A federal forget backdoor persistent attack method based on offset gradient

Abstract

The present application relates to a kind of federal forget backdoor persistent attack methods based on offset gradient, in view of existing backdoor attack is easily removed under federal forget operation and invalid problem, the method first constructs shadow dataset in local simulation server evaluation mechanism, extracts dynamic legal template containing maximum safe gradient norm and legal convergence direction;Then using the template as constraint condition, generate disguised malicious gradient by projection gradient descent algorithm, implant initial backdoor in training stage;Finally, forget-recovery trap is constructed, actively initiates forget request to trigger server recovery stage, and uploads offset gradient containing surface legal recovery component and hidden malicious counter component.The present application is accurately neutralized by dynamic offset mechanism in mathematics The forget effect of server, so that backdoor feature realizes automatic reconstruction and persistent residence after experiencing "forget-recovery" cycle, while keeping model main task performance stable, with the advantages of high concealment and strong persistence.

Description

Technical Field

[0001] This invention belongs to the field of distributed machine learning security and privacy computing technology, specifically relating to a persistent federated forgetting backdoor attack method based on offsetting gradients that exploits vulnerabilities in the federated forgetting recovery mechanism. Background Technology

[0002] In recent years, federated learning, as a privacy-preserving distributed machine learning paradigm, has attracted widespread attention across various fields by allowing decentralized clients, such as connected car devices and healthcare institutions, to collaboratively train a global model without exchanging raw private data. However, with the implementation of stringent data protection regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), users have been granted the "right to be forgotten," requiring service providers to be able to erase contributions from specific users' data in the trained model. This makes federated forgetting a necessary mechanism to ensure system compliance and maintain model effectiveness.

[0003] Due to the deep entanglement of model parameters, the forgetting process in a federated environment is more complex than in a centralized environment. Current federated forgetting methods mainly adopt a "forget-recovery" paradigm: first, the influence of specific data is approximately eliminated, followed by a recovery or fine-tuning phase to repair the performance of the main task impaired by the forgetting operation. Liu et al. (FedEraser: Enabling efficient client-level data removal from federated learning models, 2021) proposed a method to calibrate and correct the model using historical updates, aiming to significantly reduce retraining time while eliminating the influence of target data. Wu et al. (Federated unlearning with knowledge distillation, 2022) used knowledge distillation techniques to restore model performance after subtracting the accumulated historical updates from unforgotten clients. Existing research focuses mainly on optimizing the balance between algorithm efficiency, accuracy, and communication overhead.

[0004] In the field of adversarial attacks, backdoor attacks aim to inject hidden triggers into the global model, causing it to output incorrect results when processing inputs containing specific triggers. Bagdasarian et al. (How to backdoor federated learning, 2020) initially demonstrated the feasibility of poisoning using model replacement techniques. Xie et al. (DBA: Distributed backdoor attacks against federated learning, 2019) proposed a distributed backdoor attack, enhancing the persistence and stealth of the attack by decomposing global triggers into local patterns. More recently, Wang et al. (SDBA: A stealthy and long-lasting durable backdoor attack in federated learning, 2023) proposed a gradient generation algorithm based on hybrid optimization, attempting to overcome the catastrophic forgetting problem in federated learning to enhance backdoor persistence.

[0005] While existing backdoor attacks have achieved some success in standard federated learning scenarios, they exhibit significant vulnerability in federated forgetting scenarios. Since the forgetting process is essentially about stripping away specific data patterns, it often inadvertently erases previously injected triggers, rendering standard backdoors ineffective. Current research on the security of federated forgetting primarily focuses on passive information leakage, such as member inference attacks or model inversion attacks, neglecting the forgetting process itself—especially its "performance recovery phase"—which can introduce new attack entry points. To date, no technique has successfully utilized this recovery phase to achieve persistent backdoor injection resistant to forget erasure.

