Federated learning methods, apparatuses, devices, and storage media

Abstract

The application discloses a federated learning method, device, equipment and storage medium. The method comprises the following steps: sending a first global parameter of a target model to a first terminal; the first terminal is used for training the target model with the first global parameter based on a first data set, obtaining first local update information based on the first local parameter obtained through the training, and returning the first local update information; obtaining first target update information satisfying an attack defense condition based on the first local update information; obtaining a first aggregation parameter of the target model based on the first global parameter and the first target update information; and completing a federated learning task in response to the target model with the first aggregation parameter satisfying a target termination condition. The above process increases the consideration of attack problems in the federated learning process, the process of obtaining the aggregation parameter can resist the attack of malicious terminals to a certain extent, is favorable for improving the security and reliability of the federated learning, and further improves the performance of the model obtained through the federated learning.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a federated learning method, apparatus, device, and storage medium. Background Technology

[0002] With the continuous development of artificial intelligence technology, federated learning, as an emerging AI technology, is finding increasingly wider applications. Federated learning trains machine learning models through multi-party collaboration, solving the problem of data silos while protecting user privacy and data security.

[0003] In federated learning, attacks from malicious terminals frequently occur, leading to poor security and reliability, and consequently, poor performance of the models obtained through federated learning. Therefore, a new federated learning method is urgently needed to mitigate the adverse effects of such attacks. Summary of the Invention

[0004] This application provides a federated learning method, apparatus, device, and storage medium, which can be used to improve the security and reliability of federated learning. The technical solution is as follows:

[0005] On one hand, embodiments of this application provide a federated learning method, which is applied to a server and includes:

[0006] The first global parameters of the target model are sent to the first terminal. The first terminal is used to train the target model with the first global parameters based on the first dataset, obtain the first local update information for updating the first global parameters based on the first local parameters obtained by training, and return the first local update information.

[0007] Based on the first local update information, obtain the first target update information that meets the attack defense conditions;

[0008] Based on the first global parameters and the first target update information, the first aggregate parameters of the target model are obtained; in response to the target model having the first aggregate parameters satisfying the target termination condition, the federated learning task is completed.

[0009] On the other hand, a federated learning apparatus is provided, the apparatus comprising:

[0010] The sending unit is used to send the first global parameters of the target model to the first terminal. The first terminal is used to train the target model with the first global parameters based on the first dataset, obtain the first local update information for updating the first global parameters based on the first local parameters obtained by training, and return the first local update information.

[0011] The first acquisition unit is used to acquire the first target update information that meets the attack defense conditions based on the first local update information;

[0012] The second acquisition unit is used to acquire the first aggregate parameters of the target model based on the first global parameters and the first target update information; and to complete the federated learning task in response to the target model having the first aggregate parameters satisfying the target termination condition.

[0013] In one possible implementation, the first local update information is unquantized update information determined based on the first local parameters and the first global parameters; the first acquisition unit is used to acquire the target quality index corresponding to the first local update information, the target quality index corresponding to the first local update information is used to measure the credibility of the first local update information as non-attack update information; the first local update information corresponding to the target quality index that meets the reference conditions is taken as candidate update information, and based on the candidate update information, the first target update information that meets the attack defense conditions is acquired.

[0014] In one possible implementation, the number of candidate update information is at least two. The first acquisition unit is further configured to: determine at least two candidate update information groups based on the at least two candidate update information, wherein each candidate update information group includes at least one candidate update information; determine a parameter change index corresponding to each candidate update information group based on the first global parameter and the first local parameter corresponding to each candidate update information included in each candidate update information group; determine a first update information group corresponding to the parameter change index that satisfies the first condition among the at least two candidate update information groups based on the parameter change index corresponding to each of the at least two candidate update information groups; and determine a target update information group in the first update information group, and use each candidate update information included in the target update information group as the first target update information that satisfies the attack defense condition.

[0015] In one possible implementation, the number of the first update information groups is at least two, and the first acquisition unit is further configured to take the sum of the target quality indicators corresponding to each candidate update information included in any first update information group as the summary quality indicator corresponding to the any first update information group; based on the summary quality indicators corresponding to the at least two first update information groups respectively, determine the second update information group corresponding to the summary quality indicator that satisfies the second condition in the at least two first update information groups; and determine the target update information group in the second update information group.

[0016] In one possible implementation, the target quality index corresponding to the first local update information includes a first quality index. The first acquisition unit is further configured to summarize all local update information historically returned by the first terminal that returned the first local update information to obtain first summarized update information corresponding to the first local update information; acquire second summarized update information corresponding to the first global parameter, the second summarized update information being used to indicate the update status of the target model by the server; and determine the first quality index corresponding to the first local update information based on the similarity between the first summarized update information and the second summarized update information, the first quality index being used to measure the credibility of the first local update information as non-attack update information from the perspective of the similarity between summarized update information.

[0017] In one possible implementation, the target quality index corresponding to the first local update information includes a second quality index; the first acquisition unit is further configured to determine the second quality index corresponding to the first local update information based on the distribution distance between the first local parameter and the first global parameter corresponding to the first local update information, wherein the second quality index is used to measure the credibility of the first local update information as non-attack update information from the perspective of the distribution distance between the parameters.

[0018] In one possible implementation, the first local update information is update information obtained by the first terminal quantizing the original update information using a target quantization threshold and a target quantization level. The original update information is unquantized update information determined based on the first local parameters and the first global parameters. The target quantization threshold is used to ensure that the dequantized information of the first local update information satisfies the symmetry condition with the original update information. The first terminal is also used to return the target quantization threshold and the target quantization level. The first acquisition unit is also used to dequantize the first local update information based on the target quantization threshold and the target quantization level to obtain the dequantized information of the first local update information. From the dequantized information of the first local update information, the first target update information that satisfies the attack defense condition is selected.

[0019] In one possible implementation, the second acquisition unit is used to acquire the geometric median information corresponding to the first target update information; based on the first global parameters, the geometric median information corresponding to the first target update information is aggregated to obtain the first aggregated parameters of the target model.

[0020] In one possible implementation, the federated learning task is a semi-supervised federated learning task, the first dataset is a dataset without standard labels, and the server has a second dataset with standard labels for training the target model; the apparatus further includes:

[0021] The training unit is used to train a target model with reference parameters based on the second dataset to obtain the first global parameters of the target model.

[0022] In one possible implementation, the training unit is configured to perform data augmentation on the second dataset to obtain an augmented dataset, the augmented dataset including augmented samples, each augmented sample corresponding to a standard label; call the target model having the reference parameters to obtain the prediction results corresponding to the augmented samples; obtain a target loss function based on the prediction results and the standard labels corresponding to the augmented samples; update the reference parameters using the target loss function to obtain updated parameters; and obtain the first global parameters of the target model based on the updated parameters.

[0023] In one possible implementation, the training unit is further configured to, in response to the target model having the first aggregation parameters not satisfying the target termination condition, train the target model having the first aggregation parameters based on the second dataset to obtain the second global parameters of the target model;

[0024] The sending unit is further configured to send the second global parameters of the target model to the second terminal, the second terminal being configured to train the target model with the second global parameters based on the first dataset without standard labels, obtain the second local update information for updating the second global parameters based on the second local parameters obtained by training, and return the second local update information;

[0025] The first acquisition unit is further configured to acquire second target update information that meets the attack defense conditions based on the second local update information;

[0026] The second acquisition unit is further configured to acquire the second aggregation parameter of the target model based on the second global parameter and the second target update information; and to complete the semi-supervised federated learning task in response to the target model having the second aggregation parameter satisfying the target termination condition.

[0027] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement any of the federated learning methods described above.

[0028] On the other hand, a computer-readable storage medium is also provided, wherein at least one computer program is stored therein, the at least one computer program being loaded and executed by a processor to implement any of the federated learning methods described above.

[0029] On the other hand, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the federated learning methods described above.

[0030] The technical solution provided in this application has at least the following beneficial effects:

[0031] In this embodiment, the attack problem in the federated learning process is considered. First, target update information that meets the attack defense conditions is obtained based on the local update information returned by the terminal. Then, the aggregation parameters are obtained using the target update information that meets the attack defense conditions. In this process, local update information that does not meet the attack defense conditions will not participate in the process of obtaining aggregation parameters. This allows the process of obtaining aggregation parameters to resist attacks from malicious terminals to a certain extent, which helps improve the security and reliability of federated learning, and thus improves the performance of the model obtained by federated learning. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a schematic diagram of the implementation environment of a federated learning method provided in an embodiment of this application;

[0034] Figure 2 This is a flowchart of a federated learning method provided in an embodiment of this application;

[0035] Figure 3 This is a schematic diagram illustrating the relationship between a summary update vector generated by a normal terminal, a summary update vector generated by a malicious terminal, and a summary update vector generated by a server, as provided in an embodiment of this application.

[0036] Figure 4This is a schematic diagram illustrating the relationship between the distribution of local parameters generated by a normal terminal and the distribution of local parameters generated by a malicious terminal, as provided in an embodiment of this application.

[0037] Figure 5 This is a schematic diagram illustrating the differences between aggregation using the FedAvg aggregation method and aggregation using the GMA aggregation method, as provided in an embodiment of this application.

[0038] Figure 6 This is a schematic diagram illustrating the basic process of performing a semi-supervised federated learning task provided in an embodiment of this application;

[0039] Figure 7 This is a schematic diagram comparing the performance of an SSFL system with and without an update information selection scheme under a tag-flipping attack, as provided in an embodiment of this application.

[0040] Figure 8 This is a schematic diagram showing the performance comparison of an SSFL system with and without an update information selection scheme under a Gaussian attack, as provided in an embodiment of this application.

[0041] Figure 9 This is a schematic diagram showing a performance comparison of a system at quantization levels r=32, r=16, and r=8, provided in an embodiment of this application.

[0042] Figure 10 This is a schematic diagram of a federated learning device provided in an embodiment of this application;

[0043] Figure 11 This is a schematic diagram of a federated learning device provided in an embodiment of this application;

[0044] Figure 12 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application;

[0045] Figure 13 This is a schematic diagram of the structure of a server provided in an embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0047] To facilitate understanding of the technical process of the embodiments of this application, some terms involved in the embodiments of this application will be explained below.

[0048] Federated Learning (FL): Federated learning is a popular distributed machine learning framework that eliminates users' concerns about privacy data leakage when training models. It can achieve the same or similar results as modeling an entire dataset without exposing users' local data. Multiple terminals only need to exchange a series of information with the server to jointly train a machine learning model. Federated learning is based on supervised learning methods. In this embodiment, this type of federated learning based on supervised learning methods is called supervised federated learning. In supervised federated learning application scenarios, terminals have datasets with standard labels, and the terminals execute supervised federated learning tasks by interacting with the server.

[0049] Semi-Supervised Federated Learning (SSFL) applies semi-supervised learning methods to the application scenarios of federated learning, combining the advantages of both technologies to better solve real-world problems. This technique ensures sufficient training data through federated learning while mitigating the high data labeling overhead of individual terminals through semi-supervised learning. In an exemplary embodiment, in a semi-supervised federated learning application scenario, the server has a dataset with standard labels, and the terminals have datasets without standard labels. The terminals interact with the server to execute semi-supervised federated learning tasks.

[0050] The federated learning method provided in this application is applicable to both supervised federated learning and semi-supervised federated learning application scenarios.

[0051] For example, the server and terminal used to implement federated learning are located in a federated learning system. All devices in the federated learning system, or some devices in the federated learning system, can be deployed in the cloud. That is, the federated learning method provided in this application embodiment can be implemented based on cloud technology. The following describes the relevant content of cloud technology:

[0052] Cloud technology refers to a managed technology that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to achieve data computing, storage, processing, and sharing.

[0053] Cloud technology is a collective term for network technology, information technology, integration technology, management platform technology, and application technology applied to the cloud computing business model. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will all require robust system support, which can only be achieved through cloud computing.

[0054] Considering attacks during federated learning involves the field of cloud security within cloud technology. Cloud security refers to the collective term for security software, hardware, users, organizations, and secure cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. It uses a large network of clients to monitor abnormal software behavior on the network, obtain the latest information on Trojans and malware on the internet, and send it to the server for automatic analysis and processing. Finally, solutions for viruses and Trojans are distributed to each client.

[0055] The main research directions in cloud security include: 1. Cloud computing security, which focuses on how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which focuses on how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control and manage network-wide security events; 3. Cloud security services, which focuses on various security services provided to users based on cloud computing platforms, such as antivirus services. For example, a federated learning system can be considered a cloud computer system. The research direction of considering attacks during the federated learning process to ensure the security and reliability of federated learning falls under the aforementioned research directions in cloud computing security.

[0056] For example, the federated learning method provided in this application relates to the field of artificial intelligence. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. In other words, artificial intelligence is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can react in a way similar to human intelligence. Artificial intelligence also studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making functions.

[0057] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0058] Machine learning is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory, among others. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instruction-based learning.

[0059] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, and smart customer service. It is believed that with the development of technology, AI will be applied in more fields and play an increasingly important role.

[0060] This application provides a federated learning method; please refer to [reference needed]. Figure 1 This diagram illustrates the implementation environment of the federated learning method provided in this embodiment. The implementation environment includes a federated learning system 100, which includes a terminal 110 and a server 120.

