Distributed machine learning method and electronic device against byzantine attacks

Abstract

The application provides a distributed machine learning method and electronic equipment against Byzantine attack. In the method, a round of state aggregation is performed after K rounds of local model training, K>=1, wherein the local model training adopts an adaptive optimizer to update machine learning model parameters; the state aggregation comprises: sending a current state of the electronic equipment to all other nodes of the distributed machine learning system; obtaining current states of all other nodes of the distributed machine learning system; constructing a state set by combining the current states of all other nodes of the distributed machine learning system and the current state of the electronic equipment; for each state component of the current state, sorting values in size, removing F largest values and F smallest values, and then averaging the remaining values to obtain an initial value of a state of the next round of local model training of the electronic equipment. The method can resist Byzantine attack.

Description

Technical Field

[0001] This invention relates to the field of machine learning technology, and more specifically to a distributed machine learning method and electronic device resistant to Byzantine attacks. Background Technology

[0002] With the rapid development of artificial intelligence technology, machine learning models are being applied more and more widely in various fields. However, training these models typically requires a large amount of data and computing resources. Distributed machine learning, by leveraging the resources of multiple nodes (e.g., edge devices or data centers) to accelerate model training, has become a common solution. In many practical applications, such as federated learning, data is distributed among different participants, and it is impossible to centralize the data due to privacy or security reasons. Distributed machine learning allows for the training of a global model without sharing the original data.

[0003] However, distributed machine learning systems are vulnerable to various attacks, including Byzantine attacks. In a Byzantine attack, some participants (Byzantine nodes) may send malicious or erroneous information, thereby disrupting the global model's training process. Byzantine attacks can lead to degraded model performance or even complete failure. Therefore, designing Byzantine-tolerant distributed machine learning algorithms is crucial. Summary of the Invention

[0004] This invention provides a distributed machine learning method and electronic device for resisting Byzantine attacks, thereby improving resistance to Byzantine attacks.

[0005] This invention provides the following technical solution: a distributed machine learning method resistant to Byzantine attacks, applied to loyal nodes in a distributed machine learning system. The distributed machine learning method resistant to Byzantine attacks includes: performing a round of state aggregation after every K rounds of local model training, where K≥1, wherein the local model training uses an adaptive optimizer to update the machine learning model parameters. The state aggregation includes: Send its current state to all other nodes in the distributed machine learning system; Obtain the current state of all other nodes in the distributed machine learning system; The current states of all other nodes in the distributed machine learning system and its own current state are used to form a state set. For each state component of the current state, the values ​​are sorted by size. After removing the largest F values ​​and the smallest F values, the average of the remaining values ​​is used as the initial state value for the next round of local model training. Where, 1≤ N is the number of nodes in the distributed machine learning system; The current state includes: machine learning model parameters and adaptive optimizer state; For all loyal nodes in the distributed machine learning system, F and K have the same value, and the ability to resist Byzantine attacks is: the number of Byzantine nodes is less than or equal to F.

[0006] In some implementations, the adaptive optimizer is an Adam optimizer, and the adaptive optimizer state consists of first-order corrected momentum and second-order corrected momentum.

[0007] In some implementations, the adaptive optimizer is an SGDM optimizer, and the adaptive optimizer state is a velocity quantity.

[0008] In some implementations, the adaptive optimizer is an RMSprop optimizer, and the adaptive optimizer state is an exponentially weighted moving average of the squared gradient.

[0009] In some implementations, a state aggregation round is also included before the first K rounds of local model training.

[0010] The present invention provides the following technical solution: an electronic device, comprising at least one memory and at least one processor, wherein the memory stores a program, and the processor runs the program to execute the above-described distributed machine learning method against Byzantine attacks.

[0011] This invention proposes a decentralized distributed machine learning method for resisting Byzantine attacks, which has quantifiable resistance to Byzantine attacks and good model training performance. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating the state aggregation process in the distributed machine learning method for resisting Byzantine attacks according to an embodiment of the present invention.

[0013] Figure 2 This is a test result graph of a test example of the present invention, in which the SDGM optimizer is selected.

