Backdoor attack detection method and system based on double-layer processing federated learning
By introducing a two-layer processing mechanism, utilizing dimensional normalization and residual scaling, and combining model alignment metrics and mainstream symbol alignment metrics, malicious updates in federated learning are identified and eliminated, solving the problem of difficult identification of malicious updates in existing technologies and achieving efficient backdoor attack defense.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUNAN NORMAL UNIVERSITY
- Filing Date
- 2026-04-22
- Publication Date
- 2026-06-16
Smart Images
Figure CN122226475A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of security detection technology in federated learning, specifically to a method and system for detecting backdoor attacks in federated learning based on two-layer processing. Background Technology
[0002] Federated learning, as a distributed machine learning paradigm, allows participants to collaboratively train a global model without sharing raw data, and has been widely applied in finance, healthcare, and edge computing. However, the training mechanism of federated learning makes it vulnerable to backdoor attacks: malicious clients can upload carefully crafted local model updates, implanting hidden backdoors into the global model. This causes the model to output incorrect labels specified by the attacker when encountering specific triggering patterns, while the prediction of normal samples remains unaffected. Because backdoor attacks do not impair the model's accuracy on the main task, they are highly concealed and difficult to detect. To defend against backdoor attacks, existing defense methods mainly fall into the following categories: first, Byzantine robust aggregation methods, such as Krum and Trimmed Mean, which eliminate abnormal updates using statistical features (such as median distance); second, similarity-based methods, such as Foolsgold and RFA, which identify malicious updates by calculating cosine similarity or Euclidean distance; third, clustering-based methods, which divide updates into benign and malicious clusters using DBSCAN or spectral clustering; and fourth, methods based on historical information, which detect attackers by analyzing the long-term consistency of client updates. These methods have all achieved certain results in different scenarios. However, existing methods rely on relatively simple preprocessing techniques for model updates before similarity calculation. They typically use the original gradient or update vector directly for similarity calculation, without fully considering the differences in the dimensions, variance, and distribution patterns of different feature dimensions. When attackers use gradient scaling, projection, or other operations to make malicious updates numerically converge with benign updates, existing methods struggle to effectively amplify the essential differences between the two before similarity calculation, leading to a decrease in the accuracy of anomaly detection. Summary of the Invention
[0003] The technical problem to be solved by this invention is to provide a federated learning backdoor attack detection method and system based on two-layer processing, which addresses the above-mentioned problems in the prior art. This invention aims to improve the accuracy and robustness of anomaly detection by introducing an effective preprocessing mechanism and performing multi-dimensional feature processing to amplify the differences between malicious and benign updates and identify abnormal clients, thereby achieving effective defense against malicious update backdoor attacks in federated learning.
[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A federated learning backdoor attack detection method based on two-layer processing includes the following steps: S1, the server receives the model parameter update vectors uploaded by each client after performing local training based on the global model parameters issued in this round; S2, the server performs two-layer processing on the model parameter update vectors of each client, including dimensionality-level normalization and residual scaling; S3, the server calculates the model alignment index and mainstream symbol alignment index on the model parameter update vectors after two-layer processing; S4, the server eliminates abnormal clients and selects candidate clients that meet the requirements based on the model alignment index and mainstream symbol alignment index; S5, the server aggregates the model parameter update vectors of the candidate clients to generate global model parameters for the next round of issuance.
[0005] Optionally, the expression for the calculation function of the model parameter update vector in step S1 is: ; in, For the client The model parameter update vector, For the client The parameters of the model after local training are executed. These are the global model parameters issued by server t in this round.
[0006] Optionally, the function expression for dimension-level normalization in step S2 is: ; in, For the client The dimensionally normalized model parameter update vector. For the client The model parameter update vector, for Size, for Size, These are the global model parameters issued by server t in this round. A constant used to prevent division by zero; the functional expression for the residual scaling is: ; in, For the client The model parameter update vector after two-layer processing. This is the scaling factor.
[0007] Optionally, in step S3, the function expression for the server to calculate the model alignment index and the mainstream symbol alignment index for the model parameter update vector after two-layer processing is as follows: ; ; ; in, For the client Model alignment metrics For the client The model parameter update vector after two-layer processing. These are the global model parameters issued by server t in this round. for norm, for norm, For the client The mainstream symbol alignment metric, For the client The number of dimensions with the largest absolute value in the model parameter update vector. For the client The set of indices of the dimension with the largest absolute value in the model parameter update vector; This is an indicator function that takes the value when the condition is true. Otherwise ; For a symbolic function, the value can be denoted as ; for The j-th dimension, For the symbol in the first Values in each dimension; Update the total number of dimensions of the vectors for model parameters.
