Federated learning is widely used to solve the problem of data decentralization and can provide privacy protectionfor data owners. However, since multiple participants are required in federated learning, this allows a...Federated learning is widely used to solve the problem of data decentralization and can provide privacy protectionfor data owners. However, since multiple participants are required in federated learning, this allows attackers tocompromise. Byzantine attacks pose great threats to federated learning. Byzantine attackers upload maliciouslycreated local models to the server to affect the prediction performance and training speed of the global model. Todefend against Byzantine attacks, we propose a Byzantine robust federated learning scheme based on backdoortriggers. In our scheme, backdoor triggers are embedded into benign data samples, and then malicious localmodels can be identified by the server according to its validation dataset. Furthermore, we calculate the adjustmentfactors of local models according to the parameters of their final layers, which are used to defend against datapoisoning-based Byzantine attacks. To further enhance the robustness of our scheme, each localmodel is weightedand aggregated according to the number of times it is identified as malicious. Relevant experimental data showthat our scheme is effective against Byzantine attacks in both independent identically distributed (IID) and nonindependentidentically distributed (non-IID) scenarios.展开更多
后门攻击是机器学习模型在训练阶段面临的主要安全威胁之一。尽管现有针对后门攻击的防御研究已取得显著进展,但这些方法往往会导致模型在干净测试集上的准确率出现明显下降。为解决这一问题,提出了一种基于扩散模型的机器学习后门攻击...后门攻击是机器学习模型在训练阶段面临的主要安全威胁之一。尽管现有针对后门攻击的防御研究已取得显著进展,但这些方法往往会导致模型在干净测试集上的准确率出现明显下降。为解决这一问题,提出了一种基于扩散模型的机器学习后门攻击防御方法(defending against backdoor attacks with diffusion model,DBADM)。该方法的核心思想是在模型训练前,利用扩散模型对含有后门触发器的中毒样本进行预处理,通过改变样本中隐藏的触发器特征,从而有效抵御后门攻击。研究人员在MNIST、CIFAR-10、Tiny ImageNet和LFW4个基准数据集上进行了系统的攻防对比实验。实验结果表明,所提出的DBADM方法不仅能够有效防御各类后门攻击,还能保持模型在干净数据集上的高精度性能。展开更多
针对现有联邦学习后门防御方法不能实现对模型已嵌入后门特征的有效清除同时会降低主任务准确率的问题,提出了一种基于对比训练的联邦学习后门防御方法 Contra FL。利用对比训练来破坏后门样本在特征空间中的聚类过程,使联邦学习全局模...针对现有联邦学习后门防御方法不能实现对模型已嵌入后门特征的有效清除同时会降低主任务准确率的问题,提出了一种基于对比训练的联邦学习后门防御方法 Contra FL。利用对比训练来破坏后门样本在特征空间中的聚类过程,使联邦学习全局模型分类结果与后门触发器特征无关。具体而言,服务器通过执行触发器生成算法构造生成器池,以还原全局模型训练样本中可能存在的后门触发器;进而,服务器将触发器生成器池下发给各参与方,各参与方将生成的后门触发器添加至本地样本,以实现后门数据增强,最终通过对比训练有效消除后门攻击的负面影响。实验结果表明,Contra FL能够有效防御联邦学习中的多种后门攻击,且效果优于现有防御方法。展开更多
基金in part by the National Social Science Foundation of China under Grant 20BTQ058in part by the Natural Science Foundation of Hunan Province under Grant 2023JJ50033。
文摘Federated learning is widely used to solve the problem of data decentralization and can provide privacy protectionfor data owners. However, since multiple participants are required in federated learning, this allows attackers tocompromise. Byzantine attacks pose great threats to federated learning. Byzantine attackers upload maliciouslycreated local models to the server to affect the prediction performance and training speed of the global model. Todefend against Byzantine attacks, we propose a Byzantine robust federated learning scheme based on backdoortriggers. In our scheme, backdoor triggers are embedded into benign data samples, and then malicious localmodels can be identified by the server according to its validation dataset. Furthermore, we calculate the adjustmentfactors of local models according to the parameters of their final layers, which are used to defend against datapoisoning-based Byzantine attacks. To further enhance the robustness of our scheme, each localmodel is weightedand aggregated according to the number of times it is identified as malicious. Relevant experimental data showthat our scheme is effective against Byzantine attacks in both independent identically distributed (IID) and nonindependentidentically distributed (non-IID) scenarios.
文摘后门攻击是机器学习模型在训练阶段面临的主要安全威胁之一。尽管现有针对后门攻击的防御研究已取得显著进展,但这些方法往往会导致模型在干净测试集上的准确率出现明显下降。为解决这一问题,提出了一种基于扩散模型的机器学习后门攻击防御方法(defending against backdoor attacks with diffusion model,DBADM)。该方法的核心思想是在模型训练前,利用扩散模型对含有后门触发器的中毒样本进行预处理,通过改变样本中隐藏的触发器特征,从而有效抵御后门攻击。研究人员在MNIST、CIFAR-10、Tiny ImageNet和LFW4个基准数据集上进行了系统的攻防对比实验。实验结果表明,所提出的DBADM方法不仅能够有效防御各类后门攻击,还能保持模型在干净数据集上的高精度性能。
文摘针对现有联邦学习后门防御方法不能实现对模型已嵌入后门特征的有效清除同时会降低主任务准确率的问题,提出了一种基于对比训练的联邦学习后门防御方法 Contra FL。利用对比训练来破坏后门样本在特征空间中的聚类过程,使联邦学习全局模型分类结果与后门触发器特征无关。具体而言,服务器通过执行触发器生成算法构造生成器池,以还原全局模型训练样本中可能存在的后门触发器;进而,服务器将触发器生成器池下发给各参与方,各参与方将生成的后门触发器添加至本地样本,以实现后门数据增强,最终通过对比训练有效消除后门攻击的负面影响。实验结果表明,Contra FL能够有效防御联邦学习中的多种后门攻击,且效果优于现有防御方法。