[0014] Figure 3 This is a test result graph of another test example of the present invention, in which the Adam optimizer is selected.

[0015] Figure 4 This is a structural block diagram of the electronic device of the present invention. Detailed Implementation

[0016] The present invention will be further described below with reference to specific embodiments, but the scope of protection of the present invention is not limited thereto.

[0017] Combination Figure 1The embodiments of the present invention provide a distributed machine learning method resistant to Byzantine attacks, which is applied to loyal nodes in a distributed machine learning system.

[0018] Distributed machine learning methods resistant to Byzantine attacks include: performing a round of state aggregation after every K rounds of local model training, where K≥1, wherein the local model training uses an adaptive optimizer to update the machine learning model parameters; State aggregation includes: S1. Send its current state to all other nodes in the distributed machine learning system; S2. Obtain the current state of all other nodes in the distributed machine learning system; S3. Construct a state set by taking the current states of all other nodes in the distributed machine learning system and the current state of the current node itself. For each state component of the current state, sort the values ​​by size, remove the largest F values ​​and the smallest F values, and then calculate the average of the remaining values ​​as the initial state value for the next round of local model training. Where, 1≤ N is the number of nodes in the distributed machine learning system; The current state includes: machine learning model parameters and adaptive optimizer state; For all loyal nodes in the distributed machine learning system, F and K have the same value, and the ability to resist Byzantine attacks is: the number of Byzantine nodes is less than or equal to F.

[0019] The network topology of the distributed machine learning system is a fully connected network, and the set of nodes in this fully connected network is... This indicates that the total number of nodes in the fully connected network is... Node i in The model parameters at time t are Node i in The state at time is ,state The dimension is ,state The Each component is The state is a set of model parameters and adaptive optimizer states.

[0020] The distributed machine learning method against Byzantine attacks proposed in this invention needs to satisfy the following three basic assumptions.

[0021] Assumption 1. Before starting the distributed machine learning method resistant to Byzantine attacks, parameters F and K need to be set, both of which are positive integers. Parameters F and K are known to all loyal nodes. F represents the number of maximum and minimum values ​​removed by the loyal node when aggregating model parameters and adaptive optimizer states. K represents the number of rounds of local training performed by the loyal node. After every K rounds of local training, the loyal node aggregates model parameters and adaptive optimizer states with all other nodes.

[0022] Assumption 2. The number of Byzantine nodes does not exceed F.

[0023] Assumption 3. All nodes can communicate directly with each other. This assumption aligns with most scenarios in distributed machine learning. Nodes independently aggregate model parameters and adaptive optimizer states. Clearly, the model parameter values ​​shared by a Byzantine node with different loyal nodes may differ, as may the adaptive optimizer state values ​​shared with different loyal nodes. This increases the complexity of distributed machine learning.

[0024] The state of the loyalty node and the aggregation node .state Model parameters It is a superset that reflects not only model parameter information but also optimizer adaptive parameter information. Examples are given below.

[0025] The subscripts t and t+1 below both represent time steps.

[0026] Example 1. The adaptive optimizer is the Adam optimizer.

[0027] The formula for updating the model parameters is: in, and This represents the model parameters, where the subscripts t and t+1 represent the time steps. For learning rate, Let be the value of the first-order corrected momentum at time step t. Let be the value of the second-order corrected momentum at time step t. It is an extremely small positive number that avoids a denominator of 0.

[0028] Model parameters The update depends not only on It also depends on the first-order correction momentum in the Adam optimizer. and second-order corrected momentum Their expressions are: ; ; in, Let be the first-order momentum at time step t. It is a preset proportionality coefficient that is less than 1 and is positive. Let the first-order momentum be at time step t-1. For model parameters The loss function at that time For the loss function with respect to model parameters gradient, Let be the second momentum at time step t. The preset scaling factor is less than 1 and is positive. Let be the second momentum at time step t-1.

[0029] State at time step t The adaptive optimizer is the Adam optimizer, and the adaptive optimizer state consists of first-order correction momentum and second-order correction momentum.

[0030] Example 2. The adaptive optimizer is the SGDM optimizer.

