A defense method for vertical federated learning against a specific goal-forgetting attack

Abstract

The application belongs to the field of artificial intelligence security, and specifically discloses a defense method for specific target forgetting attack on vertical federated learning, which comprises the following steps: each client trains a student model by using a locally stored local data set to generate embedding features, and uploads the embedding features to a server; the server receives the embedding features from each client, calculates the gradient of the loss on the embedding features based on a preset global task loss, and generates a targeted feature according to the gradient, and distributes the targeted feature to each client; each client receives the targeted feature, and updates the student model by minimizing the feature alignment loss between the embedding features generated by the student model and the received targeted feature; when the client obtains a new data set, the client performs incremental learning by using the new data set to update the student model. The application can dynamically adapt to environmental changes and effectively resist the defense mechanism of the specific target forgetting attack with strong concealment.

Description

Technical Field

[0001] This application belongs to the field of artificial intelligence security, and more specifically, relates to a defense method against target-specific forgetting attacks on longitudinal federated learning. Background Technology

[0002] With data elements formally incorporated into the national production factor system, the demand for cross-institutional data fusion analysis and modeling in key sectors such as healthcare, finance, and government is growing at an unprecedented rate. Vertical federated learning (VFL), as an innovative distributed collaborative learning paradigm, allows multiple participants to jointly build higher-performance machine learning models without disclosing their local raw data, thanks to its unique mechanism of feature complementarity and sample alignment. By breaking down data silos, VFL has demonstrated significant application potential in scenarios such as financial joint risk control, precision medicine, and intelligent recommendation.

[0003] However, while vertical federated learning promotes data collaboration, its systemic security vulnerabilities are becoming increasingly prominent. In the VFL architecture, the participants collaborate on training by exchanging intermediate model parameters (such as gradients, embedded features, etc.), and this feature exchange link provides an opportunity for malicious attackers.

[0004] Recent research has revealed a more insidious and serious threat: forgetting attacks. These attacks cleverly exploit the federated forgetting mechanism introduced by federated learning in response to privacy regulations such as the right to be forgotten. The original intention of federated forgetting was to efficiently remove the contribution of a user's personal data to the model at their request, without retraining the model from scratch. However, malicious actors can use this process to submit carefully crafted malicious forgetting requests to the server. Their core objective is no longer simply to remove their own data, but to generate malicious feature forgetting requests by identifying the training samples most influential on the target prediction, misleading the model into excessively forgetting key information related to target samples belonging to other clients. This attack, disguised as a legitimate user data removal operation, can precisely manipulate the global model's predictive behavior for a specific target (e.g., misclassifying a high-credit customer as a low-credit customer), not only compromising the model's predictive impartiality but also posing a serious threat to data security and intellectual property rights, bringing severe challenges to the compliant implementation of the technology.

[0005] To address the aforementioned security threats, existing technologies mostly employ defense mechanisms targeting specific attacks, such as those against targeted data poisoning attacks. The common approach is anomaly detection based on statistical data distribution, identifying and filtering out outliers that introduce malicious samples. However, this statistically-based defense method has significant limitations: First, existing defenses primarily focus on traditional poisoning attacks, which are relatively easy to detect because they readily introduce data distribution anomalies. But for more covert attacks like the aforementioned forgetting attacks that don't significantly alter the statistical data distribution, the effectiveness of existing detection methods is greatly reduced. Second, most current mainstream defense technologies are limited to a static protection paradigm, where fixed defense rules (such as gradient pruning and parameter isolation) are preset before system deployment. Once the model is deployed, its defense strategy no longer adjusts with environmental changes. This rigid protection mechanism lacks sufficient adaptability and robustness when facing dynamically changing and continuously evolving targeted attacks, making it difficult to maintain overall system security in dynamic and heterogeneous trust environments.

[0006] Therefore, how to design a defense mechanism that can dynamically adapt to environmental changes and effectively resist highly concealed attacks that forget specific targets has become a key issue restricting the large-scale application and development of vertical federated learning technology. Summary of the Invention

[0007] To address the shortcomings of existing technologies, the purpose of this application is to provide a defense method against targeted forgetting attacks on vertical federated learning, a defense mechanism that can dynamically adapt to environmental changes and effectively resist highly concealed targeted forgetting attacks.

