Federal learning anti-poisoning attack method based on homomorphic encryption
By employing adaptive singular value truncation and a three-level gradient detection mechanism, combined with homomorphic encryption technology, the problem of malicious poisoning attacks in federated learning is solved. This achieves efficient and secure detection and filtering of malicious information, protects user privacy, and improves the aggregation accuracy of the model.
Patent Information
- Application Number
- CN202511582693.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-31
- Publication Date
- 2026-02-27
AI Technical Summary
Existing federated learning techniques face a trade-off between efficiency and security when facing malicious poisoning attacks. The non-transparency of the ciphertext space causes gradient anomaly detection to fail, and adaptive attacks are highly covert. Existing defense mechanisms are unable to effectively detect and remove malicious information, while failing to balance user privacy protection and model expressive power.
An adaptive singular value truncation technique is used to preprocess the local dataset, and a homomorphic encryption algorithm is used to encrypt the gradients. A three-level malicious gradient detection mechanism is designed, including backdoor attack detection, preliminary detection, and detailed detection. A reputation aggregation mechanism is used to filter and weighted aggregate benign gradients to ensure model security and privacy.
It improves the efficiency and accuracy of malicious gradient detection, reduces communication overhead, protects user privacy information, enhances the aggregation accuracy and anti-virus defense capabilities of the global model, and optimizes the trade-off between confidentiality and anti-virus strength.
Smart Images
Figure CN121585337A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of artificial intelligence and cybersecurity, specifically to a federated learning method for resisting poisoning attacks based on homomorphic encryption. Background Technology
[0002] Federated Learning (FL) is a distributed machine learning paradigm that allows multiple clients (such as mobile devices and healthcare institutions) to train models locally and only upload model parameter updates (such as gradients or weights) to a central server, rather than the original data. This mechanism aims to protect user data privacy and meet regulatory requirements such as GDPR. Classic frameworks like the FedAvg algorithm generate a global model by weighted aggregation of local model updates. However, model parameter updates themselves may carry malicious information, leading to virus attacks (such as backdoor attacks or model poisoning), compromising the security and robustness of the global model.
[0003] To address these issues, existing technologies employ homomorphic encryption to ensure the confidentiality of parameter transmission. However, the non-transparency of the ciphertext space prevents servers from performing gradient anomaly detection (such as L2 norm thresholding and cosine similarity analysis), which renders statistical defense mechanisms ineffective. Furthermore, existing technologies face a trade-off between efficiency and security. The computational complexity of HE (Heterogeneous Encryption) increases superlinearly with the ciphertext dimension. To reduce latency, existing solutions are forced to reduce model size or encryption strength, sacrificing model expressive power.
[0004] Furthermore, adaptive poisoning can evade threshold detection by dynamically adjusting the amount of poisoning. In HE-encrypted environments, the stealth of such attacks is further enhanced, posing a greater challenge to conventional static defense mechanisms. Therefore, a new anti-poisoning model is urgently needed to protect user privacy while maintaining stable and efficient anti-poisoning capabilities. Summary of the Invention
[0005] Purpose of the invention: To address the problems mentioned in the background art, this invention discloses a federated learning anti-poisoning attack method based on homomorphic encryption. By preprocessing the local dataset and designing a triple detection and reputation aggregation mechanism, the anti-virus attack model can maintain the encryption strength while ensuring the detection and screening strength of malicious information. This reduces communication overhead while protecting personal privacy information and meets the needs of data scenarios of different scales.
[0006] Technical solution:
[0007] This invention discloses a federated learning method for resisting poisoning attacks based on homomorphic encryption, the method comprising the following steps:
[0008] Constructing an anti-poisoning attack model:
[0009] S1: KDC generates two types of public-private key pairs based on the security parameter λ. One type is distributed to each client, and the other type is distributed to the key conversion server s1.
[0010] S2: The model aggregation server s0 generates the initial global model parameters, distributes them to all clients, and the clients perform local training. They use adaptive truncated singular value decomposition of the local dataset, combine it with the current round of global model training to train the local gradient, and the clients use homomorphic encryption algorithm to encrypt the preprocessed local gradient before uploading it to the detection device.