[0031] The formula for updating the model parameters is: ;in, and This represents the model parameters, where the subscripts t and t+1 represent the time steps. For learning rate, It is the value of the velocity quantity in the SGDM optimizer at time step t.

[0032] ;in, It is a preset proportionality coefficient that is less than 1 and is positive. It is the value of the velocity at time step t-1. The model parameters are The loss function at that time For the loss function with respect to model parameters The gradient.

[0033] State at time step t The adaptive optimizer is an SGDM optimizer, and the adaptive optimizer state is the velocity quantity.

[0034] Example 3. The adaptive optimizer is the RMSprop optimizer.

[0035] The formula for updating the model parameters is: ; in, and This represents the model parameters, where the subscripts t and t+1 represent the time steps. For learning rate, The model parameters are The loss function at that time For the loss function with respect to model parameters gradient, It is an extremely small positive number that avoids a denominator of 0. This represents the value of the exponentially weighted moving average of the squared gradient at time step t. As can be seen, The update depends not only on It also depends on .

[0036] ; in, It is a preset proportionality coefficient that is less than 1 and is positive. The value of the exponentially weighted moving average of the squared gradient at time step t-1.

[0037] State at time step t The adaptive optimizer is an RMSprop optimizer, and the adaptive optimizer state is an exponentially weighted moving average of the squared gradient.

[0038] Initialization phase: Each loyal node selects the same model structure and performs reasonable initialization of the model parameters and optimizer (such as random initialization).

[0039] Execution Phase: All nodes exchange states with each other, then remove the extreme values ​​from the state set (including their own state and the states of all other nodes) and calculate the average value as their new state. Loyal nodes then update their states locally K times in their new state, after which all nodes perform the next round of state exchange, and this process repeats. The specific algorithm pseudocode is as follows.

[0040] Assume the ID of the loyal node running this distributed algorithm is i; ; / / t represents the iteration round If / / These are the time steps that require state aggregation. Step 1: Node i broadcasts in state of time ; Step 2: Node i receives the states broadcast from the other nodes and obtains the set. ; / / The variable representing the state value of temporary node j at time step t. Step 3: Node i sets its state Join middle; / / The variable representing the state value of temporary node i at time step t. Step 4: For : / / For each component of the state Will Arrange the elements in a monotonically non-decreasing order, and delete the largest F elements and the smallest F elements. Calculate the mean of the remaining elements: ; Step 5: ; Else: / / This indicates that the model is iteratively optimized based on its current state value.

[0041] In the above embodiments, a state aggregation round is performed before the first K rounds of local model training. Initially, the model parameters of each loyal node and the state of the adaptive optimizer will be closer, which helps improve the convergence speed.

[0042] In some other embodiments, the initial state aggregation is performed after the first K rounds of local model training.

[0043] If a node only aggregates model parameters, the adaptive optimizer state is obtained through local iteration, but the model parameters are obtained through global aggregation. This can lead to a mismatch between the model parameters and the adaptive optimizer state, potentially causing the model to diverge.

[0044] refer to Figure 2 and Figure 3 Regardless of the presence of Byzantine attacks, when using the method of this invention for distributed machine learning, the accuracy of loyal nodes on the test set converges to a level close to 1. K-step simple mean aggregation refers to Step 4 of the pseudocode provided by this invention: for each component of the state, directly calculate the mean of all values, and update its own state to that mean.

[0045] When the number of Byzantine nodes does not exceed 1 / 3 of the total number of nodes, loyal nodes can obtain sufficient information to achieve consistency in training results, that is, all loyal nodes can eventually train a model with similar parameters.

[0046] On the other hand, this is to ensure that nodes receive sufficient and correct information. When the number of Byzantine nodes does not exceed F, and When the loyal node removes the largest F and smallest F from each component of the collected state set, the node still has at least F+1 data available, thus calculating a correct state as the starting point of the iteration, thereby ensuring that the loyal node can converge to the vicinity of the local optimum.

[0047] In the technical solution of this invention, the loyal node performs the same aggregation operation on both the model parameters and the internal state of the optimizer, which has a significant advantage over aggregating only the model parameters.

