the original model parameter vector, and sort the elements in the absolute value vector in descending order; The norm constraint loss is determined based on the top N elements and the preset target norm value, and the elements are updated using the gradient descent method based on the norm constraint loss. N is a positive integer and is less than the dimension of the original model parameter vector; The updated elements are mapped to their corresponding positions in a preset all-zero vector, and the signs of the elements are restored according to the sign vector to obtain a first alternative model parameter vector of the original model parameter vector; the cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to a preset threshold. The parameter vector of the first alternative model is uploaded to the federated learning server for global model update.

2. The federated learning model attack method according to claim 1, characterized in that, The target norm value includes the sub-target value corresponding to each order of P norm; The step of determining the norm constraint loss based on the top N elements and the preset target norm value includes: Calculate the p-norm of each of the elements; Calculate the squared difference between the p-norm and the corresponding sub-target value; The norm constraint loss is obtained by summing the squared differences corresponding to each p-norm.

3. The federated learning model attack method according to claim 1, characterized in that, The step of updating each element using gradient descent based on the norm-constrained loss includes: Calculate the gradient of the norm-constrained loss with respect to each element; Calculate the product of the gradient of each element and the preset learning rate; The updated elements are obtained by subtracting the product from the elements before the update.

4. The federated learning model attack method according to claim 1, characterized in that, After updating each element using gradient descent based on the norm-constrained loss, and before mapping the updated elements to the corresponding positions of the preset all-zero vector, the method further includes: If the updated top N elements are less than zero, then set the top N elements that are less than zero to zero.

5. The federated learning model attack method according to claim 1, characterized in that, The cosine similarity between the second alternative model parameter vector and the original model parameter vector is less than the preset threshold. The second alternative model parameter vector is obtained based on the top N-1 elements.

6. The federated learning model attack method according to claim 5, characterized in that, The steps include: obtaining the original model parameter vector generated by the federated learning client during local training; extracting the sign vector and absolute value vector of the original model parameter vector; sorting the elements in the absolute value vector in descending order; determining the norm constraint loss based on the top N elements and the preset target norm value; and updating the elements using gradient descent based on the norm constraint loss. Initialize k=0; The process is repeated iteratively until N = nk, where n is the dimension of the original model parameter vector: The current alternative model parameter vector is obtained based on the top nk elements of the original model parameter vector. If the cosine similarity between the current alternative model parameter vector and the original model parameter vector is greater than or equal to the preset threshold, then let k = k + 1.

7. A federated learning model attack device, characterized in that, include: The first module is used to obtain the original model parameter vector generated by the federated learning client during local training, extract the sign vector and absolute value vector of the original model parameter vector, and sort the elements in the absolute value vector in descending order. The second module is used to determine the norm constraint loss based on the top N elements and the preset target norm value, and to update the elements using the gradient descent method based on the norm constraint loss. N is a positive integer and is less than the dimension of the original model parameter vector; The third module is used to map the updated elements to the corresponding positions of the preset all-zero vector, and to recover the signs of the elements according to the sign vector to obtain the first alternative model parameter vector of the original model parameter vector; the cosine similarity between the first alternative model parameter vector and the original model parameter vector is greater than or equal to a preset threshold. The fourth module is used to upload the first alternative model parameter vector to the federated learning server for global model updates.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the federated learning model attack method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the federated learning model attack method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the federated learning model attack method as described in any one of claims 1 to 6.

Images