[0011] S3: After receiving all encryption gradients, the detection device is designed with a three-level malicious gradient detection mechanism to screen and eliminate malicious gradients;
[0012] S4: Upload the benign gradients to the model aggregation server s0, and aggregate them securely by weighting according to the gradient reputation score; s0 sends the encrypted aggregated model to s1, and s1 decrypts it with its own private key and then re-encrypts it with the client's public key and sends it back to s0.
[0013] s0 distributes the re-encrypted global model to all clients and detection devices. The clients decrypt the model using their own private keys and then start a new round of training.
[0014] Deploy the model to the system to ensure data security while defending against malicious data.
[0015] Furthermore, the adaptive truncated singular value decomposition local dataset described in S2 is as follows:
[0016] The client performs singular value decomposition, satisfying Where U and V are orthogonal matrices, It is a singular value diagonal matrix. The internal learning rate is set using the meta-learning framework, and the Adam optimizer is tuned for updating the meta-parameters.
[0017] Based on the client's local dataset, a local gradient matrix is trained to obtain the gradient. Then, singular value decomposition is performed on the gradient to calculate its singular value vector, resulting in a singular value sequence. ,in Finally, the squared contribution of each singular value is calculated. The number of singular values K to be retained is dynamically determined to ensure that the local gradient matrix of each client is reduced to the optimal dimension as its own dataset decreases, where K satisfies the following requirements:
[0018]
[0019] in, Let N be the energy for each singular value, and N be the total number of singular values.
[0020] Furthermore, the preprocessing procedure for the local gradient described in S2 is as follows:
[0021] The client trains the model using the received global model parameters and its own weights to obtain the local gradient. ,right Perform gradient clipping, and then perform gradient compression on the clipped gradients:
[0022]
[0023] in, Represents the norm, The clipping norm is represented using the CKKS homomorphic encryption algorithm. Obtain the encryption gradient And upload it to the detection device.
[0024] Furthermore, the three-level malicious gradient detection mechanism described in S3 includes backdoor attack detection, preliminary detection, and detailed detection, covering all encryption gradients. The system sequentially performs backdoor attack detection, preliminary detection, and detailed detection mechanisms to conduct mixed detection scoring and statistics. The detection scores are converted into reputation scores. Gradients with reputation scores below the benign score threshold are judged as malicious gradients in the current round. Gradients with reputation scores still below the threshold after multiple rounds of training are identified as malicious gradients and removed.
[0025] Furthermore, the backdoor attack detection specifically includes:
[0026] exist After the data is transmitted to the detection device, the backdoor attack detection will dynamically adjust the adaptive threshold based on the previous round of ASR, and calculate the dynamic threshold for the current round:
[0027]
[0028] in, This represents the mean of ASR in historical statistics. This represents the standard deviation of ASR in historical statistics. This represents the maximum value of ASR in historical statistics.
[0029] The detection device calculates all gradient norms and finds their median. It then compares the relationship between each gradient norm and the median of the dynamic threshold multiplied by the gradient norm to determine whether the gradient is malicious and marks it. Finally, it records the backdoor detection score, with the backdoor_score of the malicious gradient set to 1.
[0030] Furthermore, the preliminary detection specifically includes:
[0031] In the initial screening phase, the direction of the global gradient from the previous round is first calculated, and the mean, variance, Euclidean distance to the global gradient direction, and cosine similarity to the previous gradient of all local client gradients are extracted as combined features. The detection device uses the combined features of each gradient as input to the Isolation Forest. The Isolation Forest will first dynamically adjust the model contamination parameters based on the historical attack ratio and ASR.
[0032]
[0033] Then, it is determined whether the gradient is malicious, and a preliminary screening score for this gradient is calculated.
[0034] Furthermore, the detailed detection specifically includes:
[0035] The detailed detection phase extracts the basic time series features of each gradient, namely mean, variance, and rate of change; frequency domain features; autocorrelation features; reflection characteristics; similarity of malicious behavior features; and statistical features: skewness and kurtosis as time feature sequences.
[0036] The detection device inputs time-series features into the GRU for malicious detection:
[0037]
[0038] Finally, malicious gradients are scored to obtain detailed detection scores.
[0039] Furthermore, the specific steps of S4 are as follows:
[0040] After receiving all benign gradients, server s0 performs a weighted aggregation of all benign gradients according to Equation 11 to obtain a new global model. :
[0041]
[0042] in, , , Reputation value Temperature is used as a parameter to control the smoothness of the weight distribution. This is a penalty factor for model accuracy. It is a punitive factor for malicious behavior.
[0043] The model aggregation server s0 randomly generates a mask vector r and uses the public key of the key conversion server S1. Encryption yields [[r]], which is then obtained through homomorphic computation. And send it to the key conversion server S1; the key conversion server S1 performs encryption on the global model. First, decrypt using its own key sks, then re-encrypt using the client's key pki, and finally encrypt the global model using the re-encrypted version. Send to model aggregation server s0; model aggregation server s0 uses the client's public key. Encryption random mask get By adding homomorphic computation Obtain the updated re-encrypted global model It will then be sent to the detection device and all benign clients, who will receive the global model in an encrypted state. Then, use your private key ski to decrypt and begin a new round of training.
[0044] Beneficial effects:
[0045] 1. This invention designs an adaptive singular value truncation technique, which dynamically truncates singular values based on the weights of the local client's own dataset. This fully considers the different weights of each client, thus avoiding the weight loss caused by fixed singular value truncation, reducing the accuracy loss during global model training, further improving the screening accuracy of subsequent models, and optimizing the trade-off between confidentiality and anti-virus strength.
[0046] 2. This invention designs a three-level malicious gradient detection mechanism. The server-side employs a triple detection process: backdoor detection, preliminary screening, and detailed screening. This improves detection efficiency by initially screening out gradients with obvious malicious characteristics, reducing the computational overhead of subsequent detailed screening. It also enhances detection effectiveness, allowing malicious gradients that cannot be identified by the preliminary screening to be further judged and eliminated through subsequent detailed screening. This mechanism design reduces communication overhead while protecting personal privacy and ensuring the strength of malicious information detection and screening.
[0047] 3. This invention employs a reputation aggregation mechanism where the server scores the uploaded gradients based on the detection results. Through multiple rounds of scoring, the impact of malicious gradients on aggregation is eliminated, and misjudgments of benign, heterogeneous client gradients are reduced. Simultaneously, a higher aggregation percentage is allocated to benign gradients, further enhancing the overall model aggregation accuracy. Attached Figure Description
[0048] Figure 1 This is a schematic diagram of the overall structure of the present invention;
[0049] Figure 2 This is a schematic diagram of the process of the present invention. Detailed Implementation
[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0051] like Figure 1 and Figure 2 As shown, this invention discloses a federated learning method for resisting poisoning attacks based on homomorphic encryption. The components of this method are as follows:
[0052] Clients: Assume there are n clients in total, and the nodes are denoted as n. Each client Each has a local dataset Clients are typically personal devices that hold sensitive data, such as mobile phones, tablets, and laptops.
[0053] Model aggregation server s0: Receives gradient information from clients after local training, aggregates it, and updates global model parameters. It is typically provided by the machine learning model owner.
[0054] Key conversion server s1: Receives the encrypted global model sent by s0 and decrypts it. Simultaneously, it re-encrypts the global model using the client's own public key, completing the key conversion for the global model. This is typically provided by the machine learning model owner.
[0055] This paper proposes a federated learning method that can simultaneously achieve privacy protection and high accuracy in large-scale data scenarios, while reducing communication overhead, thereby improving system efficiency, overcoming performance bottlenecks, and making the entire model more practical.
[0056] The specific steps of the method of the present invention are as follows:
[0057] S1: KDC generates a public-private key pair based on the security parameter λ. and and will Distributed to each corresponding client ,as well as It is distributed to the key conversion server S1.
[0058] S1.1: First, KDC selects a security parameter λ, then initializes it using CKKS.Initialization(1λ), and subsequently calls CKKS.KeyGen(χs;χe) for each client. Distribute public and private key pairs Then, KDC assigns a public-private key pair to key conversion server S1. .