[0006] Therefore, in-depth analysis of the mechanism vulnerabilities in the Federal Forget Protocol, designing a method that can use the recovery phase in the "forget-recovery" paradigm for covert injection, and can use mathematical means to offset the effects of forgetting to achieve backdoor persistence, has become an urgent technical problem to be solved in order to reveal the security risks of the current Federal Forget Protocol and improve the system's defense capabilities. Summary of the Invention

[0007] The purpose of this invention is to address the technical problem in the field of federated learning security where backdoor attacks struggle to survive under federated forgetting mechanisms. It provides a method for persistent backdoor attacks based on offset gradients within the federated forgetting mechanism. This invention creatively exploits an inherent security vulnerability in the "recovery training phase" of the federated forgetting protocol and utilizes this vulnerability to construct a "forgetting-recovery trap." By constructing a dynamic legitimate template to simulate the global defense boundary, a highly concealed initial backdoor is generated using projective gradient descent. Subsequently, a forgetting request is actively initiated to induce the system to enter the recovery phase, and an offset gradient containing a "superficially legitimate recovery component" and a "hidden malicious adversarial component" is constructed. This method can mathematically precisely offset the server's forgetting efforts, enabling the backdoor features to be automatically reconstructed and persistently persisted after undergoing a complete "forgetting-recovery" closed loop, while maintaining the stability of the model's main task performance. This achieves a highly concealed and persistent backdoor attack within the existing federated security defense system.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: a federated forgetting backdoor persistence attack method based on gradient cancellation, comprising the following steps:

[0009] S1. Constructing dynamic legitimate templates: Attackers construct shadow datasets locally, simulate the server's evaluation mechanism, and extract dynamic legitimate templates that can bypass defense detection.

[0010] S2. Perform fake backdoor injection: Using dynamic legal templates as constraints, generate fake malicious gradients through the projection gradient descent algorithm, and implant the initial backdoor during the federated learning training phase.

[0011] S3. Constructing a forget-recovery trap: The attacker actively initiates a data forgetting request to trigger the server's recovery training phase. During this phase, the attacker uses a gradient offsetting strategy to superficially assist in restoring model performance while mathematically offsetting the server's forgetting effect, thus achieving persistent reconstruction of the backdoor.

[0012] Furthermore, step S1 specifically includes the following steps:

[0013] S1-1, Constructing a Shadow Dataset: The attacker uses the local dataset... Divided into training set and shadow dataset The shadow dataset It does not directly participate in local training, but is only used to simulate the server's verification process;

[0014] S1-2, Golden Round Filtering: The attacker receives the global model in each round of communication. and in the shadow dataset Calculate the model utility contribution for the current round. The K rounds with the largest decrease in contribution are designated as the golden rounds. The contribution rate has decreased. The calculation formula is:

[0015] (1)

[0016] S1-3. Extracting Dynamic Valid Template Parameters: Based on the selected golden rounds Calculate dynamic valid templates based on historical update records. ,in For the maximum safety gradient norm, For legitimate convergence direction, This is a hierarchical variance mask.

[0017] Furthermore, the calculation formulas for each parameter in the dynamic legal template are as follows:

[0018] (1) Maximum safety gradient norm Calculate the upper bound of the L2 norm of the model update vector in the golden cycle to prevent gradient truncation:

[0019] (2)

[0020] (2) Legal convergence direction Calculate the nearest The direction of the moving average update in each round of history is used to capture the evolutionary path of benign gradients:

[0021] (3)

[0022] (3) Hierarchical variance mask : Calculate the standard deviation of the parameters for each layer in the historical updates, for the . Layer parameters Its variance mask Represented as:

[0023] (4)

[0024] in, Indicates the first Global model parameters of the wheel, Describing the L2 norm, This represents the function for calculating standard deviation. This represents the network layer index.

[0025] Furthermore, step S2 specifically includes the following steps:

[0026] S2-1. Define the malicious task: The attacker constructs a malicious dataset based on local data. The system embeds triggers in selected target samples and modifies the sample labels to the target category specified by the attacker. ;

[0027] S2-2, Constructing a Constrained Optimization Problem: Modeling backdoor injection as a constrained optimization problem; its goal is to satisfy the dynamic legal template. Minimize the backdoor loss function on the malicious dataset under constraints;

[0028] The specific constraints include: (1) Amplitude constraint: the generated malicious gradient norm does not exceed the maximum safe gradient norm. (2) Directional constraints: The direction of the generated malicious gradient is consistent with the direction of legal convergence. Maintain high consistency, meaning the cosine similarity between the two is greater than a preset threshold. ;

[0029] S2-3. Gradient Generation Based on PGD: Solve the above optimization problem using the Projected Gradient Descent (PGD) algorithm; first, calculate the original gradient that minimizes the backdoor loss. Then project it onto the screen by and Within the defined feasible region, generate the final submitted fake malicious gradient. The projection formula is as follows:

[0030] (5)

[0031] in, This indicates a projection operation. To adjust the coefficients, used to balance the strength of malicious attacks and the stealth of gradients, to ensure... Statistically, it is indistinguishable from benign updates.

