【作者】 张伟；

【导师】 陈玮彤；

【作者基本信息】 扬州大学 ， 软件工程， 2025， 硕士

【摘要】 近年来,人工智能跟大数据技术快速发展促使海量数据被用于模型训练,不过,这也让数据泄露隐患加剧,致使数据隐私跟安全问题日益明显,在这样的背景下,联邦学习作为一种创新的分布式机器学习架构出现了,联邦学习主张在分散的参与设备上各自进行模型训练,不用把数据集中到单一中心服务器。此方法依靠在本地设备进行模型训练,切实减少了数据对外分享,加强了对隐私的保护,虽然联邦学习凭借其独特的数据隐私保护机制受到很多推崇,但是,该方法没能完全消除潜在的安全风险,比如恶意用户可能借助模型逆向工程、数据污染等策略,干扰模型训练,降低模型效能,甚至妄图盗取模型的敏感信息。同时联邦学习模型容易因为多方参与、去中心化特性而面临被不当使用、复制或者分发的风险,这些问题威胁模型的安全性跟性能,还可能给相关数据隐私跟知识产权带来不能忽视的负面影响,怎样有效识别恶意用户,怎样借助技术手段强化模型版权保护机制,以及怎样追溯模型泄露源头来遏制滥用行为,已经成为急需解决的关键问题。针对当前模型水印技术存在的隐蔽性不足、泄密追溯难、恶意客户端识别难的问题,本文给出了两种改进办法:一种是基于私有类的黑盒水印算法,能提高水印的隐蔽性跟鲁棒性,另一种是基于服务器端的白盒水印算法,能在验证版权的同时进行恶意客户端检测以及对泄露源头追溯。本文主要研究内容如下:1)提出一种基于联邦学习中基于类隐藏的客户端水印,该方法改变模型的结构,借助训练模型学习特定的输入输出行为来实现水印嵌入,并且不用更改原始数据集或标签,在水印生成阶段,该方法先创建一个私有水印数据集,接着它改变客户端的模型结构,把其从N分类模型变为N+1分类模型,在客户端的训练过程中将水印嵌入到模型中。在提交模型进行聚合之前,客户端会恢复模型结构,保存与水印类相关的输出层的参数并不断更新它们。在验证期间,将保存的水印参数重新嵌入到模型输出层中,以验证联邦学习模型的所有权。实验结果显示本文水印在经过一系列的微调剪枝根据后的检测率仍保持95%以上,具有很高的鲁棒性,同时具有高保真度,高隐蔽性。2)一种基于服务器端的联邦学习模型白盒水印方法被提出,此方法可达成恶意客户端检测、泄漏追溯以及版权验证,在水印进程里,Re LU损失函数被引入,促使作为水印载体的模型权重和水印信息符号达成对齐,实现水印嵌入,保证不会对模型性能造成影响,在恶意客户端检测阶段,通过剖析客户端上传的模型参数里水印的退化情形,辨别潜在的恶意客户端,及时识别并隔离恶意节点,保障模型的安全训练。在水印验证阶段,依靠提取嵌入的水印信息并与嵌入的水印信息进行比对,可追溯泄漏源头,明确责任,确定合法所有权,实验结果显示,本文的FL模型水印方案可有效达成恶意客户端检测、泄漏追溯以及版权验证,对模型性能的影响极为微小,并且对微调、剪枝、量化等攻击有较好的鲁棒性。3)本文设计开发了一个安全联邦学习系统,该系统集成了恶意客户端检测以及版权验证技术,系统包含发起训练、参与训练、恶意客户端检测、版权验证四个核心功能模块,可帮助用户识别客户端的恶意行为并进行模型的版权验证,经过系统的测试与评估,实验结果说明,该平台可有效检测并定位恶意客户端,保证模型的安全性,还可以准确验证模型的版权归属。更多还原

【Abstract】 In recent years,the rapid development of artificial intelligence and big data technology has led to the use of massive data for model training.However,this has also exacerbated the risk of data leakage,resulting in increasingly obvious data privacy and security issues.In this context,federated learning has emerged as an innovative distributed machine learning architecture.Federated learning advocates that model training be performed on decentralized participating devices,without centralizing data to a single central server.This method relies on model training on local devices,effectively reducing data sharing and strengthening privacy protection.Although federated learning has been highly praised for its unique data privacy protection mechanism,it has not been able to completely eliminate potential security risks.For example,malicious users may interfere with model training,reduce model performance,and even attempt to steal sensitive information of the model through strategies such as model reverse engineering and data pollution.At the same time,federated learning models are prone to the risk of improper use,copying,or distribution due to multi-party participation and decentralized characteristics.These problems threaten the security and performance of the model,and may also have a negative impact on the privacy and intellectual property rights of related data.How to effectively identify malicious users,how to use technical means to strengthen the model copyright protection mechanism,and how to trace the source of model leakage to curb abuse have become key issues that need to be urgently addressed.In view of the problems of insufficient concealment,difficulty in tracing leaks,and difficulty in identifying malicious clients in the current model watermarking technology,this thesis proposes two improvement methods:one is a black-box watermarking algorithm based on private classes,which can improve the concealment and robustness of watermarks;the other is a white-box watermarking algorithm based on the server side,which can detect malicious clients and trace the source of leaks while verifying copyright.The main research contents of this thesis are as follows:1)A client-side watermark based on class hiding in federated learning is proposed.This method changes the structure of the model and uses the training model to learn specific input and output behaviors to achieve watermark embedding without changing the original data set or label.In the watermark generation stage,this method first creates a private watermark data set,then it changes the model structure of the client,changing it from an N-classification model to an N+1-classification model,and embeds the watermark into the model during the training process of the client.Before submitting the model for aggregation,the client will restore the model structure,save the parameters of the output layer related to the watermark class,and continuously update them.During verification,the saved watermark parameters are re-embedded into the model output layer to verify the ownership of the federated learning model.The experimental results show that the detection rate of the watermark in this thesis remains above 95%after a series of fine-tuning and pruning,which is highly robust,high fidelity and high concealment.2)A white-box watermarking method based on the server-side federated learning model is proposed.This method can achieve malicious client detection,leakage tracing and copyright verification.In the watermark embedding process,the Re LU loss function is introduced to align the model weights and watermark information symbols as the watermark carrier,realize watermark embedding,and ensure that there is no impact on the model performance.In the malicious client detection stage,by analyzing the degradation of the watermark in the model parameters uploaded by the client,potential malicious clients are identified,malicious nodes are identified and isolated in time,and the safe training of the model is guaranteed.In the watermark verification stage,by extracting the embedded watermark information and comparing it with the embedded watermark information,the source of the leak can be traced,the responsibility can be clarified,and the legal ownership can be determined.The experimental results show that the FL model watermark scheme in this thesis can effectively achieve malicious client detection,leak tracing and copyright verification,with extremely small impact on model performance,and has good robustness to attacks such as fine-tuning,pruning,and quantization.3)This thesis designs and develops a secure federated learning system that integrates malicious client detection and copyright verification technology.The system includes four core functional modules:initiating training,participating in training,malicious client detection,and copyright verification.It can help users identify malicious behavior of clients and perform copyright verification of models.After systematic testing and evaluation,the experimental results show that the platform can effectively detect and locate malicious clients,ensure the security of the model,and accurately verify the copyright ownership of the model.更多还原