[0008] Optionally, step S4 includes: the server calculating the corresponding anomaly scores based on the model alignment metric and the mainstream symbol alignment metric, respectively. ; ; in, For the client The outlier score of the model alignment metric. For the client Model alignment metrics The median of the model alignment metric for all clients. Standard deviation of the model alignment metric for all clients; To take the absolute value, For the client The outlier score of the mainstream symbol alignment index, For the client The mainstream symbol alignment metric, The median of the mainstream symbol alignment metrics for all clients. The standard deviation of the mainstream symbol alignment metric for all clients; candidate clients meeting the criteria are selected based on outlier scores: ; in, For the set of candidate clients, and These are the thresholds for the model alignment metric and the mainstream symbol alignment metric, respectively. For operation, This is the index number for the client.
[0009] Optionally, step S5 includes: S5.1, the server updates the vectors based on the model parameters of each candidate client and calculates the pruning threshold: ; in, The cropping threshold, To obtain the median function, for L2 norm, For the client The model parameter update vector, A set of candidate clients; S5.2, Perform orientation-preserving pruning on the model parameter update vectors of each candidate client based on the pruning threshold: ; in, Candidate Clients The clipped model parameter update vector The function is for finding the minimum value; In S5.3, the server aggregates the model parameter update vectors after pruning the candidate clients to generate global model parameters for the next round of distribution.
[0010] Optionally, the function expression for aggregating and generating global model parameters for the next round of distribution in step S5.3 is as follows: ; ; in, To aggregate and update the vector, For the set of candidate clients, Candidate Clients The clipped model parameter update vector Candidate Clients Local data volume The global model parameters will be issued by the server in the next round (t+1). These are the global model parameters issued by server t in this round. This is the learning rate.
[0011] The present invention also provides a federated learning backdoor attack detection system based on two-layer processing, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the federated learning backdoor attack detection method based on two-layer processing.
[0012] The present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the two-layer processing-based federated learning backdoor attack detection method by a processor.
[0013] The present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the two-layer processing-based federated learning backdoor attack detection method via a processor.
[0014] Compared with existing technologies, this invention mainly achieves the following beneficial effects: To address the problem in existing federated learning backdoor defense methods where the lack of effective preprocessing leads to indistinct differences between malicious and benign updates, this invention introduces a two-layer processing mechanism before aggregation. By introducing dimensional normalization and residual scaling, the distribution characteristics of the update vector are reshaped. Without changing the numerical result of cosine similarity, the statistical properties of the vector are significantly affected, effectively amplifying the feature differences between malicious and benign updates. Subsequently, based on the model parameter update vector after two-layer processing, model alignment index and mainstream symbol alignment index are calculated. Abnormal clients are eliminated, and qualified candidate clients are selected. The model parameter update vectors of the candidate clients are aggregated to generate global model parameters for the next round of distribution, thereby improving the accuracy and robustness of anomaly detection and achieving effective defense against malicious update backdoor attacks in federated learning. Attached Figure Description
[0015] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.
[0016] Figure 2 This is a schematic diagram of the interaction process between the server and the client in an embodiment of the present invention. Detailed Implementation
[0017] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.
[0018] like Figure 1As shown, the federated learning backdoor attack detection method based on two-layer processing in this embodiment includes the following steps: S1, the server receives the model parameter update vector uploaded by each client after performing local training based on the global model parameters issued in this round; S2, the server performs two-layer processing on the model parameter update vectors of each client, including dimensionality normalization and residual scaling; S3, the server calculates the model alignment index (Top-Down Alignment, similarity between the model parameter update vector and the global model parameters) and the majority pattern sign agreement index on the model parameter update vectors after two-layer processing; S4, the server eliminates abnormal clients and selects candidate clients that meet the requirements based on the model alignment index and the majority pattern sign agreement index; S5, the server aggregates the model parameter update vectors of the candidate clients to generate global model parameters for the next round of issuance.