[0008] To achieve the above objectives, in a first aspect, this application provides a defense method against targeted forgetting attacks in vertical federated learning, applied to a vertical federated learning system comprising a server and multiple clients, comprising the following steps:

[0009] S10, each client uses its locally stored local dataset to train the student model to generate embedded features, and uploads the embedded features to the server; S20, the server receives embedded features from each client, calculates the gradient of the loss with respect to the embedded features based on a preset global task loss, generates targeted features based on the gradient, and sends the targeted features to each client. S30, each client receives the target features and updates its student model by minimizing the feature alignment loss between the embedded features generated by its student model and the received target features; S40, when the client obtains a new dataset, it uses the new dataset to perform incremental learning to update its student model.

[0010] As a further preferred embodiment, in step S20, the server generates the target feature based on the gradient using the following formula:

[0011] In the formula, The embedded features received by the server from the client; For the generated target features; The learning rate; The gradient of the preset global task loss with respect to the embedded features.

[0012] As a further preferred embodiment, the gradient is subjected to norm clipping and normalization before generating the target feature based on the gradient.

[0013] As a further preferred embodiment, in step S30, the formula for calculating the feature alignment loss is:

[0014] In the formula, For feature alignment loss; The number of embedded feature vectors; Embedded feature vectors generated for the student model; This refers to the target feature vector sent from the server.

[0015] As a further preferred embodiment, in step S30, the feature alignment loss uses cosine similarity as a metric.

[0016] As a further preferred embodiment, in step S30, each client updates its student model by minimizing a composite loss function, which consists of the local task loss and the feature alignment loss, and is expressed as follows:

[0017] in, Let be the composite loss function to be minimized; This is for losses incurred during local tasks, used to ensure business accuracy; This is the balance coefficient; This is the feature alignment loss.

[0018] As a further preferred option, the balance coefficient A dynamic adjustment strategy is adopted, which adjusts the model in real time based on the degree of model alignment.

[0019] As a further preferred embodiment, the dynamic adjustment strategy is based on the global average cosine similarity. The weights are calculated in real time using the following formula:

[0020] in, This represents the balance coefficient at the current moment; This is the preset upper limit of the balance coefficient; The global average cosine similarity is used to characterize the overall feature alignment of the model.

[0021] As a further preferred embodiment, in step S40, the incremental learning using the newly added dataset includes iteratively updating the newly added dataset using a cross-entropy loss function based on negative sampling, which is expressed as:

[0022] in, The loss function for incremental learning; For the newly added dataset; It is the sigmoid function; Let K be the matching score function of the model for sample x and label y; K is the number of negative samples. It is a negative sampling distribution.

[0023] Secondly, this application provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a defense method against targeted forgetting attacks on longitudinal federated learning as described in any of the above-mentioned methods.

[0024] Compared with the static defense paradigm in the prior art that mainly relies on preset fixed rules, the defense method proposed in this application has achieved significant improvements in dynamic adaptability, defense robustness, and operational efficiency. The specific effects are as follows: First, dynamic defense against continuously evolving attacks is achieved, enhancing system robustness. Addressing the limitations of existing defense methods in dealing with novel or unknown targeted attacks, this application constructs a teacher-student knowledge distillation defense framework. By utilizing the targeted features generated by the global teacher model as guiding anchors, the feature spaces of each participating student model are forced to remain consistent with the global knowledge. This mechanism can accurately identify and effectively block feature perturbations introduced by malicious attackers (such as targeted forgetting attacks), ensuring that the vertical federated learning system maintains high security and robustness even in the face of complex and ever-changing attack environments.

[0025] Secondly, it significantly improves model update efficiency and reduces computational resource consumption. This application innovatively introduces an incremental learning mechanism, overcoming the drawback of traditional defense methods that require full retraining when facing environmental changes. When the system receives new data or detects attack variants, it does not need to retrain the massive global model; it can achieve rapid model iteration and updates using only the new data. This not only greatly shortens the defense response time but also significantly reduces computational energy consumption and storage costs, making the defense economical and effective for long-term operation.

[0026] Then, the system intelligently balances business performance and defense strength, ensuring model accuracy. By designing a composite loss function with dynamic weight coefficients, this application addresses the problem that traditional defenses often sacrifice model prediction accuracy. The system can adaptively adjust defense weights based on real-time alignment status (such as cosine similarity): strengthening defense during active attack periods and focusing on business performance during stable periods. This intelligent adjustment mechanism ensures that the model maintains a high level of prediction accuracy while effectively resisting attacks, avoiding interference with normal business operations caused by excessive defense.

