基于联邦学习的隐私保护和抗投毒攻击方法研究

Research on Privacy Protection and Anti-Poisoning Attack Methods Based on Federated Learning

摘要: 联邦学习中的参数传输和模型训练，使其面临着投毒攻击和隐私泄露的双重威胁。现有结合隐私保护和抗投毒攻击的联邦学习研究中，通常先对客户端梯度进行加密或扰动再在密文域中执行投毒攻击检测操作，容易模糊或消除恶意梯度所具有的差异性特征，导致检测算法难以准确区分不同类型的投毒攻击。本文提出基于联邦学习的隐私保护和抗投毒攻击方法研究中，采用基于明文的梯度历史信息对客户端类型进行识别，再对筛选出的正常客户端进行隐私保护和安全聚合操作，从而在保障数据机密性的同时提升检测的有效性。考虑符号翻转、噪声注入和标签翻转攻击的普遍性，以及不同投毒攻击在目标、强度和行为模式上的显著差异，引入模型局部梯度的长短历史信息，通过比较不同梯度历史之间的异常差异性实现对多类投毒攻击的有效检测。同时设计周期性投毒攻击检测策略，实现客户端的隐私保护。此外，考虑多链聚合中固定的链数量及链内客户端，设计自适应多链安全聚合方法，增强对客户端集合动态变化的适应性，从而在隐私保护的同时提升聚合效率。实验结果表明，所提算法在MNIST和Fashion-MNIST以及CIFAR10数据集上的平均准确率达到85.18%，较基准算法平均提升约6%，具有良好的多类投毒攻击检测能力，能有效提升模型性能并满足复杂攻击场景下的防御需求。

Abstract: Parameter transmission and model training in federated learning face the dual threats of poisoning attacks and privacy leakage. Existing privacy-preserving and anti-poisoning federated learning studies typically encrypt or perturb client gradients prior to ciphertext-domain attack detection, which obscures distinctive malicious gradient characteristics and hinders accurate poisoning attack distinction. A method is proposed that identifies client types via plaintext-based gradient history and applies privacy protection and secure aggregation exclusively to filtered legitimate clients, thereby enhancing detection effectiveness while maintaining data confidentiality. Considering the prevalence of sign flipping, noise injection, and label flipping attacks, along with significant differences in objectives, intensity, and behavioral patterns, short- and long-term local gradient history is incorporated. Analyzing anomalous differences across gradient histories enables effective detection of multiple poisoning attack types. A periodic poisoning attack detection strategy is designed to ensure client privacy. Furthermore, addressing the fixed chain count and clients in multi-chain aggregation, an adaptive multi-chain secure aggregation method is developed to enhance adaptability to dynamic client set changes, improving aggregation efficiency while preserving privacy. Experimental results on the MNIST, Fashion-MNIST, and CIFAR10 datasets demonstrate that the proposed algorithm achieves an average accuracy of 85.18%, an improvement of approximately 6% over baseline algorithms. The method exhibits robust detection capabilities for multiple poisoning attacks, effectively enhancing model performance and meeting defense requirements in complex attack scenarios.