A federated learning adversarial attack method, system, device and medium

Abstract

This invention provides a method, system, device, and medium for adversarial attacks on federated learning, belonging to the field of artificial intelligence security technology. The method includes: an attacker participating in federated learning, obtaining global model parameters, and constructing a shadow model to track the decision boundary of the target model; training a proxy model using the shadow model through dynamic knowledge distillation, where dynamic knowledge distillation integrates basic distillation of clean samples and adversarial detection of adversarial samples during training, and dynamically adjusts the weights of basic distillation and adversarial detection; training a generative adversarial network on the trained proxy model to generate adversarial samples; and using the generated adversarial samples to launch a black-box attack on the target global model in federated learning. This invention can generate adversarial samples with high transferability and high concealment in a differential privacy-preserving federated learning environment, solving the problems of low attack success rate and poor stability of existing adversarial attack methods, and can be used for security assessment and defense design of federated learning systems.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, and in particular to a federated learning adversarial attack method, system, device and medium. Background Technology

[0002] Federated learning, as a distributed machine learning framework, allows clients to retain data locally and share only model updates, thus protecting data privacy to some extent. The classic federated averaging algorithm achieves collaborative modeling without sharing the original data through a mechanism of client-side local training and server-side parameter averaging. However, research shows that attackers can still steal private information through gradient inversion, membership inference, and other methods. For example, attackers can reconstruct the original training data with high accuracy based solely on gradient information uploaded by the client, or determine whether a specific sample exists in a client's training set.

[0003] To address the aforementioned privacy threats, differential privacy and other defense mechanisms have been introduced into federated learning. These methods protect the privacy of training data by adding noise to the gradients, and further combine differential privacy with federated learning to achieve client-level privacy protection. However, while protecting privacy, differential privacy defenses inevitably distort the model's decision boundaries, leading to a significant decrease in the transferability and generalization ability of traditional adversarial examples.

[0004] Adversarial attacks aim to induce deep neural networks to produce incorrect predictions by adding minute perturbations imperceptible to the original input. Based on the attacker's knowledge of the target model, adversarial attacks can be broadly categorized into white-box attacks and black-box attacks. Existing black-box attack methods are mainly divided into transfer-based attacks and query-based attacks. Transfer-based attacks rely on the similarity between the substitute model and the target model, resulting in unstable success rates; query-based attacks require a large number of queries and are easily detected. Generative adversarial networks (GANs) have been introduced into the field of adversarial attacks, enabling efficient one-time attacks. However, their performance is poor in federated learning environments protected by differential privacy, mainly because the random noise injected by differential privacy contaminates the gradient information, leading to unstable generator training.

[0005] Therefore, how to efficiently generate adversarial examples with high transferability and high concealment in a differential privacy-preserving federated learning environment has become a pressing technical problem in the field of artificial intelligence security. Summary of the Invention

[0006] The purpose of this invention is to provide a federated learning adversarial attack method, system, device, and medium. By training the agent model through dynamic knowledge distillation, it filters out differential privacy noise and retains core decision features. Combined with generative adversarial networks, it efficiently generates adversarial samples with high transferability and high concealment, thereby solving the problems of low attack success rate, poor stability, and insufficient adversarial sample transferability of existing adversarial attack methods in a differential privacy-preserving federated learning environment.

[0007] To achieve the above objectives, this invention provides a federated learning adversarial attack method, comprising the following steps: Step S1: The attacker participates in federated learning to obtain global model parameters and construct a shadow model that tracks the decision boundary of the target model. Step S2: Train the proxy model using the shadow model through dynamic knowledge distillation. During the training process, dynamic knowledge distillation integrates the basic distillation of clean samples and the adversarial detection of adversarial samples, and dynamically adjusts the weights of the basic distillation and adversarial detection. Step S3: Train a generative adversarial network on the trained proxy model to generate adversarial examples; Step S4: Use the generated adversarial examples to launch a black-box attack on the target global model in federated learning.

[0008] Preferably, dynamic knowledge distillation includes a basic distillation path and an adversarial detection path; Loss function of the basic distillation path Represented as: ; in, For cross-entropy loss, Let KL divergence be the KL divergence. and These are the outputs of the shadow model and the proxy model, respectively. The distillation temperature. As a balance factor, For the Softmax function, The true label of the input image; Loss function for adversarial detection paths Represented as: ; in, The logits output of the proxy model against adversarial examples. This is the logits output of the shadow model against adversarial examples. For adversarial examples.