[0019] like Figure 2 As shown, in this embodiment, there are N clients in total, where N=20, and each round a client is randomly selected. Number of clients participating in training, client participation ratio This means that all clients participate in each round. The server starts from the initial global model parameters. At the beginning, in each round, the global model parameters issued by server t for that round will be used. The data is distributed to all clients. Each client uses its local data for model training; in this embodiment, the number of local training rounds is [number missing]. Round, local learning rate The momentum coefficient is The weight decays to The malicious client creates backdoor data according to a preset attack strategy. In this embodiment, the number of malicious clients is... This means that out of 20 clients, 2 are malicious. Attack types can be selected as BadNet, DBA, Neurotoxin, or PGD, with varying poisoning ratios. Target category It should be noted that the global model for federated learning can be selected as needed. For example, the ResNet9 network can be selected as the global model. Its input and output can be selected according to the needs of the application scenario. For example, in this embodiment, the input of the ResNet9 network is a 3×32×32 tensor, corresponding to the original image data with RGB three channels and a size of 32×32 pixels; the output is a 10-dimensional vector, where each dimension represents the probability that the image belongs to the corresponding category (airplane, car, bird, cat, deer, dog, frog, horse, boat, truck) in the CIFAR-10 dataset. The dimension with the highest probability is taken as the final classification result.
[0020] The expression for the calculation function of the model parameter update vector in step S1 of this embodiment is: ; in, For the client The model parameter update vector, For the client The parameters of the model after local training are executed. These are the global model parameters issued by server t in this round. In this embodiment, the server receives all of them. Model parameter update vector uploaded by each client .
[0021] The function expression for dimension-level normalization in step S2 of this embodiment is: ; in, For the client The dimensionally normalized model parameter update vector. For the client The model parameter update vector, for Size, for Size, These are the global model parameters issued by server t in this round. This is a constant used to prevent division by zero; the operation divides the update value of each dimension by the sum of the absolute value of the update of that dimension and the absolute value of the corresponding parameter in the global model, so that clients with smaller update magnitudes receive relatively higher weights.
[0022] The function expression for residual scaling in step S2 of this embodiment is: ; in, For the client The model parameter update vector after two-layer processing. This is the scaling factor. The server uses a preset scaling factor. The normalized update is scaled in this embodiment. In conjunction with normalization, residual scaling is enabled to amplify the abnormal characteristics of malicious clients.
[0023] In step S3 of this embodiment, the function expressions for calculating the model alignment index and the mainstream symbol alignment index of the server on the model parameter update vector after two-layer processing are as follows: ; ; ; in, For the client The model alignment metric, specifically using the client... The model parameter update vector after two-layer processing With global model parameters Cosine similarity; For the client The model parameter update vector after two-layer processing. These are the global model parameters issued by server t in this round. for norm, for norm, For the client The mainstream symbol alignment metric, For the client The number of dimensions with the largest absolute value in the model parameter update vector. For the client The set of indices of the dimension with the largest absolute value in the model parameter update vector; This is an indicator function that takes the value when the condition is true. Otherwise ; For a symbolic function, the value can be denoted as ; for The j-th dimension, For the symbol in the first Values in each dimension (mainstream symbols); The total number of dimensions for updating the model parameter vectors. In this embodiment, the server first calculates the main symbols updated by all clients. Then for each client , Select the one with the largest absolute value in its update. Dimensions ( (The total number of model parameters) The proportion of symbols consistent with the mainstream across these dimensions is used as the mainstream symbol alignment index. In this embodiment... That is, only focus on Significant parameter dimensions. The smaller the value, the more likely the update is malicious, as it deviates from the mainstream direction in key dimensions.
[0024] In this embodiment, step S4 includes: the server calculates the corresponding anomaly scores (anomaly detection statistics based on the median and standard deviation) according to the model alignment index and the mainstream symbol alignment index respectively. ; ; in, For the client The outlier score of the model alignment metric. For the client Model alignment metrics The median of the model alignment metric for all clients. Standard deviation of the model alignment metric for all clients; To take the absolute value, For the client The outlier score of the mainstream symbol alignment index, For the client The mainstream symbol alignment metric, The median of the mainstream symbol alignment metrics for all clients. The standard deviation of the mainstream symbol alignment metric for all clients; candidate clients meeting the criteria are selected based on outlier scores: ; in, For the set of candidate clients, and These are the thresholds for the model alignment metric and the mainstream symbol alignment metric, respectively. For operation, This is the client's index number. The server calculates the median and standard deviation based on the model alignment metric and the mainstream sign alignment metric, respectively. Then, it calculates the outlier score for each client. The outlier score is based on the median, not the mean, to ensure robustness against outliers. Clients that simultaneously meet these criteria are then selected. and The client as a benign collection In this embodiment , If the benign set is empty, a zero update is returned to avoid model crashing. By filtering candidate clients that meet the requirements based on anomaly scores, the accuracy and robustness of anomaly detection can be significantly improved, ultimately achieving effective defense against malicious updates.
