联邦学习中的模型中毒攻击防御策略综述OA

Model poisoning attack is a serious threat in federated learning.In model poisoning attacks,malicious attackers inject malicious information into training data or model updates,thereby interfering with the normal convergence of the global model until their prediction results are manipulated.The concealment and diversity of model poisoning attacks make defense extremely difficult,so it has attracted extensive attention from researchers.The principle of model poisoning attack is analyzed,and the internal mechanism of how attackers destroy the performance of the global model by tampering with local training data or forging model parameters is analyzed.On this basis,this paper systematically divides the existing defense strategies into three categories:defense strategies based on malicious model analysis,which mainly identify potential malicious behaviors through model update similarity comparison and quality assessment techniques.The core of the defense strategy based on model update robust aggregation is to significantly reduce the impact of attacks by removing extreme values or automatically weighting innovations.The defense strategy based on model update encryption aggregation creatively combines the frontier technologies of differential privacy and homomorphic encryption,which greatly improves the robustness of the model while ensuring data privacy security.The advantages and disadvantages and application scenarios are analyzed and explained.The privacy protection problems and specific solutions of model poisoning attacks are analyzed in detail,and the future development direction is proposed from the perspectives of attack and defense.