[0009] Preferably, dynamic knowledge distillation is performed using an adaptive weighting function. The weights of the basic distillation path and the adversarial detection path are dynamically adjusted, and the adaptive weight function is expressed as follows: ; in, To normalize the training progress, For the current training round, For the total number of training rounds, The center offset, This refers to the slope coefficient; Total loss function of dynamic knowledge distillation Represented as: ; in This refers to the distillation loss of the soft label on normal samples.

[0010] Preferably, the generative adversarial network includes a generator G and a discriminator D; the original image The input generator G is subjected to adversarial perturbations. Generate adversarial examples ,in For cropping operations; Training a generative adversarial network includes a generator loss function. : ; in, For adversarial loss on the proxy model, To generate adversarial network loss, For soft hinge loss, and To balance the weights.

[0011] Preferred soft hinge loss function Represented as: ; in, This is the preset upper limit of the disturbance; Generative Adversarial Network Loss Represented as: ; in, This is the output of the discriminator.

[0012] Preferably, the shadow model has the same structure as the global model, and the parameters of the shadow model are synchronized in real time through each round of communication via federated learning; the proxy model has a lightweight network structure.

[0013] Preferably, the method is applied to a federated learning environment with differential privacy protection, which includes gradient pruning and Gaussian noise injection; the parameters of the shadow model contain differential privacy noise, and the proxy model learns the class probability output of the shadow model through dynamic knowledge distillation.

[0014] This invention also provides a federated learning adversarial attack system for executing a federated learning adversarial attack method as described above, comprising: The shadow model building module is used by attackers to participate in federated learning to obtain global model parameters and build a shadow model that tracks the decision boundary of the target model. The dynamic distillation training module is used to train the proxy model through dynamic knowledge distillation using the shadow model. During the training process, dynamic knowledge distillation integrates the basic distillation of clean samples and the adversarial detection of adversarial samples, and dynamically adjusts the weights of the basic distillation and adversarial detection. The Generative Adversarial Network (GAN) training module is used to train a GAN on a pre-trained proxy model to generate adversarial examples. The attack execution module is used to carry out black-box attacks on the target global model in federated learning using generated adversarial examples.

[0015] The present invention also provides an electronic device, comprising: a memory and a processor; the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described federated learning adversarial attack method.

[0016] The present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the above-described federated learning adversarial attack method.

[0017] Therefore, the present invention employs the above-described federated learning adversarial attack method, system, device, and medium, and the beneficial technical effects are as follows: (1) The present invention introduces an adversarial example detection path in the knowledge distillation process, which enables the proxy model to learn the vulnerable areas of the shadow model near the decision boundary, which is beneficial to generating adversarial examples with high transferability. (2) In the process of training the proxy model, the present invention introduces an adaptive weight function to achieve a smooth transition from basic distillation to adversarial distillation, which effectively alleviates the gradient mutation problem and improves the stability of the attack. (3) The present invention places dynamic weights inside soft label distillation, so that hard label loss always maintains fixed weights, ensuring that the proxy model is always supervised by the real label, and avoiding decision boundary distortion caused by the disappearance of hard label loss in the later stage. (4) This invention provides a general methodology that can be used to attack any federated learning system, and can also be combined with existing attack methods to obtain better results. The proxy model, generative adversarial network and dynamic weight function in the method can be flexibly selected. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of the present invention; Figure 2 This is a schematic diagram of the federated learning architecture used in this invention; Figure 3 This is a diagram of the core architecture of the dynamic knowledge distillation algorithm of this invention; Figure 4 This is a graph showing the evolution of the adaptive weighting function of this invention. Figure 5 This is a schematic diagram of the knowledge distillation process used in this invention. Detailed Implementation

[0019] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0020] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0021] Example 1 This embodiment provides a method for adversarial attacks in federated learning, applied to a differential privacy-preserving federated learning environment. Please refer to... Figures 1 to 5 .

[0022] Step S1: The attacker participates in federated learning, obtains global model parameters, and constructs a shadow model that tracks the decision boundary of the target model.

