一种基于联邦学习参与方的投毒攻击防御方法

Defense method on poisoning attack based on clients in federated learning

联邦学习分布式的训练结构易受到投毒攻击的威胁,现有方法主要针对中央服务器设计安全聚合算法以防御投毒攻击,但要求中央服务器可信且中毒参与方数量需低于正常参与方。为了解决上述问题,提出了一种基于联邦学习参与方的投毒攻击防御方法,将防御策略的执行转移到联邦学习的参与方。首先,每个参与方独立构造差异损失函数,通过计算全局模型与本地模型的输出并进行误差分析,得到差异损失权重与差异损失量;其次,依据本地训练的损失函数与差异损失函数进行自适应训练;最终,依据本地模型与全局模型的性能分析进行模型选取,防止中毒严重的全局模型干扰正常参与方。在MNIST与FashionMNIST等数据集上的实验表明,基于该算法的联邦学习训练准确率优于DnC等投毒攻击防御方法,在中毒参与方比例超过一半时,正常参与方仍能够实现对投毒攻击的防御。

The distributed training structure of federated learning is vulnerable to poisoning attacks.Existing methods mainly design secure aggregation algorithms for central servers to defend against poisoning attacks,but require the central server to be trusted and the number of poisoned participants to be lower than normal participants.To address the above issues,this paper proposed a poison attack defense method based on federated learning participants,which transfered the execution of defense strategies to the participants of federated learning.Firstly,each participant independently constructed a differential loss function,calculated the output of the global and local models,and conducted error analysis to obtain the weight and amount of differential loss.Secondly,it performed adaptive training based on the local trained loss function and differential loss function.Finally,this approach selected models based on the performance analysis of local and global models to prevent severely poisoned global models from interfering with normal clients.Experiments on datasets such as MNIST and FashionMNIST show that the federated learning training accuracy based on this algorithm is superior to poison attack defense methods such as DnC.Even when the proportion of poisoned participants exceeds half,normal participants can still achieve defense against poison attacks.