基于隐私推断Non-IID联邦学习模型的后门攻击研究  

Research on Backdoor Attack Based on Privacy Inference Non-IID Federated Learning Model

作　　者：梅皓琛 李高磊[1] 杨潇 MEI Haochen;LI Gaolei;YANG Xiao(School of Electronic Information and Electrical Engineering,Shanghai Jiao Tong University,Shanghai 200240,China)

机构地区：[1]上海交通大学电子信息与电气工程学院,上海200240

出　　处：《现代信息科技》2023年第19期167-171,共5页Modern Information Technology

基　　金：国防基础科研项目(JCKY2020604B004);上海市科委“科技创新行动计划”(22511101200,22511101202)。

摘　　要：联邦学习安全与隐私在现实场景中受数据异构性的影响很大,为了研究隐私推断攻击、后门攻击与数据异构性的相互作用机理,提出一种基于隐私推断的高隐蔽后门攻击方案。首先基于生成对抗网络进行客户端的多样化数据重建,生成用于改善攻击者本地数据分布的补充数据集;在此基础上,实现一种源类别定向的后门攻击策略,不仅允许使用隐蔽触发器控制后门是否生效,还允许攻击者任意指定后门针对的源类别数据。基于MNIST、CIFAR 10和YouTube Aligned Face三个公开数据集的仿真实验表明,所提方案在数据非独立同分布的联邦学习场景下有着较高的攻击成功率和隐蔽性。Federated learning security and privacy are greatly affected by data heterogeneity in real scenarios.In order to study the interaction mechanism between privacy inference attacks,backdoor attacks,and data heterogeneity,a high covert backdoor attack scheme based on privacy inference is proposed.Firstly,based on generating adversarial networks,diverse data reconstruction is performed on the client side,generating supplementary datasets to improve the local data distribution of attackers;On this basis,a source category oriented backdoor attack strategy is implemented,which not only allows the use of hidden triggers to control whether the backdoor is effective,but also allows attackers to arbitrarily specify the source category data targeted by the backdoor.Simulation experiments based on three public datasets,MNIST,CIFAR 10,and YouTube Aligned Face,show that the proposed scheme has a high attack success rate and concealment in federated learning scenarios with non independent identically distributed data.

关 键 词：联邦学习 非独立同分布数据 后门攻击 隐私推断攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP181[自动化与计算机技术—计算机科学与技术] TP393