[0059] S2: The model aggregation server s0 is initialized and generates global model parameters. Then distribute it to .
[0060] S3: Upon receiving Then, local training begins. First, adaptive truncation of singular values is used to decompose the local dataset to reduce its dimensionality.
[0061] The client performs singular value decomposition, satisfying Where U and V are orthogonal matrices, It is a singular value diagonal matrix. The internal learning rate is set using the meta-learning framework, and the Adam optimizer is tuned for updating the meta-parameters.
[0062] Based on the client's local dataset, a local gradient matrix is trained to obtain the gradient. Then, singular value decomposition is performed on the gradient to calculate its singular value vector, resulting in a singular value sequence. ,in Finally, the squared contribution of each singular value is calculated. The number of singular values K to be retained is dynamically determined to ensure that the local gradient matrix of each client is reduced to the optimal dimension as its own dataset decreases, where K satisfies the following requirements:
[0063]
[0064] in, Let N be the energy of each singular value (expressed as its squared contribution), and N be the total number of singular values.
[0065] S4: In each training round t It will combine global model parameters Train the dataset as a local gradient At the same time, gradient compression and gradient clipping are performed on the local gradients to avoid gradient explosion in subsequent training, which would affect the training results.
[0066] S4.1: The client trains the model based on the received global model parameters and its own weights to obtain the local gradient. .
[0067] S4.2: Perform gradient clipping using formula (2), and then perform gradient compression on the clipped gradient.
[0068]
[0069] in, Represents the norm, This represents the clipping norm.
[0070] S4.3: Use the public key of key conversion server S1 to process the local gradient. After encryption, the data is uploaded to the detection device.
[0071] S5: Processed through The encrypted data is uploaded to the detection device. The detection device receives all... Then, a three-level malicious gradient detection mechanism is designed to screen and remove malicious gradients:
[0072] Backdoor attack detection: After the local gradient is passed to the detection device on the client, the backdoor attack detection will dynamically adjust the adaptive threshold according to the previous round of ASR, that is, calculate the dynamic threshold of this round by formula (3) (the fixed threshold is used for the first round of detection).
[0073]
[0074] The detection device calculates all gradient norms and finds their medians. It then compares the relationship between each gradient norm and the median of the dynamic threshold multiplied by the gradient norm to determine whether the gradient is malicious and marks it. Finally, it records the backdoor detection score, with the backdoor_score of the malicious gradient set to 1.
[0075] Preliminary Detection: All gradients detected by the backdoor attack detection are passed to the preliminary detection. First, the preliminary detection calculates the global gradient from the previous round. The algorithm extracts the mean, variance, Euclidean distance to the global gradient direction, and cosine similarity to the previous gradient as features. (Note: In the first round, the mean of all gradients is calculated as the global gradient, its direction is calculated, and the Euclidean distance between each gradient direction and the global gradient direction is calculated. Cosine similarity is not calculated in the first round.) Then, the extracted features are fed into the Isolation Forest, and gradients exhibiting anomalous behavior are identified and marked as malicious gradients. Finally, a score is given for its initial testing.
[0076] In the initial screening stage, the direction of the global gradient in the previous round is first calculated, and the following features are extracted from all local client gradients: 1. mean, 2. variance, 3. Euclidean distance with the global gradient direction, and 4. cosine similarity with the previous gradient (see Formula 4) as combined features.
[0077]
[0078] Then, the detection device uses the combined features of each gradient as input to the isolated forest. The isolated forest will first dynamically adjust the model contamination parameters based on the historical attack ratio and ASR (attack success rate) (see Formula 5), and then determine whether the gradient is a malicious gradient.
[0079]
[0080] in, Pollution parameters representing isolated forests.
[0081] Finally, the initial screening score for this gradient is calculated.
[0082] Detailed testing: After preliminary testing, all gradients The data is then fed into the detailed detection process. First, the basic time series features (mean, variance, rate of change), frequency domain features, autocorrelation features, reflection characteristics, similarity to malicious behavior features, and statistical features (skewness and kurtosis) of each gradient are extracted as time feature sequences. Then, the time feature sequences are input into the GRU. Finally, the GRU determines whether the current gradient is a malicious gradient and calculates its detailed detection score.
