基于触发器逆向的联邦学习后门防御方法  

Federated Learning Backdoor Defense Method Based on Trigger Inversion

作　　者：林怡航 周鹏远 吴治谦 廖勇 LIN Yihang;ZHOU Pengyuan;WU Zhiqian;LIAO Yong(School of Cyber Science and Technology,University of Science and Technology of China,Hefei 230031,China)

机构地区：[1]中国科学技术大学网络空间安全学院,合肥230031

出　　处：《信息网络安全》2024年第2期262-271,共10页Netinfo Security

基　　金：国家重点研发计划[2021YFC3300500]。

摘　　要：联邦学习作为一种新兴分布式机器学习范式,实现了多客户间的分布式协同模型训练,不需要上传用户的原始数据,从而保护了用户隐私。然而,在联邦学习中由于服务器无法审查客户端的本地数据集,恶意客户端可通过数据投毒将后门嵌入全局模型。传统的联邦学习后门防御方法大多基于模型检测的思想进行后门防御,而忽略了联邦学习自身的分布式特性。因此,文章提出一种基于触发器逆向的联邦学习后门防御方法,使聚合服务器和分布式客户端协作,利用触发器逆向技术生成额外的数据,增强客户端本地模型的鲁棒性,从而进行后门防御。在不同数据集上进行实验,实验结果表明,文章提出的方法可以有效防御后门攻击。As an emerging distributed machine learning paradigm,federated learning realizes distributed collaborative model training among multiple clients without uploading user original data,thereby protecting user privacy.However,since the server cannot inspect the client's local dataset in federated learning,malicious clients can embed the backdoor into the global model by data poisoning.Traditional federated learning backdoor defense methods are mostly based on the idea of model detection for backdoor defense,but ignore the inherent distributed feature of federated learning.Therefore,this paper proposed a federated learning backdoor defense method based on trigger inversion.The aggregation server and distributed clients collaborated to generate additional data using trigger reverse technology to enhance the robustness of the client's local model for backdoor defense.Experiments on different datasets,and the results show that the proposed method can mitigate backdoor attacks effectively.

关 键 词：联邦学习 后门攻击 后门防御 鲁棒性训练 触发器逆向 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]