[0027] Finally, this application possesses broad applicability and adaptability to various scenarios. The defense method proposed in this application does not rely on specific attack type assumptions and is a general defense framework. Theoretical analysis and implementation schemes show that this method can be effectively applied to various highly sensitive scenarios such as financial joint risk control, cross-domain medical diagnosis, and government data fusion. It can effectively resist various threats, including data poisoning, model poisoning, and forgetting attacks, providing reliable security guarantees for the large-scale implementation of vertical federated learning in key areas. Attached Figure Description

[0028] Figure 1 This is a flowchart of a defense method against targeted forgetting attacks on vertical federated learning provided in an embodiment of this application; Figure 2 This is a technical block diagram of a defense method against specific target forgetting attacks in vertical federated learning provided in this application embodiment. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] Current vertical federated systems face the threat of targeted forgetting attacks, and existing static defense methods are ill-equipped to address the novelty and continuous evolution of these attacks. Therefore, this application proposes a defense method for vertical federated learning based on feature alignment and incremental learning. By constructing a collaborative architecture between a server-side teacher model and client-side student models, security defense is achieved in complex and dynamic environments. The proposed defense method employs a teacher-guided feature alignment mechanism. First, the teacher model integrates features uploaded by all participants and generates targeted features. Then, it guides the student model to optimize by minimizing feature alignment loss, ensuring its feature space aligns with global knowledge, thereby blocking the propagation of features carrying malicious perturbations. Building upon this, the system introduces an incremental learning mechanism, utilizing new data to achieve rapid model updates and iterations, solving the dynamic adaptability problem and effectively improving the security and robustness of the vertical federated learning system.

[0031] In one embodiment, the technical solution for achieving the above objective can be specifically as follows: Figure 1 and 2 As shown in this embodiment, the method for defending against targeted forgetting attacks in vertical federated learning is achieved by constructing a teacher-student knowledge distillation architecture, using a targeted feature alignment mechanism to purify malicious perturbations, and combining an incremental learning mechanism to achieve adaptive defense against dynamic environments and new types of attacks.

[0032] This implementation plan is mainly divided into four parts: system architecture design, knowledge distillation process based on targeted feature alignment, dynamic weight adjustment strategy, and incremental learning update mechanism. These will be explained in detail below.

[0033] (1) System architecture design The defense system in this embodiment is applied to a vertical federated learning scenario that includes one server and multiple participating clients. For example... Figure 2 As shown, the overall system architecture includes the following core components: Server-side (configuration of teacher model): Responsible for aggregating the embedded features uploaded by each participant, calculating the gradient using the global task loss, generating targeted features with global optimal guidance significance, and distributing them to each client.

[0034] Client (Configure Student Model): Each participant trains a student model based on local data, generates embedded features, and uploads them to the server; at the same time, it receives targeted features from the server, updates local model parameters by minimizing the alignment loss between local features and targeted features, thereby suppressing the propagation of malicious attack features.

[0035] Incremental learning module: Deployed on the server and client, when the system receives new data, it triggers an incremental update mechanism to quickly adapt to changes in data distribution without retraining the entire model.

[0036] (2) Knowledge distillation process based on targeted feature alignment The core of this method lies in using the targeted features generated by the teacher model as anchor points to force the feature space of the student model to remain consistent with global knowledge, thereby filtering out malicious noise introduced by attackers. The specific implementation steps are as follows: Step 1, Feature Generation and Upload: Each client utilizes its local dataset. Training student model Input local features Student model generates embedded features (recorded as) (Initial state), and upload this feature to the server.

[0037] Step 2, Targeted Feature Generation (Teacher Model Optimization): After receiving the embedded features uploaded by all parties, the server combines them with the global task loss. The gradient of the task loss with respect to the current embedded features is calculated through backpropagation. In order to generate targeted features that can guide the correction direction of student models. The server optimizes the features based on gradient descent, and the calculation formula is as follows: (1) in, For the currently received embedded features, For learning rate, The gradient of the embedded features is used as the task loss. This process can perform norm clipping and normalization of the gradient to enhance stability. Generated target features. It contains global optimization direction information, which is then sent back to each client.

[0038] Step 3, Feature Alignment and Model Update (Student Model Optimization): The client receives the target features. Then, by minimizing the feature alignment loss This is used to update the local student model. The scheme employs cosine similarity as a metric to maintain consistency in the direction of feature vectors.