[0025] In this embodiment, step S5 includes: S5.1, the server updates the vectors based on the model parameters of each candidate client and calculates the pruning threshold: ; in, The cropping threshold, To obtain the median function, for L2 norm, For the client The model parameter update vector, The set of candidate clients (a benign set); S5.2, Perform orientation-preserving pruning on the model parameter update vectors of each candidate client based on the pruning threshold: ; in, Candidate Clients The clipped model parameter update vector The function is for finding the minimum value; In step S5.3, the server aggregates the pruned model parameter update vectors from the candidate clients to generate global model parameters for the next round of deployment. In steps S5.1 and S5.2, the server extracts the set of candidate clients. For the original updates from the client (updates before preprocessing), calculate the L2 norm of each update, take the median of these norms as the pruning threshold, and then perform directional preservation pruning on the original updates from all clients (including those judged to be malicious). This operation can effectively limit the extreme magnitude of malicious updates.
[0026] The server only processes the set of candidate clients. Aggregate data from each client, with the weight being the amount of local data on each client. In this embodiment, the function expression for aggregating and generating global model parameters for the next round of distribution in step S5.3 is as follows: ; ; in, To aggregate and update the vector, For the set of candidate clients, Candidate Clients The clipped model parameter update vector Candidate Clients Local data volume The global model parameters will be issued by the server in the next round (t+1). These are the global model parameters issued by server t in this round. The learning rate is used. After each round of aggregation, the server records detection performance metrics: TPR (True Validity Rate), which is the proportion of correctly identified benign clients, and FPR (False Validity Rate), which is the proportion of incorrectly identified malicious clients. Simultaneously, the accuracy of the global model on the clean test set and the attack success rate on the backdoor test set in the current round are recorded to evaluate the defense effectiveness. The above steps are repeated until a preset number of rounds is reached, ultimately completing federated learning and obtaining a trained global model. In this embodiment, the preset number of rounds is 100.
[0027] To verify the effectiveness of the federated learning backdoor attack detection method based on two-layer processing in this embodiment, experiments were conducted on the CIFAR-10 dataset. The data distribution adopted a non-independent and identically distributed setting (implemented through Dirichlet distribution, parameter β=0.5), and the global model used a ResNet9 network. The experiments simulated different types of backdoor attack methods (including badnet, DBA, and Neurotoxin) and compared the method of this embodiment (hereinafter referred to as "this method") with the contrasting method (AlignIns). The results are shown in Table 1.
[0028] Table 1: Comparison of experimental results between the method in this embodiment and the comparative method
[0029] As shown in Table 1, under the three typical backdoor attack scenarios of BadNet, DBA, and Neurotoxin, our proposed method effectively reduces the backdoor attack success rate (BA) while maintaining a main task accuracy (MA) comparable to or better than the baseline method. Particularly under Neurotoxin attacks, MA is improved by approximately 2%, and BA is reduced by approximately 1%. Regarding the total response rate (TPR), our method maintains a low and stable level under different attack types and trigger rates, indicating that it possesses good backdoor sample detection capabilities. Overall, our proposed method demonstrates strong robustness and stability under different attack types and trigger rate settings, effectively defending against malicious update backdoor attacks.
[0030] Furthermore, this embodiment also provides a federated learning backdoor attack detection system based on two-layer processing, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the federated learning backdoor attack detection method based on two-layer processing. This embodiment also provides a computer-readable storage medium storing a computer program or instructions programmed or configured to execute the federated learning backdoor attack detection method based on two-layer processing via a processor. This embodiment also provides a computer program product including a computer program or instructions programmed or configured to execute the federated learning backdoor attack detection method based on two-layer processing via a processor.
[0031] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0032] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.