[0048] 1. If the internal state of the optimizer is ignored and only the model parameters are aggregated, it may lead to model state drift.

[0049] Specifically, even if the model parameters between nodes can reach consistency in the current round, since the key optimizer internal state evolves completely independently in each node and is not included in the synchronization mechanism, the update step size and optimization direction calculated by different nodes will have a huge and non-negligible deviation when facing the next iteration.

[0050] 2. Byzantine nodes with high privileges can exploit this vulnerability to carry out a more covert and destructive "state poisoning" attack. Attackers can outwardly send model parameters that appear to conform to a normal distribution, but through carefully constructed historical trajectories, they induce loyal nodes to accumulate extreme internal states (e.g., induce minimal or maximal estimates of the second moment).

[0051] In summary, even with Byzantine attacks, this method ensures that the test set accuracy converges to a high value within a finite number of rounds. The method is simple, efficient, and suitable for distributed machine learning scenarios. In distributed machine learning scenarios, the state shared by the Byzantine nodes may differ for each loyal node.

[0052] Based on the same inventive concept, and referring to Figure 4 Embodiments of the present invention also provide an electronic device, including at least one memory and at least one processor, wherein the memory stores a program and the processor runs the program to perform the above-described distributed machine learning method against Byzantine attacks.

[0053] It should be noted that the processors mentioned above may include, but are not limited to, one or more processors or microprocessors. Each processor may be implemented as an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a controller, a microcontroller, a microprocessor (MCU), a central processing unit (CPU), a graphics processing unit (GPU), a data processing unit (DPU), or other electronic components to execute the methods in the above embodiments.

[0054] The above-mentioned storage devices can be various media capable of storing program code, such as USB flash drives, hard disk drives, solid-state drives, portable hard drives, read-only memory (ROM), random access memory (RAM), flash memory, EPROM memory, EEPROM memory, registers, magnetic disks, or optical disks. The storage device can be volatile memory, non-volatile memory, or a combination of both.

[0055] In one example, a readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in application-specific integrated circuits (ASICs). Alternatively, the processor and the readable storage medium can exist as discrete components in an electronic device.

[0056] This invention is not limited to the above-described embodiments. Any modifications, improvements, or substitutions that can be conceived by those skilled in the art without departing from the essential content of this invention fall within the scope of this invention.

Claims

1. A distributed machine learning method resistant to Byzantine attacks, applied to loyal nodes in a distributed machine learning system, characterized in that, The distributed machine learning method for resisting Byzantine attacks includes: performing one round of state aggregation after every K rounds of local model training, where K≥1, wherein the local model training uses an adaptive optimizer to update the machine learning model parameters; The state aggregation includes: Send its current state to all other nodes in the distributed machine learning system; Obtain the current state of all other nodes in the distributed machine learning system; The current states of all other nodes in the distributed machine learning system and its own current state are used to form a state set. For each state component of the current state, the values ​​are sorted by size. After removing the largest F values ​​and the smallest F values, the average of the remaining values ​​is used as the initial state value for the next round of local model training. in, N is the number of nodes in the distributed machine learning system; The current state includes: machine learning model parameters and adaptive optimizer state; For all loyal nodes in the distributed machine learning system, F and K have the same value, and the ability to resist Byzantine attacks is: the number of Byzantine nodes is less than or equal to F.

2. The method according to claim 1, characterized in that, The adaptive optimizer is the Adam optimizer, and the adaptive optimizer state consists of first-order corrected momentum and second-order corrected momentum.

3. The method according to claim 1, characterized in that, The adaptive optimizer is an SGDM optimizer, and the state of the adaptive optimizer is a velocity quantity.

4. The method according to claim 1, characterized in that, The adaptive optimizer is an RMSprop optimizer, and the state of the adaptive optimizer is an exponentially weighted moving average of the squared gradient.

5. The method according to claim 1, characterized in that, Also includes: Before performing the first K rounds of local model training, a round of state aggregation is performed.

6. An electronic device, characterized in that, It includes at least one memory and at least one processor, wherein the memory stores a program and the processor runs the program to perform a distributed machine learning method resistant to Byzantine attacks according to any one of claims 1 to 5.

Images