[0061] Server 120 can send the model's global parameters to terminal 110; terminal 110 can obtain update information for updating the global parameters based on its locally maintained dataset and return the update information to server 120. Server 120 can obtain target update information that meets the attack defense conditions based on the update information returned by the terminal, and then obtain the model's aggregate parameters based on the target update information. Through this process, attacks in the federated learning process can be resisted to a certain extent, improving the security and reliability of federated learning.

[0062] In one possible implementation, terminal 110 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. Server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Terminal 110 and server 120 can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0063] Those skilled in the art should understand that the terminal 110 and server 120 in the above-described federated learning system 100 are merely examples. Other existing or future terminals or servers that are applicable to this application should also be included within the scope of protection of this application, and are hereby incorporated by reference.

[0064] Based on the above Figure 1 The implementation environment shown in this application provides a federated learning method, taking the application of this method to server 120 as an example. Figure 2 As shown, the method provided in this application embodiment includes the following steps 201 to 203:

[0065] In step 201, the first global parameters of the target model are sent to the first terminal. The first terminal is used to train the target model with the first global parameters based on the first dataset, obtain the first local update information for updating the first global parameters based on the first local parameters obtained by training, and return the first local update information.

[0066] The target model refers to a shared model that requires collaborative training between the server and the terminal. This application does not limit the model type of the target model, as it depends on the actual application scenario. Similarly, the data type of the first dataset on the terminal also depends on the actual application scenario. For example, in an image classification scenario, the target model is an image classification model, and the first dataset is composed of images.

[0067] It should be noted that the entire federated learning task is completed based on a multi-round learning process. This embodiment only uses a single round of learning as an example for illustration. The first global parameter is the global parameter that needs to be sent to the terminal during the current round of learning. The current round of learning may be any round of learning during the execution of the federated learning task.

[0068] Before executing step 201, the server needs to obtain the first global parameters of the target model. The federated learning method provided in this application embodiment is applicable to both supervised and semi-supervised federated learning application scenarios. In supervised federated learning application scenarios, the federated learning task to be executed is a supervised federated learning task; in semi-supervised federated learning application scenarios, the federated learning task to be executed is a semi-supervised federated learning task. The way the server obtains the first global parameters of the target model differs in different application scenarios.

[0069] 1. Semi-supervised federated learning application scenarios

[0070] In semi-supervised federated learning applications, the terminal has a dataset (the first dataset) without standard labels, while the server has a second dataset with standard labels. In this case, the process by which the server obtains the first global parameters of the target model is as follows: the server trains the target model with reference parameters based on the second dataset to obtain the first global parameters of the target model.

[0071] The second dataset is a labeled dataset provided by the server for training the target model. Unlike supervised federated learning, in semi-supervised federated learning, the server not only needs to aggregate the update information uploaded by the terminals, but also needs to train the target model using the labeled second dataset.

[0072] The reference parameters are the parameters that the target model possesses before the start of the current learning round. For example, if the current learning round is the first round of a semi-supervised federated learning task, the reference parameters are the initial parameters of the target model. If the current learning round is any of the subsequent rounds of a semi-supervised federated learning task (excluding the first round), the reference parameters are the aggregated parameters of the target model obtained in the previous learning round.

[0073] In one possible implementation, the second dataset includes second samples, each corresponding to a standard label. This application embodiment does not limit the number of second samples included in the second dataset and can be flexibly adjusted according to the actual application scenario. In another possible implementation, the first global parameters of the target model are obtained by training a target model with reference parameters based on the second dataset, including but not limited to the following methods one and two:

[0074] Method 1: Perform data augmentation on the second dataset to obtain an augmented dataset, which includes augmented samples with corresponding standard labels; train the target model with reference parameters based on the augmented samples to obtain the first global parameters of the target model.

[0075] Data augmentation of the second dataset can increase the number of samples in the second dataset and improve the training effect on the target model. This application does not limit the method of data augmentation; exemplarily, the data augmentation method includes at least one of flipping transformation, translation transformation, and random augmentation. It should be noted that the augmented dataset includes both the second dataset and samples obtained after data augmentation of the second samples in the second dataset. All samples included in the augmented dataset are referred to as augmented samples. In this application embodiment, a certain second sample and the samples obtained after data augmentation of that second sample are both considered as augmented samples related to that second sample. The standard label corresponding to each augmented sample related to a certain second sample is the standard label corresponding to that second sample; therefore, each augmented sample corresponds to a standard label.

[0076] In one possible implementation, the process of training a target model with reference parameters based on augmented samples to obtain the first global parameters of the target model is as follows: calling the target model with reference parameters to obtain the prediction results corresponding to the augmented samples; obtaining the target loss function based on the prediction results and standard labels corresponding to the augmented samples; updating the reference parameters using the target loss function to obtain the updated parameters; and obtaining the first global parameters of the target model based on the updated parameters.

[0077] By inputting augmented samples into a target model with reference parameters, we can obtain the prediction results corresponding to the augmented samples output by the target model with reference parameters. The form of the prediction results corresponding to the augmented samples depends on the processing task of the target model. For example, if the processing task of the target model is a classification task, the prediction results corresponding to the augmented samples are classification results; if the processing task of the target model is a segmentation task, the prediction results corresponding to the augmented samples are segmentation results.

[0078] The target loss function is used to measure the difference between the prediction result corresponding to the augmented sample and the standard label corresponding to the augmented sample. This application does not limit the method of obtaining the target loss function based on the prediction result and the standard label corresponding to the augmented sample. For example, the cross-entropy loss function between the prediction result and the standard label corresponding to the augmented sample is used as the target loss function.

[0079] After obtaining the target loss function, the reference parameters are updated using the target loss function to obtain the updated parameters. It should be noted that the updated parameters refer to the parameters obtained after updating the reference parameters once using the target loss function. This application does not limit the method of updating the reference parameters using the target loss function; for example, the update method is gradient descent.

[0080] For example, the augmented sample used to calculate the target loss function can refer to one augmented sample in the augmented dataset, a mini-batch of augmented samples in the augmented dataset, or all augmented samples in the augmented dataset; this embodiment does not limit this. The mini-batch is greater than 1 and less than the total number of augmented samples in the augmented dataset. The mini-batch size is set empirically or flexibly adjusted according to the application scenario; this embodiment does not limit this. It should be noted that when the number of augmented samples used to calculate the target loss function is at least two, the target loss function refers to the average of the loss functions calculated based on each augmented sample.

[0081] For example, the first global parameter may refer to the parameter obtained after updating the reference parameter one or more times consecutively; this embodiment of the application does not limit this. The first update count threshold used to limit the number of consecutive updates to the reference parameter is set based on experience or can be flexibly adjusted according to the application scenario. Under different first update count thresholds, the method of obtaining the first global parameter of the target model based on the updated parameter is different.

[0082] For example, when the first update threshold is 1, that is, when the first global parameter is the parameter obtained after updating the reference parameter once, the first global parameter of the target model is obtained based on the updated parameter by taking the updated parameter as the first global parameter of the target model.

[0083] For example, for the first update count threshold being an integer greater than 1, that is, the first global parameter being the parameter obtained after continuously updating the reference parameter multiple times, the method for obtaining the first global parameter of the target model based on the updated parameter is as follows: after obtaining the updated parameter, the target model with the updated parameter is called to re-obtain the prediction result corresponding to the augmented sample; the updated parameter is updated again using the loss function between the re-obtained prediction result corresponding to the augmented sample and the standard label corresponding to the augmented sample; this process is repeated until the number of continuous updates to the reference parameter reaches the first update count threshold, and the parameter obtained when the number of continuous updates to the reference parameter reaches the first update count threshold is taken as the first global parameter.

[0084] It should be noted that, for the case where the first global parameter is the parameter obtained after multiple consecutive updates of the reference parameter, the augmented samples used in different parameter update processes may be the same or different, and this application embodiment does not limit this.

[0085] For example, the optimization objective of updating the reference parameters is to minimize the server-side loss function, which is denoted as L. s If (ω), then the optimization objective for updating the reference parameters is... Here, ω represents the parameters of the target model on the server side. Assume that the number of augmented samples used to update the reference parameters in one operation is N. s Then L s (ω) is calculated based on the following formula 1:

[0086]

[0087] Among them, X i Y represents the second sample; i Indicates the second sample X i The corresponding standard label, i.e., the second sample X i The corresponding standard labels for the augmented samples; D s Represents the second dataset; φ(·) represents the data augmentation function; φ(X i ) represents the second sample X i Related augmented samples; f(φ(X) i );ω)) represents the second sample X i The prediction results corresponding to the relevant augmented samples; Indicates the second sample X i The prediction results corresponding to the augmented samples and the second sample X i The cross-entropy loss function between the standard labels corresponding to the augmented samples.

[0088] Method 2: Train the target model with reference parameters directly based on the second sample to obtain the first global parameters of the target model.

[0089] This second approach improves the efficiency of obtaining the first global parameters of the target model. In one possible implementation, the process of directly training the target model with reference parameters based on the second sample to obtain the first global parameters of the target model is as follows: Call the target model with reference parameters and obtain the prediction result corresponding to the second sample; update the reference parameters using the loss function between the prediction result corresponding to the second sample and the standard label corresponding to the second sample to obtain the updated parameters; obtain the first global parameters of the target model based on the updated parameters. The implementation of this process is similar to the process in Method 1 above, where the target model with reference parameters is trained based on augmented samples to obtain the first global parameters of the target model, and will not be repeated here.

[0090] 2. Supervise the application scenarios of federated learning

[0091] In supervised federated learning applications, the dataset (the first dataset) possessed by the terminal has standard labels, and the server does not need to maintain the dataset. In this case, for the first round of learning within a supervised federated learning task, the first global parameter refers to the parameters obtained by the server after initializing the target model; that is, the first global parameter refers to the initial parameters of the target model. For other rounds of learning within a supervised federated learning task besides the first round, the first global parameter refers to the aggregated parameters of the target model obtained by the server in the previous learning round.

[0092] Regardless of the application scenario, the server can obtain the first global parameters of the target model. After obtaining the first global parameters of the target model, the server sends the first global parameters of the target model to the first terminal, so that the first terminal can use the local dataset of the terminal to train the target model with the first global parameters and obtain the first local update information for updating the first global parameters.

[0093] The first terminal here refers to the terminal that needs to interact with the server during the current round of learning. The first terminal is determined from the terminals in the federated learning system. It should be noted that, in this embodiment, each terminal in the federated learning system has a first dataset. Different terminals may have completely identical, partial, or completely different first datasets, and this embodiment does not limit this. The data type of the first dataset in the terminal is related to the actual application scenario.

[0094] For example, the first terminal is a reference number of terminals randomly selected by the server from the terminals in the federated learning system. The parameter number is determined based on the total number of terminals in the federated learning system and the reference ratio. The reference ratio indicates the proportion of the number of terminals required to participate in one round of learning to the total number of terminals in the federated learning system. The parameter ratio is set based on experience or flexibly adjusted according to the application scenario, and this embodiment of the application limits this. The reference number determined in this way may be one or more, that is, the number of first terminals may be one or more. In the case where the number of first terminals is multiple, the server sends the first global parameters of the target model to each first terminal.

[0095] For example, during the execution of the federated learning task, the number of terminals selected for interaction with the server in different rounds of learning is a reference number, but the number of terminals selected according to the reference number may be different in different rounds of learning.

[0096] In an exemplary embodiment, before sending the first global parameters, the server broadcasts the model structure information of the target model to each terminal in the federated learning system, so that each terminal in the federated learning system is aware of the model structure of the target model to be collaboratively trained. After the server sends the first global parameters to the first terminal, the first terminal can combine the first global parameters with the model structure of the target model to obtain a target model with the first global parameters.

[0097] After the server sends the first global parameters to the first terminal, the first terminal receives the first global parameters, then trains the target model with the first global parameters based on the first dataset. Based on the trained first local parameters, it obtains first local update information for updating the first global parameters and returns the first local update information. It should be noted that this embodiment uses one first terminal as an example. If there are multiple first terminals, each first terminal obtains one piece of first local update information and returns it to the server. The process of the first terminal training the target model with the first global parameters based on the first dataset differs in different application scenarios, which will be described separately below.

[0098] 1. Semi-supervised federated learning application scenarios

[0099] In semi-supervised federated learning applications, the dataset possessed by the terminal is unlabeled, meaning the first dataset is unlabeled. Each first sample in the unlabeled first dataset has no standard label. In one possible implementation, the process of the first terminal training a target model with first global parameters based on the unlabeled first dataset includes the following steps 1 to 3:

[0100] Step 1: Based on the first dataset, obtain the first augmented dataset corresponding to the first dataset; based on the first augmented dataset, obtain the second augmented dataset corresponding to the first dataset. The first augmented dataset includes the first augmented samples, and the second augmented dataset includes the second augmented samples.

[0101] The first augmented dataset is derived from the first dataset, and the samples in the first augmented dataset are referred to as the first augmented samples; the second augmented dataset is derived from the first augmented dataset, and the samples in the second augmented dataset are referred to as the second augmented samples. It should be noted that since the first dataset is an unlabeled dataset, both the first and second augmented datasets corresponding to the first dataset are unlabeled datasets.