[0032] Furthermore, step S3 specifically includes the following steps:

[0033] S3-1, Triggered Recovery Phase: At any time after the backdoor injection is successful and the model performance is stable, the attacker actively sends malicious data targeting the server. The forget request forces the server to initiate the recovery training phase.

[0034] S3-2, Calculate the legal surface recovery component: using the local shadow dataset Calculate the surface legal restoration component :

[0035] (6)

[0036] in, These are the global model parameters after the server has performed a forgetting operation;

[0037] S3-3, Calculate the hidden malicious adversarial component: based on the malicious dataset And the current global model after the forgetting operation The original loss gradient used to reconstruct the backdoor task is calculated; then, a hierarchical variance mask is used. The gradient is modulated using the Hadamard product to generate a hidden malicious component. The calculation formula is as follows:

[0038] (7)

[0039] in, This represents the Hadama product, which is the product of elements. Represents the gradient operator, Represents the global model parameters for the forgetting recovery phase. This indicates a malicious dataset constructed by the attacker.

[0040] Furthermore, in step S3, the attacker constructs and uploads the final offset gradient. The weighted fusion strategy is used to construct the following execution logic: First, the surface-based legitimate recovery component is processed. and hidden malicious confrontation elements Perform separately Norm normalization is applied to eliminate the influence of differences in the original gradient magnitudes on the fusion direction; subsequently, a camouflage coefficient is introduced. and offset coefficient Weighted summation of the normalized components cancels out gradients. The specific calculation formula is as follows:

[0041] (8)

[0042] in, Representing vectors Norm.

[0043] Furthermore, the gradient cancellation The mechanism of action is to establish a mathematically dynamic offsetting mechanism, using the attacker's injection volume to precisely fill parameter gaps left by forgotten operations on the server; when the server aggregates during the recovery phase... When the client updates, the system internally performs two opposing optimization processes: the server subtracts backdoor features through gradient ascent or rollback, while the attacker adds them back using hidden malicious terms; at this time, the net parameter change of the global model is... Represented as:

[0044] (9)

[0045] in, The global learning rate; This indicates the direction of the gradient executed by the server to eliminate the impact of malicious data; This indicates the direction of the malicious gradient calculated by the attacker.

[0046] Furthermore, in step S3, after generating the offset gradient and before uploading it to the server, a feasibility projection step is included to ensure the stealth of the attack; specifically, this involves calculating the generated offset gradient. of norm and compare it with the maximum safe gradient norm. Compare; if Then, a truncation operation is performed, projecting the gradient back to the input. Within a safe sphere of radius , the specific projection formula is:

[0047] (10)

[0048] like Then keep constant.

[0049] Furthermore, the shadow dataset The construction ratio is set to 20% of the attacker's total local data; the offset coefficient The range of values ​​is .

[0050] The present invention also provides a federated forgetting backdoor persistence attack system based on offsetting gradients, including a memory, a processor, and computer program instructions stored in the memory and executable by the processor. When the processor executes the computer program instructions, it can implement the above-described method.

[0051] Compared with existing technologies, this invention has the following advantages: Firstly, this invention identifies and verifies for the first time that the "performance recovery phase" in the federated forgetting protocol is a fatal integrity vulnerability. It proves that in a distributed environment, the recovery operation after forgetting can not only be used to repair the model but may also be maliciously exploited to recover a cleared backdoor, thus providing a novel defense perspective for the security design of federated learning systems. By introducing shadow datasets and a dynamic legal template mechanism, this invention solves the information asymmetry problem for attackers in black-box and non-independent, identically distributed environments. This ensures that the generated malicious gradients are highly consistent with benign gradients in terms of geometric and statistical features, effectively bypassing robust aggregation algorithms based on geometric distance and backdoor detection mechanisms based on reverse engineering, achieving excellent attack concealment. Simultaneously, by utilizing the proposed gradient cancellation strategy, the impact of the server's forgetting operation is mathematically neutralized, allowing the backdoor to quickly bounce back and persist after undergoing a powerful forgetting algorithm and subsequent recovery process. Furthermore, the model's accuracy on benign main tasks remains stable, truly realizing persistent backdoor attacks. Attached Figure Description

[0052] Figure 1 A flowchart of the federated forgetting backdoor persistence attack method based on offsetting gradient provided in this embodiment of the invention;

[0053] Figure 2 This is a flowchart illustrating the specific process of constructing a dynamic legal template and extracting key parameters in an embodiment of the present invention.

