摘要：

联邦学习作为一种新型的深度学习范式, 允许多个参与方在客户端本地共同训练模型, 极大地保护了用户的数据隐私, 得到了广泛关注和研究。然而, 联邦学习作为一种分布式学习方式, 极易遭受非法复制、恶意分发及客户端懒惰不作为等攻击。针对上述问题, 提出一种支持安全联邦学习的主动保护模型水印框架。首先, 设计了一个基于护照层水印的个性化参数聚合方法, 在解决水印冲突问题的同时防止懒惰客户端盗窃模型; 其次, 设计了一个基于向量承诺的全局水印聚合方法, 有效抵御了恶意攻击者伪造私有水印进行歧义攻击。实验结果表明, 与当前最好的FedIPR相比, 所提方法具有更高的水印容量, 可以支持更大型的联邦学习系统; 在差分隐私、客户端选择等安全联邦学习策略下能保持近100%的水印提取率, 在遭遇微调、剪枝等攻击时也能保持98%以上的水印提取率。

关键词: 版权保护, 联邦学习, 向量承诺, 歧义攻击, 懒惰客户端

Abstract:

As a new paradigm in deep learning, federated learning allows multiple parties to jointly train deep learning models while ensuring that data remains on the clients' local devices. This approach has greatly protected user data privacy and has gained widespread attention from researchers. However, as a distributed learning method, federated learning is highly vulnerable to illegal copying, malicious distribution, and free rider attacks. In response to these security issues in federated learning, this study proposes an active model watermarking framework for secure federated learning. First, the framework employs a personalized parameter aggregation method based on passport layer watermarking scheme, which resolves watermark conflicts while preventing free riders from obtaining usable models. Second, a global watermark aggregation algorithm based on vector commitment is proposed, which can effectively resist malicious attackers attempting to forge private watermarks for ambiguity attacks. Experimental results show that, compared to the state-of-the-art client-side federated learning watermarking scheme FedIPR, the proposed method has a higher watermark capacity, enabling support for larger federated learning systems. The proposed method maintains a near 100% watermark extraction rate under secure federated learning strategies such as differential privacy and client selection. It also maintains an extraction rate of over 98% when faced with attacks such as fine-tuning and pruning.

Key words: copyright protection, federated learning, vector commitment, ambiguity attack, lazy client