[0102] For example, based on the first dataset, the method to obtain the first augmented dataset corresponding to the first dataset is: to perform a first data augmentation process on the first dataset to obtain the first augmented dataset corresponding to the first dataset. Alternatively, based on the first dataset, the method to obtain the first augmented dataset corresponding to the first dataset is: to directly use the first dataset as the first augmented dataset corresponding to the first dataset.

[0103] For example, performing a first data augmentation on a first dataset means performing a first data augmentation on a first sample in the first dataset. The first augmented dataset includes first augmented samples related to each first sample. For example, the first data augmentation is a weak data augmentation. The sample obtained after weak data augmentation has little difference from the original sample. For example, the weak data augmentation method includes at least one of flip transformation and translation transformation.

[0104] For example, the method for obtaining the second augmented dataset corresponding to the first augmented dataset based on the first augmented dataset is as follows: performing a second data augmentation process on the first augmented dataset to obtain the second augmented dataset. For example, performing a second data augmentation process on the first augmented dataset means performing a second data augmentation process on the first augmented samples in the first augmented dataset. The second augmented dataset includes second augmented samples related to each of the first augmented samples. In this embodiment, if a second augmented sample A is a second augmented sample related to a first augmented sample a, then the first augmented sample a is referred to as the first augmented sample corresponding to the second augmented sample A.

[0105] This application does not limit the method of the second data augmentation process. For example, the second data augmentation process can be weak data augmentation or strong data augmentation. The sample obtained after strong data augmentation differs significantly from the original sample. For example, strong data augmentation methods include at least one of cropping and mosaicking.

[0106] Step 2: Call the target model with the first global parameter, obtain the prediction results corresponding to each first augmented sample in the first augmented dataset, and determine the pseudo label corresponding to each first augmented sample in the first augmented dataset based on the prediction results corresponding to each first augmented sample in the first augmented dataset.

[0107] Since the first augmentation dataset lacks standard labels, before obtaining the first local parameters, it is necessary to first obtain the pseudo-labels corresponding to each first augmented sample in the first augmentation dataset based on the target model with the first global parameters. The pseudo-label corresponding to any first augmented sample is determined based on the prediction result corresponding to that first augmented sample obtained by calling the target model with the first global parameters. For example, the pseudo-label corresponding to any first augmented sample is the label corresponding to the highest probability in the prediction result corresponding to that first augmented sample.

[0108] Step 3: Call the target model with the first global parameters, obtain the prediction result corresponding to the second augmented sample, and update the first global parameters using the loss function between the prediction result and the pseudo-label of the second augmented sample to obtain the updated local parameters; based on the updated local parameters, obtain the first local parameters. Here, the pseudo-label corresponding to the second augmented sample refers to the pseudo-label corresponding to the first augmented sample.

[0109] The first augmented sample corresponding to the second augmented sample refers to the first augmented sample upon which the second augmented sample is based. The pseudo-label corresponding to the second augmented sample can be obtained from the pseudo-label of the first augmented sample. This pseudo-label is used to provide a supervision signal for the local update of the target model's parameters. Inputting the second augmented sample into the target model with the first global parameters yields the prediction result corresponding to the second augmented sample output by the target model with the first global parameters. Then, the first global parameters are updated using the loss function between the prediction result and the pseudo-label of the second augmented sample, resulting in the updated local parameters. For example, the loss function between the prediction result and the pseudo-label of the second augmented sample is the cross-entropy loss function.

[0110] The updated local parameter refers to the parameter obtained after performing a single local update on the first global parameter. For example, the first local parameter may refer to the parameter obtained after continuously updating the first global parameter locally once or multiple times; this embodiment of the application does not limit this. The second update count threshold used to limit the number of continuous local updates to the first local parameter is set empirically or flexibly adjusted according to the application scenario. Under different second update count thresholds, the method of obtaining the first local parameter based on the updated local parameter differs.

[0111] For example, if the second update count threshold is 1, that is, the first local parameter refers to the parameter obtained after updating the first global parameter locally once, the first local parameter is obtained based on the updated local parameter by taking the updated local parameter as the first local parameter.

[0112] For example, for the second update count threshold being an integer greater than 1, that is, the first local parameter refers to the parameter obtained after continuously updating the first global parameter locally multiple times, the method for obtaining the first local parameter based on the updated local parameter is as follows: after obtaining the updated local parameter, the target model with the updated local parameter is called to re-obtain the prediction result corresponding to the second augmented sample; the updated local parameter is updated again using the loss function between the re-obtained prediction result corresponding to the second augmented sample and the pseudo label corresponding to the second augmented sample; this process is repeated until the number of continuous local updates to the first global parameter reaches the second update count threshold, and the local parameter obtained when the number of continuous local updates to the first global parameter reaches the second update count threshold is taken as the first local parameter.

[0113] It should be noted that the first local parameter refers to the parameter obtained after continuously updating the first global parameter locally multiple times. The second enhancement sample used in different local parameter update processes may be the same or different, and this application embodiment does not limit this.

[0114] For example, the optimization objective of locally updating the first global parameter is to minimize the loss function on the first terminal side, denoted as L. k (ω k If the optimization objective for locally updating the first global parameter is... Where, ω k This represents the parameters of the target model on the terminal side. Assume that the number of second augmented samples used to perform a local update of the first global parameters is N. k Then L k (ω k The following formula 2 is used for calculation:

[0115]

[0116] Where, x i D represents the first sample; k Indicates the first dataset; Indicates based on the first sample x i The second augmented sample obtained; Indicates the second augmented sample The corresponding prediction result; λ represents the threshold hyperparameter, which is used to determine which second-enhanced samples have reliable pseudo-labels. The value of λ is set according to experience or can be flexibly adjusted according to the application scenario. This application embodiment does not limit this. For example, the value of λ is 90%.

[0117] γ(·) represents the indicator function. When the condition is met, the value of the indicator function is 1, and when the condition is not met, the value of the indicator function is 0. It is the second augmented sample obtained by calling the target model with the first global parameter. The corresponding first augmented sample φ(x) i The corresponding prediction results; Indicates the first augmented sample φ(x) i The maximum probability value in the corresponding prediction results; Indicates the first augmented sample φ(x) i The label corresponding to the highest probability value in the prediction results, i.e., the label of the first enhanced sample φ(x) i The pseudo-label corresponding to ) will be used to augment the first sample φ(x) i The corresponding pseudo-labels are used as the second augmented samples. The corresponding pseudo-tags; Indicates the second augmented sample Corresponding pseudo-labels and second augmented samples The cross-entropy loss function between the corresponding prediction results.

[0118] In the above process, the first terminal trains a target model with first global parameters on a local, unlabeled first dataset. This process is a semi-supervised learning process. For example, in semi-supervised learning, pseudo-labels corresponding to augmented samples generated by weak data augmentation methods can be used to train augmented samples generated by strong data augmentation methods. This approach can generate a wide variety of samples, thereby improving the performance of semi-supervised learning.

[0119] 2. Supervise the application scenarios of federated learning

[0120] In supervised federated learning applications, the terminal possesses a dataset with standard labels; that is, the first dataset is a dataset with standard labels. Each first sample included in the first dataset with standard labels has a standard label. In this case, the first terminal trains the target model with the first global parameters based on the first dataset with standard labels in the following ways, including but not limited to:

[0121] Method A: Perform data augmentation on the first dataset to obtain a reference augmented dataset, which includes reference augmented samples with corresponding standard labels; train the target model with the first global parameters based on the reference augmented samples to obtain the first local parameters.

[0122] Method B: Train the target model with the first global parameters directly based on the first sample to obtain the first local parameters.

[0123] The implementation process of the above two methods can be found in the two methods for the server to obtain the first global parameters of the target model in a semi-supervised federated learning application scenario, which will not be repeated here.

[0124] After obtaining the first local parameters, the first terminal obtains first local update information for updating the first global parameters based on the trained first local parameters. In one possible implementation, the first terminal obtains the first local update information for updating the first global parameters based on the trained first local parameters in the following ways: Method 1 and Method 2.

[0125] Method 1: The first terminal uses the unquantized update information determined based on the first local parameters and the first global parameters as the first local update information.

[0126] The first local parameter is obtained based on the first global parameter. Unquantized update information determined based on the first local parameter and the first global parameter is used to visually represent the difference between the first local parameter and the first global parameter. For example, the parameters of the target model consist of multiple sub-parameters, and the sub-information included in the unquantized update information corresponds one-to-one with the sub-parameters included in the parameters of the target model. For example, the sub-information in the unquantized update information is used to indicate the parameter increment of the sub-parameters in the parameters of the target model.

[0127] In this method 1, after obtaining the first local parameter information, the first terminal can directly obtain the first local update information, which is highly efficient.

[0128] Method 2: The first terminal uses the unquantized update information determined based on the first local parameters and the first global parameters as the original update information; it then quantizes the original update information using the target quantization threshold and the target quantization level to obtain the first local update information.

[0129] In this second method, the first local update information is the update information obtained by the first terminal quantizing the original update information with the target quantization threshold and target quantization level. Compared with the original update information, the first local update information obtained after quantization has a smaller data volume, which is beneficial to improving the communication efficiency between the first terminal and the server.

[0130] For example, quantization refers to converting floating-point information into integer information during actual computation. Compared to floating-point information, integer information occupies less data and requires fewer communication resources. For example, the information in the actual computation process is 32-bit floating-point information.

[0131] Before quantizing the original updated information using the target quantization threshold and target quantization level, the first terminal needs to determine the target quantization threshold and target quantization level. The target quantization level is set based on experience or can be flexibly adjusted according to actual communication requirements. For example, the target quantization level can be 2, 4, 6, 8, or 16. It should be noted that the target quantization level indicates the number of bits in the quantized integer information; for example, when the target quantization level is 8, the quantized integer information will have 8 bits.

[0132] The target quantization threshold is used to ensure that the dequantized information of the first local update satisfies the symmetry condition with the original update information. Satisfying the symmetry condition means that the difference between the dequantized information of the first local update and the original update information is not greater than the difference threshold. The difference threshold is set empirically or flexibly adjusted according to the application scenario. Typically, the difference threshold is a small value to ensure that the dequantized information of the first local update is as close as possible to the original update information.

[0133] In one possible implementation, the target quantization threshold is obtained by minimizing the maximum average difference between the original update information and the first local update information. The maximum average difference between the original update information and the first local update information reflects the difference in their distributions. By minimizing the maximum average difference between the original update information and the first local update information, the distribution of the first local update information can be made as close as possible to the distribution of the original update information.

[0134] Next, we will introduce the Maximum Mean Discrepancy (MMD):

[0135] The maximum mean difference (MMD) is defined as follows: Let h and g represent the distributions of the source sample P and the target sample Q, respectively. If there exists a random projection function f, then the maximum mean difference (MMD) is calculated using the following formulas 3 and 4:

[0136]

[0137] Where, p i q represents the data in the source sample P; i Let represent the data in the target sample Q; m (an integer not less than 1) represents the number of data in the source sample P; n (an integer not less than 1) represents the number of data in the target sample Q; F represents mapping the feature space to the set of real numbers. The set of all functions; sup(·) denotes the supremum function.

[0138] The MMD calculation method described above cannot be directly used in federated learning settings. Therefore, it needs to be improved to suit federated learning. Let w represent the information before quantization, and Q(w) represent the information after quantization. Assume that w follows a distribution of w~N(0,σ). 2 We introduce a regenerating kernel Hilbert space, using the dot product in space H to represent the mapping of function f, i.e., f(x) =<f,ψ(x)> H , where ψ(·) represents χ→H. The MMD between w and Q(w) can be calculated based on the following formula 5:

[0139]

[0140] in, E represents w [ψ(x)]; E represents Q(w) [ψ(y)];<·,·> H This represents the dot product operation in the regenerated kernel Hilbert space. For example, the dot product operation is calculated using the kernel function k(x,x′), which is defined as shown in Equation 6:

[0141] k(x,x′)=exp(-||xx′|| 2 / (2σ 2 )) (Formula 6)

[0142] For example, both w and Q(w) are in matrix form. According to Formula 5 above, the formula for calculating the MMD between w and Q(w) as shown in Formula 7 can be obtained:

[0143]

[0144] Among them, w i and w j Let Q(w) represent two sub-information items located at positions i and j in w, respectively. i And Q(w) jLet i and j represent the two sub-informations in Q(w) at positions i and j respectively; m (an integer not less than 1) represents the number of sub-informations in w; n (an integer not less than 1) represents the number of sub-informations in Q(w); in Formula 7, since Q(w) is the information obtained after quantizing w, m and n are equal.

[0145] The process of minimizing the maximum average difference between the original update information and the first local update information is to continuously adjust the quantization threshold to minimize the MMD calculated based on Formula 7. Specifically, for each quantization threshold selected, the original update information is quantized according to the quantization threshold and the target quantization level to obtain the quantized update information. Then, the original update information and the quantized update information are substituted into Formula 7 to calculate the MMD, and the quantization threshold selected when the minimum MMD is obtained is taken as the target quantization threshold.

[0146] In Formula 7 above, the first and second terms after the equal sign represent pruning noise, and the third term after the equal sign represents rounding noise. The target quantization threshold obtained by minimizing the maximum average difference between the original updated information and the first local updated information can minimize the cumulative error caused by pruning.

[0147] It should be noted that, since the target quantization threshold is used to ensure that the dequantized information of the first local update information and the original update information satisfy the symmetry condition, the quantization method provided in this application embodiment is a symmetric quantization method. It should be further noted that this application embodiment only uses one first terminal as an example for illustration. When there are multiple first terminals, each first terminal can determine the target quantization threshold and target quantization level according to the above method. The target quantization levels determined by different first terminals can be the same or different; in addition, the target quantization thresholds determined by different first terminals can be the same or different.

[0148] After determining the target quantization threshold and target quantization level, the original updated information is quantized using the target quantization threshold and target quantization level to obtain the first local updated information. In one possible implementation, the process of quantizing the original updated information using the target quantization threshold and target quantization level to obtain the first local updated information is as follows: the original updated information is pruned using the target quantization threshold so that the values ​​of all sub-information in the original updated information are within the value range determined based on the target quantization threshold; the pruned original updated information is then quantized using the target quantization level to obtain the first local updated information.

[0149] For example, suppose the original update information Δω is in matrix form, suppose Δω ij∈[min,max] represents the value of the sub-information located in the i-th row and j-th column of the original updated information Δω, where min is the minimum value of each sub-information in the original updated information Δω, and max is the maximum value of each data point in the original updated information Δω. Assume the target quantization level is r, meaning the original updated information Δω is quantized into r-bit (e.g., r = 2, 4, 6, 8, 16) unsigned integer data. In this case, for Δω... ij The quantification process is implemented according to the following formula 8:

[0150] Q(Δω ij )=[(2 r -1)*(Δω ij -min) / (max-min)] (Formula 8)

[0151] Where Q(·) represents the quantization function; Q(Δω) ij ) represents the expression for Δω ij The values ​​obtained after quantization. It should be noted that the process of quantizing the original update information Δω is the process of quantizing the values ​​of each sub-information in the original update information Δω separately. Before quantizing the original update information Δω using the above formula 8, the original update information is first pruned using the target quantization threshold so that the values ​​of all sub-information in the original update information are within the range determined based on the target quantization threshold.

[0152] Assuming the target quantization threshold is α, the range of values ​​determined based on the target quantization threshold is [-α, α]. The method for pruning the original updated information using the target quantization threshold is as follows: values ​​of sub-information with values ​​greater than α are pruned to α; values ​​of sub-information with values ​​less than -α are pruned to -α; and values ​​of sub-information with values ​​between [-α, α] remain unchanged. After pruning the original updated information using the target quantization threshold, the minimum value (min) of each sub-information in the original updated information Δω is equal to -α, and the maximum value (max) of each sub-information in the original updated information Δω is equal to α. In other words, after pruning the original updated information using the target quantization threshold, Δω... ij ∈[-α,α]. Using Formula 8 to calculate Q(Δω) ij When ), let min = -α, max = α. After quantizing the values ​​of each sub-information in the original update information using Formula 8, the first local update information is obtained.

[0153] Regardless of whether the first terminal obtains the first local update information for updating the first global parameter using either method 1 or method 2 described above, after obtaining the first local update information, the first terminal returns the first local update information to the server. In an exemplary embodiment, when the first terminal obtains the first local update information using method 2 described above, in addition to returning the first local update information to the server, the first terminal also returns the target quantization threshold and the target quantization level to the server, so that the server can dequantize the received first local update information according to the target quantization threshold and the target quantization level.

[0154] In step 202, based on the first local update information, the first target update information that meets the attack defense conditions is obtained.

[0155] In federated learning, because the terminal has complete control over the locally maintained initial dataset, malicious terminals can easily launch attacks on the federated learning process, thereby damaging the performance of the target model. Therefore, after receiving the initial local update information returned by the initial terminal, the server uses this information to obtain the initial target update information that meets the attack defense conditions, in order to mitigate the adverse effects of attacks from malicious terminals. The initial target update information that meets the attack defense conditions refers to high-quality update information, which helps improve the training performance of the target model.

[0156] It should be noted that the number of first local update messages is the same as the number of first terminals. When there are multiple first terminals, the number of first local update messages is also multiple.

[0157] In one possible implementation, as described in step 201 above, the first local update information may be unquantized update information determined based on the first local parameters and the first global parameters, or it may be update information obtained by the first terminal quantizing the original update information using the target quantization threshold and the target quantization level. Depending on the type of the first local update information, the method for obtaining the first target update information that satisfies the attack defense conditions will also differ.

[0158] In one possible implementation, for the case where the first local update information is unquantified update information determined based on the first local parameters and the first global parameters, the way to obtain the first target update information that meets the attack defense conditions based on the first local update information is: directly select the first target update information that meets the attack defense conditions from the first local update information.

[0159] In one possible implementation, directly selecting the first target update information that meets the attack defense conditions from the first local update information includes the following steps A and B:

[0160] Step A: Obtain the target quality index corresponding to the first local update information. The target quality index corresponding to the first local update information is used to measure the credibility of the first local update information as non-attack update information.

[0161] The target quality index corresponding to the first local update information is used to measure the reliability of the first local update information as non-attack update information. The larger the target quality index corresponding to the first local update information, the greater the reliability of the first local update information as non-attack update information, which means that the first local update information is more likely to be the first local update information returned by a normal terminal. The smaller the target quality index corresponding to the first local update information, the lower the reliability of the first local update information as non-attack update information, which means that the first local update information is more likely to be the first local update information returned by a malicious terminal.

[0162] It should be noted that when there are multiple instances of the first local update information, it is necessary to obtain the target quality index corresponding to each instance of the first local update information separately. This embodiment of the application only illustrates the process of obtaining the target quality index corresponding to one instance of the first local update information.

[0163] In one possible implementation, the target quality metric corresponding to the first local update includes at least one of a first quality metric and a second quality metric. The first and second quality metrics are used to measure the credibility of the first local update information as non-attack update information from two different perspectives. For example, the first quality metric is used to measure the credibility of the first local update information as non-attack update information from the perspective of the similarity between the aggregated update information corresponding to the first local update information and the aggregated update information corresponding to the first global parameter; the second quality metric is used to measure the credibility of the first local update information as non-attack update information from the perspective of the distribution distance between the first local parameter corresponding to the first local update information and the first global parameter.

[0164] In an exemplary embodiment, the aggregated update information corresponding to the first local update information is the aggregated update information generated by the first terminal, and the aggregated update information corresponding to the first global parameter is the aggregated update information generated by the server. The aggregated update information can be represented as an aggregated update vector. This application's embodiments explore the relationship between aggregated update vectors generated by normal terminals, aggregated update vectors generated by malicious terminals, and aggregated update vectors generated by servers, such as... Figure 3 As shown. According to Figure 3 It can be seen that the aggregated update vector generated by a normal terminal is close to the aggregated update vector generated by the server, while the aggregated update vector generated by a malicious terminal is not close to the aggregated update vector generated by the server. The closer the two vectors are, the greater the similarity between them.

[0165] Local update information generated by a normal terminal is non-attack update information, while local update information generated by a malicious terminal is attack update information. Therefore, the credibility of the first terminal generating the first local update information as a normal terminal can be measured from the similarity between the aggregated update information corresponding to the first local update information and the aggregated update information corresponding to the first global parameter, that is, the credibility of the first local update information as non-attack update information.

[0166] In an exemplary embodiment, the first local parameter corresponding to the first local update information is a local parameter generated by the first terminal. This application's embodiments explore the relationship between the distribution of local parameters generated by normal terminals and the distribution of local parameters generated by malicious terminals, such as... Figure 4 As shown. According to Figure 4 It is evident that the distribution of local parameters generated by a normal terminal differs significantly from that generated by a malicious terminal. It should be noted that, in this embodiment, the distribution of local parameters generated by a normal terminal is considered to be substantially the same as the distribution of global parameters generated by the server. Therefore, the distribution of local parameters generated by a malicious terminal differs considerably from the distribution of global parameters generated by the server.

[0167] Local update information generated by a normal terminal is non-attack update information, while local update information generated by a malicious terminal is attack update information. Therefore, the credibility of the first terminal generating the first local update information as a normal terminal can be measured from the distribution distance between the first local parameter and the first global parameter corresponding to the first local update information, that is, the credibility of the first local update information as non-attack update information.

[0168] In one possible implementation, if the target quality indicator corresponding to the first local update information includes the first quality indicator, it is necessary to obtain the first quality indicator corresponding to the first local update information. In an exemplary embodiment, the method for obtaining the first quality indicator corresponding to the first local update information is as follows: summarizing all local update information historically returned by the first terminal that returned the first local update information to obtain the first summarized update information corresponding to the first local update information; obtaining the second summarized update information corresponding to the first global parameter, wherein the second summarized update information is used to indicate the server's update status of the target model; and determining the first quality indicator corresponding to the first local update information based on the similarity between the first summarized update information and the second summarized update information.

[0169] The first aggregated update information refers to the aggregated information of all local update information historically returned by the first terminal during its participation in the federated learning task. The first local update information is the latest local update information among all historically returned local update information. The local update information returned by the first terminal carries the terminal identifier of the first terminal. The server can extract all local update information historically returned by the first terminal during its participation in the federated learning task based on the first terminal identifier carried in the first local update information, and then obtain the first aggregated update information corresponding to the first local update information by aggregating them.

[0170] The second summary update information corresponding to the first global parameter is used to indicate the server's update status of the target model. For example, in a supervised federated learning application scenario, the second summary update information corresponding to the first global parameter refers to the update information of the first global parameter obtained by the server relative to the initial parameters of the target model. For example, in a semi-supervised federated learning application scenario, each time the server obtains global parameters through training, it can obtain update information of a global parameter relative to the aggregated parameters obtained in the previous learning process. The second summary update information refers to the summary information of all update information obtained by the server itself when obtaining the first global parameter.

[0171] After obtaining the first aggregated update information corresponding to the first local update information and the second aggregated update information corresponding to the first global parameter, a first quality index corresponding to the first local update information is determined based on the similarity between the first aggregated update information and the second aggregated update information. For example, both the first aggregated update information and the second aggregated update information can be represented using vectors, and the similarity between the first aggregated update information and the second aggregated update information is cosine similarity.

[0172] In one possible implementation, the first quality indicator corresponding to the first local update information is determined based on the similarity between the first aggregated update information and the second aggregated update information by using the similarity between the first aggregated update information and the second aggregated update information as the first quality indicator corresponding to the first local update information. In another possible implementation, the product of the similarity between the first aggregated update information and the second aggregated update information and a reference value is used as the first quality indicator corresponding to the first local update information.

[0173] This application embodiment uses the cosine similarity between the first aggregated update information and the second aggregated update information as an example for illustration. For example, assuming the first local update information is the local update information obtained by the first terminal k during the t-th (an integer not less than 1) round of learning, the first quality index corresponding to the first local update information is calculated based on Formula 9:

[0174]

[0175] in, This represents the first quality index corresponding to the first local update information obtained by the first terminal k during the t-th round of learning; This represents the second summary update information corresponding to the first global parameter obtained by the server during the t-th round of learning; Let represent the first aggregated update information corresponding to the first local update information obtained by the first terminal k during the t-th round of learning; cos(·,·) represents the cosine similarity calculation function.

[0176] It should be noted that in calculating the first quality index in this embodiment, the summary update information is used, which can mitigate the adverse effects of unexpected situations. Compared to single update information on the terminal side, the summary update information on the terminal side can better reflect the reliability of the terminal, and the reliability of the terminal is used to measure whether the historical behavior of the terminal is reliable.

[0177] In one possible implementation, if the target quality indicator corresponding to the first local update information includes a second quality indicator, it is necessary to obtain the second quality indicator corresponding to the first local update information. In an exemplary embodiment, the second quality indicator corresponding to the first local update information is obtained by: determining the second quality indicator corresponding to the first local update information based on the distribution distance between the first local parameter and the first global parameter corresponding to the first local update information.

[0178] The distribution distance between the first local parameter and the first global parameter corresponding to the first local update information is used to reflect the distance between the distribution of the first local parameter and the distribution of the first global parameter corresponding to the first local update information. This application embodiment does not limit the method of measuring the distance between two distributions; for example, the Wasserstein distance is used to measure the distance between two distributions.

[0179] In one possible implementation, a larger second quality index indicates a higher degree of credibility for the first local update information as non-attack update information. A larger distribution distance indicates that the two distributions are less close. The method for determining the second quality index corresponding to the first local update information based on the distribution distance between the first local parameter and the first global parameter corresponding to the first local update information is as follows: the product of the distribution distance between the first local parameter and the first global parameter corresponding to the first local update information and the target negative number is used as the second quality index corresponding to the first local update information. The target negative number is set empirically or flexibly adjusted according to the application scenario; this embodiment does not limit this. For example, the target negative number is -1.

[0180] For example, using the Wasserstein distance to measure the distance between two distributions, assuming the first local update information is the local update information obtained by the first terminal k during the t-th round of learning, the second quality index corresponding to the first local update information is calculated based on Formula 10:

[0181]

[0182] in, ω represents the second quality index corresponding to the first local update information obtained by the first terminal k during the t-th round of learning; t ω represents the first global parameter acquired by the server during the t-th round of learning; k,t The first local parameter represents the first local update information obtained by the first terminal k during the t-th round of learning; W(·,·) represents the Wasserstein distance calculation function; γ~Π(ω t ,ω k,t ) represents ω t and ω k,t The joint distribution of E; (x,y)～γ [||xy||] represents the expected distance between sample pairs (x,y) in the joint distribution γ. Considering the second quality metric, the distance between the distribution of the first local parameters corresponding to the first local update information and the distribution of the first global parameters can be used to select the first local update information generated by a normal terminal.

[0183] For example, suppose the server obtains the first global parameter ω during the t-th round of learning. t The distribution of ω is Gaussian, and ω t ~N(μ) t ,Σ t The distribution ω of the first local parameters corresponding to the first local update information obtained by the first terminal k during the t-th round of learning. k,t It also follows a Gaussian distribution, and ω k,t ~N(μ) k,t ,Σ k,t If the first terminal k obtains the first local update information during the t-th round of learning, then the second quality index corresponding to it can be calculated based on formula 11:

[0184]

[0185] Where, μ t This represents the first global parameter ω acquired by the server during the t-th round of learning. t The mean of the Gaussian distribution; μ k,t This represents the first local parameter ω corresponding to the first local update information obtained by the first terminal k during the t-th round of learning. k,tThe mean of the Gaussian distribution; Σ t This represents the first global parameter ω acquired by the server during the t-th round of learning. t The variance of the Gaussian distribution; Σ k,t This represents the first local parameter ω corresponding to the first local update information obtained by the first terminal k during the t-th round of learning. k,t The variance of the Gaussian distribution; μ t and μ k,t The l2 norm distance between them; tr(·) represents the trace function.

[0186] Step B: Take the first local update information corresponding to the target quality index that meets the reference conditions as the candidate update information, and obtain the first target update information that meets the attack and defense conditions based on the candidate update information.

[0187] Reference conditions are used to limit the target quality indicators. These conditions are set based on experience or can be flexibly adjusted according to the application scenario; this application embodiment does not limit their application. For example, if the target quality indicator includes a first quality indicator, the reference conditions include that the first quality indicator is not less than a first quality threshold; if the target quality indicator includes a second quality indicator, the reference conditions include that the second quality indicator is not less than a second quality threshold; if the target quality indicator includes both a first and a second quality indicator, the reference conditions include that the first quality indicator is not less than the first quality threshold and the second quality indicator is not less than the second quality threshold. The first and second quality thresholds are set based on experience or can be flexibly adjusted according to the application scenario; this application embodiment does not limit their application. The first quality threshold may be the same as or different from the second quality threshold.

[0188] After determining the quality update index corresponding to the first local update information, it can be determined whether the quality update index corresponding to the first local update information meets the reference conditions. The first local update information corresponding to the target quality index that meets the reference conditions is used as candidate update information. The candidate update information is high-quality first local update information. The number of candidate update information may be one or more, and this application embodiment does not limit this.

[0189] In one possible implementation, the method for obtaining the first target update information that satisfies the attack defense conditions based on candidate update information is to use the candidate update information as the first target update information that satisfies the attack defense conditions. In this approach, regardless of whether there is one or more candidate update information, the candidate update information is directly used as the first target update information that satisfies the attack defense conditions, which helps improve the efficiency of obtaining the first target update information that satisfies the attack defense conditions.

[0190] In another possible implementation, for cases where there are at least two candidate update information, the process of obtaining the first target update information that satisfies the attack defense conditions based on the candidate update information includes the following steps a to d:

[0191] Step a: Based on at least two candidate update information, determine at least two candidate update information groups, where each candidate update information group includes at least one candidate update information.

[0192] Each candidate update information group includes at least one candidate update information. Different candidate update information groups may include the same or different numbers of candidate update information. In one possible implementation, determining at least two candidate update information groups based on at least two candidate update information involves: determining all update information groups that can be formed by at least two candidate update information; and determining at least two candidate update information groups based on all update information. It should be noted that in this embodiment, a single candidate update information can also constitute an update information group.

[0193] In one possible implementation, determining at least two candidate update information groups based on all update information involves treating all update information groups as candidate update information groups. In another possible implementation, determining at least two candidate update information groups based on all update information involves selecting update information groups from all update information groups whose number of candidate update information is not less than a certain threshold. The threshold is set empirically or adjusted flexibly according to the application scenario. It should be noted that this application embodiment uses an example where the number of candidate update information groups is at least two. If the number of candidate update information groups is one, each candidate update information in that candidate update information group can be directly used as the first target update information that satisfies the attack defense conditions.

[0194] Step b: Based on the first global parameter and the first local parameter corresponding to each candidate update information included in any candidate update information group, determine the parameter change index corresponding to any candidate update information group.

[0195] In one possible implementation, step b is implemented as follows: For any candidate update information included in any candidate update information group, calculate the difference between the first global parameter and the first local parameter corresponding to the candidate update information; in response to the difference being positive, multiply the difference by a first value as the sub-change index corresponding to the candidate update information; in response to the difference being negative, multiply the difference by a second value as the sub-change index corresponding to the candidate update information; in response to the difference being 0, multiply the difference by a third value as the sub-change index corresponding to the candidate update information. The sum of the sub-change indices corresponding to each candidate update information included in any candidate update information group is used as the parameter change index corresponding to the candidate update information group. For example, the first value is negative, such as -1; the second value is positive, such as 1; and the third value is any value.

[0196] Step c: Based on the parameter change indicators corresponding to at least two candidate update information groups, determine the first update information group corresponding to the parameter change indicator that satisfies the first condition among the at least two candidate update information groups.

[0197] Based on the implementation of step b, parameter change indices corresponding to at least two candidate update information groups can be determined. Then, among the parameter change indices corresponding to the at least two candidate update information groups, the parameter change index that satisfies the first condition is determined. In one possible implementation, the parameter change index that satisfies the first condition refers to the smallest parameter change index among the parameter change indices corresponding to the at least two candidate update information groups, where d is an integer not less than 1. The value of d is set empirically; for example, d is set to 1, meaning that the parameter change index that satisfies the first condition is the smallest parameter change index among the parameter change indices corresponding to the at least two candidate update information groups.

[0198] After identifying the parameter change indicators that meet the first condition, the candidate update information group corresponding to the parameter change indicators that meet the first condition is taken as the first update information group.

[0199] Step d: In the first update information group, determine the target update information group, and take each candidate update information included in the target update information group as the first target update information that meets the attack and defense conditions.

[0200] The number of first update information groups may be one or more, and this application embodiment does not limit this. When the number of first update information groups is one, the method for determining the target update information group in the first update information group is: directly using the one first update information group as the target update information group.

[0201] In one possible implementation, when the number of first update information groups is at least two, the method for determining the target update information group in the first update information groups is: randomly select one of the at least two first update information groups as the target update information group.

[0202] In another possible implementation, when the number of first update information groups is at least two, the method for determining the target update information group in the first update information group is as follows: the sum of the target quality indicators corresponding to each candidate update information included in any first update information group is used as the summary quality indicator corresponding to any first update information group; based on the summary quality indicators corresponding to at least two first update information groups respectively, the second update information group corresponding to the summary quality indicator that satisfies the second condition is determined in the at least two first update information groups; the target update information group is determined in the second update information group.

[0203] In one possible implementation, the aggregate quality indicator that satisfies the second condition refers to the largest (z is an integer not less than 1) aggregate quality indicator among the aggregate quality indicators corresponding to at least two first update information groups. The value of z is set empirically; for example, the value of z is 1, meaning that the aggregate quality indicator that satisfies the second condition is the largest aggregate quality indicator among the aggregate quality indicators corresponding to at least two first update information groups.

[0204] After determining the aggregated quality indicators that meet the second condition, the first updated information group of the aggregated quality indicators that meet the second condition is designated as the second updated information group. Based on the second updated information group, a target updated information group is determined. There can be one or more second updated information groups. When there is only one second updated information group, that single second updated information group is directly designated as the target updated information group. When there are at least two second updated information groups, one is randomly selected from the at least two second updated information groups as the target updated information group.

[0205] After determining the target update information group, each candidate update information included in the target update information group is taken as the first target update information group that meets the attack and defense conditions.

[0206] For example, the parameter change index that satisfies the first condition refers to the smallest parameter change index among the parameter change indices corresponding to at least two candidate update information groups, and the summary quality index that satisfies the second condition refers to the largest summary quality index among the summary quality indices corresponding to at least two first update information groups. The process of obtaining the first target update information that satisfies the attack and defense conditions can be regarded as the process of selecting the first target update information that satisfies the attack and defense conditions from the candidate update information using the minimax optimization strategy.

[0207] For example, the process of selecting the first target update information that satisfies the attack and defense conditions from the candidate update information using the minimax optimization strategy is implemented based on Equation 12:

[0208]

[0209] Where s represents the sign vector, when ω t -ω′ k,t When ω > 0, the value of s is -1; when ω > 0, the value of s is -1. t -ω′ k,t When ω < 0, the value of s is 1; when ω < 0, the value of s is 1. t -ω′ k,t When ω = 0, the value of s is 0. t Represents the first global parameter; ω′ k,t This represents the first local parameter corresponding to the candidate update information included in the candidate update information group; T represents transpose; s T (ω t -ω′ k,t ) represents the parameter change index corresponding to the candidate update information group; M k,t M represents the target quality index corresponding to the first local update information obtained by the first terminal k during the t-th round of learning; δ represents the quality threshold indicated by the reference condition, and δ is the threshold hyperparameter; k,t ≥δ indicates that the target quality index corresponding to the first local update information obtained by the first terminal k in the t-th round of learning meets the reference condition; R (R is an integer not less than 1) represents the total number of the first terminals.

[0210] Based on the min-max optimization strategy, the first local update information returned by the first terminal whose update direction is as close as possible to the server's update direction can be selected, and as many candidate update information as possible can be selected. This min-max optimization strategy can select more first local update information with high quality.

[0211] In one possible implementation, when the first local update information is the update information obtained by the first terminal quantizing the original update information using a target quantization threshold and a target quantization level, the server receives not only the first local update information returned by the first terminal, but also the target quantization threshold and target quantization level returned by the first terminal. In this case, the method for obtaining the first target update information that meets the attack defense conditions based on the first local update information is as follows: based on the target quantization threshold and target quantization level, the first local update information is dequantized to obtain the dequantized information of the first local update information; from the dequantized information of the first local update information, the first target update information that meets the attack defense conditions is selected.

[0212] Since the first local update information is obtained by quantizing using a target quantization threshold and a target quantization level, the server, upon receiving the first local update information, the target quantization threshold, and the target quantization level, can dequantize the first local update information based on the target quantization threshold and the target quantization level, thereby obtaining the dequantized information of the first local update information. It should be noted that, because the target quantization threshold is used to ensure that the dequantized information of the first local update information satisfies a symmetry condition with the original update information, the dequantized information of the first local update information obtained by dequantizing the first local update information based on the target quantization threshold and the target quantization level has a high degree of similarity to the original update information before quantization.

[0213] In one possible implementation, the process of dequantizing the first local update information is to dequantize each sub-information in the first local update information separately. For example, based on the target quantization threshold and the target quantization level, the dequantization process of the sub-information q′ in the first local update information is implemented according to Formula 13:

[0214] Q -1 (q′)=q′*(max-min) / (2 r -1)+min (Formula 13)

[0215] Among them, Q -1 (q′) represents the dequantized sub-information obtained by dequantizing the sub-information q′ in the first local update information based on the target quantization threshold and the target quantization level; max represents the target quantization threshold; min represents the negative of the target quantization threshold; and r represents the target quantization level.

[0216] It should be noted that the process of selecting the first target update information that meets the attack defense conditions from the dequantized information of the first local update information is the same as the process of selecting the first target update information that meets the attack defense conditions directly from the first local update information, that is, refer to steps A and B above, and will not be repeated here.

[0217] For example, the scheme in step 202 that obtains the first target update information that meets the attack defense conditions based on the first local update information can select the first target update information with high quality and high reliability. This scheme can be called the update information selection scheme.

[0218] In step 203, the first aggregated parameters of the target model are obtained based on the first global parameters and the first target update information; in response to the target model with the first aggregated parameters satisfying the target termination condition, the federated learning task is completed.

[0219] The first target update information is high-quality update information. Based on the first global parameter and the first target update information, the first aggregate parameter of the target model can be obtained, which can improve the reliability of the obtained first aggregate parameter.

[0220] In one possible implementation, the process of obtaining the first aggregated parameter of the target model based on the first global parameter and the first target update information is as follows: based on the first global parameter, the first target update information is aggregated to obtain the first aggregated parameter of the target model.

[0221] In an exemplary embodiment, the process of aggregating the first target update information based on the first global parameters to obtain the first aggregated parameters of the target model is as follows: calculate the average value of the first target update information, and use the sum of the average value of the first target update information and the first global parameters as the first aggregated parameters of the target model. For example, taking the current learning round as the t-th round (t is an integer not less than 1), the process of aggregating the first target update information based on the first global parameters to obtain the first aggregated parameters of the target model is implemented based on Formula 14:

[0222]

[0223] Where, ω′ t+1 ω represents the first aggregation parameter of the target model. t Denotes the first global parameter of the target model; K represents the total number of the first terminals corresponding to the first target update information; Δω k,t This represents the first target update information generated by the first terminal k; This represents the average value of the first target update information.