[0054] Figure 3 This is a flowchart illustrating the specific process of constructing a forgetting-recovery trap and generating a counteracting gradient in an embodiment of the present invention;

[0055] Figure 4 This is a schematic diagram of the attack framework and gradient cancellation mechanism in an embodiment of the present invention. Detailed Implementation

[0056] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0057] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0058] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0059] like Figure 1 As shown, this embodiment provides a federated forgetting backdoor persistence attack method based on offsetting gradients, including the following steps: S1, Constructing a dynamic legitimate template: The attacker constructs a shadow dataset locally, simulates the server's evaluation mechanism, and extracts a dynamic legitimate template that can bypass defense detection; S2, Performing a fake backdoor injection: Using the dynamic legitimate template as a constraint, a fake malicious gradient is generated through the Projective Gradient Descent (PGD) algorithm, and an initial backdoor is implanted during the federated learning training phase; S3, Constructing a forgetting-recovery trap: The attacker actively initiates a data forgetting request to trigger the server's recovery training phase, and during this phase, the offsetting gradient strategy is used to superficially assist in recovering model performance while mathematically offsetting the server's forgetting effect, thereby achieving persistent reconstruction of the backdoor.

[0060] This method is based on the assumption that, under the black-box setting of federated learning, attackers cannot see the global model, but can infer the global defense boundary through local proxy data.

[0061] In this embodiment, the specific implementation steps of step S1 are as follows.

[0062] S1-1, Constructing a Shadow Dataset: The attacker uses the local dataset... Divided into training set and shadow dataset ,in The proportion of local data constructed is about 20%, and it does not directly participate in local training, but is only used to simulate the verification process of the server.

[0063] S1-2, Golden Round Filtering: The attacker receives the global model in each round of communication. and in the shadow dataset Calculate the model utility contribution for the current round. During this period, the attacker will continuously monitor changes in the loss value, defining the K rounds that cause the largest decrease in contribution as the golden rounds. These rounds represent updates that contribute significantly from the server's perspective. Contribution decreases. The calculation formula is:

[0064] (1)

[0065] S1-3. Extracting Dynamic Valid Template Parameters: Based on the selected golden rounds Calculate dynamic valid templates based on historical update records. .in For the maximum safety gradient norm, For the legitimate convergence direction, This is a hierarchical variance mask.

[0066] The calculation formulas for each parameter in the dynamic legal template are as follows:

[0067] (1) Maximum safety gradient norm Calculate the upper bound of the L2 norm of the model update vector in the golden cycle to prevent gradient truncation:

[0068] (2)

[0069] (2) Legal convergence direction Calculate the nearest The direction of the moving average update in each round of history is used to capture the evolutionary path of benign gradients:

[0070] (3)

[0071] (3) Hierarchical variance mask : Calculate the standard deviation of the parameters for each layer in the historical updates, for the . Layer parameters Its variance mask Represented as:

[0072] (4)

[0073] in, Indicates the first Global model parameters of the wheel, Describing the L2 norm, This represents the function for calculating standard deviation. This represents the network layer index.

[0074] In this embodiment, the specific implementation steps of step S2 are as follows.

[0075] S2-1. Define the malicious task: The attacker constructs a malicious dataset based on local data. The attacker embeds specific triggers into selected target samples and modifies the sample labels to the target category specified by the attacker. .

[0076] S2-2, Constructing a Constrained Optimization Problem: To ensure the concealment of the injection process, backdoor injection is modeled as a constrained optimization problem; its objective is to satisfy the dynamic legal template... Under constraints, minimize the backdoor loss function on malicious datasets.

[0077] The specific constraints include: (1) Amplitude constraint: The generated malicious gradient norm must not exceed the maximum safe gradient norm. (2) Directional constraint: The direction of the generated malicious gradient must be consistent with the direction of legal convergence. To maintain a high degree of consistency, the cosine similarity between the two must be greater than a preset threshold. .

[0078] S2-3. Gradient Generation Based on PGD: Solve the above optimization problem using the Projected Gradient Descent (PGD) algorithm; first, calculate the original gradient that minimizes the backdoor loss. Then project it onto the screen by and Within the defined feasible region, generate the final submitted fake malicious gradient. The projection formula is as follows:

[0079] (5)

[0080] in, This indicates a projection operation. To adjust the coefficients, used to balance the strength of malicious attacks and the stealth of gradients, to ensure... Statistically, it is indistinguishable from benign updates.