[0023] like Figure 1 As shown, the overall architecture of this invention includes a malicious client, a global model, an aggregator, and... A normal client. This embodiment uses the CIFAR-10 benchmark dataset in the field of computer vision, which contains 60,000 images in 10 categories. Color images were used, with 50,000 for model training and 10,000 for testing. In the federated learning setting, this data was non-independently and identically distributed across 5 clients. Global model. It adopts the ResNet18 architecture.

[0024] like Figure 2 As shown, the federated learning system used in this embodiment includes a server and There are several clients (Client 1 to Client N). The server contains a global model and an aggregator, and its workflow is as follows: ① Receive local model parameters uploaded by each client. ② The aggregator uses the FedAvg algorithm to aggregate the parameters; ③ The aggregated and updated global model parameters are distributed to all clients. Each client holds local data and a local model, performs local training, and then uploads the parameters. In this embodiment, the total number of federated training rounds is 100, with 5 clients participating in each round of training, and each client training locally for 3 rounds. The server deploys a gradient pruning strategy based on the L2 norm and injects Gaussian difference privacy noise (DP noise) after parameter aggregation to achieve client-level differential privacy protection.

[0025] The attacker, acting as a malicious client, legitimately accesses the system. The server distributes global parameters containing differential privacy noise. To the malicious client. The malicious client uses this noisy global parameter to construct a shadow model with the same structure as the global model. The shadow model contains DP noise to simulate the decision-making behavior of the global model.

[0026] Step S2: Train the proxy model using the shadow model through dynamic knowledge distillation. During the training process, dynamic knowledge distillation integrates the basic distillation of clean samples and the adversarial detection of adversarial samples, and dynamically adjusts the weights of the basic distillation and adversarial detection.

[0027] A batch of images to be processed is randomly selected from the dataset. and its real label Set the batch size to 128. Add the images to be processed. Input shadow model Obtain the shadow model output. .

[0028] like Figure 3 As shown, the malicious client internally contains a generative adversarial network module and a dynamic knowledge distillation module. Dynamic knowledge distillation includes a basic distillation path and an adversarial detection path, and the weights of the two paths are dynamically adjusted through an adaptive weight function.

[0029] The basic distillation path uses clean samples to train the surrogate model, enabling it to learn the global decision boundary of the shadow model. Basic distillation loss function. Represented as: ; in, For cross-entropy loss, Let KL divergence be the KL divergence. As a balance factor, For the Softmax function, The actual label of the input image. In this embodiment, , .

[0030] Adversarial detection path exploit generator generated adversarial examples As probe points, the surrogate model is forced to fit the shadow model into vulnerable regions near the decision boundary. Adversarial probe loss function. Represented as: ; This loss forces the proxy model to learn the shadow model's vulnerable areas near the decision boundary.

[0031] Adaptive weight function based on normalized training progress The construction uses the Sigmoid function form: ; in, For the current training round, For the total number of training rounds, The center offset, This is the slope coefficient. For example... Figure 4 As shown, the adaptive weight function With normalized training progress The change in slope coefficient follows an S-shaped curve. Control the steepness of the weight changes. The larger the value, the more drastic the transition of the weight from 0 to 1, and the greater the center offset. Determine the central location of the weight change, i.e., when hour = 0.5. In this embodiment, , .

[0032] Total loss function of dynamic knowledge distillation Represented as: ; in, This represents the soft-label distillation loss on normal samples. This dynamic weight is placed within the soft-label distillation process, ensuring the hard-label loss always maintains a fixed weight.

[0033] like Figure 5 As shown, the input is a clean sample (without adversarial perturbations). Simultaneously inputting the teacher model and student model, we obtain the logits output of the teacher model. The logits output of the student model .Will and Divide by distillation temperature respectively The soft-label output of the teacher model is obtained after undergoing a Softmax transformation. soft label output of student model Calculate the KL divergence between the two. The soft-label loss is obtained. For the hard-label loss, the logits output of the student model is divided by the distillation temperature. (at this time After (=1), a Softmax transformation is performed to obtain the hard-label output of the student model. And calculate the cross-entropy loss by comparing it with the labels of the real data. Ultimately, through the balance factor The basic distillation loss is obtained. This method... Figure 5 Adversarial detection paths and adaptive weight functions are introduced on the basis of the framework.