[0039] The alignment loss function is defined as: (2) in, Embedding vectors generated for the student model The target feature vectors issued to the teacher model.

[0040] The overall optimization objective function of the client Loss due to local task and alignment loss Composed of multiple components: (3) in, Used to ensure business accuracy (such as classification cross-entropy loss). This is the balance coefficient.

[0041] (3) Dynamic weight adjustment strategy To achieve the optimal balance between defense strength and model task performance, this implementation scheme adjusts the weighting coefficients. A dynamic adjustment strategy is adopted instead of a fixed value. A larger value is set during the initial training phase or when obvious attack characteristics are detected (large alignment deviation). The value is used to force the model to quickly correct feature shifts and return to a safe state; after the model stabilizes, the value is gradually reduced. The optimization focus shifts to improving task accuracy. This scheme's adaptive adjustment strategy is based on the global average cosine similarity. Calculate weights in real time.

[0042] Its calculation formula can be defined as: (4) in, This represents the weighting coefficient value at the current moment. This is a preset upper limit for weights. When the overall alignment of the model is poor (i.e., ... When the alignment is relatively small, the λ value is automatically increased to strengthen the defense; when the alignment is good (i.e., (Approaching 1), automatically reduce the λ value to avoid over-alignment.

[0043] (4) Dynamic defense mechanism based on incremental learning To address the problem that existing static defenses cannot cope with the constantly evolving new targeted attacks, this solution introduces an incremental learning mechanism.

[0044] Triggering condition: When the client receives a newly added dataset. Updates are triggered when (e.g., when a new user record is created, or a new attack sample is found).

[0045] Optimization method: Instead of full retraining, the model utilizes a cross-entropy loss function based on negative sampling. This mechanism allows for rapid iteration. While retaining the knowledge of the original model, it quickly absorbs the features of new data.

[0046] Loss function design: Incremental update loss function Represented as: (5) in, For the sigmoid function, Let K be the matching score function of the model for sample x and label y, and K be the number of negative samples. It is a negative sampling distribution.

[0047] Through the above steps, this implementation plan constructs a complete dynamic defense closed loop: the knowledge distillation mechanism provides real-time feature layer defense to block malicious disturbances; the incremental learning mechanism provides time-dimensional defense evolution to ensure that the model can resist unknown attack variants in long-term operation.

[0048] The key technical point of this application is: 1) Knowledge Distillation Defense Mechanism Based on Targeted Feature Alignment: To block the propagation of malicious features, this application constructs a teacher-student model architecture. The server-side teacher model uses the gradient information of the global task loss to generate guiding targeted features in reverse. The client-side student model forces the locally generated embedded features to maintain directional consistency with the targeted features by minimizing the feature alignment loss based on cosine similarity. This mechanism utilizes globally optimal knowledge to calibrate the local feature space, thereby effectively identifying and filtering out malicious perturbation noise introduced by specific target forgetting attacks.

[0049] 2) Design of a composite loss function with dynamic weights: This application designs a composite objective function that includes task loss and alignment loss (Formula (3)). The key lies in the weight coefficients. The dynamic adjustment strategy (phased or adaptive adjustment) increases weights in the early or high-risk stages of defense to enhance feature correction, and decreases weights during the model stabilization period to focus on business performance. This dynamic balancing mechanism avoids training instability or over-defense caused by a single loss mechanism, achieving a dual optimization of model robustness and task accuracy.

[0050] 3) Proactive Evolutionary Defense Based on Incremental Learning: Addressing the characteristics of continuously evolving targeted attacks and dynamically changing environments, this application introduces an incremental learning mechanism. When the system receives new data, it does not need to retrain the entire model; instead, it uses a cross-entropy loss function based on negative sampling for rapid iterative updates. This mechanism enables the defense system to continuously absorb new knowledge at low computational cost, proactively adapting to data distribution shifts, thereby effectively defending against unknown or novel variants of targeted attacks.

[0051] Compared with the static defense paradigm in the prior art that mainly relies on preset fixed rules, the defense method proposed in this application has achieved significant improvements in dynamic adaptability, defense robustness, and operational efficiency. The specific effects are as follows: First, dynamic defense against continuously evolving attacks is achieved, enhancing system robustness. Addressing the limitations of existing defense methods in dealing with novel or unknown targeted attacks, this application constructs a teacher-student knowledge distillation defense framework. By utilizing the targeted features generated by the global teacher model as guiding anchors, the feature spaces of each participating student model are forced to remain consistent with the global knowledge. This mechanism can accurately identify and effectively block feature perturbations introduced by malicious attackers (such as targeted forgetting attacks), ensuring that the vertical federated learning system maintains high security and robustness even in the face of complex and ever-changing attack environments.

