| 引用本文: | 曹益皓,张建标,赵亚茹,韩宇飞,张承昱,叶涛.FedProbe: 代理模型引导的可解释联邦学习投毒攻击防御框架.软件学报,,():1-20 |
| |
|
| |
|
|
| 本文已被：浏览 357次 下载 147次 |
码上扫一扫！ |
|
|
| FedProbe: 代理模型引导的可解释联邦学习投毒攻击防御框架 |
|
曹益皓1,2, 张建标1,2, 赵亚茹3, 韩宇飞1,2, 张承昱1,2, 叶涛4
|
|
1.北京工业大学 计算机学院, 北京 100124;2.可信计算北京市重点实验室 (北京工业大学), 北京 100124;3.湖南科技大学 计算机科学与工程学院, 湖南 湘潭, 411201;4.青海民族大学 计算机学院, 青海 西宁, 810007
|
|
| 摘要: |
| 联邦学习允许多个参与方在不共享本地私有数据的前提下协同训练一个共享的深度学习模型. 然而, 该范式在实际应用中极易受到日益复杂的投毒攻击威胁. 现有的防御方法在检测效率、对多样化攻击的泛化能力以及在非独立同分布 (non-IID) 数据环境下的性能稳定性方面仍存在局限. 为应对上述挑战, 提出一种名为 FedProbe 的、由代理模型引导的可解释联邦学习投毒攻击防御框架. FedProbe采用两阶段机制: 首先, 在代理模型引导阶段, 利用服务器端的可信样本集计算各本地模型间的KL散度以度量其行为相似性, 并确定最优聚类数量. 在剔除离群更新后, 各簇被聚合成代理模型, 此举旨在有效划分由不同数据分布训练的模型并提升后续检测效率. 其次, 在可解释分析阶段, FedProbe利用SHAP可解释技术对代理模型进行深度分析, 计算其关键特征归因, 并最终通过跨类别可疑度分数来精准识别并剔除潜在的恶意模型. 实验结果表明, FedProbe在多种基准数据集上展现出卓越的性能与鲁棒性. 在良性环境中, 其收敛时间仅为标准聚合算法的1.11–1.21倍, 性能开销极小. 在安全性方面, 即使在恶意用户占比高达40%的极端场景下, FedProbe在抵御无目标攻击和后门攻击时仍能保持优越的收敛性, 并将攻击成功率控制在25%以下; 而在面对自适应攻击时, 其在防御有效性与任务准确率方面均具有显著优势. |
| 关键词: 联邦学习 投毒攻击 防御策略 可解释性 代理模型 |
| DOI：10.13328/j.cnki.jos.007661 |
| 分类号: |
| 基金项目:北京市自然科学基金(M21039) |
|
| FedProbe: Proxy-model-guided Explainable Defense Framework for Poisoning Attacks in Federated Learning |
|
CAO Yi-Hao1,2, ZHANG Jian-Biao1,2, ZHAO Ya-Ru3, HAN Yu-Fei1,2, ZHANG Cheng-Yu1,2, YE Tao4
|
|
1.College of Computer Science, Beijing University of Technology, Beijing 100124, China;2.Beijing Key Laboratory of Trusted Computing (Beijing University of Technology), Beijing 100124, China;3.College of Computer Science and Engineering, Hunan University of Science and Technology, Xiangtan 411201, China;4.College of Computer, Qinghai Minzu University, Xining 810007, China
|
| Abstract: |
| Federated Learning enables collaborative model training among multiple clients without exchanging their local private data. However, this paradigm is vulnerable to increasingly sophisticated poisoning attacks. Existing defense mechanisms often exhibit shortcomings in detection efficiency, generalization to diverse attacks, and performance stability under non-independent and identically distributed (non-IID) data. To address these challenges, this study proposes FedProbe, an interpretable federated poisoning attack defense framework guided by proxy models. FedProbe adopts a two-stage mechanism. In the first stage, under proxy model guidance, the framework computes the KL divergence among local models on a trusted server-side dataset to measure their behavioral similarity and determine the optimal number of clusters. After removing outlier updates, each cluster is aggregated into a proxy model, aiming to effectively partition models trained on different data distributions and improve subsequent detection efficiency. In the second stage, an interpretable analysis is conducted. FedProbe leverages the SHAP technique to perform an in-depth analysis of the proxy models, computing key feature attributions and ultimately using cross-category suspicion scores to identify and remove potentially malicious models accurately. Experimental results demonstrate that FedProbe exhibits superior performance and robustness across various benchmark datasets. In benign settings, the convergence time is only 1.11 to 1.21 times that of standard aggregation algorithms, indicating minimal overhead. In terms of security, even in extreme scenarios with up to 40% malicious clients, FedProbe maintains superior convergence when defending against untargeted attacks and backdoor attacks, while keeping the attack success rate below 25%. Moreover, when facing adaptive attacks, it shows significant advantages in both defense effectiveness and task accuracy. |
| Key words: federated learning (FL) poisoning attack defense strategy explainable proxy model |
|
|
|
|