[0224] For example, the aggregation process implemented based on the above formula 14 is an aggregation process using the average aggregation (FedAvg) method. This application's embodiments explore the differences between aggregation using the FedAvg aggregation method and aggregation using the geometric median aggregation (GMA) method, such as... Figure 5 As shown. According to Figure 5 It is known that if some noise gradient exists, the aggregation result generated by the FedAvg aggregation method differs significantly from the true result, while the GMA aggregation method is robust to noise gradients and the aggregation result generated by the GMA aggregation method is closer to the true result. Therefore, in the exemplary embodiment, the process of obtaining the first aggregation parameter of the target model based on the first global parameter and the first target update information can also be completed using the geometric median aggregation method.

[0225] In one possible implementation, the process of obtaining the first aggregated parameter of the target model based on the first global parameter and the first target update information is accomplished by using the geometric median aggregation method as follows: obtain the geometric median information corresponding to the first target update information; and aggregate the geometric median information corresponding to the first target update information based on the first global parameter to obtain the first aggregated parameter of the target model.

[0226] The geometric median information corresponding to the first target update information is used to better represent the first target update information. For example, the geometric median is defined as follows: assuming s (s∈S) is a subset of the natural number space, the geometric median of s is calculated using Equation 15:

[0227]

[0228] in, Let represent the geometric median of s; This represents the sum of distances between element v and all elements in s.

[0229] For example, the process of aggregating the geometric median information corresponding to the first target update information based on the first global parameters to obtain the first aggregated parameters of the target model is implemented based on Equation 16:

[0230]

[0231] Where, ω′ t+1 ω represents the first aggregation parameter of the target model. t Denotes the first global parameter of the target model; K represents the total number of the first terminals corresponding to the first target update information; Δω k,t This represents the first target update information generated by the first terminal k; This represents the first target update information Δω generated by the first terminal k. k,t The corresponding geometric median information. For example, when the first global parameter is in matrix form, the geometric median information corresponding to the first target update information is also in matrix form, and the size of the matrix is ​​the same.

[0232] After obtaining the first aggregation parameter, it is determined whether the target model with the first aggregation parameter meets the target termination condition. The target termination condition indicates the conditions that must be met to complete the federated learning task. It should be noted that for supervised federated learning applications, the federated learning task refers to the supervised federated learning task; for semi-supervised federated learning applications, the federated learning task refers to the semi-supervised federated learning task.

[0233] The target termination conditions are set based on experience or can be flexibly adjusted according to the application scenario. For example, the target termination conditions include, but are not limited to, the following four situations: 1. The prediction accuracy of the target model with the first aggregation parameter reaches the accuracy threshold, which is set based on experience or can be flexibly adjusted according to the application scenario; 2. The loss function of the target model with the first aggregation parameter converges; 3. The loss function of the target model with the first aggregation parameter is less than the loss function threshold, which is set based on experience or can be flexibly adjusted according to the application scenario; 4. The number of rounds of the learning process that has been performed when the target model with the first aggregation parameter is obtained reaches the round number threshold, which is set based on experience or can be flexibly adjusted according to the application scenario.

[0234] When the target model with the first aggregation parameter satisfies any of the above conditions, it is determined that the target model with the first aggregation parameter meets the target termination condition. In response to the target model with the first aggregation parameter satisfying the target termination condition, the federated learning task is completed. After completing the federated learning task, the target model with the first aggregation parameter can be used to perform actual processing tasks, such as classification tasks, segmentation tasks, etc.

[0235] In one possible implementation, the target model with the first aggregation parameter may not satisfy the target termination condition. The procedures to be executed differ depending on the application scenario, especially when the target model with the first aggregation parameter may not satisfy the target termination condition.

[0236] In an exemplary embodiment, in a semi-supervised federated learning application scenario, in response to the target model with the first aggregation parameter not satisfying the target termination condition, the following process is executed: the target model with the first aggregation parameter is trained based on a second dataset to obtain the second global parameters of the target model; the second global parameters are sent to a second terminal, which is used to train the target model with the second global parameters based on a first dataset without standard labels, obtain second local update information for updating the second global parameters based on the second local parameters obtained from the training, and return the second local update information; based on the second local update information, second target update information that satisfies the attack defense conditions is obtained; based on the second global parameters and the second target update information, the second aggregation parameter of the target model is obtained; in response to the target model with the second aggregation parameter satisfying the target termination condition, the semi-supervised federated learning task is completed.

[0237] In an exemplary embodiment, in a supervised federated learning application scenario, in response to the target model having the first aggregation parameter not satisfying the target termination condition, the following process is executed: the first aggregation parameter of the target model is used as the second global parameter of the target model; the second global parameter of the target model is sent to a second terminal, which is used to train the target model having the second global parameter based on a first dataset with standard labels, obtain second local update information for updating the second global parameter based on the second local parameter obtained from the training, and return the second local update information; based on the second local update information, second target update information that satisfies the attack defense condition is obtained; based on the second global parameter and the second target update information, the second aggregation parameter of the target model is obtained; in response to the target model having the second aggregation parameter satisfying the target termination condition, the supervised federated learning task is completed.

[0238] The implementation of the process in the case where the target model with the first aggregation parameter may not meet the target termination condition is described in steps 201 to 203, and will not be repeated here. It should be noted that the second terminal may be the same as or different from the first terminal; this embodiment does not limit this. For example, the number of second terminals is the same as the number of first terminals.

[0239] For example, in a semi-supervised federated learning application scenario, the basic process of performing a semi-supervised federated learning task is as follows: Figure 6 As shown. The server trains a target model with reference parameters based on a dataset with standard labels, obtaining global parameters; the global parameters are then sent to the terminal; the terminal trains the target model with global parameters based on a dataset without standard labels, returning local update information; the server uses the local update information to obtain target update information that meets the attack and defense conditions; the server uses the global parameters and target update information to obtain the aggregate parameters of the target model. When the target model with aggregate parameters meets the target termination condition, the trained model is obtained.

[0240] For example, in a semi-supervised federated learning application scenario, the process of executing a semi-supervised federated learning task is implemented based on the following algorithm:

[0241] Input: The labeled dataset D s on the server,the unlabeled dataset D k on the client, the threshold hyperparameters δ and λ, and the cross-entropy loss / / Input: The server's standard-labeled dataset Ds The terminal's unlabeled dataset D k Threshold hyperparameters δ and λ and cross-entropy loss function

[0242] Output: Optimal global modelω * / / Output: Optimized parameters ω *

[0243] 1Server: / / server

[0244] 2. For each round t = 1, 2, ..., T, do / / For the t-th round of learning...

[0245] 3. Train the global model ω t on the labeled dataset D s by using / / Based on cross-entropy loss function Using a dataset D with standard labels s Train the target model to obtain the global parameters ω t

[0246] 4. Broadcast the global modelω t to all the clients; / / Set the global parameter ω t Send to terminal

[0247] 5Client: / / Terminal

[0248] 6 for each client C k ,k∈[1,R]do / / For the k-th terminal

[0249] 7Receive global modelω t / / Receive global parameter ω t

[0250] 8Train the local model,on the local unlabeled dataset D k / / Utilizing a local dataset D without standard labels k Training the local target model

[0251] 9. Use data augmentation methods to generate diverse labeled data; / / Utilize data augmentation methods to obtain diverse data with pseudo-labels.

[0252] 10. Upload the update Δω k,t to the server; / / Update local information Δω k,t Return to server

[0253] 11Server: / / server

[0254] 12 for each round t=1,2,...T do / / For the t-th round of learning process

[0255] 13. Set the threshold hyperparameters; / / Set the threshold hyperparameters

[0256] 14. Utilize minimax optimization strategy to select clients with high-quality updates; / / Use the minimax optimization strategy to select high-quality local updates generated by the client.

[0257] 15. Use Geometric Median Aggregation to aggregate the selected updates; / / Aggregate selected local updates using geometric median aggregation.

[0258] 16Broadcast the global modelω t+1 to all the clients; / / Set the global parameter ω t+1 Send to terminal

[0259] 17returnω * / / Returns the optimized parameter ω *

[0260] Next, taking the application of the federated learning method provided in the embodiments of this application in a semi-supervised federated learning application scenario as an example, we will introduce the experimental setup and related experimental results involved in the embodiments of this application.

[0261] 1. Experimental setup

[0262] In the application embodiments, performance analysis was performed on the MNIST (Mixed National Institute of Standards and Technology Database) dataset and the CIFAR-10 (a color image dataset) dataset. All experiments were implemented using PyTorch (a deep learning framework) and PySyft (a privacy-preserving general-purpose deep learning framework) on the same computing environment (e.g., Linux Ubuntu 18.04, Intel i5-4210M CPU (Central Processing Unit), 16GB RAM (Random Access Memory), and 512GB SSD (Solid State Drives).

[0263] During the experiments, simple deep learning models (e.g., CNNs with two convolutional layers and one fully connected layer) were used for classification tasks on the MNIST dataset, and AlexNet (a type of convolutional neural network) was used for classification tasks on the CIFAR-10 dataset.

[0264] The MNIST dataset is a dataset of handwritten digit images, containing 60,000 training samples and 10,000 test samples. Each image consists of 28×28 pixels, with each pixel represented by a grayscale value, and the standard label is a one-hot encoded 0-9. The CIFAR-10 dataset consists of 60,000 images in total, each of 10 types of 32×32 color images, with 6,000 images in each type. 50,000 images are used as the training dataset, and 10,000 images are used as the test dataset. Pixel values ​​in all images in all datasets are normalized to [0,1], and the standard label is a one-hot encoded 0-9. It should be noted that in the semi-supervised federated learning (SSFL) system, the standard labels of the local dataset are removed from the terminal.

[0265] In the data allocation process, training samples with standard labels are assigned to the server, while training samples without standard labels are assigned to the terminals. For the allocation of iID (Independent and Identically Distributed) data, data without standard labels from multiple classes are evenly distributed to each terminal. For the allocation of non-iID data, data without standard labels is evenly distributed to each terminal, while only two classes of data without standard labels are retained for each terminal. In an exemplary embodiment, in the allocation of non-iID data, the class for each terminal is randomly assigned.

[0266] For example, the total number of terminals is set to 100, the terminal participation ratio is 0.1, the total number of training epochs is 250, the number of local training epochs on each terminal is 5, the learning rate is 0.001, the mini-batch size is 32, and the number of training samples N in the server is... s =10,000. For the symmetric quantization method, the target quantization threshold α = 0.5. For the SSFL setting, the threshold hyperparameter λ = 0.95. Furthermore, SGD (Stochastic Gradient Descent) and mini-batch momentum are used to optimize the model.

[0267] During the experiments, two typical attack methods were identified: label flipping attacks (also known as data poisoning attacks) and Gaussian attacks (also known as model poisoning attacks). For label flipping attacks, the malicious terminal modifies one class of pseudo-labels in the local dataset to another. For example, for the MNIST dataset, the malicious terminal changes all training samples with the pseudo-label "1" to the pseudo-label "7"; for the CIFAR-10 dataset, the malicious terminal changes the pseudo-label "dog" of all training samples to the pseudo-label "cat". For Gaussian attacks, the malicious terminal uploads an untrained Gaussian distribution as local update information to the server. For example, the mean of the untrained Gaussian distribution is the mean of the update information from a normal terminal, and the variance of the untrained Gaussian distribution is 10. Although the malicious terminals use different attack methods, their attack targets are the same. Because terminals in the SSFL system have complete autonomous control over their local datasets and local model updates, both of these attack methods are easy to implement in the SSFL system.

[0268] 2. System performance

[0269] The performance of the semi-supervised federated learning system (SSFL system using GMA aggregation and update information selection scheme) provided in this application embodiment will be compared with other benchmark systems. In the experiments, FL using FedAvg aggregation, FL using FedSGD aggregation, FL using GMA aggregation, SSFL using FedAvg aggregation, and SSFL using FedSGD aggregation are used as benchmark systems. It should be noted that the FL system is based on supervised learning, and these benchmark systems are currently the most common and typical FL and SSFL systems. Furthermore, performance comparison experiments were conducted on both iid and non-iid data in the MNIST and CIFAR-10 datasets.

[0270] The performance of each system was evaluated on both iid and non-iid data in the MNIST and CIFAR-10 datasets, and the evaluation results are shown in Tables 1 and 2. Based on Tables 1 and 2, it can be seen that the performance of the system provided in this embodiment is close to that of the best benchmark system (a supervised learning-based FL system using GMA aggregation) and surpasses the performance of other SSFL systems. Supervised learning-based FL systems rely on rich standard label information to achieve superior performance on the MNIST and CIFAR-10 datasets. However, labeling data is a time-consuming and expensive task in real-world scenarios, making it difficult to deploy supervised learning FL systems. The SSFL system proposed in this embodiment does not rely on rich standard label information, yet its performance is comparable to FL systems. This is because the SSFL system proposed in this embodiment improves system performance by using pseudo-labeling methods and data augmentation methods, especially data augmentation methods, which increase the diversity of data on the terminal, even when the terminal lacks datasets with standard labels.

[0271] Table 1

[0272]

[0273]

[0274] Table 2

[0275]

[0276] Tables 1 and 2 above also illustrate the impact of different aggregation methods on the performance of FL and SSFL systems. Based on the experimental results shown in Tables 1 and 2, it is evident that the system using the GMA aggregation method outperforms similar systems using the FedAvg and FedSGD aggregation methods. The reasons for the higher performance of the system using the GMA aggregation method include, but are not limited to: the FedAvg and FedSGD aggregation methods introduce update noise, thereby impairing system performance; the GMA aggregation method can mitigate the adverse effects of update noise. For example, in this embodiment, an optimized update information selection strategy is designed before using the GMA aggregation method, which helps the system select high-quality update information and further improves system performance.

[0277] 3. System robustness

[0278] During the experiments, the robustness of the system on the MNIST and CIFAR-10 datasets was explored under two typical poisoning attacks (i.e., label flipping attack and Gaussian attack). It was assumed that malicious terminals could collude to launch attacks.

[0279] First, the impact of different quality thresholds δ on the performance of the system proposed in this application embodiment on the MNIST and CIFAR-10 datasets was evaluated. As shown in Table 3, for the MNIST dataset, the system performance is optimal when δ = 0.90. For the CIFAR-10 dataset, the system performance is optimal when δ = 0.85. This is because the model updates generated on different datasets are different, therefore different quality thresholds need to be set for different datasets.

[0280] Table 3

[0281]

[0282] Secondly, during the experiments, the performance of the system proposed in this application embodiment on the MNIST and CIFAR-10 datasets was evaluated under label-flipping attacks. Figure 7 (a) and Figure 7 (b) shows a performance comparison of the SSFL system with and without an update information selection scheme under label-flipping attacks on both iid and non-iid data in the MNIST dataset. Figure 7 (c) and Figure 7 (d) shows a performance comparison of the SSFL system with and without an update information selection scheme under label flipping attacks on iid and non-iid data in the CIFAR-10 dataset.

[0283] according to Figure 7 (a) to Figure 7 (d) It can be seen that the SSFL system without an update information selection scheme is susceptible to label flip attacks and becomes unstable or even fails to converge in scenarios with non-iid data. Conversely, the SSFL system with an update information selection scheme mitigates the adverse effects of label flip attacks by selecting high-quality update information, effectively defending against them while maintaining good system performance. In the designed update information selection scheme, the server selects update information returned by normal terminals by comparing the cosine similarity and distribution distance between terminal updates and its own updates. This prevents update information returned by malicious terminals from participating in SSFL training.

[0284] Furthermore, the performance of the system proposed in this application embodiment under Gaussian attack was evaluated on the MNIST and CIFAR-10 datasets. Under Gaussian attack, malicious terminals collude to launch a model poisoning attack. Exemplarily, malicious terminals conspire to use the average of the update information from normal terminals as the average value of the Gaussian attack to poison the global model. Figure 8 (a) and Figure 8 (b) shows a performance comparison of the SSFL system with and without an update information selection scheme under Gaussian attacks on both iid and non-iid data in the MNIST dataset. Figure 8 (c) and Figure 8 (d) shows a performance comparison of the SSFL system with and without an update information selection scheme under Gaussian attacks on both iid and non-iid data in the CIFAR-10 dataset. Figure 8 (a) to Figure 8 (d) It can be seen that the update information selection scheme designed in the embodiments of this application can help the system maintain accuracy and convergence in the presence of Gaussian attacks. Through the analysis of... Figure 7 The experimental results shown and Figure 8 Analysis of the experimental results shows that, compared with label flipping attacks (i.e., data poisoning attacks), Gaussian attacks (i.e., model poisoning attacks) have a stronger global model poisoning capability.

[0285] 4. System communication efficiency

[0286] During the experiments, the impact of quantization levels in the symmetric quantization method on system communication efficiency and system performance was explored. For example, a quantization level of r=32 was set as the baseline scheme. A CNN model was used as a local model on the MNSIT dataset, and an AlexNet model was used as a local model on the CIFAR-10 dataset.

[0287] Table 4

[0288]

[0289] First, the relationship between different quantization levels and the amount of update information data is summarized in Table 4. Table 4 shows that the amount of update information data is directly proportional to the quantization level. Communication overhead can be reduced by decreasing the amount of update information data in each round of terminal-server interaction.

[0290] Secondly, the performance of the system proposed in this application's embodiments on the MNIST and CIFAR-10 datasets was evaluated at different quantization levels. Figure 9 (a) and Figure 9 (b) illustrates a performance comparison of the proposed system at quantization levels r=32, r=16, and r=8 on both iid and non-iid data in the MNIST dataset. Figure 9 (c) and Figure 9Section (d) demonstrates a performance comparison of the proposed system at quantization levels r=32, r=16, and r=8 on both iid and non-iid data in the CIFAR-10 dataset. In the experiments, quantization level r=32 was used as the baseline. Systems at quantization levels r=16 and r=8, relative to quantization level r=32, refer to systems using a symmetric quantization scheme.

[0291] according to Figure 9 (a) to Figure 9 (d) shows that the convergence speed of the system using a symmetric quantization scheme (i.e., r = 16 or r = 8 bits) is close to that of the system without a symmetric quantization scheme (i.e., r = 32 bits). For example, in the non-iid data of the MNIST dataset, both the system using the r = 8 symmetric quantization scheme and the system using the baseline scheme reached convergence during the 200th training round. Compared to r = 32 bits, when r = 8 bits, the communication overhead per training round can be reduced by a factor of 4. Figure 9 The results show that the symmetric quantization scheme designed in this embodiment does not affect the system's performance and convergence. In other words, the symmetric quantization scheme can not only improve communication efficiency by 2 to 4 times, but also maintain system performance.

[0292] Applying the federated learning method provided in this application to semi-supervised federated learning scenarios can provide a novel, robust, and communication-efficient semi-supervised federated learning system (referred to as the RC-SSFL system) to handle real-world scenarios where terminals lack standardized labeled data. Addressing the inherent challenges of communication overhead and poisoning attacks affecting system performance, the RC-SSFL system offers the following features: 1. The RC-SSFL system implements an update information selection scheme based on a minimax optimization strategy to select high-quality update information for aggregation, thereby reducing the impact of poisoning attacks. 2. The RC-SSFL system utilizes the Geometric Median Aggregation (GMA) algorithm to achieve robust update information aggregation. 3. The RC-SSFL system employs a novel symmetric quantization scheme to significantly reduce communication overhead.

[0293] In this embodiment, the attack problem in the federated learning process is considered. First, target update information that meets the attack defense conditions is obtained based on the local update information returned by the terminal. Then, the aggregation parameters are obtained using the target update information that meets the attack defense conditions. In this process, update information that does not meet the attack defense conditions will not participate in the process of obtaining aggregation parameters. This allows the process of obtaining aggregation parameters to resist attacks from malicious terminals to a certain extent, which helps improve the security and reliability of federated learning, and thus improves the performance of the model obtained by federated learning.

[0294] See Figure 10 This application provides a federated learning device, which includes:

[0295] The sending unit 1001 is used to send the first global parameters of the target model to the first terminal. The first terminal is used to train the target model with the first global parameters based on the first dataset, obtain the first local update information for updating the first global parameters based on the first local parameters obtained by training, and return the first local update information.

[0296] The first acquisition unit 1002 is used to acquire the first target update information that meets the attack defense conditions based on the first local update information;

[0297] The second acquisition unit 1003 is used to acquire the first aggregate parameters of the target model based on the first global parameters and the first target update information; and to complete the federated learning task in response to the target model with the first aggregate parameters satisfying the target termination condition.

[0298] In one possible implementation, the first local update information is unquantified update information determined based on the first local parameters and the first global parameters; the first acquisition unit 1002 is used to acquire the target quality index corresponding to the first local update information, and the target quality index corresponding to the first local update information is used to measure the credibility of the first local update information as non-attack update information; the first local update information corresponding to the target quality index that meets the reference conditions is used as candidate update information, and the first target update information that meets the attack defense conditions is acquired based on the candidate update information.

[0299] In one possible implementation, the number of candidate update information is at least two. The first acquisition unit 1002 is further configured to: determine at least two candidate update information groups based on the at least two candidate update information, wherein each candidate update information group includes at least one candidate update information; determine the parameter change index corresponding to each candidate update information group based on the first global parameter and the first local parameter corresponding to each candidate update information included in each candidate update information group; determine the first update information group corresponding to the parameter change index that satisfies the first condition among the at least two candidate update information groups based on the parameter change index corresponding to each of the at least two candidate update information groups; and determine the target update information group in the first update information group, and use each candidate update information included in the target update information group as the first target update information that satisfies the attack defense condition.

[0300] In one possible implementation, the number of first update information groups is at least two. The first acquisition unit 1002 is further configured to take the sum of the target quality indicators corresponding to each candidate update information included in any first update information group as the summary quality indicator corresponding to any first update information group; based on the summary quality indicators corresponding to the at least two first update information groups respectively, determine the second update information group corresponding to the summary quality indicator that satisfies the second condition among the at least two first update information groups; and determine the target update information group among the second update information groups.

[0301] In one possible implementation, the target quality index corresponding to the first local update information includes a first quality index. The first acquisition unit 1002 is further used to summarize all local update information historically returned by the first terminal that returned the first local update information to obtain the first summarized update information corresponding to the first local update information; acquire the second summarized update information corresponding to the first global parameter, the second summarized update information being used to indicate the server's update status of the target model; and determine the first quality index corresponding to the first local update information based on the similarity between the first summarized update information and the second summarized update information, the first quality index being used to measure the credibility of the first local update information as non-attack update information from the perspective of the similarity between the summarized update information.

[0302] In one possible implementation, the target quality index corresponding to the first local update information includes a second quality index; the first acquisition unit 1002 is further configured to determine the second quality index corresponding to the first local update information based on the distribution distance between the first local parameters and the first global parameters corresponding to the first local update information, and the second quality index is used to measure the credibility of the first local update information as non-attack update information from the perspective of the distribution distance between parameters.

[0303] In one possible implementation, the first local update information is the update information obtained by the first terminal quantizing the original update information using a target quantization threshold and a target quantization level. The original update information is the unquantized update information determined based on the first local parameters and the first global parameters. The target quantization threshold is used to ensure that the dequantized information of the first local update information satisfies the symmetry condition with the original update information. The first terminal is also used to return the target quantization threshold and the target quantization level. The first acquisition unit 1002 is also used to dequantize the first local update information based on the target quantization threshold and the target quantization level to obtain the dequantized information of the first local update information. From the dequantized information of the first local update information, the first target update information that satisfies the attack defense condition is selected.

[0304] In one possible implementation, the second acquisition unit 1003 is used to acquire the geometric median information corresponding to the first target update information; based on the first global parameters, the geometric median information corresponding to the first target update information is aggregated to obtain the first aggregated parameters of the target model.

[0305] In one possible implementation, the federated learning task is a semi-supervised federated learning task, where the first dataset is an unlabeled dataset, and the server has a second labeled dataset for training the target model; see also Figure 11 The device also includes:

[0306] Training unit 1004 is used to train the target model with reference parameters based on the second dataset to obtain the first global parameters of the target model.

[0307] In one possible implementation, training unit 1004 is used to perform data augmentation on the second dataset to obtain an augmented dataset, which includes augmented samples and corresponding standard labels; calling a target model with reference parameters to obtain the prediction results corresponding to the augmented samples; obtaining a target loss function based on the prediction results and standard labels corresponding to the augmented samples; updating the reference parameters using the target loss function to obtain updated parameters; and obtaining the first global parameters of the target model based on the updated parameters.

[0308] In one possible implementation, the training unit 1004 is further configured to train the target model with the first aggregation parameter based on the second dataset in response to the target model having the first aggregation parameter not satisfying the target termination condition, thereby obtaining the second global parameters of the target model.

[0309] The sending unit 1001 is also used to send the second global parameters of the target model to the second terminal. The second terminal is used to train the target model with the second global parameters based on the first dataset without standard labels, obtain the second local update information for updating the second global parameters based on the second local parameters obtained by training, and return the second local update information.

[0310] The first acquisition unit 1002 is also used to acquire second target update information that meets the attack defense conditions based on the second local update information;

[0311] The second acquisition unit 1003 is further configured to acquire the second aggregate parameters of the target model based on the second global parameters and the second target update information; and to complete the semi-supervised federated learning task in response to the target model having the second aggregate parameters satisfying the target termination condition.

[0312] In this embodiment, the attack problem in the federated learning process is considered. First, target update information that meets the attack defense conditions is obtained based on the local update information returned by the terminal. Then, the aggregation parameters are obtained using the target update information that meets the attack defense conditions. In this process, update information that does not meet the attack defense conditions will not participate in the process of obtaining aggregation parameters. This allows the process of obtaining aggregation parameters to resist attacks from malicious terminals to a certain extent, which helps improve the security and reliability of federated learning, and thus improves the performance of the model obtained by federated learning.

[0313] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0314] Figure 12 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. The terminal can be a smartphone, tablet computer, laptop computer, or desktop computer. The terminal may also be referred to as user equipment, portable terminal, laptop terminal, desktop terminal, or other names.

[0315] Typically, a terminal includes a processor 1201 and a memory 1202.