[0083] First, the detailed detection phase extracts the following features for each gradient as time feature sequences: 1. basic time series features (mean, variance, rate of change), 2. frequency domain features, 3. autocorrelation features, 4. reflection characteristics, 5. similarity of malicious behavior features, and 6. statistical features (skewness and kurtosis).
[0084] Then, the detection device inputs the time series features into the GRU for malicious judgment (Formula 6).
[0085]
[0086] in, This represents the gradient vector at the last time step of the gradient sequence. This is the gradient prediction of the GRU model for the next time step. This represents the L2 norm.
[0087] Finally, malicious gradients are scored to obtain detailed detection scores.
[0088] S6: The gradients from the mixed detection and the scores of each detection part are input into the malicious gradient scoring. The reputation scores of the three parts are calculated. Gradients with reputation scores below the benign score threshold are judged as malicious gradients in the current round. Gradients with reputation scores below the threshold after multiple rounds of training are also determined as malicious gradients and removed.
[0089] First, the detection score is converted into a reputation score (Formulas 7 and 8), and the malicious client count corresponding to the gradient where the abnormal score exceeds the threshold of 0.5 is incremented by 1.
[0090]
[0091]
[0092] in, For the preliminary test score, For detailed scoring, The score is for backdoor detection.
[0093] Then, the time series features of the malicious gradients are recorded in the archive (the maximum archive record T for each gradient is 5); the next step is to calculate the penalty factor based on the verification accuracy, and if the accuracy shows a downward trend (exceeding 0.1), a penalty factor of 0.8 is applied.
[0094] Subsequently, the penalty factor is updated according to ASR (Formula 9).
[0095]
[0096] Finally, the credit score is updated based on the exponential moving average (EMA) (Formula 10).
[0097]
[0098] S7: The benign gradient of the current round The gradients are uploaded together to the server for secure aggregation. During global aggregation, the model aggregation server s0 performs weighted aggregation based on the gradient's reputation score; that is, gradients with lower reputation scores are given less aggregation weight. (Note: Malicious gradients require multiple rounds of detection to identify, so before being confirmed as malicious, abnormal gradients with low reputation scores are allowed to participate in aggregation to avoid losing important weights.)
[0099] After receiving all benign gradients, the model aggregation server s0 performs a weighted aggregation of all benign gradients according to Equation 11 to obtain a new global model. .
[0100]
[0101] in, , , Reputation value Temperature is used as a parameter to control the smoothness of the weight distribution. This is a penalty factor for model accuracy. It is a punitive factor for malicious behavior.
[0102] S8: Model aggregation server s0 randomly generates a mask vector r and uses the public key of key conversion server S1. Encryption yields [[r]], which is then obtained through homomorphic computation. And send it to the key conversion server S1.
[0103] Key conversion server S1 for global encryption model First, decrypt using its own key sks, then re-encrypt using the client's key pki, and finally encrypt the global model using the re-encrypted version. Send to model aggregation server s0.
[0104] The model aggregation server s0 uses the client's public key. Encryption random mask get By adding homomorphic computation Obtain the updated re-encrypted global model It will be sent to the detection device and all benign clients. The global model received in encrypted state Then, the model is decrypted using its own private key (ski), and a new round of training begins. Once the entire training iteration is complete, the aggregated global model is deployed to the system. In this embodiment, it is deployed to the bank's transaction system. The model can ensure that specific transaction details are not leaked and can effectively defend against malicious clients injecting toxic data containing fraudulent patterns, preventing fraudsters from obtaining other traders' personal privacy information by corrupting the model.
[0105] To verify the defensive capability of the method of this invention against poisoning attacks, multiple sets of experiments were conducted and compared with the federated learning model with robust aggregation (MKrum) and the federated learning model with malicious poisoning detection mechanism (DPFLA).
[0106] This experiment uses the MINST dataset and the CIFAR10 dataset.
