基于对比训练的联邦学习后门防御方法

Backdoor defense method in federated learning based on contrastive training

针对现有联邦学习后门防御方法不能实现对模型已嵌入后门特征的有效清除同时会降低主任务准确率的问题,提出了一种基于对比训练的联邦学习后门防御方法 Contra FL。利用对比训练来破坏后门样本在特征空间中的聚类过程,使联邦学习全局模型分类结果与后门触发器特征无关。具体而言,服务器通过执行触发器生成算法构造生成器池,以还原全局模型训练样本中可能存在的后门触发器;进而,服务器将触发器生成器池下发给各参与方,各参与方将生成的后门触发器添加至本地样本,以实现后门数据增强,最终通过对比训练有效消除后门攻击的负面影响。实验结果表明,Contra FL能够有效防御联邦学习中的多种后门攻击,且效果优于现有防御方法。

In response to the inadequacy of existing defense methods for backdoor attacks in federated learning to effectively remove embedded backdoor features from models,while simultaneously reducing the accuracy of the primary task,a federated learning backdoor defense method called ContraFL was proposed,which utilized contrastive training to disrupt the clustering process of backdoor samples in the feature space,thereby rendering the global model classifications in federated learning independent of the backdoor trigger features.Specifically,on the server side,a trigger generation algorithm was developed to construct a generator pool to restore potential backdoor triggers in the training samples of the global model.Consequently,the trigger generator pool was distributed to the participants by the server,where each participant added the generated backdoor triggers to their local samples to achieve backdoor data augmentation.Experimental results demonstrate that ContraFL effectively defends against various backdoor attacks in federated learning,outperforming existing defense methods.