[0081] In this embodiment, the specific implementation steps of step S3 are as follows.

[0082] S3-1, Triggered Recovery Phase: At any time after the backdoor injection is successful and the model performance is stable, the attacker actively sends malicious data targeting the server. The server will perform a forgetting operation to eliminate the impact of this data, which will cause a decrease in model performance and force the start of the retraining phase.

[0083] S3-2, Calculate the legal surface recovery component: using the local shadow dataset The calculation of the seemingly legitimate recovery gradient of the surface This component is mainly used to restore the accuracy of the model on benign tasks and to check the utility of the server during the recovery phase.

[0084] (6)

[0085] in, These are the global model parameters after the server has performed a forgetting operation.

[0086] S3-3, Calculate the hidden malicious adversarial component: based on the malicious dataset And the current global model after the forgetting operation The original loss gradient for reconstructing the backdoor task is calculated. Then, the hierarchical variance mask extracted in steps S1-3 is used. The gradient is modulated using the Hadamard product to generate a hidden malicious component. This step reduces the statistical risk of detection by concentrating malicious perturbation weights onto the high-variance region of the model parameters. The calculation formula is as follows:

[0087] (7)

[0088] in, This represents the Hadama product, which is the product of elements. Represents the gradient operator, Represents the global model parameters for the forgetting recovery phase. This indicates a malicious dataset constructed by the attacker.

[0089] In step S3, the attacker constructs and uploads the final offset gradient. It is constructed using a weighted fusion strategy, specifically including the following execution logic: First, the surface-based legitimate recovery component is processed. and hidden malicious confrontation elements Perform separately Norm normalization is applied to eliminate the influence of differences in the original gradient magnitudes on the fusion direction. Subsequently, a camouflage coefficient is introduced. and offset coefficient Weighted summation of the normalized components cancels out gradients. The specific calculation formula is as follows:

[0090] (8)

[0091] in, Representing vectors Norm.

[0092] The disguise coefficient It is mainly used to control the weights of the components in the gradient that recover the performance of the main task, and to dominate the average convergence direction of the benign gradient. The statistical characteristics significantly reduce the model's loss on the benign validation set, thereby ensuring that attackers pass the server's utility check during the recovery phase and are misjudged as high-contribution benign clients; the offset coefficient It is the core parameter of the anti-federated forgetting strategy, used to control the injection strength of malicious components. Its generated update direction is exactly opposite to the direction of the server's forgetting gradient, and is used to mathematically cancel the server's forgetting operation.

[0093] The offset gradient The mechanism works by establishing a mathematically dynamic offsetting mechanism, using the attacker's injection to precisely fill parameter gaps left by forgotten operations on the server. Specifically, when the server aggregates during the recovery phase... When the client updates, the system internally performs two opposing optimization processes: the server attempts to subtract the backdoor feature through gradient ascent or rollback, while the attacker adds it back using hidden malicious terms. At this point, the net parameter change of the global model... It can be approximated as:

[0094] (9)

[0095] in, The global learning rate; This indicates the gradient direction performed by the server to eliminate the influence of malicious data, such as the calibration gradient or gradient ascent direction in FedEraser; This represents the direction of the malicious gradient calculated by the attacker. According to this formula, canceling the gradient makes the net parameter change of the backdoor feature approximately zero after a complete "forget-recovery" cycle, thus allowing the main task performance to rebound normally (due to...). While ensuring this, it also enables the subsequent transition from being cleared to being retained.

[0096] After generating the offset gradient and before uploading it to the server, a feasibility projection step is included to ensure the stealth of the attack. This step involves calculating the generated offset gradient. of norm and compare it with the maximum safe gradient norm. Compare; if Then, a truncation operation is performed, projecting the gradient back to the input. Within a safe sphere of radius , the specific projection formula is:

[0097] (10)

[0098] like Then keep constant.

[0099] The purpose of this step is to prevent [the spread of disease]. Setting the coefficient too large will cause the generated gradient magnitude to be abnormal, thus avoiding being filtered out by the server-side defense mechanism based on norm pruning or anomaly detection.

