AI Research Portal

This paper introduces Consensus Learning, a novel paradigm for secure model access in multi-party collaborative deep learning environments. The core idea is to enforce fine-grained control over model execution permissions through a multi-party joint authorization mechanism. To achieve this, the authors propose the Collaborative Perturbation Trigger Method (CPTM), which enables participating parties to collaboratively generate perturbation-based trigger data, called Consensus Triggered Data (CTD), that embeds identity features. The model is designed to activate only when presented with collectively constructed CTD, ensuring tightly bound access control without modifying the model architecture. Extensive experiments on CIFAR-10, CIFAR-100, MNIST, and Face-LFW datasets demonstrate that the method maintains prediction accuracy within 2% of baseline unprotected models on authorized data, while model accuracy drops below 10% for unauthorized or adversarial inputs, showcasing strong access control and robustness.

The paper addresses several bottlenecks in multi-party collaborative deep learning scenarios:

Consensus Learning Paradigm: The paper proposes Consensus Learning, a collaborative paradigm that binds model execution to jointly authorized data from all participants. It enforces access control under full authorization without modifying the model architecture, enhancing security and robustness in multi-party settings.
Collaborative Perturbation Trigger Method (CPTM): The paper introduces CPTM, a chained perturbation injection method that generates Consensus Triggered Data (CTD) as identity-bound credentials. CTD binds model access to full multi-party authorization, enabling secure, distributed control.
Empirical Validation: Extensive experiments across datasets and models demonstrate that the method enforces secure access with negligible performance loss, confirming its effectiveness and generality.

The proposed method, Consensus Learning, ensures that model activation and execution are jointly authorized by all participating parties. It relies on the Collaborative Perturbation Trigger Method (CPTM) to generate Consensus Triggered Data (CTD).

Method Flow:

Consensus Learning Paradigm: This paradigm enforces two conditions:
- Joint Authorization: All parties must contribute valid trigger factors for activation; missing or forged components render the model inactive.
- Collaborative Embedding: Trigger signals are individually embedded during training to define secure, distributed access control.
Collaborative Perturbation Trigger Method (CPTM): This method integrates spatial perturbations with frequency-domain embeddings.
- Each participant sequentially injects identity-bound perturbations into shared data.
- In a typical five-client federated setting (A-E), perturbations are constructed in a fixed order, with each participant applying affine transformations and nonlinear noise to embed personal identity features.
- The final image integrates perturbations from all parties, forming CTD.
Dataset Structuring: Three types of training datasets are constructed to enhance the model's ability to distinguish valid perturbation patterns and improve robustness:
- Invalid Set: Images with random or forged perturbations paired with incorrect labels, simulating malicious attackers.
- Initial Set: Images without perturbation information and with randomly assigned labels, used to train the model to remain inactive when exposed to clean inputs.
- Authorized Set: Images with valid perturbations collaboratively generated by all participants, accompanied by correct labels. This is the only set permitted to activate the model's predictive functionality.
Model Training: Each participant trains a local model on private data, with periodic parameter aggregation via a federated scheme. This yields a unified model that embeds multi-party perturbation signals while preserving structural and training consistency, enabling it to recognize CTD and enforce secure access control.

Key Equations:

Single-Stage Affine Transformation: Source point set : Si = {P1, P2, P3} Target point set : Ti = {q1, q2, q3} The affine matrix Mi ∈ R2×3 is computed based on these three pairs of points, satisfying: [ q1 q2 q3 ] = Mi [ p1 p2 p3 ] [ 1 1 1 ] The perturbed image is obtained by: X' = A(X, Mi)
Multi-Stage Joint Affine Perturbation: For N clients (A1, ..., AN), the initial image X0 = X, and the image at stage i is Xi = A(Xi-1, Mi). The final output image is: XN = A(XN-1, MN) = A(A(A(X0, M1), M2), ..., MN)
Nonlinear Perturbation Injection: For each pixel coordinate (x, y), a sinusoidal perturbation is defined: δ(x, y) = α sin(βx + γy + φ) This perturbation is added to each channel of the image's pixel values: Xi(x, y, c) ← Xi(x, y, c) + δ(x, y), ∀c ∈ {1, 2, ..., C} A fixed structured noise image Nfixed ∈ RH×W×C is also injected: Xi(x, y, c) ← Xi(x, y, c) + δ(x, y) + Nfixed(x, y, c)
Frequency-Domain Trigger Embedding: The two-dimensional Fourier transform of an image X is: F[X](u, v) = Σx=0 to H-1 Σy=0 to W-1 X(x, y) · e-2πi(ux/H + vy/W) The final Consensus Triggered Data (CTD) is obtained by inverse Fourier transform after high-frequency patch replacement: Xtrigger (x, y, c) = F-1[X̂C] where X̂C(u, v) = Σu=0 to H-1 Σv=0 to W-1 X̂C(u, v) · e2πi(ux/H + vy/W) / (HW)

