Tag inference attack defense method, system, device and readable storage medium

Abstract

The application provides a label inference attack defense method, system, device and readable storage medium. The method comprises the following steps: generating a target key of a current training batch, and determining a sampling probability corresponding to each sample in the current training batch based on the target key; determining a target sample set participating in gradient aggregation of the current training batch based on the sampling probability of each sample; and determining and sending an aggregated gradient for updating a passive party model parameter based on the gradient of the sample in the target sample set. Compared with the prior art, the application drives the generation of the sampling probability by introducing the target key, so that the attacker cannot establish a stable mapping between the gradient and the label across rounds, thereby fundamentally preventing the label inference attack based on statistical fitting, and overcoming the technical defect that the static defense is easy to be cracked for a long time. Meanwhile, the application does not depend on any auxiliary model, and does not increase the communication rounds or encryption calculation between the participants. The deployment cost is extremely low while the privacy protection is realized.

Description

Technical Field

[0001] This invention belongs to the field of federated learning technology, specifically relating to a method, system, device, and readable storage medium for defending against tag-based inference attacks. Background Technology

[0002] Vertical federated learning (VFL) enables collaborative modeling across institutions without requiring data to leave the local machine, and is widely used in privacy-sensitive scenarios such as financial risk control and medical diagnosis. In a typical VFL architecture, during training, each party only exchanges intermediate gradients and embedding representations; the original data and labels remain on-premises, which reduces the risk of direct leakage to some extent.

[0003] However, research indicates that the aforementioned architecture still harbors serious privacy vulnerabilities. A malicious passive party could exploit the received gradient feedback to launch a label inference attack, gradually recovering the active party's private labels by analyzing the statistical correlation between gradients and labels.

[0004] To address this threat, researchers have proposed various defense strategies, such as adding random noise to gradients, label obfuscation, or introducing auxiliary models and cryptographic protocols. However, these methods generally face a dilemma: enhancing defense strength often comes at the cost of a significant decrease in the accuracy of the primary task or a significant increase in system overhead. More importantly, existing defense strategies are mostly static mechanisms, with their noise-adding parameters or obfuscation rules remaining unchanged during training. Malicious attackers can accumulate gradient information through multiple rounds of training, approximate the defense patterns through statistical analysis, and ultimately render the defense ineffective.

[0005] Therefore, in order to address the above-mentioned technical problems, it is necessary to provide a method, system, device, and readable storage medium for defending against tag-based inference attacks.

[0006] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0007] The purpose of this invention is to provide a method, system, device, and readable storage medium for defending against tag-based inference attacks, which can solve the problem of privacy leakage caused by inference attacks.

[0008] To achieve the above objectives, the technical solution provided by the present invention is as follows:

[0009] In a first aspect, the present invention provides a method for defending against label inference attacks, applied to the active party in vertical federated learning, comprising:

[0010] Generate the target key for the current training batch, and determine the sampling probability corresponding to each sample in the current training batch based on the target key;

[0011] Based on the sampling probability of each sample, determine the target sample set for gradient aggregation in the current training batch;

[0012] Based on the gradients of the samples in the target sample set, an aggregated gradient is determined and sent to update the passive square model parameters.

[0013] In one or more embodiments of the present invention, determining and sending an aggregated gradient for updating the passive square model parameters based on the gradients of samples in the target sample set includes:

[0014] Obtain the sampling probability of each sample in the target sample set, and calculate the weight corresponding to each sample; wherein, the weight is the product of the reciprocal of the total number of samples in the current training batch and the reciprocal of the sampling probability corresponding to the sample;

[0015] The weighted gradient of each sample in the target sample set is determined, and the weighted gradients are summed to obtain the aggregated gradient; wherein the weighted gradient is the product of the gradient of the sample and the corresponding weight of the sample.

[0016] In one or more embodiments of the present invention, generating the target key for the current training batch includes:

[0017] The preset original key is concatenated with the batch identifier corresponding to the current training batch and / or the round identifier of the current training round to generate a concatenated string;

[0018] Using the concatenated string as input, the target key is generated based on a preset key derivation algorithm, wherein the target keys corresponding to different batches and / or different rounds are different, and the key derivation algorithm is a deterministic transformation.

[0019] In one or more embodiments of the present invention, determining the sampling probability corresponding to each sample in the current training batch based on the target key includes:

[0020] Based on the target key, generate a corresponding pseudo-random number for each sample in the current training batch, wherein the pseudo-random number is greater than or equal to 0 and less than or equal to 1;

[0021] The pseudo-random numbers corresponding to each sample in the current training batch are mapped to the interval formed by the preset minimum sampling probability and the maximum sampling probability to obtain the sampling probability corresponding to the sample.

[0022] In one or more embodiments of the present invention, the pseudo-random number corresponding to each sample in the current training batch is mapped to the interval formed by the preset minimum sampling probability and the maximum sampling probability, and the sampling probability corresponding to the sample is obtained as follows:

[0023]

[0024] in, The sampling probability corresponding to the sample; The preset minimum sampling probability; The preset maximum sampling probability; is the pseudo-random number corresponding to the sample.

[0025] In one or more embodiments of the present invention, the preset minimum sampling probability is greater than 0, and / or the preset maximum sampling probability is less than or equal to 1.

[0026] In one or more embodiments of the present invention, after determining the target sample set for gradient aggregation in the current training batch, the method further includes:

[0027] Obtain the samples in the target sample set and the labels corresponding to the samples, and determine the gradient of the samples based on forward propagation and / or backward propagation;

[0028] Set the gradient of samples that do not belong to the target sample set to zero.

[0029] Secondly, the present invention provides a tag-based inference attack defense system, comprising:

[0030] The generation module is used to generate the target key for the current training batch and determine the sampling probability corresponding to each sample in the current training batch based on the target key.

[0031] The first determining module is used to determine the target sample set for gradient aggregation in the current training batch based on the sampling probability of each sample.

[0032] The second determining module is used to determine and send the aggregated gradient for updating the passive square model parameters based on the gradient of the samples in the target sample set.

[0033] Thirdly, the present invention provides an electronic device comprising:

[0034] At least one processor; and

[0035] A memory that stores instructions that, when executed by the at least one processor, cause the at least one processor to execute the tag inference attack defense method.

[0036] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the aforementioned tag inference attack defense method.

[0037] Compared with existing technologies, the label inference attack defense method provided by this invention introduces a target key to drive the generation of sampling probabilities. This results in unpredictable dynamic changes in which sample gradients are used for aggregation in each batch, and the sampling behavior is dynamically updated with training rounds and batches. Attackers cannot establish a stable mapping between gradients and labels across rounds, thus fundamentally preventing label inference attacks based on statistical fitting and overcoming the technical deficiency of static defenses being easily cracked over a long period.

[0038] Meanwhile, this invention only modifies the sample selection logic within the active party, without relying on any auxiliary models, introducing trusted third-party servers, or increasing the number of communication rounds or encrypted computations between participants. It achieves privacy protection while completely preserving the original VFL's communication efficiency and system architecture, resulting in extremely low deployment costs. It is applicable to various tag inference attack scenarios and has strong adaptability. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram illustrating an implementation scenario of the tag inference attack defense method in one embodiment of the present invention;

[0041] Figure 2 This is a flowchart of a tag inference attack defense method according to an embodiment of the present invention;

[0042] Figure 3 This is a structural block diagram of a tag inference attack defense system according to another embodiment of the present invention;

[0043] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0044] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0045] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0046] Existing technologies commonly employ static defense mechanisms, such as adding random noise of fixed amplitude to the transmitted gradient, using constant label mapping rules for obfuscation, or pre-setting fixed soft label perturbation strategies. While these mechanisms allow for configuration of defense parameters before federated learning begins and are simple to implement, their fundamental flaw lies in the fact that once determined, these parameters remain unchanged throughout the multiple iterations. This static characteristic allows attackers to leverage the inherent multi-round interaction of vertical federated learning, accumulating gradient information across rounds and performing systematic statistical analysis to gradually approximate the statistical distribution of the added noise, or to deduce the mapping rules of label obfuscation. As the number of training rounds increases, the defense effectiveness inevitably suffers irreversible decay, ultimately allowing attackers to completely break the defense mechanism and achieve high-precision recovery of user privacy labels.