[0100] The setting of key hyperparameters follows the principle of balancing attack stealth and persistence: the shadow dataset The default construction ratio is set to 20% of the attacker's total local data. This ratio ensures that the attacker has enough data to accurately simulate the distribution of the global model and extract high-quality, dynamic, legitimate templates, while reserving most of the data for local training to maintain the normal performance of their own model. The offsetting coefficient... The preferred value range is... .when At that time, the resulting reverse momentum is insufficient to completely counteract the server's forgetting effect, potentially leading to backdoor recovery failure. While the recovery speed increases, it also leads to a decrease in the statistical characteristics of the gradient (such as the gradient concealment score GSS), increasing the risk of detection. Therefore, within this range, attackers can generate enough momentum to offset the forgetting effect while maintaining high gradient concealment, thus achieving the best balance between attack persistence and concealment.

[0101] This invention proposes a federated forgetting backdoor persistence attack method based on offsetting gradients. It is the first to identify and verify that the "performance recovery phase" in the federated forgetting protocol is a fatal integrity vulnerability. It demonstrates that in a distributed environment, the recovery operation after forgetting can not only be used to repair the model but also maliciously exploited to recover a deleted backdoor. Validation on multiple datasets shows that the proposed LURA framework has significant effectiveness and stealth in federated forgetting scenarios, significantly improving the average backdoor attack success rate (P-ASR) while maintaining stable accuracy on the main task.

[0102] The specific implementation of the present invention will be further described below with reference to the accompanying drawings.

[0103] This embodiment provides a federated forgetting backdoor persistence attack method based on offsetting gradients. It utilizes the "right to be forgotten" interface provided by the federated learning system to transform the federated forgetting process into a cover for backdoor injection. The attacker actively initiates a forgetting request, forcing the system into a retraining phase, and injects carefully constructed offsetting gradients during this phase. For example... Figure 1As shown, the federated forgetting backdoor persistence attack method based on offsetting gradients provided in this embodiment includes the following steps: S1, Constructing a dynamic legitimate template: A shadow dataset is constructed locally to simulate a server evaluation mechanism. The golden round is selected by monitoring global model changes, and the maximum safe gradient norm and legitimate convergence direction are extracted. S2, Performing a disguised backdoor injection: The backdoor injection is modeled as a constrained optimization problem. The dynamic legitimate template is used as the constraint boundary. A disguised malicious gradient with hidden statistical features is generated and uploaded through projective gradient descent (PGD). S3, Constructing a forgetting-recovery trap: A data forgetting request is actively initiated to trigger the server recovery phase. An offsetting gradient containing a surface legitimate recovery component and a hidden malicious adversarial component is constructed to mathematically offset the server's forgetting effect to reconstruct the backdoor. That is, in this embodiment, constrained optimization based on projective gradient descent is applied to eliminate statistical anomalies during the injection process, ensuring that the backdoor can remain hidden in the model. Subsequently, an offsetting gradient strategy is applied to neutralize the server's forgetting operation, ensuring that the backdoor can "come back to life" after experiencing the forgetting-recovery cycle, thereby enhancing the persistence of the backdoor in the model.

[0104] The federated forgetting backdoor persistence attack method provided in this embodiment is based on the assumption that attackers can infer the global defense boundary through local shadow data and disguise malicious attacks as legitimate benign updates. Please refer to... Figure 2 Steps S1 and S2 specifically include the following steps: S1-1, Shadow dataset construction and golden round selection. The attacker divides the local data into a training set and a shadow dataset, and uses the shadow dataset to continuously monitor the global model loss. The K rounds that cause the largest loss reduction are selected as "golden rounds" using formula (1). S1-2, Extracting dynamic legal templates. Based on the golden rounds, three key parameters are extracted: maximum safe gradient norm. (Formula 2), legitimate convergence direction (Formula 3), and hierarchical variance mask (Formula 4). These parameters collectively define a "safe and feasible region". S2-1, Perform spoofing injection. During the normal training phase, the attacker defines a malicious task (adding triggers + label flipping) and calculates the original malicious gradient. S2-2, PGD optimization. Projected gradient descent is performed using formula (5) to force malicious gradients. satisfy And with The cosine similarity is greater than the threshold. That is, in this embodiment, a dynamic legal template is used to shape the malicious gradient so that it is highly similar to the benign gradient in terms of geometric direction and magnitude energy, thereby deceiving the defense mechanism based on distance or similarity.