[0034] The final total loss function is passed through a balancing factor. (In this embodiment) The hard label loss is compared with the soft label portion (by...). and (Weighted combination) fusion.

[0035] The proxy model uses the Adam optimizer with a learning rate of [missing information]. Each round of federal training is followed by 30 rounds of distillation training. Based on total losses... Calculate the gradient and use the optimizer to update the surrogate model. Parameters: ; in, These are the updated parameters.

[0036] Step S3: Train a generative adversarial network on the trained proxy model to generate adversarial examples.

[0037] Continue reading Figure 3 The malicious client contains a generative adversarial network (GAN) module. The GAN consists of a generator G and a discriminator D. The generator uses a U-Net architecture, while the discriminator uses a CNN constructed from multiple ordinary convolutional layers for global binary classification.

[0038] Image to be processed Input generator Obtain counter-disturbance Generate adversarial examples The adversarial loss, generative adversarial network loss, and soft hinge loss are jointly optimized. For the cropping operation, each element of the input tensor is restricted to the interval [0,1] to ensure that the output is a valid image.

[0039] Total loss function of the generator Represented as: ; ; ; ; in, To generate adversarial network loss, For adversarial loss on the proxy model; This is the soft hinge loss, used to limit the size of the disturbance; and To balance the weights; This indicates the preset upper limit of the disturbance; This represents the mathematical expectation. In this embodiment, , , The learning rates for both the generator and the discriminator are set to 1. The optimizer used is Adam, and one round of generator training is performed after each round of federated training.

[0040] Step S4: Use the generated adversarial examples to launch a black-box attack on the target global model in federated learning.

[0041] After training, the malicious client uses the trained generator G to generate adversarial examples. Direct attack on global model This enables non-targeted attacks in black-box scenarios. Training ends when a preset number of iterations is reached (100 iterations in this embodiment). During iteration, the learning rates of both the proxy model and the generative adversarial network are dynamically adjusted.

[0042] To verify the effectiveness of this method, comparative experiments were conducted with three existing black-box attack methods under the same federated learning environment and dataset: ① Fast Gradient Sign Method (FGSM), with a step size of 0.01 and 1 iteration; ② Projected Gradient Descent (PGD), with a step size of 0.01 and 40 iterations; ③ Direct AdvGAN method (training the generative adversarial network directly on the noisy shadow model without using dynamic knowledge distillation). All adversarial perturbations were constrained by the L2 norm, with an upper limit set to... The attack targets a global model protected by differential privacy. The attack success rate (ASR) is defined as the proportion of samples that successfully mislead the model's predictions. Each experiment was repeated 5 times, and the mean and standard deviation were taken. The experimental results are shown in Table 1.

[0043] Table 1. Comparison of attack success rates of different attack methods in a differential privacy federated learning environment.

[0044] As shown in Table 1, the attack success rate of our proposed method reaches 70.88%, significantly higher than FGSM (61.24%), PGD (58.03%), and Direct AdvGAN (54.56%). Meanwhile, the standard deviation of our method is 8.16%, lower than FGSM and Direct AdvGAN, and comparable to PGD, indicating good attack stability. The reasons for this are as follows: FGSM and PGD are gradient-based single-step or multi-step attacks. Under the interference of differential privacy noise, the gradient information is severely distorted, leading to a low attack success rate. Although Direct AdvGAN can generate adversarial examples in one go, its proxy model is directly affected by differential privacy noise, resulting in blurred decision boundaries and difficulty in the generator learning effective transferability perturbations. Our proposed method uses dynamic knowledge distillation to first train a proxy model that filters out noise and retains core decision features. Then, a generative adversarial network is trained on this proxy model, thereby giving the generated adversarial examples stronger transferability and a higher attack success rate.

[0045] Example 2 A federated learning adversarial attack system includes: The shadow model building module is used by attackers to participate in federated learning to obtain global model parameters and build a shadow model that tracks the decision boundary of the target model. The dynamic distillation training module is used to train the proxy model through dynamic knowledge distillation using the shadow model. During the training process, dynamic knowledge distillation integrates the basic distillation of clean samples and the adversarial detection of adversarial samples, and dynamically adjusts the weights of the basic distillation and adversarial detection. The Generative Adversarial Network (GAN) training module is used to train a GAN on a pre-trained proxy model to generate adversarial examples. The attack execution module is used to carry out black-box attacks on the target global model in federated learning using generated adversarial examples.

