Edge Node Backdoor Defense via Parameter Mutation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Backdoor attacks in edge computing scenarios are difficult to detect due to limited resources and independence of edge nodes, allowing attackers to implant backdoors in deep learning models, which can spread to other nodes and cause incorrect outputs when specific triggers are encountered.
Innovation Solution
A method that generates an initial optional operation set to enhance model generalization, selects subsets with specific concave and convex function characteristics for model accuracy and attack probability, constructs a mutation characteristic set, and determines final parameter settings to actively defend against backdoor attacks, without requiring cooperation between edge nodes or human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep learning based anomaly behavior detection models are deployed at edge nodes, then the ability to detect attacks is improved, but the device resources (computing performance and storage capability) are insufficient to meet the requirements
Solution Approach 1:
Multiple edge nodes are merged into a collaborative learning system where they collectively train and share deep learning models. This distributes the computing burden across multiple nodes while maintaining advanced detection capabilities that would be impossible for individual resource-constrained edge nodes to achieve alone.
Solution Approach 2:
The collaborative learning system provides universal model training capabilities that serve all participating edge nodes. Each node benefits from a model trained on aggregated data from all nodes, making the system multi-functional in supporting diverse detection requirements across different edge devices with varying resource constraints.
2Loss of information
If edge nodes independently train models with their own data, then privacy protection is improved, but the model accuracy and generalization ability are limited due to insufficient training data
Solution Approach 1:
A collaborative learning framework acts as an intermediary mechanism that enables data sharing between edge nodes without direct data exchange. The framework allows models to learn from aggregated data patterns while keeping raw training data localized at each edge node, thus preserving privacy while improving model accuracy through access to diverse training samples.
3Device complexity
If edge nodes operate independently without perception of other nodes' status, then system simplicity is maintained, but backdoor attacks can spread undetected across the network
Solution Approach 1:
A feedback mechanism is introduced where edge nodes exchange model information and detection results with the collaborative learning system. This allows the system to detect anomalies and backdoor attacks by analyzing patterns across multiple nodes while maintaining relative operational simplicity at each individual edge node through standardized feedback protocols.
Data Source
AI summary
A method and an apparatus for actively defending against backdoor attacks under an edge computing scenario. The method includes: generating an initial optional operation set based on optional operations configured to enhance a model generalization ability, and constructing a configuration parameter set for each operation in the set; selecting a first subset with a curve between configuration parameters and model accuracies of the operation presenting a monotonically decreasing concave function characteristic; selecting a second subset with a curve of the operation between configuration parameters and probabilities that a model is successfully attacked by the backdoor attack presenting a monotonically decreasing convex function characteristic; constructing a mutation characteristic set for each operation in an intersection of the first and second subsets; and for each operation in the intersection, determining a final parameter setting value of the operation based on the mutation characteristic set, to actively defend against possible backdoor attacks.