[0047] The inventors recognized that existing technical solutions often face a dilemma in addressing the aforementioned problems. Improving defense effectiveness by increasing noise amplitude or perturbation strength significantly sacrifices model training accuracy and convergence performance. Introducing additional generative adversarial networks or complex cryptographic protocols, such as homomorphic encryption and secure multi-party computation, incurs enormous communication overhead and computational burden, making them impractical in resource-constrained federated learning scenarios. Based on a profound understanding of these technical limitations, the inventors moved beyond the traditional mindset of static defense and sacrificing accuracy for security. Starting from the fundamental mechanism of disrupting the long-term statistical consistency upon which attackers rely for success, they proposed a completely new technical implementation path.

[0048] Specifically, this invention utilizes a secret key held solely by the active party to dynamically generate unpredictable random sampling probabilities in each training batch. Based on these probabilities, it secretly and selectively discards gradient information from some samples. The core innovation of this operation lies in the fact that it does not simply add noise or obfuscate the mapping, but rather severs the stable statistical correlation between the gradient flow and the true label at the information theory level. Even if an attacker accumulates a large amount of gradient data across rounds, they cannot extract statistical patterns that can be used for regression or classification, because which samples' gradients are retained and which are discarded in each batch is determined by the unpredictable sequence generated in real time.

[0049] In summary, this invention defeats various tag inference attacks at their source, including but not limited to gradient analysis attacks, model inversion attacks, and statistical inference attacks, without introducing any additional communication overhead or significant computational burden.

[0050] Please see Figure 1 , Figure 1 This diagram illustrates an application scenario of the label inference attack defense method provided by an embodiment of the present invention. The application scenario is based on a vertical federated learning architecture, including an active party and at least one passive party. The active party holds the label data (Label) of all training samples and some feature data (Feature A), while the passive party holds the remaining feature data (Feature B) of the same batch of samples but does not hold the labels. During training, the two parties do not directly exchange raw data and labels; they only exchange intermediate computation results through a server to jointly train a global model.

[0051] To defend against various label inference attacks initiated by the passive party, this invention configures a LISS (Label-Inference-proof Secret Subsampling) defense module on the active party's side. This module is embedded in the active party's gradient aggregation and transmission process, dynamically processing the gradients to be sent back to the passive party in each training batch. The LISS module specifically includes: a key control randomization component (Master Seed + PRF(k)), a secret subsampling component, and an unbiased weighted correction component (IPW Correction). These three components are sequentially connected to achieve the step-by-step transmission of data and control.

[0052] Specifically, the communication network upon which the communication connection relies can include various connection types, such as wired connections (e.g., Ethernet), wireless connections (e.g., Wi-Fi, Bluetooth, 5G), or fiber optic cable connections. This communication network can be a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), or any combination of these, to support data interaction between internal components of the active party and gradient transmission between the active and passive parties.

[0053] Furthermore, the key-controlled randomization component is used to generate batch- and sample-specific randomness using cryptographic pseudo-random functions. Its role is to ensure that sampling behavior varies across different rounds and remains unpredictable to attackers, thereby preventing long-term statistical fitting of defense patterns.

[0054] The secret subsampling component strictly and selectively suppresses the gradient contribution of some samples on the active side. Its function is to break the stable correspondence between gradient flow and label information, ensuring that the passive side cannot determine whether weak or missing gradients are caused by sample exclusion or by the inherent properties of the training dynamics themselves.

[0055] The unbiased weighted correction component rescales the retained samples based on their sampling probabilities. Its function is to compensate for biases caused by sampling and maintain the mathematical expectation of the original full-batch gradients, thereby preserving the trainability and convergence behavior of the VFL model.

[0056] These three components together endow LISS with two desirable properties: enhanced privacy, because attackers can no longer accumulate stable gradient-label mappings over multiple rounds; and improved compatibility, because the corrected gradients are still unbiased estimators of the original training gradients.

