ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2021, Vol. 58 ›› Issue (5): 927-943.doi: 10.7544/issn1000-1239.2021.20200966

所属专题: 2021人工智能安全与隐私保护技术专题

• 综述 • 上一篇    下一篇

分布式深度学习隐私与安全攻击研究进展与挑战

周纯毅1,2,陈大卫1,王尚1,付安民1,2,高艳松1   

  1. 1(南京理工大学计算机科学与工程学院 南京 210094);2(桂林电子科技大学广西可信软件重点实验室 广西桂林 541004) (zhouchunyi@njust.edu.cn)
  • 出版日期: 2021-05-01
  • 基金资助: 
    国家自然科学基金项目(62072239,62002167);广西可信软件重点实验室研究课题(KX202029);中央高校基本科研业务费专项资金(30920021129)

Research and Challenge of Distributed Deep Learning Privacy and Security Attack

Zhou Chunyi1,2, Chen Dawei1, Wang Shang1, Fu Anmin1,2, Gao Yansong1   

  1. 1(School of Computer Science and Engineering, Nanjing University of Science & Technology, Nanjing 210094);2(Guangxi Key Laboratory of Trusted Software, Guilin University of Electronic Technology, Guilin, Guangxi 541004)
  • Online: 2021-05-01
  • Supported by: 
    This work was supported by the National Natural Science Foundation of China (62072239, 62002167), the Guangxi Key Laboratory of Trusted Software (KX202029), and the Fundamental Research Funds for the Central Universities (30920021129).

摘要: 不同于集中式深度学习模式,分布式深度学习摆脱了模型训练过程中数据必须中心化的限制,实现了数据的本地操作,允许各方参与者在不交换数据的情况下进行协作,显著降低了用户隐私泄露风险,从技术层面可以打破数据孤岛,显著提升深度学习的效果,能够广泛应用于智慧医疗、智慧金融、智慧零售和智慧交通等领域.但生成对抗式网络攻击、成员推理攻击和后门攻击等典型攻击揭露了分布式深度学习依然存在严重隐私漏洞和安全威胁.首先对比分析了联合学习、联邦学习和分割学习3种主流的分布式深度学习模式特征及其存在的核心问题.其次,从隐私攻击角度,全面阐述了分布式深度学习所面临的各类隐私攻击,并归纳和分析了现有隐私攻击防御手段.同时,从安全攻击角度,深入剖析了数据投毒攻击、对抗样本攻击和后门攻击3种安全攻击方法的攻击过程和内在安全威胁,并从敌手能力、防御原理和防御效果等方面对现有安全攻击防御技术进行了度量.最后,从隐私与安全攻击角度,对分布式深度学习未来的研究方向进行了讨论和展望.

关键词: 深度学习, 分布式深度学习, 隐私攻击, 隐私保护, 后门攻击

Abstract: Different from the centralized deep learning mode, distributed deep learning gets rid of the limitation that the data must be centralized during the model training process, which realizes the local operation of the data, and allows all participants to collaborate without exchanging data. It significantly reduces the risk of user privacy leakage, breaks the data island from the technical level, and improves the efficiency of deep learning. Distributed deep learning can be widely used in smart medical care, smart finance, smart retail and smart transportation. However, typical attacks such as generative adversarial network attacks, membership inference attacks and backdoor attacks, have revealed that distributed deep learning still has serious privacy vulnerabilities and security threats. This paper first compares and analyzes the characteristics of the three distributed deep learning modes and their core problems, including collaborative learning, federated learning and split learning. Secondly, from the perspective of privacy attacks, it comprehensively expounds various types of privacy attacks faced by distributed deep learning, and summarizes the existing privacy attack defense methods. At the same time, from the perspective of security attacks, the paper analyzes the attack process and inherent security threats of the three security attacks: data poisoning attacks, adversarial sample attacks, and backdoor attacks, and analyzes the existing security attack defense technology from the perspectives of defense principles, adversary capabilities, and defense effects. Finally, from the perspective of privacy and security attacks, the future research directions of distributed deep learning are discussed and prospected.

Key words: deep learning, distributed deep learning, privacy attack, privacy protection, backdoor attack

中图分类号: