A method, apparatus, equipment, and medium for detecting backdoor attacks in heterogeneous federated learning.

Abstract

This application relates to the field of federated learning technology and discloses a method, apparatus, device, and medium for detecting backdoor attacks in heterogeneous federated learning, applied to a central server. The method includes: distributing global model parameters to multiple clients; receiving model parameters uploaded by clients and determining the parameter offset of each client's model parameters relative to the global model parameters of the previous training round; determining a dynamic adjudication threshold based on the parameter offsets of all clients, and identifying clients with parameter offsets exceeding the dynamic adjudication threshold as potential malicious actors; if the detection of potential malicious actors is abnormal, removing the potential malicious actors and aggregating the model parameters uploaded by the remaining benign clients to generate global model parameters for a new training round. The technical solution provided by this application can achieve accurate identification and defense against covert backdoor attacks or data poisoning while ensuring the convergence accuracy of the global model.

Description

Technical Field

[0001] This application relates to the field of federated learning technology, and in particular to a method, apparatus, device and medium for detecting backdoor attacks in heterogeneous federated learning. Background Technology

[0002] Federated learning addresses privacy compliance challenges in data-sensitive scenarios such as finance and healthcare by leveraging its architecture advantage of local data remaining within the domain and only synchronizing model parameters. However, its distributed, multi-party autonomous architecture cannot verify the compliance of the local training process, making it inherently vulnerable to backdoor injection by a small number of malicious clients through multiple rounds of gradient updates. This is the core inherent contradiction of traditional architectures.

[0003] Current industry attempts to address backdoor attacks using dynamic perturbation in Mobile Threat Defense (MTD) and dynamic heterogeneous redundancy mechanisms in mimicry defense, but neither approach is well-suited to the characteristics of federated learning scenarios. The former's pseudo-random perturbation patterns are easily cracked by multiple rounds of probing, while the latter remains merely a conceptual application, lacking in-depth design considering the execution characteristics, update logic, and non-independent identically distributed (Non-IID) data characteristics of federated learning. Existing research generally suffers from three core shortcomings: First, the dynamic mechanisms do not match the periodic updates and relatively fixed client sets of federated learning, making it easy for attackers to reverse-engineer normal updates through pseudo-random perturbations. Second, treating clients as training black boxes lacks execution-level dynamic reconstruction and anomaly feedback mechanisms, making compromised clients vulnerable to continuous attacks. Third, failing to consider Non-IID characteristics and employing a one-size-fits-all gradient filtering strategy, while intercepting backdoor gradients, inadvertently harms personalized updates, significantly reducing the generalization performance of the global model and failing to meet the dual requirements of "high security and high accuracy" in the scenario.

[0004] Therefore, how to effectively address the differences in model updates and the difficulty in distinguishing between malicious attacks caused by the non-independent and identically distributed (Non-IID) characteristics of client data during the distributed training process of federated learning has become an urgent technical problem to be solved, so as to achieve accurate identification and defense against covert backdoor attacks or data poisoning behaviors while ensuring the convergence accuracy of the global model. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for detecting backdoor attacks in heterogeneous federated learning. It solves the technical problem of effectively addressing the difficulty in distinguishing between model update differences and malicious attack behaviors caused by the non-independent and identically distributed characteristics of client data during the distributed training process of federated learning. It achieves the technical effect of accurately identifying and defending against covert backdoor attacks or data poisoning behaviors while ensuring the convergence accuracy of the global model.

[0006] To achieve the above objectives, the main technical solutions adopted in this application include: In a first aspect, embodiments of this application provide a method for detecting backdoor attacks in heterogeneous federated learning, applied to a central server, comprising: Global model parameters are distributed to multiple clients so that the clients can train locally using private data. Receive the model parameters uploaded by the client and determine the parameter offset of each client's model parameters relative to the global model parameters of the previous training round; A dynamic adjudication threshold is determined based on the parameter offset of all clients, and clients whose parameter offset exceeds the dynamic adjudication threshold are identified as potential malicious actors. If the potential malicious executable is detected to be benign, the potential malicious executable is removed, and the model parameters uploaded by the remaining benign clients are aggregated to generate global model parameters for a new training round.

[0007] In one implementation, determining the parameter offset of each client's model parameters relative to the global model parameters of the previous training round includes: For any client, the generator model parameters uploaded in the current training round and the global generator model parameters in the previous training round are vectorized to obtain the generator model parameter vector for the current training round and the global generator model parameter vector for the previous training round. Determine the difference between the parameter vector of the generator model in the current training round and the parameter vector of the global generator model in the previous training round, and determine the difference as the parameter offset.

[0008] In one implementation, determining the dynamic adjudication threshold based on parameter offsets from all clients includes: The parameter offset is used as the parameter update step size for the client in the current training round. Perform statistical analysis on the parameter update step size for all clients to obtain the step size standard deviation; The step size standard deviation is determined as the dynamic decision threshold for the current training round.

[0009] In one implementation, the global model parameters for the new training epoch include global generator model parameters and global classifier shared layer parameters; the step of aggregating the remaining model parameters uploaded by benign clients to generate global model parameters for the new training epoch includes: For any benign client, determine the label information entropy of the benign client, and determine the generator aggregation weight corresponding to the benign client based on the number of data samples of the benign client and the label information entropy; Based on the generator model parameters of each benign client and the generator aggregation weight corresponding to the benign client, a weighted aggregation is performed to generate the global generator model parameters; Based on the classifier shared layer parameters of each benign client and the number of data samples of the benign client, a weighted aggregation is performed to generate the global classifier shared layer parameters.

[0010] In one implementation, after removing the potential malicious executable, the method further includes: Remove the potential malicious executable from the model aggregation process of the current training round, and continue to receive the model parameters uploaded by the potential malicious executable; In subsequent training rounds, if the parameter offset of the potential malicious executor is determined to be less than or equal to the dynamic adjudication threshold, it is determined that the behavior of the potential malicious executor has returned to normal, and the benign counter value of the potential malicious executor is increased. When the benign counter value reaches a preset threshold for consecutive training rounds, the participation status of the potential malicious actor is restored, and the potential malicious actor is reintegrated into the model aggregation process.

[0011] Secondly, embodiments of this application provide a method for detecting backdoor attacks in heterogeneous federated learning, applied to a client, including: Receive global model parameters sent by the central server, load the global model parameters into the local model to be trained as the student model, and load the local model that has been trained in the previous training round as the teacher model. The student model is trained using local private data to obtain the common and individual characteristics output by the student model. Based on the common features, the individual features, and the output of the teacher model, the parameters of the student model are updated using a pre-constructed joint loss function; The updated model parameters are uploaded to the central server, which then performs malicious behavior adjudication and model aggregation.

[0012] In one implementation, the joint loss function is constructed as follows: Construct a personality feature classification loss term, which is used to characterize the difference between the personality features extracted by the student model and the true labels; A common feature reconstruction loss term is constructed, which is used to characterize the difference between the common features extracted by the student model and the common features extracted by the teacher model; Construct an overall data classification loss term, which is used to characterize the difference between the student model's classification prediction result for the original input data and the true label; A common feature cognitive consistency loss term is constructed, which is used to characterize the difference between the student model and the teacher model in classifying the same common feature; The joint loss function is obtained by weighting and summing the individual feature classification loss term, the common feature reconstruction loss term, the overall data classification loss term, and the common feature cognitive consistency loss term.

[0013] Thirdly, embodiments of this application provide a heterogeneous federated learning backdoor attack detection device, applied to a central server, the device comprising: The parameter distribution unit is used to distribute global model parameters to multiple clients so that the clients can train locally using private data. The offset determination unit is used to receive the model parameters uploaded by the client and determine the parameter offset of each client's model parameters relative to the global model parameters of the previous training round. The malicious determination unit is used to determine a dynamic adjudication threshold based on the parameter offset of all clients, and to determine clients whose parameter offset exceeds the dynamic adjudication threshold as potential malicious executables. The model aggregation unit is used to remove potential malicious executables when they are detected as exhibiting abnormal behavior, and to aggregate the model parameters uploaded by the remaining benign clients to generate global model parameters for a new training round.

[0014] Fourthly, embodiments of this application provide a heterogeneous federated learning backdoor attack detection device, applied to a client, the device comprising: The model loading unit is used to receive global model parameters sent by the central server, load the global model parameters into the local model to be trained as the student model, and load the local model that has been trained in the previous training round as the teacher model. The feature extraction unit is used to train the student model using local private data to obtain the common features and individual features output by the student model. The parameter update unit is used to update the parameters of the student model based on the common features, the individual features, and the output of the teacher model, using a pre-constructed joint loss function. The parameter uploading unit is used to upload the updated model parameters to the central server, so that the central server can perform malicious behavior adjudication and model aggregation.

[0015] Fifthly, embodiments of this application provide a computer device, including: The system includes a memory and a processor, which are interconnected. The memory stores computer instructions, and the processor executes these computer instructions to perform the heterogeneous federated learning backdoor attack detection method described above.

[0016] Sixthly, embodiments of this application provide a computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the heterogeneous federated learning backdoor attack detection method described above.

[0017] The technical solution provided by one or more embodiments of this application calculates the parameter offset of each client model parameter relative to the previous round of the global model, and uses the parameter offset to determine the dynamic adjudication threshold. This allows the judgment criteria to be adaptively adjusted according to the dispersion of the parameter update in this round. In this way, while accepting normal parameter fluctuations, it can keenly capture abnormal updates that significantly deviate from the group distribution, effectively resist Byzantine attacks such as data poisoning and model poisoning, and reduce the false judgment rate caused by network fluctuations or data heterogeneity. After removing the confirmed malicious executables, the model is aggregated based on the model parameters uploaded by benign clients to generate global model parameters for the new training round. This effectively eliminates the pollution of the global model by abnormal parameters, ensures the security and robustness of the aggregation process, and fully explores the knowledge value of high-quality data clients through differentiated weight allocation, realizing the synergistic optimization of the federated learning system in terms of accuracy, generalization performance and anti-attack capability. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a method for detecting backdoor attacks in heterogeneous federated learning applied to a central server, provided in this application embodiment; Figure 2 A flowchart of step S3 provided in the embodiments of this application; Figure 3 A flowchart for determining a dynamic decision threshold provided in an embodiment of this application; Figure 4 A flowchart for generating global model parameters for a new training round, provided as an embodiment of this application; Figure 5 A flowchart illustrating the process after removing potentially malicious executables, provided in this application embodiment; Figure 6 A flowchart illustrating a heterogeneous federated learning backdoor attack detection method applied to a client side, provided as an embodiment of this application; Figure 7 A flowchart illustrating the construction method of the joint loss function provided in the embodiments of this application; Figure 8 A block diagram of a heterogeneous federated learning backdoor attack detection device provided in an embodiment of this application; Figure 9 A block diagram of a heterogeneous federated learning backdoor attack detection device provided in an embodiment of this application; Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] The reason federated learning has been able to be rapidly implemented in data-sensitive scenarios such as finance and healthcare is that it precisely addresses the privacy compliance pain points in distributed machine learning scenarios: its design logic of keeping local data within its domain and only synchronizing model parameters avoids the risk of raw data leakage at the architectural level, breaking down the barriers to cross-entity collaborative modeling under data silos. However, this distributed, multi-party autonomous architecture design itself also harbors security vulnerabilities—because the central server can only obtain encrypted model gradients / parameters and cannot penetrate the local environment of the executors to verify the authenticity of the data and the compliance of the training process, it is inherently vulnerable to gradient poisoning and backdoor injection attacks by malicious executors. Attackers only need to control a small number of clients to gradually embed backdoor features into the global model through multiple rounds of malicious updates. This characteristic of low attack cost and high harmful consequences is the core inherent contradiction of the traditional federated learning architecture in security scenarios.

[0022] To address the backdoor attack risks of federated learning, the industry initially attempted to migrate the logic of Mobile Threat Defense (MTD) to this scenario, hoping to create cognitive barriers for attackers through policy randomization and configuration perturbation. However, this kind of shell-like dynamic mechanism did not fundamentally reconstruct the core execution logic of federated learning. Attackers only need to conduct multiple rounds of probing to grasp its changing patterns, and can even use pseudo-random characteristics to construct targeted bypass attacks, failing to truly disrupt the attacker's poisoning path. The currently proposed Mimicry Defense (CMD) architecture, through the Dynamic Heterogeneous Redundancy (DHR) mechanism, constructs an uncertainty space from the attacker's perspective, breaking the attacker's cognitive path to the execution logic at the system level. Its inherent immune characteristics are inherently suitable for the distributed scenario of federated learning. However, the current integration of the two is still at the stage of conceptual application and has not yet been deeply coupled with the core characteristics of federated learning, such as execution-level behavioral features, model update paths, and Non-IID data distribution, resulting in the defense effect falling far short of expectations.

[0023] The current research on mimicry defense in federated learning scenarios suffers from three main shortcomings, essentially stemming from a failure to adapt to the specific characteristics of federated learning: First, the "pseudo-randomness" problem of existing dynamic mechanisms arises from merely applying the surface-level perturbation logic of MTD to the federated learning scenario. Dynamic mechanisms are not designed to address the periodic updates and relatively fixed client sets inherent in federated learning. Attackers can easily grasp the changing patterns of client scheduling and aggregation logic by observing only a few training rounds, and can even exploit pseudo-random perturbation features to reverse-locate normal updates and achieve their poisoning objectives. Second, the lack of execution-level reconstruction and feedback mechanisms stems from the traditional federated learning architecture treating clients as uncontrollable training black holes. First, the system can only perform coarse-grained client removal from the central side, and cannot dynamically reconstruct the training environment and execution logic of individual executors, nor can it transmit abnormal feedback to the executor side to achieve self-repair. This makes compromised clients extremely vulnerable to becoming the entry point for a continuous poisoning attack chain. Second, the imbalance between security and performance stems from the fact that the existing defense mechanism does not consider the Non-IID characteristics of federated learning. It adopts a one-size-fits-all gradient pruning and update restriction strategy, which, while filtering backdoor gradients, also inadvertently harms personalized updates that conform to the local data distribution. This results in a significant decrease in the personalized generalization performance of the global model, which cannot meet the dual requirements of "high security and high accuracy" in scenarios such as finance and healthcare.

[0024] In summary, how to effectively address the differences in model updates and the difficulty in distinguishing between malicious attacks caused by the non-independent and identically distributed (Non-IID) characteristics of client data during the distributed training process of federated learning has become an urgent technical problem to be solved. This is so that, while ensuring the convergence accuracy of the global model, we can accurately identify and defend against covert backdoor attacks or data poisoning.

[0025] According to an embodiment of this application, a method for detecting backdoor attacks in heterogeneous federated learning is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0026] Figure 1 A flowchart of a backdoor attack detection method for heterogeneous federated learning applied to a central server, provided for embodiments of this application, is included in the following steps: Step S1: Distribute global model parameters to multiple clients so that the clients can train locally using private data.

[0027] Specifically, at the start of the t-th training round, the central server holds the global model parameters generated in the previous round. The central server broadcasts these parameters to the set of all participating clients K={1,2,...,K}. Each client k, upon receiving the global model parameters, loads them into its local model to be trained as a student model, and combines them with its local private dataset D. k Multiple rounds of local training are performed to obtain updated local model parameters.

[0028] Step S3: Receive the model parameters uploaded by the client and determine the parameter offset of each client's model parameters relative to the global model parameters of the previous training round.

[0029] Specifically, after the central server receives the local model parameters uploaded by client k, it calculates the parameter offset Δ between the parameters and the global model parameters from the previous round. k Parameter offset Δ k This reflects the magnitude of parameter updates by client k during this training round. Under normal circumstances, parameter updates by each client should be made with minor adjustments around the global model parameters; if the parameter offset of a certain client deviates significantly from that of other clients, there may be abnormal behavior, such as data poisoning, model poisoning, or Byzantine attacks.

[0030] Step S5: Determine the dynamic adjudication threshold based on the parameter offset of all clients, and identify clients whose parameter offset exceeds the dynamic adjudication threshold as potential malicious executables.

[0031] Specifically, the decision boundary is dynamically constructed by utilizing the overall statistical characteristics of the parameter offsets of all clients in the current round—namely, the mean and standard deviation of the parameter offsets. By setting the sum of the mean and the weighted standard deviation as the dynamic decision threshold, the judgment criteria can be automatically adjusted according to the dispersion of parameter updates in this round. This ensures that normal parameter fluctuations are accepted while keenly capturing abnormal updates that significantly deviate from the group distribution. Subsequently, by comparing the parameter offsets of each client with this dynamic threshold, clients that exceed the boundary are marked as potential malicious actors. This decision strategy based on group consistency testing not only effectively resists Byzantine attacks such as data poisoning or model poisoning, but also reduces the false judgment rate caused by network fluctuations or data heterogeneity through a dynamic adjustment mechanism, laying a solid foundation of trust for subsequent security aggregation.

[0032] Step S7: If a potential malicious executor is detected as exhibiting abnormal behavior, the potential malicious executor is removed, and the model parameters uploaded by the remaining benign clients are aggregated to generate global model parameters for the next training round.

[0033] Specifically, for entities identified as potential malicious actors, the central server can further verify their status by combining historical behavior records and indicators such as the consistency of parameter update directions. If their abnormal behavior is confirmed, they are removed from the aggregated client set for the current round. For example, the frequency of abnormal behavior of potential malicious actors in the past N rounds of communication is statistically analyzed. If their historical abnormal records exceed a preset threshold (e.g., they are marked as potentially abnormal in M ​​consecutive rounds), they are determined to have abnormal behavior with a persistent malicious tendency.

[0034] The aggregation weight is dynamically calculated based on the number of data samples from each client and the label information entropy. The number of data samples reflects the breadth of coverage of the global data distribution by the client, while the label information entropy quantifies the diversity and richness of information in the local data. By normalizing the product of the two and using it as the aggregation weight, clients with larger data scales and higher distribution diversity are given higher contribution, thereby guiding the global model to converge towards a more generalizable direction. This weighted aggregation strategy not only effectively eliminates the pollution of the global model by outlier parameters, ensuring the security and robustness of the aggregation process, but also fully taps into the knowledge value of high-quality data clients through differentiated weight allocation, achieving synergistic optimization of the global model in terms of accuracy and generalization performance. Ultimately, while defending against malicious attacks, it maximizes the preservation of the effective results of local training.

[0035] It should be noted that in the initial stage of federated learning, the central server first distributes randomly initialized classifier models to each client. With generator model W 0 Θ 0These represent the classifier and generator parameters initialized by the central server, respectively. This initialization process provides a unified starting point for global training in federated learning, ensuring that each client can update its parameters based on the same model architecture during subsequent local training.

[0036] Subsequently, each client independently updates the aforementioned model locally using its private data, typically performing one to two rounds of local training. This ensures that the generator possesses basic data mapping capabilities and the classifier has preliminary discriminative abilities, thus providing a solid initial foundation for subsequent common feature extraction and federated aggregation. This warm-up phase avoids training instability issues that might arise from clients directly performing feature decoupling and knowledge distillation on completely randomly initialized models, laying the necessary parameter foundation for the effective operation of the subsequent teacher-student model collaborative architecture.

[0037] Through the above initialization and warm-up training, the local models of each client transition from a state of random parameters to an initial state with basic representation and discrimination capabilities, providing a usable parameter starting point for the construction of teacher and student models in the subsequent step S2, and ensuring the effectiveness of the feature separation mechanism and joint loss function optimization.

[0038] This embodiment provides a method for detecting backdoor attacks in heterogeneous federated learning systems applied to a central server. By calculating the parameter offset of each client model relative to the previous round of the global model, and dynamically constructing the decision boundary using the mean and standard deviation of the parameter offset, the judgment criteria can adaptively adjust according to the dispersion of parameter updates in the current round. This allows for the acceptance of normal parameter fluctuations while keenly capturing abnormal updates that significantly deviate from the group distribution, effectively resisting Byzantine attacks such as data poisoning and model poisoning, and reducing the false positive rate caused by network fluctuations or data heterogeneity. After eliminating confirmed malicious actors, the aggregation weight is dynamically calculated based on the number of data samples from benign clients and the label information entropy. Clients with large data scales and high distribution diversity are given higher contribution, which not only effectively eliminates the pollution of the global model by abnormal parameters and ensures the security and robustness of the aggregation process, but also fully explores the knowledge value of high-quality data clients through differentiated weight allocation, guiding the global model to converge towards a more generalizable direction. Ultimately, this achieves synergistic optimization of the federated learning system in terms of accuracy, generalization performance, and anti-attack capability.

[0039] Figure 2 The flowchart for step S3 provided in the embodiments of this application may include the following steps: Step S31: Vectorize the generator model parameters uploaded by any client in the current training round and the global generator model parameters in the global model parameters of the previous training round to obtain the generator model parameter vector of the current training round and the global generator model parameter vector of the previous training round.

[0040] In each round of training in federated learning, the central server receives the locally trained generator model parameters uploaded by each client. To quantify the update magnitude of each client relative to the global generator model parameters, the model parameters are first vectorized.

[0041] Specifically, for any client k uploading generator model parameters in the current training round t And the global generator model parameters Θ from the previous training round t-1. t-1 Perform the following operations: The high-dimensional model parameter tensor is converted into a one-dimensional vector through a flattening operation. This operation is denoted as vec(∙), which keeps the parameter values ​​unchanged and only changes their storage structure to facilitate subsequent numerical calculations, resulting in the generator model parameter vector for the current training epoch: vec( ); This yields the global generator model parameter vector from the previous training round: vec(Θ t-1 ).

[0042] Step S33: Determine the difference between the parameter vector of the generator model in the current training round and the parameter vector of the global generator model in the previous training round, and define the difference as the parameter offset.

[0043] Specifically, the difference between the two vectors is calculated, and this difference is the parameter offset Δ of client k in this round of training. k Its mathematical expression is as follows: Δ k =vec( )-vec(Θ t-1 ).

[0044] This embodiment vectorizes the model parameters and calculates the difference to determine the parameter offset. This allows for precise quantification of the update magnitude of each client relative to the global generator model parameters in the current training round. This enables the central server to intuitively and accurately identify the degree of difference in parameter changes after local training for each client. Based on this parameter offset, the central server can further evaluate the distribution characteristics and training consistency of the client data. This effectively selects clients with high data quality and training directions that are consistent with the global model to participate in aggregation, suppressing the problem of model update direction deviation caused by heterogeneous data distribution or abnormal clients, and improving the convergence speed and training stability of the federated learning global generator model.

[0045] Figure 3 The flowchart for determining the dynamic decision threshold provided in this application embodiment may include the following steps: Step S51: Use the parameter offset as the parameter update step size for the client in the current training round.

[0046] Step S53: Perform statistical analysis on the parameter update step size for all clients to obtain the step size standard deviation.

[0047] Specifically, after obtaining the parameter update step size of all participating clients, the central server performs statistical analysis on these parameter update step sizes to characterize the dispersion of the client group behavior in the current round.

[0048] Let S be the set of clients participating in the training in the current round. t Then the set of parameter update step sizes for all clients is {Δ k} k ∈S t The central server first calculates the average of these step sizes. This mean reflects the average level of client group updates in the current round.

[0049] Subsequently, the central server calculates the standard deviation of the parameter update step size, which is used to measure the degree to which each client's update behavior deviates from the average level: Where σ represents the step size standard deviation, S t This indicates the number of participating clients.

[0050] Step S55: Determine the step size standard deviation as the dynamic decision threshold for the current training round.

[0051] Specifically, the calculated step size standard deviation σ is directly determined as the dynamic decision threshold ε for the current training round, i.e., ε = σ. This threshold ε can adaptively reflect the normal fluctuation range of the client group behavior in the current round. When a client's parameter update step size Δ... k When it deviates significantly from the group average, its Δ k The value will exceed the normal range defined by ε, thus being identified as a potential malicious executor.

[0052] It should be noted that, in order to further enhance the accuracy of detection, an auxiliary verification mechanism based on the similarity of generator model parameters has also been introduced.

[0053] Since the core function of a generator model is to extract common features from data, the common features learned by different client devices should have a high degree of consistency, even if they are heterogeneous. Therefore, the parameters of the generator model used to generate common features should exhibit a similar distribution in the vector space.

[0054] The central server performs the following operations: Vectorize the generator model parameters of all clients to obtain a parameter vector set {vec(Θ t-1 )} k ∈S t .

[0055] The mean vector of the parameters of the normal client generator model in the previous round is calculated. The cosine similarity between the current parameter vector of each client and the mean vector is then calculated to obtain the deviation value, which measures the degree of difference between each client and the common characteristics of the group. When a client's deviation exceeds a preset deviation threshold, it is identified as a potential malicious executable. By combining parameter update step size analysis and cosine similarity analysis, the behavioral stability of the client can be comprehensively judged from two dimensions: update magnitude and feature direction, thus more accurately identifying potential malicious executables.

[0056] In addition to the dynamic threshold calculation based entirely on data statistics, the system also supports setting the dynamic adjudication threshold ε as a strategic parameter that is dynamically adjusted by the control module. Specifically, it can monitor the entropy change trend of client behavior disturbances. When an abnormal increase in system entropy is detected, it indicates that there is a significant divergence in client behavior. At this time, the control module can appropriately adjust the value of the dynamic adjudication threshold ε to achieve a flexible balance between defense strength and the risk of misjudgment.

[0057] This strategic adjustment mechanism can adaptively optimize based on the security needs and operational status of actual application scenarios, thereby improving the robustness and practicality of the overall defense.

[0058] This embodiment uses the parameter offset as the parameter update step size for the client and performs statistical analysis on the parameter update step sizes of all clients to obtain the step size standard deviation as a dynamic adjudication threshold. This can adaptively reflect the normal fluctuation range of the client group behavior in the current round, allowing the central server to define reasonable parameter update boundaries in real time based on data statistics. When the parameter update step size of a client deviates significantly from the average level of the group, its parameter offset will exceed the normal range defined by the dynamic threshold, thus being accurately identified as a potential malicious actor. This effectively suppresses malicious client pollution attacks on the global model and improves the security robustness and training reliability of the federated learning system.

[0059] Figure 4 The flowchart for generating global model parameters for a new training epoch provided in this application embodiment includes global generator model parameters and global classifier shared layer parameters; the process may include the following steps: Step S71: For any benign client, determine the label information entropy of the benign client, and determine the generator aggregation weight corresponding to the benign client based on the number of data samples and the label information entropy of the benign client.

[0060] Specifically, for any identified benign client k, the central server first calculates the client's local dataset D. k The entropy of the tag information h kInformation entropy is an indicator that measures the uncertainty of data distribution. The higher the information entropy, the more uniform the distribution of data categories and the richer the data diversity of the client, and the greater the amount of information it carries.

[0061] Where m represents the total number of label categories, p k,j This represents the probability of label j appearing in the dataset of a benign client k.

[0062] After obtaining the tag information entropy, the central server combines it with the number of data samples from benign clients. Together, they determine the generator aggregation weight corresponding to this benign client. Specifically, the generator aggregation weight adopts a linear combination of label information entropy and the number of data samples: in, ρ is the generator aggregation weight for benign clients k; ρ is an adjustment coefficient used to balance the relative importance of the number of data samples and the label information entropy in the weight calculation; K is the total number of benign clients participating in the aggregation; when ρ=0, the generator aggregation weight is completely determined by the number of data samples; when ρ>0, benign clients with higher label information entropy will get higher aggregation weights, thus making their generator model parameters have a greater impact on the global model.

[0063] Step S73: Based on the generator model parameters of each benign client and the generator aggregation weights corresponding to the benign clients, perform weighted aggregation to generate global generator model parameters.

[0064] Specifically, after obtaining the generator aggregation weights of each benign client, the central server performs weighted aggregation of the generator model parameters uploaded by each benign client based on these weights to generate a new round of global generator model parameters.

[0065] Where, Θ t Let be the global generator model parameters for round t. This represents the generator model parameters uploaded by benign client k in round t.

[0066] Through the above aggregation method, the global generator model can more fully absorb knowledge from high information entropy clients, thereby enhancing its generalization ability to diverse data distributions.

[0067] Step S75: Based on the classifier shared layer parameters of each benign client and the number of data samples of the benign client, perform weighted aggregation to generate global classifier shared layer parameters.

[0068] Specifically, the central server determines the number of data samples from each benign client. Calculate the corresponding shared layer aggregate weight w k,base : Based on the above-mentioned shared layer aggregate weight w k,base Classifier shared layer parameters for each benign client Perform weighted aggregation to generate shared layer parameters for the global classifier. : This ensures that clients with a larger number of data samples contribute more to updating the parameters of the classifier's shared layer, thereby achieving a dynamic balance between participation and influence.

[0069] This embodiment determines the generator aggregation weight by combining the label information entropy of benign clients with the number of data samples, and adopts a weighted aggregation based on the number of data samples for the classifier shared layer parameters, thus achieving a differentiated and adaptive model parameter aggregation mechanism. Specifically, by introducing label information entropy as a weight calculation element, clients with more uniform data category distribution and richer diversity receive higher generator aggregation weights, thereby ensuring that the global generator model more fully absorbs knowledge from high information entropy clients and enhances its generalization ability to diverse data distributions. At the same time, a pure data sample quantity weighting strategy is adopted for the classifier shared layer parameters, ensuring that clients with larger data sample sizes contribute more to the updating of common features of the classifier, achieving a dynamic balance between participation and influence. By designing differentiated aggregation weight calculation methods for the generator and the classifier shared layer, the federated learning scenario can take into account both the model's ability to perceive data diversity and its stable learning ability of common features, effectively improving the convergence quality, generalization performance, and overall training efficiency of the global model.

[0070] Figure 5 The flowchart provided in this application embodiment, after removing potential malicious executables, may include the following steps: Step S91: Remove potential malicious actors from the model aggregation process of the current training round, and continue to receive model parameters uploaded by potential malicious actors.

[0071] Specifically, in each round of training in federated learning, the central server detects the parameter update behavior of each client based on the aforementioned dynamic decision threshold ε. When the parameter offset Δ of a client k... k When the dynamic adjudication threshold ε is exceeded, the client is identified as a potential malicious executor.

[0072] The central server removes the potential malicious executable from the model aggregation process of the current training round, meaning that the uploaded model parameters are not included in the weighted aggregation calculation of the global model.

[0073] However, the exclusion only applies to aggregation participation rights and does not affect the reception and monitoring of parameters. The central server continues to receive model parameters uploaded by the potential malicious actor in subsequent rounds and continuously calculates its parameter offset Δk in order to monitor its behavioral trends in real time.

[0074] While ensuring the security of the global model, a recovery channel is reserved for possible misjudgments to avoid the permanent exclusion of the executor due to a one-time incorrect judgment.

[0075] In step S93, if the parameter offset of the potential malicious executor is determined to be less than or equal to the dynamic adjudication threshold in subsequent training rounds, it is determined that the behavior of the potential malicious executor has returned to normal, and the benign counter value of the potential malicious executor is increased.

[0076] Specifically, in subsequent training rounds, the central server continuously monitors the behavior of potential malicious executables that have been removed. If the central server determines the parameter offset Δ of the potential malicious executable k... k If the value is less than or equal to the dynamic adjudication threshold ε, it indicates that the update behavior of the potential malicious executor has returned to the normal range.

[0077] At this point, the central server increments the benign counter value benign_count_k corresponding to the potential malicious executable. The benign counter is used to record the number of training rounds in which the executable is consecutively judged as benign. That is, when the potential malicious executable k is detected as benign in the current round, its benign counter value is incremented by 1; if abnormal behavior occurs again, the counter is reset to zero and the accumulation starts again.

[0078] Step S95: When the benign counter value reaches the preset threshold for consecutive training rounds, restore the participation status of the potential malicious actors and reintegrate them into the model aggregation process.

[0079] Specifically, when the benign counter value reaches a preset threshold M for consecutive training rounds, the central server considers that the previous judgment of the potential malicious executable as malicious may have been a misjudgment, or its abnormal behavior may have been corrected. At this time, the central server restores the participation status of the potential malicious executable and reintegrates it into the global model aggregation scope. Strategies such as demotion, freezing, and replacement can also be implemented based on the severity of the attack.

[0080] By setting a threshold for consecutive benign cycles, the risk of false recovery caused by accidental fluctuations in a single cycle is effectively reduced, while providing a clear recovery path for potential malicious executors that are truly misjudged.

[0081] This embodiment removes potential malicious executors from the current round of model aggregation while continuously receiving and monitoring their parameters. Combined with a benign counter mechanism, it enables conditional dynamic recovery. This ensures the security of the global model while preserving a recovery channel for possible misjudgments, preventing the permanent exclusion of executors due to a one-time erroneous judgment. This allows federated learning to achieve a dynamic balance between resisting malicious attacks and maintaining the fairness of client participation, significantly improving the robustness, fault tolerance, and long-term operational stability of the overall defense strategy.

[0082] Figure 6 A flowchart of a heterogeneous federated learning backdoor attack detection method applied to a client, provided for embodiments of this application, is included in the following steps: Step S2: Receive the global model parameters sent by the central server, load the global model parameters into the local model to be trained as the student model, and load the local model trained in the previous training round as the teacher model.

[0083] Specifically, suppose that at the start of the t-th training round, client k receives the global model parameters Θ from the central server. t And assign it to the generator parameter of the student model, that is: Θ student =Θ t Meanwhile, the client retains the generator parameters of the local model after the previous training round. And assign it to the generator parameter of the teacher model, namely: Θ teacher = The teacher model, as a knowledge source, carries the historical learning outcomes of the client's local data; the student model, as a learner, needs to absorb the common knowledge of the teacher model in the current round, while adapting to the new characteristics of the local private data. This collaborative architecture of teacher and student models lays the foundation for subsequent feature decoupling and knowledge distillation.

[0084] Step S4: Train the student model using local private data to obtain the common and individual features output by the student model.

[0085] Specifically, during local training, each client decouples the intermediate feature representation x into common features x through the feature decomposition module. r With personality traits x s Among them, the common feature x r These represent common attributes shared across clients in local data. These characteristics are less affected by perturbations in the distribution of data from specific clients and have strong generalization ability; individual characteristics x s These represent discriminative information directly related to the predicted label. These features are crucial for improving the model's local performance and are the core basis for the model to complete the classification task.

[0086] To ensure the effectiveness of feature decomposition, this embodiment uses information theory constraints to ensure that no information is lost during the decomposition process: common features x r With personality traits x s The joint information entropy is equal to the information entropy of the original feature x, that is, it satisfies H(x). r ,x s |x)=0 and H(x|x) r ,x s )=0 indicates that all information about x can be obtained from x. r With x s A complete description is provided, and the combination of the two can fully reconstruct the original features. Furthermore, by constraining I(x,y│x... s )=0, I is a function of entropy, ensuring that individual characteristic x s All useful information related to label y is contained in x; that is, the key discriminative features required for label prediction are preserved in x. s middle.

[0087] Based on shared attributes of common features, to maximize the transfer of universal knowledge among clients, the common feature x is guided by optimization objectives. r To occupy as much of the dominant proportion of the original characteristics as possible, i.e., to minimize the individual characteristic x. s The proportion of this is significant. This design allows each client to extract purer common knowledge for federated aggregation during local training, while retaining necessary individual characteristics to adapt to local data distribution, achieving a balance between common knowledge sharing and local performance optimization.

[0088] Specifically, let the input data be x, and the generator for the student model be... Then the common feature x r With personality traits x s The extraction process can be represented as: x r = (x), x s =xx r Among them, the common feature x r A structure reflecting the universality of data can be the generator structure in a Generative Adversarial Network (GAN) or Variational Autoencoder (VAE); individual features x s This is obtained through residuals, which represent local-specific information in the data that cannot be explained by the common model.

[0089] The core idea of ​​this feature separation mechanism is that common features are modeled uniformly by a global model to ensure knowledge sharing across clients; while individual features retain the unique patterns of local data to avoid performance degradation caused by overgeneralization.

[0090] Step S6: Based on common features, individual features, and the output of the teacher model, update the parameters of the student model using a pre-built joint loss function.

[0091] Specifically, the teacher model is used as a knowledge anchor to guide the alignment of the student model in the common feature space, while the real labels are used as a discrimination benchmark to ensure the effectiveness of the individual feature space. Specifically, the process first calculates the common feature reconstruction loss and the common feature cognitive consistency loss. The former forces the common features extracted by the student model to approximate the common features generated by the teacher model in Euclidean space, while the latter, through KL divergence, forces both to maintain cognitive consistency at the probability distribution level, thus ensuring that the student model can inherit the teacher model's ability to represent the general laws of local data. Simultaneously, by introducing individual feature classification loss and overall data classification loss, the cross-entropy function is used to measure the difference between the predicted results and the real labels, ensuring that during feature decoupling, individual features still retain key discriminative information sufficient to distinguish specific categories, and that the overall classification performance of the model does not decrease due to feature splitting. Finally, these four loss terms are weighted and summed to form a joint loss function, which is then used to synchronously update the student model parameters Θ through the backpropagation algorithm. t To obtain a new round of local model parameters This allows the student model to adapt to the specific distribution of local data while mimicking the common expressions of the teacher model.

[0092] Step S8: Upload the updated model parameters to the central server for malicious behavior adjudication and model aggregation.

[0093] Specifically, the client updates the model parameters. Uploaded to the central server, where malicious behavior is adjudicated and models are aggregated.

[0094] After receiving the model parameters uploaded by each client, the central server first calculates the parameter offset Δ for each client. k The data is then compared with a dynamic adjudication threshold ε to identify potential malicious actors. For clients deemed benign, the server calculates generator aggregation weights based on the number of data samples and information entropy, and performs weighted aggregation to generate a new round of global model parameters.

[0095] This mechanism ensures that local training results can be effectively integrated into the global model, while the security of the aggregation process is guaranteed by malicious behavior detection on the central server.

[0096] This embodiment provides a backdoor attack detection method for heterogeneous federated learning applied to the client side. It utilizes the teacher model as a knowledge anchor to guide the alignment of student models in the common feature space. It ensures the stability of cross-client knowledge sharing through common feature reconstruction loss and cognitive consistency loss, while leveraging individual feature classification loss and overall data classification loss to guarantee the effectiveness of local specific information discrimination and avoid classification performance degradation caused by overgeneralization. Based on this, the client uploads the updated model parameters to the central server for malicious behavior adjudication and weighted aggregation. This ensures that local training results are effectively integrated into the global model, and filters potential malicious actors through the central server's dynamic threshold detection mechanism. Thus, it achieves secure and efficient federated collaborative learning while protecting data privacy, significantly improving the global model's generalization ability to diverse data distributions and overall training robustness.

[0097] Figure 7 A flowchart illustrating the construction method of the joint loss function provided in the embodiments of this application is shown. The process may include the following steps: Step S51: Construct a personality feature classification loss term, which is used to characterize the difference between the personality features extracted by the student model and the true labels.

[0098] Specifically, individual characteristics refer to the feature components extracted by the student model from the input data that reflect the specificity of local data, denoted as x. s This feature is generated by the feature extractor of the student model and input into the classifier f(;W). k ), where W k These are the classifier parameters.

[0099] The loss term for individual feature classification is calculated using the cross-entropy loss function, whose expression is: in, Let be the cross-entropy loss function, and y be the true label of the input data. The purpose of this loss term is to force the student model to retain sufficient class discriminative information when extracting individual features, preventing individual features from degenerating into meaningless noise.

[0100] Step S53: Construct a common feature reconstruction loss term, which is used to characterize the difference between the common features extracted by the student model and the common features extracted by the teacher model.

[0101] Specifically, common characteristics refer to feature components that reflect common patterns in the data. (Teacher Model) Let x be the common features generated by the local generator obtained from the previous round of training on the client side. r = (x); Student Model The common characteristics generated by the global generator issued by the central server are denoted as follows: .

[0102] The loss term for common feature reconstruction uses the L2 norm (Euclidean distance) to measure the difference between the two features, and its expression is as follows: This loss term forces the student model to learn the common structure of local data captured by the teacher model, enabling the global model to gradually approach the common expressive ability of the local model, thereby achieving effective knowledge transfer.

[0103] Step S55: Construct the overall data classification loss term, which is used to characterize the difference between the student model's classification prediction results for the original input data and the true labels.

[0104] Specifically, the input data x is the client's local raw data (such as images, text, etc.), and the student model combines common and individual features to make the final classification prediction. The overall data classification loss term also uses cross-entropy loss, and its expression is: This loss term ensures that the overall classification ability of the student model does not decrease during feature decoupling and distillation, maintaining the ability to accurately identify the original input.

[0105] Step S57: Construct a common feature cognitive consistency loss term. The common feature cognitive consistency loss term is used to characterize the difference between the student model and the teacher model in classifying the same common feature.

[0106] Specifically, the teacher model addresses common features x r The classification output is f(x) r ;W k The common features generated by the student model itself. The classification output is f( ;W k ).

[0107] The expression for the common feature cognitive consistency loss term is: The introduction of KL divergence enables the student model to not only approximate the teacher model in terms of feature vectors, but also to maintain consistency in the distribution of classification decisions, thereby achieving a higher level of knowledge transfer.

[0108] Step S59: The loss function is obtained by weighted summation of the individual feature classification loss term, the common feature reconstruction loss term, the overall data classification loss term, and the common feature cognitive consistency loss term.

[0109] Specifically, the four loss terms are weighted and summed to construct the final joint loss function, which is used for end-to-end training of the student model.

[0110] The joint loss function is expressed as follows: in, ,λ x , , These are the weighting coefficients for each loss term, used to balance the contribution of different losses to the overall objective. They can be determined through experimental optimization based on the specific task.

[0111] This joint loss function, through multi-dimensional supervision signals, collaboratively optimizes the student model's ability to discriminate individual features, accuracy of reconstructing common features, overall classification performance, and cognitive consistency, thereby achieving an organic unity of feature decoupling and knowledge distillation.

[0112] This embodiment constructs a multi-dimensional joint loss function comprising individual feature classification loss, common feature reconstruction loss, overall data classification loss, and common feature cognitive consistency loss. This function collaboratively optimizes the student model from four levels: feature discrimination, structure reconstruction, overall performance, and cognitive distribution. Specifically, the individual feature classification loss ensures that decoupled individual features retain sufficient class discrimination information, preventing them from degenerating into meaningless noise. The common feature reconstruction loss forces the student model to learn the common structure of the teacher model through the L2 norm, achieving effective knowledge transfer. The overall data classification loss maintains the model's accurate recognition ability of the original input, while the common feature cognitive consistency loss ensures cognitive consistency between the teacher and student models at the probability distribution level through KL divergence, achieving a higher level of knowledge transfer. By weighted summing of the four loss terms to form an end-to-end joint optimization objective, the organic unity of feature decoupling and knowledge distillation is achieved. This allows the student model to inherit historical common knowledge from the teacher model while adapting to the specific distribution of local data, effectively improving the model's generalization ability, classification accuracy, and training stability in federated learning scenarios.

[0113] Accordingly, please refer to Figure 8 A block diagram of a heterogeneous federated learning backdoor attack detection device provided in this application embodiment, applied to a central server, the device comprising: The parameter distribution unit 101 is used to distribute global model parameters to multiple clients so that the clients can train locally using private data. The offset determination unit 103 is used to receive the model parameters uploaded by the client and determine the parameter offset of each client's model parameters relative to the global model parameters of the previous training round. The malicious determination unit 105 is used to determine the dynamic adjudication threshold based on the parameter offset of all clients, and to determine clients whose parameter offset exceeds the dynamic adjudication threshold as potential malicious executables. The model aggregation unit 107 is used to remove potential malicious executables when they are detected as exhibiting abnormal behavior, and to aggregate the model parameters uploaded by the remaining benign clients to generate global model parameters for the next training round.

[0114] In some optional implementations, the offset determination unit 103 includes: For any client, the generator model parameters uploaded in the current training round and the global generator model parameters in the previous training round are vectorized to obtain the generator model parameter vector for the current training round and the global generator model parameter vector for the previous training round. Determine the difference between the parameter vector of the generator model in the current training round and the parameter vector of the global generator model in the previous training round, and define the difference as the parameter offset.

[0115] In some optional implementations, the malice determination unit 105 includes: Use the parameter offset as the parameter update step size for the client in the current training round; Perform statistical analysis on the parameter update step size for all clients to obtain the step size standard deviation; The step size standard deviation is determined as the dynamic decision threshold for the current training round.

[0116] In some optional implementations, the global model parameters for the new training epoch include global generator model parameters and global classifier shared layer parameters; the model aggregation unit 107 includes: For any benign client, determine the label information entropy of the benign client, and determine the generator aggregation weight corresponding to the benign client based on the number of data samples and the label information entropy of the benign client; Based on the generator model parameters of each benign client and the generator aggregation weights corresponding to the benign clients, weighted aggregation is performed to generate global generator model parameters. Based on the shared layer parameters of the classifier for each benign client and the number of data samples for each benign client, a weighted aggregation is performed to generate the global shared layer parameters of the classifier.

[0117] In some alternative implementations, after eliminating potentially malicious executables, the device is used to: The model aggregation process removes potential malicious actors from the current training round, and continues to receive model parameters uploaded by potential malicious actors; In subsequent training rounds, if the parameter offset of a potential malicious executor is determined to be less than or equal to the dynamic adjudication threshold, the behavior of the potential malicious executor is determined to have returned to normal, and the benign counter value of the potential malicious executor is increased. When the benign counter value reaches the preset threshold for consecutive training rounds, the participation status of potential malicious actors is restored, and the potential malicious actors are reintegrated into the model aggregation process.

[0118] Accordingly, please refer to Figure 9 A block diagram of a heterogeneous federated learning backdoor attack detection device provided in this application embodiment, applied to a client, the device comprising: The model loading unit 201 is used to receive global model parameters sent by the central server, load the global model parameters into the local model to be trained as the student model, and load the local model that has been trained in the previous training round as the teacher model. The feature extraction unit 203 is used to train the student model using local private data to obtain the common and individual features output by the student model. The parameter update unit 205 is used to update the parameters of the student model based on common features, individual features and the output of the teacher model, using a pre-built joint loss function. The parameter upload unit 207 is used to upload the updated model parameters to the central server, so that the central server can perform malicious behavior adjudication and model aggregation.

[0119] In some optional implementations, the parameter update unit 205 includes: A personality feature classification loss term is constructed to characterize the difference between the personality features extracted by the student model and the true labels. A common feature reconstruction loss term is constructed to characterize the difference between the common features extracted by the student model and the common features extracted by the teacher model. Construct an overall data classification loss term, which is used to characterize the difference between the student model's classification prediction results for the original input data and the true labels; A common feature cognitive consistency loss term is constructed to characterize the difference between the student model and the teacher model in classifying the same common feature. The joint loss function is obtained by weighting and summing the loss terms of individual feature classification, common feature reconstruction, overall data classification, and common feature cognitive consistency.

[0120] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0121] In this embodiment, a heterogeneous federated learning backdoor attack detection device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit), a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0122] Please see Figure 10 , Figure 10 This application provides a schematic diagram of the structure of a computer device, as shown in the embodiment of the present application. Figure 10 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 10 Take a processor 10 as an example.

[0123] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0124] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0125] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0126] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0127] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0128] This application also provides a computer-readable storage medium. The methods described in this application can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code downloaded over a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the methods shown in the above embodiments are implemented.

[0129] The apparatus and units described in the above embodiments can be implemented by a computer chip or physical entity, or by a product with a certain function. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0130] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0131] Those skilled in the art will understand that the embodiments of this application can be provided as methods or apparatus. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, and devices according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0133] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0135] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0136] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0137] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

[0138] Although embodiments of this application have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of this application, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for detecting backdoor attacks in heterogeneous federated learning, characterized in that, Applications to central servers include: Global model parameters are distributed to multiple clients so that the clients can train locally using private data. Receive the model parameters uploaded by the client and determine the parameter offset of each client's model parameters relative to the global model parameters of the previous training round; A dynamic adjudication threshold is determined based on the parameter offset of all clients, and clients whose parameter offset exceeds the dynamic adjudication threshold are identified as potential malicious actors. If the potential malicious executable is detected to be benign, the potential malicious executable is removed, and the model parameters uploaded by the remaining benign clients are aggregated to generate global model parameters for a new training round.

2. The method according to claim 1, characterized in that, Determining the parameter offset of each client's model parameters relative to the global model parameters of the previous training round includes: For any client, the generator model parameters uploaded in the current training round and the global generator model parameters in the previous training round are vectorized to obtain the generator model parameter vector for the current training round and the global generator model parameter vector for the previous training round. Determine the difference between the parameter vector of the generator model in the current training round and the parameter vector of the global generator model in the previous training round, and determine the difference as the parameter offset.

3. The method according to claim 1, characterized in that, The determination of the dynamic adjudication threshold based on parameter offsets from all clients includes: The parameter offset is used as the parameter update step size for the client in the current training round. Perform statistical analysis on the parameter update step size for all clients to obtain the step size standard deviation; The step size standard deviation is determined as the dynamic decision threshold for the current training round.

4. The method according to claim 1, characterized in that, The global model parameters for the new training epoch include global generator model parameters and global classifier shared layer parameters; the process of aggregating the remaining model parameters uploaded by benign clients to generate global model parameters for the new training epoch includes: For any benign client, determine the label information entropy of the benign client, and determine the generator aggregation weight corresponding to the benign client based on the number of data samples of the benign client and the label information entropy; Based on the generator model parameters of each benign client and the generator aggregation weight corresponding to the benign client, a weighted aggregation is performed to generate the global generator model parameters; Based on the classifier shared layer parameters of each benign client and the number of data samples of the benign client, a weighted aggregation is performed to generate the global classifier shared layer parameters.

5. The method according to claim 1, characterized in that, After removing the potential malicious executables, the following is also included: Remove the potential malicious executable from the model aggregation process of the current training round, and continue to receive the model parameters uploaded by the potential malicious executable; In subsequent training rounds, if the parameter offset of the potential malicious executor is determined to be less than or equal to the dynamic adjudication threshold, it is determined that the behavior of the potential malicious executor has returned to normal, and the benign counter value of the potential malicious executor is increased. When the benign counter value reaches a preset threshold for consecutive training rounds, the participation status of the potential malicious actor is restored, and the potential malicious actor is reintegrated into the model aggregation process.

6. A method for detecting backdoor attacks in heterogeneous federated learning, characterized in that, Applied to the client side, including: Receive global model parameters sent by the central server, load the global model parameters into the local model to be trained as the student model, and load the local model that has been trained in the previous training round as the teacher model. The student model is trained using local private data to obtain the common and individual characteristics output by the student model. Based on the common features, the individual features, and the output of the teacher model, the parameters of the student model are updated using a pre-constructed joint loss function; The updated model parameters are uploaded to the central server, which then performs malicious behavior adjudication and model aggregation.

7. The method according to claim 6, characterized in that, The joint loss function is constructed as follows: Construct a personality feature classification loss term, which is used to characterize the difference between the personality features extracted by the student model and the true labels; A common feature reconstruction loss term is constructed, which is used to characterize the difference between the common features extracted by the student model and the common features extracted by the teacher model; Construct an overall data classification loss term, which is used to characterize the difference between the student model's classification prediction result for the original input data and the true label; A common feature cognitive consistency loss term is constructed, which is used to characterize the difference between the student model and the teacher model in classifying the same common feature; The joint loss function is obtained by weighting and summing the individual feature classification loss term, the common feature reconstruction loss term, the overall data classification loss term, and the common feature cognitive consistency loss term.

8. A heterogeneous federated learning backdoor attack detection device, characterized in that, The device, applied to a central server, includes: The parameter distribution unit is used to distribute global model parameters to multiple clients so that the clients can train locally using private data. The offset determination unit is used to receive the model parameters uploaded by the client and determine the parameter offset of each client's model parameters relative to the global model parameters of the previous training round. The malicious determination unit is used to determine a dynamic adjudication threshold based on the parameter offset of all clients, and to determine clients whose parameter offset exceeds the dynamic adjudication threshold as potential malicious executables. The model aggregation unit is used to remove potential malicious executables when they are detected as exhibiting abnormal behavior, and to aggregate the model parameters uploaded by the remaining benign clients to generate global model parameters for a new training round.

9. A heterogeneous federated learning backdoor attack detection device, characterized in that, Applied to a client, the device includes: The model loading unit is used to receive global model parameters sent by the central server, load the global model parameters into the local model to be trained as the student model, and load the local model that has been trained in the previous training round as the teacher model. The feature extraction unit is used to train the student model using local private data to obtain the common features and individual features output by the student model. The parameter update unit is used to update the parameters of the student model based on the common features, the individual features, and the output of the teacher model, using a pre-constructed joint loss function. The parameter uploading unit is used to upload the updated model parameters to the central server, so that the central server can perform malicious behavior adjudication and model aggregation.

10. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the heterogeneous federated learning backdoor attack detection method according to any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the heterogeneous federated learning backdoor attack detection method according to any one of claims 1 to 7.

Images