摘要： 联邦学习框架下，各参与方通过共享模型参数而非原始数据来协同训练全局模型，这种分布式训练方式在保护数据隐私的同时，也带来了新的安全挑战。由于分布式的本地训练难以监督，联邦学习系统更容易遭受模型中毒攻击。大多数现有的模型中毒攻击方法是对模型所有参数进行操作，通过统计相似性检查，可较容易检测到模型的显著改变。为了进一步分析该类攻击方法可能存在的隐秘方式，研究了一种针对联邦学习敏感参数扰动的模型中毒攻击方法（FedMSP）。该方法通过分析模型参数的梯度变化，精准识别出对模型性能具有显著影响的敏感参数，并对这些敏感参数施加扰动，以提高本地中毒模型的抗检测性，降低整体模型性能。此外，还提出了一种基于距离和方向不变性的攻击机制。该机制通过保持攻击向量的距离和方向不变，使攻击者能够有效规避现有的防御机制，显著提升模型中毒攻击的成功率。实验结果表明，针对Fashion-MNIST和CIFAR-100数据集构建联邦预测模型，当无防御条件时，该攻击方法将模型的测试准确率由原来的99.48%和61.37%分别降低至14.43%、8.27%；加入防御机制后，模型准确率回升至15.75%、10.87%，但仍显著低于正常水平。此外，FedMSP在多种安全聚合算法中展现出最优或接近最优的攻击效果，充分证明了其降低模型性能和减缓收敛速度的能力，为联邦学习的安全性研究提供了新的视角和挑战。

Abstract: Under the federated learning framework, participants collaborate to train global models by sharing model parameters instead of raw data, and this distributed training approach brings new security challenges while protecting data privacy. Because distributed local training is difficult to supervise, federated learning systems are more vulnerable to model poisoning attacks. Most existing model poisoning attack methods operate on all parameters of the model, and significant changes to the model can be detected more easily through statistical similarity checking. In order to further analyze the possible stealthy ways of this type of attack methods, a model poisoning attack method (FedMSP) for federated learning sensitive parameter perturbation is investigated. This method accurately identifies the sensitive parameters that have a significant impact on the model performance by analyzing the gradient change of the model parameters and applies perturbations to these sensitive parameters to improve the anti-detectability of locally-poisoned models and reduce the overall model performance. In addition, an attack mechanism based on distance and direction invariance is proposed. By keeping the distance and direction of the attack vectors invariant, this mechanism enables the attacker to effectively circumvent the existing defense mechanisms and significantly improves the success rate of the model poisoning attack. The experimental results show that, constructing the federal prediction model for Fashion-MNIST and CIFAR-100 datasets, when there is no defense condition, the attack method reduces the test accuracy of the model from the original 99.48% and 61.37% to 14.43% and 8.27%, respectively; after adding the defense mechanism, the accuracy of the model is rebounded to 15.75%, 10.87%, but still significantly lower than the normal level. In addition, FedMSP demonstrates optimal or near-optimal attack effects in multiple security aggregation algorithms, which fully proves its ability to reduce model performance and slow down convergence speed, and provides new perspectives and challenges for the security research of federated learning.