联邦原型学习的特征图中毒攻击和双重防御机制  

Feature Map Poisoning Attack and Dual Defense Mechanism for Federated Prototype Learning

作　　者：王瑞锦[1] 王金波 张凤荔[1] 李经纬 李增鹏 陈厅[2] WANG Rui-Jin;WANG Jin-Bo;ZHANG Feng-Li;LI Jing-Wei;LI Zeng-Peng;CHEN Ting(School of Information and Software Engineering,University of Electronic Science and technology of China,Chengdu 610054,China;School of Computer Science and Engineering,University of Electronic Science and technology of China,Chengdu 611731,China;School of Cyber Science and Technology,Shandong University,Qingdao 266237,China)

机构地区：[1]电子科技大学信息与软件工程学院,四川成都610054 [2]电子科技大学计算机科学与工程学院,四川成都611731 [3]山东大学网络空间安全学院,山东青岛266237

出　　处：《软件学报》2025年第3期1355-1374,共20页Journal of Software

基　　金：国家重点研发计划(2022YFB4501200,2022YFB3304303);国家自然科学基金(62271128,61972073,U2333207);成都市重点研发支撑计划“揭榜挂帅”项目(2022-JB00-00013-GX);四川省科技计划重点研发项目(2022ZDZX0004,2023YFG0029,2023YFG0150,2022YFG0212,2021YFS0391);四川省科技计划“揭榜挂帅”项目(2023YFG0374,2023YFG0373);山东省自然科学基金(ZR2023MF045)。

摘　　要：联邦学习是一种无需用户共享私有数据、以分布式迭代协作训练全局机器学习模型的框架.目前流行的联邦学习方法FedProto采用抽象类原型(称为特征图)聚合,优化模型收敛速度和泛化能力.然而,该方法未考虑所聚合的特征图的正确性,而错误的特征图可能导致模型训练失效.为此,首先探索针对FedProto的特征图中毒攻击,论证攻击者只需通过置乱训练数据的标签,便可将模型的推测准确率至多降低81.72%.为了抵御上述攻击,进一步提出双重防御机制,分别通过全知识蒸馏和特征图甄别排除错误的特征图.基于真实数据集的实验表明,防御机制可将受攻击模型的推测准确率提升1-5倍,且仅增加2%系统运行时间.class prototypes,termed feature maps,to enhance model convergence speed and generalization capacity.However,this approach overlooks the verification of the aggregated feature maps’accuracy,risking model training failures due to incorrect feature maps.This study investigates a feature map poisoning attack on FedProto,revealing that malicious actors can degrade inference accuracy by up to 81.72%through tampering with the training data labels.To counter such attacks,we propose a dual defense mechanism utilizing knowledge distillation and feature map validation.Experimental results on authentic datasets demonstrate that this defense strategy can enhance the compromised model inference accuracy by a factor of 1 to 5,with only a marginal 2%increase in operational time.

关 键 词：联邦学习 数据异构 知识蒸馏 特征图中毒攻击 双重防御机制 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]