[0105] Reference Figure 3 and Figure 4This embodiment constructs a forget-recovery trap and achieves backdoor persistence by generating offsetting gradients. Specifically, it includes the following steps: S3-1, Triggering recovery. The attacker actively requests to forget malicious data, forcing the server to execute the forgetting algorithm and start recovery training. S3-2, Two-stream gradient calculation. (The rest of the text is missing.) Figure 3 As shown, the attacker computes two paths in parallel: the left path (surface camouflage): using the shadow dataset to compute the legitimate recovery gradient. (Formula 6) is used to restore the accuracy of the main task and ensure that it passes the server utility check; the right path (malicious reconstruction): calculates the backdoor reconstruction gradient using the malicious dataset and applies a hierarchical variance mask. Obtain hidden malicious components (Formula 7) concentrates the attack on the high variance layer of the model to hide the traces. S3-3, canceling gradient fusion. Using formula (8), the two components above are weighted and fused to generate canceling gradients. The camouflage coefficient and offset coefficient Used to balance the weights of restoring the main task and reconstructing the backdoor. S3-4, Offset Mechanism. For example... Figure 4 As shown, the offsetting coefficient The generated malicious momentum mathematically precisely cancels the server's forgotten gradient (Equation 9), ensuring that the backdoor features are preserved in the parameter space. S3-5, Feasibility Projection. Finally, Equation (10) is used to check and truncate the norm of the canceled gradient to ensure that it does not exceed the safety boundary and prevent it from being pruned. That is, in this embodiment, a new gradient cancellation strategy is proposed, which takes advantage of the server's eagerness to improve model performance during the recovery phase to submit updates that appear to have high contributions but are malicious in the kernel, thereby achieving persistent reconstruction of the backdoor while passing the system check.

[0106] In summary, the present invention has the following beneficial effects: (1) In terms of attack concealment: the present invention solves the problem of information asymmetry in the black-box environment by constructing dynamic legal templates and shadow datasets, making it impossible to distinguish malicious gradients from benign gradients in terms of statistical features, and effectively bypassing mainstream defense detection such as Krum and Neural Cleanse. (2) In terms of attack persistence: the "forget-recovery trap" and gradient cancellation strategy proposed in the present invention precisely neutralize the impact of server forgetting operations in mathematics. It has been verified that under forgetting mechanisms such as FedEraser, this method can significantly improve the success rate of backdoor attacks and achieve true persistent attacks.

[0107] This embodiment also provides a federated forgetting backdoor persistence attack system based on offsetting gradients, including a memory, a processor, and computer program instructions stored in the memory and executable by the processor. When the processor executes the computer program instructions, it can implement the above-described method.

[0108] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0110] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0112] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A federated forgetting backdoor persistence attack method based on gradient cancellation, characterized in that, Includes the following steps: S1. Constructing dynamic legitimate templates: Attackers construct shadow datasets locally, simulate the server's evaluation mechanism, and extract dynamic legitimate templates that can bypass defense detection. S2. Perform fake backdoor injection: Using dynamic legal templates as constraints, generate fake malicious gradients through the projection gradient descent algorithm, and implant the initial backdoor during the federated learning training phase. S3. Constructing a forget-recovery trap: The attacker actively initiates a data forgetting request to trigger the server's recovery training phase. During this phase, the attacker uses a gradient offsetting strategy to superficially assist in restoring model performance while mathematically offsetting the server's forgetting effect, thus achieving persistent reconstruction of the backdoor.

2. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 1, characterized in that, Step S1 specifically includes the following steps: S1-1, Constructing a Shadow Dataset: The attacker uses the local dataset... Divided into training set and shadow dataset The shadow dataset It does not directly participate in local training, but is only used to simulate the server's verification process; S1-2, Golden Round Filtering: The attacker receives the global model in each round of communication. and in the shadow dataset Calculate the model utility contribution for the current round. The K rounds with the largest decrease in contribution are designated as the golden rounds. The contribution rate has decreased. The calculation formula is: （1） S1-3. Extracting Dynamic Valid Template Parameters: Based on the selected golden rounds Calculate dynamic valid templates based on historical update records. ,in For the maximum safety gradient norm, For the legitimate convergence direction, This is a hierarchical variance mask.

3. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 2, characterized in that, The calculation formulas for each parameter in the dynamic legal template are as follows: (1) Maximum safety gradient norm Calculate the upper bound of the L2 norm of the model update vector in the golden cycle to prevent gradient truncation: （2） (2) Legal convergence direction Calculate the nearest The direction of the moving average update in each round of history is used to capture the evolutionary path of benign gradients: （3） (3) Hierarchical variance mask : Calculate the standard deviation of the parameters for each layer in the historical updates, for the . Layer parameters Its variance mask Represented as: （4） in, Indicates the first Global model parameters of the wheel, Represents the L2 norm. This represents the function for calculating standard deviation. This represents the network layer index.

4. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 1, characterized in that, Step S2 specifically includes the following steps: S2-1. Define the malicious task: The attacker constructs a malicious dataset based on local data. The system embeds triggers in selected target samples and modifies the sample labels to the target category specified by the attacker. ; S2-2, Constructing a Constrained Optimization Problem: Modeling backdoor injection as a constrained optimization problem; its goal is to satisfy the dynamic legal template. Minimize the backdoor loss function on the malicious dataset under constraints; The specific constraints include: (1) Amplitude constraint: the generated malicious gradient norm does not exceed the maximum safe gradient norm. (2) Directional constraints: The direction of the generated malicious gradient is consistent with the direction of legal convergence. Maintain high consistency, meaning the cosine similarity between the two is greater than a preset threshold. ; S2-3. Gradient Generation Based on PGD: Solve the above optimization problem using the Projected Gradient Descent (PGD) algorithm; first, calculate the original gradient that minimizes the backdoor loss. Then project it onto the screen by and Within the defined feasible region, generate the final submitted fake malicious gradient. The projection formula is as follows: （5） in, This indicates a projection operation. To adjust the coefficients, used to balance the strength of malicious attacks and the stealth of gradients, to ensure... Statistically, it is indistinguishable from benign updates.

5. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 1, characterized in that, Step S3 specifically includes the following steps: S3-1, Triggered Recovery Phase: At any time after the backdoor injection is successful and the model performance is stable, the attacker actively sends malicious data targeting the server. The forget request forces the server to initiate the recovery training phase. S3-2, Calculate the legal surface recovery component: using the local shadow dataset Calculate the surface legal restoration component : （6） in, These are the global model parameters after the server has performed a forgetting operation; S3-3, Calculate the hidden malicious adversarial component: based on the malicious dataset And the current global model after the forgetting operation The original loss gradient used to reconstruct the backdoor task is calculated; then, a hierarchical variance mask is used. The gradient is modulated using the Hadamard product to generate a hidden malicious component. The calculation formula is as follows: （7） in, This represents the Hadama product, which is the product of elements. Represents the gradient operator, Represents the global model parameters for the forgetting recovery phase. This indicates a malicious dataset constructed by the attacker.

6. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 5, characterized in that, In step S3, the attacker constructs and uploads the final offset gradient. The weighted fusion strategy is used to construct the following execution logic: First, the surface-based legitimate recovery component is processed. and hidden malicious confrontation elements Perform separately Norm normalization is applied to eliminate the influence of differences in the original gradient magnitude on the fusion direction; Subsequently, a camouflage coefficient was introduced. and offset coefficient Weighted summation of the normalized components cancels out gradients. The specific calculation formula is as follows: （8） in, Representing vectors Norm.

7. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 6, characterized in that, The offset gradient The mechanism of action is to establish a mathematical dynamic cancellation mechanism, using the amount of injection from the attacker to precisely fill the parameter gaps left by the server due to forgotten operations. When the server aggregates during the recovery phase When the client updates, the system internally performs two opposing optimization processes: the server subtracts backdoor features through gradient ascent or rollback, while the attacker adds them back through hidden malicious items; At this point, the net parameter change of the global model Represented as: （9） in, The global learning rate; This indicates the direction of the gradient executed by the server to eliminate the impact of malicious data; This indicates the direction of the malicious gradient calculated by the attacker.

8. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 6, characterized in that, In step S3, after generating the offset gradient and before uploading it to the server, a feasibility projection step is included to ensure the stealth of the attack; specifically, this involves calculating the generated offset gradient. of norm and compare it with the maximum safe gradient norm. Compare; if Then, a truncation operation is performed, projecting the gradient back to the input. Within a safe sphere of radius , the specific projection formula is: （10） like Then keep constant.

9. The federated forgetting backdoor persistence attack method based on offsetting gradients according to claim 1, characterized in that, The shadow dataset The construction ratio is set to 20% of the attacker's total local data; the offset coefficient The range of values ​​is .

10. A federated forgetting backdoor persistence attack system based on gradient cancellation, characterized in that, It includes a memory, a processor, and computer program instructions stored in the memory and executable by the processor, wherein when the processor executes the computer program instructions, it can implement the method as described in any one of claims 1-9.

Images