[0046] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0047] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0048] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0049] It is worth noting that all contents not described in detail in this invention are existing technologies and are well known to those skilled in the art.

[0050] Therefore, the present invention employs the aforementioned federated learning adversarial attack method, system, device, and medium to simultaneously train the proxy model during the training of the generative adversarial network, thereby filtering out differential privacy noise and retaining core decision features, and effectively generating adversarial examples.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A federated learning adversarial attack method, characterized in that, Includes the following steps: Step S1: The attacker participates in federated learning to obtain global model parameters and construct a shadow model that tracks the decision boundary of the target model. Step S2: Train the proxy model using the shadow model through dynamic knowledge distillation. During the training process, dynamic knowledge distillation integrates the basic distillation of clean samples and the adversarial detection of adversarial samples, and dynamically adjusts the weights of the basic distillation and adversarial detection. Step S3: Train a generative adversarial network on the trained proxy model to generate adversarial examples; Step S4: Use the generated adversarial examples to launch a black-box attack on the target global model in federated learning; Dynamic knowledge distillation includes basic distillation paths and adversarial detection paths; Loss function of the basic distillation path Represented as: ； in, For cross-entropy loss, Let KL divergence be the KL divergence. and These are the outputs of the shadow model and the proxy model, respectively. The distillation temperature. As a balance factor, For the Softmax function, The true label of the input image; Loss function for adversarial detection paths Represented as: ； in, The logits output of the proxy model against adversarial examples. This is the logits output of the shadow model against adversarial examples. For adversarial examples; Dynamic knowledge distillation uses an adaptive weighting function The weights of the basic distillation path and the adversarial detection path are dynamically adjusted, and the adaptive weight function is expressed as follows: ； in, To normalize the training progress, For the current training round, For the total number of training rounds, The center offset, This refers to the slope coefficient; Total loss function of dynamic knowledge distillation Represented as: ； in, Distillation loss of soft labels on normal samples; The method is applied to a federated learning environment with differential privacy protection, which includes gradient pruning and Gaussian noise injection. The parameters of the shadow model contain differential privacy noise, and the proxy model learns the class probability output of the shadow model through dynamic knowledge distillation.

2. The federated learning adversarial attack method according to claim 1, characterized in that, Generative adversarial networks consist of a generator G and a discriminator D; the original image is... The input generator G is subjected to adversarial perturbations. Generate adversarial examples ,in For cropping operations; Training a generative adversarial network includes a generator loss function. : ； in, For adversarial loss on the proxy model, To generate adversarial network loss, For soft hinge loss, and To balance the weights.

3. The federated learning adversarial attack method according to claim 2, characterized in that, soft hinge loss function Represented as: ； in, This is the preset upper limit of the disturbance; Generative Adversarial Network Loss Represented as: ； in, This is the output of the discriminator.

4. The federated learning adversarial attack method according to claim 1, characterized in that, The shadow model has the same structure as the global model, and the parameters of the shadow model are synchronized in real time through each round of communication via federated learning; the proxy model is a lightweight network structure.

5. A federated learning adversarial attack system, characterized in that, A method for executing a federated learning adversarial attack as described in any one of claims 1-4, comprising: The shadow model building module is used by attackers to participate in federated learning to obtain global model parameters and build a shadow model that tracks the decision boundary of the target model. The dynamic distillation training module is used to train the proxy model through dynamic knowledge distillation using the shadow model. During the training process, dynamic knowledge distillation integrates the basic distillation of clean samples and the adversarial detection of adversarial samples, and dynamically adjusts the weights of the basic distillation and adversarial detection. The Generative Adversarial Network (GAN) training module is used to train a GAN on a pre-trained proxy model to generate adversarial examples. The attack execution module is used to carry out black-box attacks on the target global model in federated learning using generated adversarial examples.

6. An electronic device, comprising: Memory and processor; The memory stores a computer program, characterized in that when the processor executes the computer program, it implements the steps of a federated learning adversarial attack method according to any one of claims 1-5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When a computer program is executed by a processor, it implements the steps of any one of the federated learning adversarial attack methods according to claims 1-5.

Images