Claims
1. A federated learning backdoor attack detection method based on two-layer processing, characterized in that, The process includes the following steps: S1, the server receives the model parameter update vectors uploaded by each client after performing local training based on the global model parameters issued in this round; S2, the server performs two-layer processing on the model parameter update vectors of each client, including dimension-level normalization and residual scaling; S3, the server calculates the model alignment index and mainstream symbol alignment index on the model parameter update vectors after the two-layer processing. S4, the server eliminates abnormal clients and selects qualified candidate clients based on model alignment metrics and mainstream symbol alignment metrics; S5, the server updates vector aggregation based on the model parameters of the candidate clients to generate global model parameters for the next round of distribution.
2. The federated learning backdoor attack detection method based on two-layer processing according to claim 1, characterized in that, The expression for the calculation function of the model parameter update vector in step S1 is: ； in, For the client The model parameter update vector, For the client The parameters of the model after local training are executed. These are the global model parameters issued by server t in this round.
3. The federated learning backdoor attack detection method based on two-layer processing according to claim 1, characterized in that, The function expression for dimension-level normalization in step S2 is: ； in, For the client The dimensionally normalized model parameter update vector. For the client The model parameter update vector, for Size, for Size, These are the global model parameters issued by server t in this round. A constant used to prevent division by zero; the functional expression for the residual scaling is: ； in, For the client The model parameter update vector after two-layer processing. This is the scaling factor.
4. The federated learning backdoor attack detection method based on two-layer processing according to claim 1, characterized in that, In step S3, the function expressions for calculating the model alignment index and the mainstream symbol alignment index for the server's updated model parameter vector after two-layer processing are as follows: ； ； ； in, For the client Model alignment metrics For the client The model parameter update vector after two-layer processing. These are the global model parameters issued by server t in this round. for norm, for norm, For the client The mainstream symbol alignment metric, For the client The number of dimensions with the largest absolute value in the model parameter update vector. For the client The set of indices of the dimension with the largest absolute value in the model parameter update vector; This is an indicator function that takes the value when the condition is true. Otherwise ; For a symbolic function, the value can be denoted as ; for The j-th dimension, For the symbol in the first Values in each dimension; Update the total number of dimensions of the vectors for model parameters.
5. The federated learning backdoor attack detection method based on two-layer processing according to claim 1, characterized in that, Step S4 includes: The server calculates the corresponding anomaly scores based on the model alignment metric and the mainstream symbol alignment metric, respectively. ； ； in, For the client The outlier score of the model alignment metric. For the client Model alignment metrics The median of the model alignment metric for all clients. Standard deviation of the model alignment metric for all clients; To take the absolute value, For the client The outlier score of the mainstream symbol alignment index, For the client The mainstream symbol alignment metric, The median of the mainstream symbol alignment metrics for all clients. The standard deviation of the mainstream symbol alignment metric for all clients; candidate clients meeting the criteria are selected based on outlier scores: ； in, For the set of candidate clients, and These are the thresholds for the model alignment metric and the mainstream symbol alignment metric, respectively. For operation, This is the index number for the client.
6. The federated learning backdoor attack detection method based on two-layer processing according to claim 1, characterized in that, Step S5 includes: S5.1, the server updates the vectors based on the model parameters of each candidate client and calculates the pruning threshold: ； in, The cropping threshold, To obtain the median function, for L2 norm, For the client The model parameter update vector, A set of candidate clients; S5.2, Perform orientation-preserving pruning on the model parameter update vectors of each candidate client based on the pruning threshold: ； in, Candidate Clients The clipped model parameter update vector The function is for finding the minimum value; In S5.3, the server aggregates the model parameter update vectors after pruning the candidate clients to generate global model parameters for the next round of distribution.
7. The federated learning backdoor attack detection method based on two-layer processing according to claim 6, characterized in that, The function expression for aggregating and generating global model parameters for the next round of distribution in step S5.3 is as follows: ； ； in, To aggregate and update the vector, For the set of candidate clients, Candidate Clients The clipped model parameter update vector Candidate Clients Local data volume The global model parameters will be issued by the server in the next round (t+1). These are the global model parameters issued by server t in this round. This is the learning rate.
8. A federated learning backdoor attack detection system based on two-layer processing, comprising interconnected microprocessors and memory, characterized in that, The microprocessor is programmed or configured to execute the federated learning backdoor attack detection method based on two-layer processing as described in any one of claims 1 to 7.
9. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the federated learning backdoor attack detection method based on two-layer processing as described in any one of claims 1 to 7.
10. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the federated learning backdoor attack detection method based on two-layer processing as described in any one of claims 1 to 7.