[0052] Secondly, it significantly improves model update efficiency and reduces computational resource consumption. This application innovatively introduces an incremental learning mechanism, overcoming the drawback of traditional defense methods that require full retraining when facing environmental changes. When the system receives new data or detects attack variants, it does not need to retrain the massive global model; it can achieve rapid model iteration and updates using only the new data. This not only greatly shortens the defense response time but also significantly reduces computational energy consumption and storage costs, making the defense economical and effective for long-term operation.

[0053] Then, the system intelligently balances business performance and defense strength, ensuring model accuracy. By designing a composite loss function with dynamic weight coefficients, this application addresses the problem that traditional defenses often sacrifice model prediction accuracy. The system can adaptively adjust defense weights based on real-time alignment status (such as cosine similarity): strengthening defense during active attack periods and focusing on business performance during stable periods. This intelligent adjustment mechanism ensures that the model maintains a high level of prediction accuracy while effectively resisting attacks, avoiding interference with normal business operations caused by excessive defense.

[0054] Finally, this application possesses broad applicability and adaptability to various scenarios. The defense method proposed in this application does not rely on specific attack type assumptions and is a general defense framework. Theoretical analysis and implementation schemes show that this method can be effectively applied to various highly sensitive scenarios such as financial joint risk control, cross-domain medical diagnosis, and government data fusion. It can effectively resist various threats, including data poisoning, model poisoning, and forgetting attacks, providing reliable security guarantees for the large-scale implementation of vertical federated learning in key areas.

[0055] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for defending against targeted forgetting attacks in vertical federated learning, applied to a vertical federated learning system comprising a server and multiple clients, characterized in that, Includes the following steps: S10, each client uses its locally stored local dataset to train the student model to generate embedded features, and uploads the embedded features to the server; S20, the server receives embedded features from each client, calculates the gradient of the loss with respect to the embedded features based on a preset global task loss, generates targeted features based on the gradient, and sends the targeted features to each client. S30, each client receives the target features and updates its student model by minimizing the feature alignment loss between the embedded features generated by its student model and the received target features; S40, when the client obtains a new dataset, it uses the new dataset to perform incremental learning to update its student model.

2. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 1, characterized in that, In step S20, the server generates the target feature based on the gradient using the following formula: In the formula, The embedded features received by the server from the client; For the generated target features; The learning rate; The gradient of the embedded features is the preset global task loss.

3. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 1, characterized in that, Before generating target features based on the gradient, the gradient is subjected to norm clipping and normalization.

4. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 1, characterized in that, In step S30, the formula for calculating the feature alignment loss is: In the formula, For feature alignment loss; This represents the number of embedded feature vectors. Embedded feature vectors generated for the student model; This refers to the target feature vector sent from the server.

5. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 1, characterized in that, In step S30, the feature alignment loss uses cosine similarity as a metric.

6. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 1, characterized in that, In step S30, each client updates its student model by minimizing a composite loss function, which consists of the local task loss and the feature alignment loss, and is expressed as follows: in, Let be the composite loss function to be minimized; This is for losses incurred during local tasks, used to ensure business accuracy; This is the balance coefficient; This is the feature alignment loss.

7. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 6, characterized in that, The balance coefficient A dynamic adjustment strategy is adopted, which adjusts the model in real time based on the degree of model alignment.

8. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 7, characterized in that, The dynamic adjustment strategy is based on the global average cosine similarity. The weights are calculated in real time using the following formula: in, This represents the balance coefficient at the current moment; This is the preset upper limit of the balance coefficient; The global average cosine similarity is used to characterize the overall feature alignment of the model.

9. The defense method against target-specific forgetting attacks in vertical federated learning as described in claim 1, characterized in that, In step S40, the incremental learning using the newly added dataset includes iteratively updating the newly added dataset using a cross-entropy loss function based on negative sampling. This loss function is expressed as: in, The loss function for incremental learning; For the newly added dataset; It is the sigmoid function; Let K be the matching score function of the model for sample x and label y; K is the number of negative samples. It is a negative sampling distribution.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements a defense method against targeted forgetting attacks on vertical federated learning as described in any one of claims 1 to 9.

Images