[0107] MNIST (Modified National Institute of Standards and Technology) is one of the most classic introductory datasets in the fields of machine learning and computer vision. Compiled and optimized by the National Institute of Standards and Technology (NIST), it contains 70,000 images of handwritten digits (0-9), with 60,000 for training and 10,000 for testing. Each image is a single-channel grayscale image with a fixed size of 28×28 pixels, a black background, and white digits (pixel values 0-255, where 0 represents black and 255 represents white).
[0108] CIFAR10 (Canadian Institute for Advanced Research 10) is an image classification dataset released by the Canadian Institute for Advanced Research. Compared to MNIST, it is more complex and more closely resembles real-world scenes. It contains 60,000 color images divided into 10 categories (airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck), with 6,000 images in each category. 50,000 images are used for training, and 10,000 for testing. Each image is a 3-channel RGB image with a fixed size of 32×32 pixels. The images depict objects in natural scenes, with some background interference and pose variations.
[0109] The hardware and software configuration for this experiment is shown in Table 1.
[0110] Table 1
[0111]
[0112] The following indicators were used in this experiment to evaluate the superiority of the method of the present invention:
[0113] Global Model Accuracy (TACC): Evaluates the accuracy of the final model from federated learning.
[0114] Malicious Infection Attack Success Rate (ASR): The success rate of backdoor attacks. The lower the ASR, the better the model's defense performance against infection attacks.
[0115] Average Time to Aggregate Models (AGT): The evaluation time for federated learning aggregation. The shorter the time, the less computational cost of the model.
[0116] By employing a hybrid detection mechanism (initial screening based on isolated forest and detailed screening based on time-series GRU), this invention reduces the impact of malicious gradients on model training. The prediction error of this method reaches approximately 98% on the MINST dataset and 76.36%-78.84% on CIFAR10, both significantly higher than MKrum and DPFLA. The global model accuracy comparison is shown in Table 2.
[0117] Table 2
[0118]
[0119] By employing a hybrid detection mechanism (initial screening based on isolated forests and detailed screening based on time-series GRUs), this invention can better capture malicious gradients and improve the model's resistance to viral attacks. Table 3 shows a comparison of backdoor attack success rates (ASRs). The ASR of the method described in this invention is significantly lower than that of MKrum and DPFLA on the MINST dataset and CIFAR10.
[0120] Table 3
[0121]
[0122] By employing meta-learning-based adaptive singular value truncation, this invention can better reduce computational overhead. The average aggregation time (AGT) of the model is shown in Table 4. The AGT of the method of this invention reaches 0.39 on the MINST dataset and 0.75 on the CIFAR10 dataset, both lower than MKrum and DPFLA.
[0123] Table 4
[0124]
[0125] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent transformations or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.
Claims
1. A federated learning method for resisting poisoning attacks based on homomorphic encryption, characterized in that, The method includes the following steps: Constructing an anti-poisoning attack model: S1: KDC generates two types of public-private key pairs based on the security parameter λ. One type is distributed to each client, and the other type is distributed to the key conversion server s1. S2: The model aggregation server s0 generates the initial global model parameters, distributes them to all clients, and the clients perform local training. They use adaptive truncated singular value decomposition of the local dataset, combine it with the current round of global model training to train the local gradient, and the clients use homomorphic encryption algorithm to encrypt the preprocessed local gradient before uploading it to the detection device. S3: After receiving all encryption gradients, the detection device is designed with a three-level malicious gradient detection mechanism to screen and eliminate malicious gradients; S4: Upload benign gradients to the model aggregation server s0, and aggregate them safely by weighting gradient reputation scores; s0 sends the encrypted aggregation model to s1, and s1 decrypts it with its own private key and then re-encrypts it with the client's public key before sending it back to s0. s0 distributes the re-encrypted global model to all clients and detection devices. The clients decrypt the model using their own private keys and then start a new round of training. Deploy the model to the system to ensure data security while defending against malicious data.
2. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 1, characterized in that, The adaptive truncated singular value decomposition local dataset described in S2 is as follows: The client performs singular value decomposition, satisfying Where U and V are orthogonal matrices, It is a singular value diagonal matrix. The internal learning rate is set using the meta-learning framework, and the Adam optimizer is tuned for updating the meta-parameters. Based on the client's local dataset, a local gradient matrix is trained to obtain the gradient. Then, singular value decomposition is performed on the gradient to calculate its singular value vector, resulting in a singular value sequence. ,in Finally, the squared contribution of each singular value is calculated. The number of singular values K to be retained is dynamically determined to ensure that the local gradient matrix of each client is reduced to the optimal dimension as its own dataset decreases, where K satisfies the following requirements: ； in, Let N be the energy for each singular value, and N be the total number of singular values.
3. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 2, characterized in that, The preprocessing procedure for the local gradient described in S2 is as follows: The client trains the model using the received global model parameters and its own weights to obtain the local gradient. ,right Perform gradient clipping, and then perform gradient compression on the clipped gradients: ； in, Represents the norm, The clipping norm is represented using the CKKS homomorphic encryption algorithm. Obtain the encryption gradient And upload it to the detection device.
4. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 1, characterized in that, S3's three-tiered malicious gradient detection mechanism includes backdoor attack detection, preliminary detection, and detailed detection, covering all encryption gradients. The system sequentially performs backdoor attack detection, preliminary detection, and detailed detection mechanisms to conduct mixed detection scoring and statistics. The detection scores are converted into reputation scores. Gradients with reputation scores below the benign score threshold are judged as malicious gradients in the current round. Gradients with reputation scores still below the threshold after multiple rounds of training are identified as malicious gradients and removed.
5. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 4, characterized in that, The backdoor attack detection specifically involves: exist After the data is transmitted to the detection device, the backdoor attack detection will dynamically adjust the adaptive threshold based on the previous round of ASR, and calculate the dynamic threshold for the current round: ； in, This represents the mean of ASR in historical statistics. This represents the standard deviation of ASR in historical statistics. This represents the maximum value of ASR in historical statistics; The detection device calculates all gradient norms and finds their median. It then compares the relationship between each gradient norm and the median of the dynamic threshold multiplied by the gradient norm to determine whether the gradient is malicious and marks it. Finally, it records the backdoor detection score, with the backdoor_score of the malicious gradient set to 1.
6. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 4, characterized in that, The preliminary detection specifically includes: In the initial screening phase, the direction of the global gradient from the previous round is first calculated, and the mean, variance, Euclidean distance to the global gradient direction, and cosine similarity to the previous gradient of all local client gradients are extracted as combined features. The detection device uses the combined features of each gradient as input to the Isolation Forest. The Isolation Forest will first dynamically adjust the model contamination parameters based on the historical attack ratio and ASR. ； Then, it is determined whether the gradient is malicious, and a preliminary screening score for this gradient is calculated.
7. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 4, characterized in that, The detailed detection process is as follows: The detailed detection phase extracts the basic time series features of each gradient, namely mean, variance, and rate of change; frequency domain features; autocorrelation features; reflection characteristics; and similarity of malicious behavior features. Statistical characteristics: skewness and kurtosis as time-series features; The detection device inputs time-series features into the GRU for malicious detection: ； Finally, malicious gradients are scored to obtain detailed detection scores.
8. The federated learning anti-poisoning attack method based on homomorphic encryption according to claim 4, characterized in that, The specific steps for S4 are as follows: After receiving all benign gradients, server s0 performs a weighted aggregation of all benign gradients according to Equation 11 to obtain a new global model. : ； in, , , Reputation value The temperature parameter is used to control the smoothness of the weight distribution. This is a penalty factor for model accuracy. A punitive factor for malicious behavior; The model aggregation server s0 randomly generates a mask vector r and uses the public key of the key conversion server S1. Encryption yields [[r]], which is then obtained through homomorphic computation. And send it to the key conversion server S1; the key conversion server S1 performs encryption on the global model. First, decrypt using its own key sks, then re-encrypt using the client's key pki, and finally encrypt the global model using the re-encrypted version. Send to model aggregation server s0; model aggregation server s0 uses the client's public key. Encryption random mask get By adding homomorphic computation Obtain the updated re-encrypted global model It will then be sent to the detection device and all benign clients, who will receive the global model in an encrypted state. Then, use your private key ski to decrypt and begin a new round of training.