黑盒垂直联邦学习中的批量标签推理和替换攻击
Batch Label Inference and Replacement Attacks in Black-Boxed Vertical Federated Learning
摘要：
在垂直联邦学习（VFL）场景中，特征和模型被分成不同的部分，样本特定更新的通信对于正确的梯度计算是必需的，但可以用于推断重要的样本级标签信息。一个直接的防御策略是保护与同态加密（HE）通信的样本级消息，并且以这种方式，只有批量平均的局部梯度被暴露给每一方（称为黑盒VFL）。在本文中，我们首先探讨了在具有HE保护通信的垂直联邦学习设置中恢复标签的可能性，并通过训练梯度反转模型来高精度地重建私有标签。此外，我们表明，标签替换后门攻击可以在黑盒VFL直接更换加密的通信消息（称为梯度替换攻击）。由于批量平均信息共享是安全的，批量标签推理和替换攻击是VFL面临的严峻挑战。为了抵御批量标签推理攻击，我们进一步评估了几种防御策略，包括混淆自动编码器（CoAE），我们提出了一种基于自动编码器和熵正则化的技术。我们证明，标签推理和替换攻击可以成功地阻止这种技术，而不会损害尽可能多的主要任务的准确性相比，现有的方法。
英文摘要：
In a vertical federated learning (VFL) scenario where features and model are split into different parties, communications of sample-specific updates are required for correct gradient calculations but can be used to deduce important sample-level label information. An immediate defense strategy is to protect sample-level messages communicated with Homomorphic Encryption (HE), and in this way only the batch-averaged local gradients are exposed to each party (termed black-boxed VFL). In this paper, we first explore the possibility of recovering labels in the vertical federated learning setting with HE-protected communication, and show that private labels can be reconstructed with high accuracy by training a gradient inversion model. Furthermore, we show that label replacement backdoor attacks can be conducted in black-boxed VFL by directly replacing encrypted communicated messages (termed gradient-replacement attack). As it is a common presumption that batch-averaged information is safe to share, batch label inference and replacement attacks are a severe challenge to VFL. To defend against batch label inference attack, we further evaluate several defense strategies, including confusional autoencoder (CoAE), a technique we proposed based on autoencoder and entropy regularization. We demonstrate that label inference and replacement attacks can be successfully blocked by this technique without hurting as much main task accuracy as compared to existing methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