[0057] Please refer to Figure 2 The diagram shown illustrates a flowchart of a tag-based inference attack defense method according to an embodiment of the present invention. This tag-based inference attack defense method specifically includes the following steps:

[0058] S201: Generate the target key for the current training batch, and determine the sampling probability corresponding to each sample in the current training batch based on the target key;

[0059] This step is performed by the active party in vertical federated learning, with the aim of providing an unpredictable and round-varying source of randomness for subsequent secret subsampling, thereby disrupting the ability of a malicious passive party to establish a stable mapping through long-term gradient observations.

[0060] First, the active party generates the target key for the current training batch. In one implementation, the active party pre-stores a high-entropy original key that is held only by itself and not disclosed to others. In each training round, when processing a batch, the active party obtains the round identifier of the current training round and the batch identifier of the current batch. The active party concatenates the original key with the round identifier and the batch identifier to form a binary string. Then, the active party inputs this concatenated string into a preset key derivation algorithm. The key derivation algorithm outputs a fixed-length value as the target key for the current training batch.

[0061] In one implementation, the target key is generated based on a preset pseudo-random function (PRF), and can be further expressed as:

[0062]

[0063] in, The target key; The original key; This serves as the round identifier for the current training round. This is the batch identifier for the current batch.

[0064] Because the identifiers differ between rounds and batches, the generated target keys also differ, making it impossible for attackers to predict the random behavior of the current batch from the historical training process. This step ensures that the sampling behavior between different batches is independent and unpredictable, effectively preventing replay attacks or statistical analysis based on historical gradients.

[0065] In this embodiment, the round identifier can be the sequence number of the global training iteration, and the batch identifier can be the sequence number of the batch in the entire training dataset or the local sequence number relative to the current round; these embodiments of the invention do not impose any limitations. Furthermore, since the active party needs to be able to fully reproduce the previous sampling behavior when training resumes after an interruption, and does not need to store the random state of each round and each batch to reduce system overhead, in a preferred embodiment, the key derivation algorithm can be a deterministic transformation, such as a hash-based message authentication code or a cryptographically secure pseudo-random function.

[0066] Furthermore, the active party can determine the sampling probability of each sample in the current training batch based on the target key. In this embodiment of the invention, the sampling probability represents the likelihood that the sample will be selected to participate in gradient aggregation in this batch.

[0067] In an exemplary embodiment, the active party uses the target key of the current batch as the seed for a random number generator, independently generating a pseudo-random number for each sample in the batch. This pseudo-random number is uniformly distributed within the interval [0,1], including 0 and 1. Simultaneously, the active party pre-configures the minimum and maximum sampling probabilities. For any sample in the current batch, the active party transforms its corresponding pseudo-random number through a linear mapping to the interval formed by the minimum and maximum sampling probabilities, thus obtaining the sampling probability corresponding to the sample.

[0068] In one implementation, the mapping formula can be:

[0069]

[0070] in, The sampling probability corresponding to the sample; The preset minimum sampling probability; The preset maximum sampling probability; is the pseudo-random number corresponding to the sample.

[0071] This mapping mechanism ensures that each sample has a non-zero probability of being selected, avoiding overfitting or underfitting caused by long-term omission of some samples. On the other hand, by assigning randomized probability values, it further obscures the direct relationship between gradient and sample importance, making it difficult for attackers to distinguish whether gradient vanishing is due to sample removal or model convergence.

[0072] In one implementation, the minimum sampling probability and the maximum sampling probability satisfy a relationship greater than 0 and less than or equal to 1, which is used to control the overall retention rate. The minimum sampling probability is typically set to a positive number to ensure that each sample has a chance to be selected during long-term training, while the maximum sampling probability is typically set to a value less than or equal to 1 to control the overall sample retention rate.

[0073] In this way, step S201 assigns a dynamic and unpredictable sampling probability to each sample, laying the foundation for randomness in subsequent sample selection and gradient correction. Simultaneously, since the target key is exclusively held by the active party, the passive party cannot reproduce or infer the sampling probability of each sample, thus effectively blocking the attacker's path to reverse-engineer the label information using the gradient missing pattern.