Implementation: All experiments were conducted using PyTorch on a high-performance platform with multiple NVIDIA Tesla V100 GPUs.
Datasets: MNIST, CIFAR-10, CIFAR-100, and Face-LFW.
Architectures: VGG16, ResNet18, DenseNet121, and WideResNet50-2.
Affine Transformation: Each client randomly selects three pairs of coordinate points to construct an affine matrix Mi.
Nonlinear Perturbation Parameters: α (perturbation amplitude), β and γ (frequency factors), φ (phase constant). Not stated in the paper.
High-Frequency Patch Size: h, w. Not stated in the paper.
Fixed Noise Image: Nfixed ∈ RH×W×C.
Brute-Force Complexity: For N clients applying sequential affine transformations on a 32x32 image, the brute-force complexity is (C(1024, 3) × C(1024, 3))^N. For N=5, this exceeds 2^270.
Client Number Experiments: ResNet-18 model on CIFAR-10 dataset with 5, 10, 15, and 20 clients.

Datasets: MNIST, CIFAR-10, CIFAR-100, Face-LFW.
Networks: VGG16, ResNet18, DenseNet, WideResNet.
Metrics:
- Acc-Clean: Accuracy of the unprotected model on clean data.
- Acc-Pro: Protected model's accuracy on consensus triggered data.
- Acc-Origin: Protected model's accuracy on original clean data.
- Acc-Single: Attacker possesses perturbation information from a single client.
- Acc-Fusion: Attacker acquires partial information (e.g., from three out of five clients).
Prediction Accuracy (Table 1):
- MNIST: Acc-Pro is comparable to Acc-Clean (e.g., VGG16: Acc-Clean 99.30, Acc-Pro 99.38). Acc-Origin is below 10% (e.g., VGG16: 11.35).
- CIFAR-10: Acc-Pro is comparable to Acc-Clean (e.g., ResNet18: Acc-Clean 93.08, Acc-Pro 93.33). Acc-Origin is below 1% (e.g., ResNet18: 0.56).
- CIFAR-100: Acc-Pro is comparable to Acc-Clean (e.g., ResNet18: Acc-Clean 75.34, Acc-Pro 75.41). Acc-Origin is below 1% (e.g., ResNet18: 0.77).
- Face-LFW: Acc-Pro is comparable to Acc-Clean (e.g., ResNet18: Acc-Clean 95.04, Acc-Pro 94.17). Acc-Origin is below 1% (e.g., ResNet18: 0.99).
Robustness Experiments (Table 2):
- MNIST: Acc-Origin, Acc-Single, Acc-Fusion remain consistently low (e.g., ResNet18: Acc-Origin 11.21, Acc-Single 12.17, Acc-Fusion 10.32).
- CIFAR-10: Acc-Origin, Acc-Single, Acc-Fusion remain consistently low (e.g., ResNet18: Acc-Origin 0.56, Acc-Single 1.90, Acc-Fusion 4.35).
- CIFAR-100: Acc-Origin, Acc-Single, Acc-Fusion remain consistently low (e.g., ResNet18: Acc-Origin 0.77, Acc-Single 1.89, Acc-Fusion 1.10).
- Face-LFW: Acc-Origin, Acc-Single, Acc-Fusion remain consistently low (e.g., ResNet18: Acc-Origin 0.99, Acc-Single 1.16, Acc-Fusion 3.55).
Impact of Client Number (Table 3, ResNet-18 on CIFAR-10):
- Acc-Pro remains stable (e.g., 5 clients: 93.33; 20 clients: 93.02), comparable to Acc-Clean (93.08).
- Acc-Origin and Acc-Single remain low across varying client numbers (e.g., 5 clients: Acc-Origin 0.56, Acc-Single 1.90; 20 clients: Acc-Origin 0.72, Acc-Single 1.68).
Runtime/Training Cost: Not stated in the paper.

No explicit paper-reported limitations were found.

Method evidence: "To support the Consensus Learning paradigm, we introduce the Collaborative Perturbation Trigger Method (CPTM). CPTM enables each participant to sequentially inject identity-bound perturbations into shared data, producing Consensus Triggered Data (CTD) that encodes multi-party authorization." (section: Abstract)
Result evidence: "The experimental results (Table 1) show that Acc-Pro achieves performance comparable to or even better than Acc-Clean, indicating that consensus-triggered data enhances feature learning. In contrast, Acc-Origin remains below 10%, demonstrating strong suppression of unauthorized inputs." (section: Model Performance Evaluation)
Limitation evidence: Not stated in the paper.

Consensus Learning with Multi-Party Perturbation Triggers for Secure Model Access

Summary

Problem

Key Contributions

Method

Technical Details

Results

Weaknesses / Limitations

Evidence

Additional Figures