[0074] S202: Based on the sampling probability of each sample, determine the target sample set for the current training batch to participate in gradient aggregation;

[0075] This step is performed by the active party in vertical federated learning. Its core purpose is to randomly select the samples that truly participate in gradient feedback in the current batch based on the sampling probability corresponding to each sample, thereby cutting off the path for the malicious passive party to establish a stable statistical mapping from the continuous gradient flow.

[0076] Specifically, after obtaining the sampling probability for each sample in the current training batch, the active party independently performs a random sampling decision for each sample. For a given sample, the probability of it being selected is equal to the sampling probability calculated in the above steps, and the probability of it being excluded is equal to one minus that sampling probability.

[0077] In one embodiment, based on the sampling probability generated above LISS for each sample Perform the Bernoulli trial independently. Define the indicator variable. ,when This indicates that the sample has been selected. If the target sample is not found, it will be discarded. Therefore, the target sample set for the current batch is constructed as follows:

[0078]

[0079] It should be noted that the embodiments of the present invention do not limit the engineering implementation of the Bernoulli experiment. For example, the active party can generate a random number following a uniform distribution for each sample and compare it with the sampling probability. If the random number is less than or equal to the sampling probability of the sample, the sample is marked as selected; otherwise, it is marked as discarded. Since the sampling probability of each sample may be different, and the judgment between each sample is independent, the final selected samples constitute a set, which is the target sample set.

[0080] Samples not in this set, i.e., unselected samples, will be excluded from the gradient aggregation process in this batch. For these excluded samples, the active party will set their corresponding gradients to zero or directly mask them during subsequent gradient calculation and backpropagation stages, so that they do not participate in updating the passive party's model parameters.

[0081] It should be noted that the construction of the target sample set is entirely performed within the active party. The active party does not disclose any information to the passive party about which samples were selected or which were discarded. The passive party can only receive the aggregated gradient signal and cannot determine whether the missing or weakened gradient values ​​are due to samples being actively discarded or because the model has already converged on some samples.

[0082] Furthermore, in one implementation, to ensure long-term convergence of the training process, the sampling probability of each sample is set to be greater than zero. This means that even if a sample is not selected in the current batch, it still has the possibility of being selected in subsequent rounds. Through multiple iterations, each sample will participate in model training with a certain probability, thereby avoiding underfitting or bias caused by some samples being ignored for a long time.

[0083] S203: Based on the gradients of the samples in the target sample set, determine and send the aggregated gradient for updating the passive square model parameters.

[0084] This step is also performed by the active party in vertical federated learning. Its core purpose is to determine and send the aggregated gradient to the passive party based on the defined target sample set, so that the passive party can update the corresponding model parameters based on the aggregated gradient.

[0085] Specifically, the active party first needs to obtain the original gradients of each sample in the target sample set. This invention does not restrict the method of obtaining the sample gradients; for example, these gradients can be calculated during forward propagation and / or backward propagation. Thus, each sample in the target sample set corresponds to a gradient vector, reflecting the sample's contribution to the updating of the model parameters.

[0086] It should be noted that since this step only retains the gradients of samples from the target sample set and optionally sets the gradients of samples from non-target sample sets to 0, simply averaging the gradients of these selected samples and backpropagating them will lead to bias in the gradient estimation, meaning that its mathematical expectation will deviate from the true gradient of the entire batch of data. This bias will disrupt the convergence stability of vertical federated learning and reduce the model accuracy of the main task.

[0087] To address this issue, the present invention provides a novel implementation method that allows the active party to correct the gradient of samples in the target sample set using an inverse probability weighting method.

[0088] Specifically, the active party obtains the sampling probability corresponding to each sample in the target sample set, which has been calculated in the steps above. Simultaneously, the active party obtains the total number of samples in the current training batch, i.e., the batch size. For any sample in the target sample set, the active party calculates its weight in the aggregated gradient after it is selected.

[0089] For example, for the selected sample Assign it a correction weight Considering the sample The probability of being selected is And the total number of samples in the current training batch is The formula for calculating the weights can be:

[0090]

[0091] The weights are inversely proportional to the probability of a sample being selected. The lower the sampling probability of a sample, the higher its weight will be in the aggregate gradient once it is selected, thus compensating for the information loss that may occur when it is excluded.

[0092] Furthermore, the active party calculates the weighted gradient for each selected sample. The weighted gradient is equal to the product of the sample's original gradient and its corresponding weight. The active party sums the weighted gradients of all samples in the target sample set to obtain the aggregated gradient for the current batch.

[0093] The above embodiments can be used to aggregate gradients. Represented as:

[0094]

[0095] in, For the sample The original gradient, For the sample The corresponding weights This represents the total number of samples in the current training batch. For the sample The probability of being selected.

[0096] Mathematically, the aggregated gradient is equal to the weighted sum of all samples, where unselected samples contribute zero because the indicator variable is zero, and selected samples contribute their weighted gradients. It can be proven that the expected value of this aggregated gradient is equal to the arithmetic mean of the gradients of all samples in the entire batch; that is, it is an unbiased estimator of the true gradient. This property guarantees that vertical federated learning can still converge to an optimal solution consistent with the original training objective after introducing secret subsampling.

[0097] about It is the full gradient. The unbiased estimate can be verified based on the following formula:

[0098]

[0099] An unbiased aggregated gradient is constructed by inverse probability weighting and then sent to the passive side to update its underlying model parameters. This process ensures the mathematical correctness of the training process while preventing the passive side from deriving label information from the gradient.

[0100] After the aggregated gradient calculation is completed, the active party sends the aggregated gradient to the passive party. Upon receiving this gradient, the passive party uses it to update its own underlying model parameters, for example, through stochastic gradient descent or an adaptive optimizer. During this process, the passive party only obtains a weighted aggregated gradient signal and cannot separate the gradient information of individual samples, nor can it determine which samples are discarded and which are retained. Because the sampling probability and sampling mask are entirely controlled by the active party and not disclosed, the passive party cannot reconstruct a stable mapping relationship between the gradient and the true label through multiple rounds of gradient statistics, thus effectively defending against label inference attacks.

[0101] Furthermore, in one implementation, the active party can send the aggregated gradient without performing any additional encryption or perturbation operations, because the inverse probability weighting itself has already achieved a balance between privacy protection and model utility through mathematical transformation. This aggregated gradient maintains the same dimension and numerical range as the original gradient, does not increase communication overhead, and does not change the passive party's update protocol, thus exhibiting good engineering compatibility.

[0102] Please refer to Figure 3 As shown, based on the same inventive concept as the aforementioned tag inference attack defense method, one embodiment of the present invention provides a tag inference attack defense system 300, including: a generation module 301, a first determination module 302 and a first determination module 302.

[0103] It should be noted that the tag-based inference attack defense method of this invention can be applied to the tag-based inference attack defense system of this invention. This tag-based inference attack defense system can be configured on a terminal. The terminal can include, but is not limited to, PCs (Personal Computers), PDAs (Tablet Computers), smartphones, smart wearable devices, etc.

[0104] Specifically, the generation module 301 is used to generate the target key for the current training batch and determine the sampling probability corresponding to each sample in the current training batch based on the target key; the first determination module 302 is used to determine the target sample set for the current training batch to participate in gradient aggregation based on the sampling probability of each sample; the second determination module 303 is used to determine and send the aggregated gradient for updating the passive square model parameters based on the gradient of the samples in the target sample set.

[0105] Please refer to Figure 4 As shown, embodiments of the present invention also provide an electronic device 400, which includes at least one processor 401, a memory 402 (e.g., non-volatile memory), a main memory 403, and a communication interface 404, wherein the at least one processor 401, the memory 402, the main memory 403, and the communication interface 404 are connected together via an internal bus 405. The at least one processor 401 is configured to invoke at least one program instruction stored or encoded in the memory 402 to cause the at least one processor 401 to perform various operations and functions of tag inference attack defense described in the various embodiments of this specification.

[0106] In the embodiments of this specification, electronic device 400 may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile electronic device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable electronic device, consumer electronic device, etc.

[0107] This invention also provides a computer-readable medium carrying computer-executable instructions. When executed by a processor, these instructions can be used to implement various operations and functions of tag inference attack defense described in the various embodiments of this specification.

[0108] The computer-readable medium in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0109] In this invention, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, optical fiber, RF, etc., or any suitable combination thereof.

[0110] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus, systems, and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0112] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

[0113] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0114] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for defending against label inference attacks, applied to the active party in vertical federated learning, characterized in that, include: Generate the target key for the current training batch, and determine the sampling probability corresponding to each sample in the current training batch based on the target key; Based on the sampling probability of each sample, determine the target sample set for gradient aggregation in the current training batch; Based on the gradients of the samples in the target sample set, an aggregated gradient is determined and sent to update the passive square model parameters.

2. The tag-based reasoning attack defense method according to claim 1, characterized in that, Based on the gradients of samples in the target sample set, determine and send the aggregated gradient for updating the passive square model parameters, including: Obtain the sampling probability of each sample in the target sample set, and calculate the weight corresponding to each sample; wherein, the weight is the product of the reciprocal of the total number of samples in the current training batch and the reciprocal of the sampling probability corresponding to the sample; The weighted gradient of each sample in the target sample set is determined, and the weighted gradients are summed to obtain the aggregated gradient; wherein the weighted gradient is the product of the original gradient of the sample and the corresponding weight of the sample.

3. The tag-based reasoning attack defense method according to claim 1, characterized in that, The generation of the target key for the current training batch includes: The preset original key is concatenated with the batch identifier corresponding to the current training batch and / or the round identifier of the current training round to generate a concatenated string; Using the concatenated string as input, the target key is generated based on a preset key derivation algorithm, wherein the target keys corresponding to different batches and / or different rounds are different, and the key derivation algorithm is a deterministic transformation.

4. The tag-based reasoning attack defense method according to claim 1, characterized in that, Determining the sampling probability of each sample in the current training batch based on the target key includes: Based on the target key, generate a corresponding pseudo-random number for each sample in the current training batch, wherein the pseudo-random number is greater than or equal to 0 and less than or equal to 1; The pseudo-random numbers corresponding to each sample in the current training batch are mapped to the interval formed by the preset minimum sampling probability and the maximum sampling probability to obtain the sampling probability corresponding to the sample.

5. The tag-based reasoning attack defense method according to claim 4, characterized in that, The pseudo-random numbers corresponding to each sample in the current training batch are mapped to the interval formed by the preset minimum sampling probability and the maximum sampling probability, and the sampling probability corresponding to the sample is obtained as follows: in, The sampling probability corresponding to the sample; The preset minimum sampling probability; The preset maximum sampling probability; is the pseudo-random number corresponding to the sample.

6. The tag-based reasoning attack defense method according to claim 4, characterized in that, The preset minimum sampling probability is greater than 0, and / or the preset maximum sampling probability is less than or equal to 1.

7. The tag-based reasoning attack defense method according to claim 1, characterized in that, After determining the target sample set for gradient aggregation in the current training batch, the method further includes: Obtain the samples in the target sample set and the labels corresponding to the samples, and determine the gradient of the samples based on forward propagation and / or backward propagation; Set the gradient of samples that do not belong to the target sample set to zero.

8. A tag-based reasoning attack defense system, characterized in that, include: The generation module is used to generate the target key for the current training batch and determine the sampling probability corresponding to each sample in the current training batch based on the target key. The first determining module is used to determine the target sample set for gradient aggregation in the current training batch based on the sampling probability of each sample. The second determining module is used to determine and send the aggregated gradient for updating the passive square model parameters based on the gradient of the samples in the target sample set.

9. An electronic device, characterized in that, include: At least one processor; as well as A memory that stores instructions that, when executed by the at least one processor, cause the at least one processor to perform the tag inference attack defense method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to execute the tag inference attack defense method according to any one of claims 1-7.

Images