[0316] Processor 1201 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1201 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 1201 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1201 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 1201 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0317] The memory 1202 may include one or more computer-readable storage media, which may be non-transitory. The memory 1202 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1202 are used to store at least one instruction, which is executed by the processor 1201 to implement the federated learning method provided in the method embodiments of this application.

[0318] In some embodiments, the terminal may also optionally include: a peripheral device interface 1203 and at least one peripheral device. The processor 1201, memory 1202, and peripheral device interface 1203 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 1203 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of: a radio frequency circuit 1204, a display screen 1205, a camera assembly 1206, an audio circuit 1207, and a power supply 1209.

[0319] Peripheral device interface 1203 can be used to connect at least one I / O (Input / Output) related peripheral device to processor 1201 and memory 1202. In some embodiments, processor 1201, memory 1202 and peripheral device interface 1203 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 1201, memory 1202 and peripheral device interface 1203 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0320] The radio frequency (RF) circuit 1204 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 1204 communicates with communication networks and other communication devices via electromagnetic signals. The RF circuit 1204 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals back into electrical signals. Optionally, the RF circuit 1204 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The RF circuit 1204 can communicate with other terminals via at least one wireless communication protocol. This wireless communication protocol includes, but is not limited to: metropolitan area networks (MANs), various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks (WLANs), and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF circuit 1204 may also include circuitry related to NFC (Near Field Communication), which is not limited in this application.

[0321] Display screen 1205 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, and any combination thereof. When display screen 1205 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 1201 for processing. In this case, display screen 1205 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, display screen 1205 can be a single screen, located on the front panel of the terminal; in other embodiments, display screen 1205 can be at least two screens, respectively located on different surfaces of the terminal or in a folded design; in other embodiments, display screen 1205 can be a flexible display screen, located on a curved or folded surface of the terminal. Furthermore, display screen 1205 can be configured as a non-rectangular, irregular shape, i.e., a non-rectangular screen. Display screen 1205 can be made of materials such as LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0322] The camera assembly 1206 is used to acquire images or videos. Optionally, the camera assembly 1206 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the terminal, and the rear-facing camera is located on the back of the terminal. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions. In some embodiments, the camera assembly 1206 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm-light flash and a cool-light flash, which can be used for light compensation at different color temperatures.

[0323] The audio circuit 1207 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, converting the sound waves into electrical signals that are input to the processor 1201 for processing, or input to the radio frequency circuit 1204 to achieve voice communication. For stereo sound acquisition or noise reduction purposes, multiple microphones may be used, each positioned at a different location on the terminal. The microphone may also be an array microphone or an omnidirectional microphone. The speaker is used to convert electrical signals from the processor 1201 or the radio frequency circuit 1204 into sound waves. The speaker may be a conventional diaphragm speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can convert electrical signals not only into audible sound waves but also into inaudible sound waves for purposes such as distance measurement. In some embodiments, the audio circuit 1207 may also include a headphone jack.

[0324] The power supply 1209 is used to power the various components in the terminal. The power supply 1209 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When the power supply 1209 includes a rechargeable battery, the rechargeable battery can support wired or wireless charging. The rechargeable battery can also be used to support fast charging technology.

[0325] In some embodiments, the terminal further includes one or more sensors 1210. The one or more sensors 1210 include, but are not limited to: an acceleration sensor 1211, a gyroscope sensor 1212, a pressure sensor 1213, an optical sensor 1215, and a proximity sensor 1216.

[0326] Accelerometer 1211 can detect the magnitude of acceleration along the three coordinate axes of a coordinate system established by the terminal. For example, accelerometer 1211 can be used to detect the components of gravitational acceleration along the three coordinate axes. Processor 1201 can control display screen 1205 to display the user interface in either a landscape or portrait view based on the gravitational acceleration signal acquired by accelerometer 1211. Accelerometer 1211 can also be used for games or for acquiring user motion data.

[0327] The gyroscope sensor 1212 can detect the terminal's orientation and rotation angle. The gyroscope sensor 1212 can work in conjunction with the accelerometer sensor 1211 to collect the user's 3D movements on the terminal. Based on the data collected by the gyroscope sensor 1212, the processor 1201 can perform the following functions: motion sensing (e.g., changing the UI based on the user's tilt), image stabilization during shooting, game control, and inertial navigation.

[0328] The pressure sensor 1213 can be disposed on the side bezel of the terminal and / or the lower layer of the display screen 1205. When the pressure sensor 1213 is disposed on the side bezel of the terminal, it can detect the user's grip signal on the terminal, and the processor 1201 can perform left / right hand recognition or quick operation based on the grip signal collected by the pressure sensor 1213. When the pressure sensor 1213 is disposed on the lower layer of the display screen 1205, the processor 1201 can control the operable controls on the UI interface based on the user's pressure operation on the display screen 1205. The operable controls include at least one of button controls, scroll bar controls, icon controls, and menu controls.

[0329] The optical sensor 1215 is used to collect ambient light intensity. In one embodiment, the processor 1201 can control the display brightness of the display screen 1205 based on the ambient light intensity collected by the optical sensor 1215. Specifically, when the ambient light intensity is high, the display brightness of the display screen 1205 is increased; when the ambient light intensity is low, the display brightness of the display screen 1205 is decreased. In another embodiment, the processor 1201 can also dynamically adjust the shooting parameters of the camera assembly 1206 based on the ambient light intensity collected by the optical sensor 1215.

[0330] The proximity sensor 1216, also known as a distance sensor, is typically installed on the front panel of the terminal. The proximity sensor 1216 is used to detect the distance between the user and the front of the terminal. In one embodiment, when the proximity sensor 1216 detects that the distance between the user and the front of the terminal is gradually decreasing, the processor 1201 controls the display screen 1205 to switch from a screen-on state to a screen-off state; when the proximity sensor 1216 detects that the distance between the user and the front of the terminal is gradually increasing, the processor 1201 controls the display screen 1205 to switch from a screen-off state to a screen-on state.

[0331] Those skilled in the art will understand that Figure 12 The structure shown does not constitute a limitation on the terminal and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0332] Figure 13This is a schematic diagram of a server structure provided in an embodiment of this application. The server can vary significantly due to differences in configuration or performance. It may include one or more Central Processing Units (CPUs) 1301 and one or more memories 1302. The one or more memories 1302 store at least one computer program, which is loaded and executed by the one or more processors 1301 to implement the federated learning method provided in the various method embodiments described above. Of course, the server may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input and output. The server may also include other components for implementing device functions, which will not be elaborated upon here.

[0333] In an exemplary embodiment, a computer device is also provided, comprising a processor and a memory storing at least one computer program. The at least one computer program is loaded and executed by one or more processors to implement any of the federated learning methods described above.

[0334] In an exemplary embodiment, a computer-readable storage medium is also provided, which stores at least one computer program that is loaded and executed by a processor of a computer device to implement any of the federated learning methods described above.

[0335] In one possible implementation, the aforementioned computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device, etc.

[0336] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the above-described federated learning methods.

[0337] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the above exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0338] It should be understood that "multiple" as used in this article refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0339] The above description is merely an exemplary embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A federated learning method, characterized in that, The method is applied to a server, and the method comprises: sending a first global parameter of a target model to a first terminal, the first terminal being configured to train the target model with the first global parameter based on a first data set, obtain first local update information for updating the first global parameter based on a first local parameter obtained through the training, and return the first local update information; in a case where the first local update information is unquantized update information determined based on the first local parameter and the first global parameter, obtaining a target quality index corresponding to the first local update information, the target quality index corresponding to the first local update information being used to measure a degree of credibility of the first local update information being non-attack update information; taking, as candidate update information, the first local update information corresponding to a target quality index that meets a reference condition, and obtaining first target update information that meets an attack defense condition based on the candidate update information; obtaining a first aggregated parameter of the target model based on the first global parameter and the first target update information, and completing a federated learning task in response to the target model with the first aggregated parameter meeting a target termination condition.

2. The method of claim 1, wherein, The number of the candidate update information is at least two, and the obtaining of the first target update information that meets the attack defense condition based on the candidate update information comprises: determining at least two candidate update information groups based on the at least two candidate update information, any candidate update information group including at least one candidate update information; determining a parameter change index corresponding to any candidate update information group based on the first global parameter and a first local parameter corresponding to each candidate update information included in the candidate update information group; determining, among the at least two candidate update information groups, a first update information group corresponding to a parameter change index that meets a first condition based on the parameter change index corresponding to each candidate update information group; determining a target update information group in the first update information group, and taking each candidate update information included in the target update information group as the first target update information that meets the attack defense condition.

3. The method of claim 2, wherein, The number of the first update information group is at least two, and the determining of a target update information group in the first update information group comprises: taking a sum of target quality indexes corresponding to each candidate update information included in any first update information group as an aggregated quality index corresponding to the first update information group; determining, among the at least two first update information groups, a second update information group corresponding to an aggregated quality index that meets a second condition based on the aggregated quality index corresponding to each first update information group; determining a target update information group in the second update information group.

4. The method according to any of claims 1 to 3, characterized in that, The target quality index corresponding to the first local update information comprises a first quality index, and the obtaining of the target quality index corresponding to the first local update information comprises: aggregating all local update information historically returned by the first terminal that returns the first local update information to obtain first aggregated update information corresponding to the first local update information; and obtaining second summary update information corresponding to the first global parameter, the second summary update information being used to indicate an update situation of the target model by the server; determining a first quality index corresponding to the first local update information based on a similarity between the first summary update information and the second summary update information, the first quality index being used to measure a credibility of the first local update information as non-attack update information from the perspective of the similarity between the summary update information.

5. The method according to any of claims 1 to 3, characterized in that The target quality index corresponding to the first local update information includes a second quality index; and the obtaining of the target quality index corresponding to the first local update information includes: determining a second quality index corresponding to the first local update information based on a distribution distance between the first local parameter corresponding to the first local update information and the first global parameter, the second quality index being used to measure the credibility of the first local update information as non-attack update information from the perspective of the distribution distance between the parameters.

6. The method of claim 1, wherein, The method further includes: in a case where the first local update information is update information obtained by quantizing original update information by a target quantization threshold and a target quantization level by the first terminal, dequantizing the first local update information based on the target quantization threshold and the target quantization level to obtain dequantized information of the first local update information; selecting first target update information satisfying an attack defense condition from the dequantized information of the first local update information; wherein the original update information is unquantized update information determined based on the first local parameter and the first global parameter, the target quantization threshold is used to ensure that the dequantized information of the first local update information and the original update information satisfy a symmetry condition; and the first terminal is further configured to return the target quantization threshold and the target quantization level.

7. The method according to any of claims 1 to 3, 6, characterized in that, The obtaining of the first aggregated parameter of the target model based on the first global parameter and the first target update information includes: obtaining geometric median information corresponding to the first target update information; aggregating the geometric median information corresponding to the first target update information based on the first global parameter to obtain the first aggregated parameter of the target model.

8. The method according to any of claims 1 to 3, 6, characterized in that, The federated learning task is a semi-supervised federated learning task, the first data set is a data set without standard labels, and the server has a second data set with standard labels for training the target model; Before the first global parameter of the target model is sent to the first terminal, the method further includes: training the target model with reference parameters based on the second data set to obtain the first global parameter of the target model.

9. The method of claim 8, wherein, The training of the target model with reference parameters based on the second data set to obtain the first global parameter of the target model includes: performing data enhancement processing on the second data set to obtain an enhanced data set, the enhanced data set including enhanced samples, the enhanced samples corresponding to standard labels; calling the target model with the reference parameters to obtain a prediction result corresponding to the enhanced samples; and obtain a target loss function based on the prediction result corresponding to the augmented sample and the standard label corresponding to the augmented sample; update the reference parameter by using the target loss function to obtain an updated parameter, and obtain a first global parameter of the target model based on the updated parameter.

10. The method of claim 8, wherein, After obtaining the first aggregated parameter of the target model, the method further comprises: in response to the target model with the first aggregated parameter not satisfying the target termination condition, training the target model with the first aggregated parameter based on the second data set to obtain a second global parameter of the target model; sending the second global parameter of the target model to a second terminal, the second terminal being configured to train the target model with the second global parameter based on the first data set without a standard label, obtain second local update information for updating the second global parameter based on a second local parameter obtained through training, and return the second local update information; obtaining second target update information satisfying an attack defense condition based on the second local update information; obtaining a second aggregated parameter of the target model based on the second global parameter and the second target update information, and completing the semi-supervised federated learning task in response to the target model with the second aggregated parameter satisfying the target termination condition.

11. A federated learning apparatus, comprising: The device is applied to a server, and the device comprises: a sending unit configured to send a first global parameter of a target model to a first terminal, the first terminal being configured to train the target model with the first global parameter based on a first data set, obtain first local update information for updating the first global parameter based on a first local parameter obtained through training, and return the first local update information; a first obtaining unit configured to, in a case where the first local update information is unquantized update information determined based on the first local parameter and the first global parameter, obtain a target quality indicator corresponding to the first local update information, the target quality indicator corresponding to the first local update information being used to measure a credibility of the first local update information being non-attack update information, and take first local update information corresponding to a target quality indicator satisfying a reference condition as candidate update information, and obtain first target update information satisfying an attack defense condition based on the candidate update information; a second obtaining unit configured to obtain a first aggregated parameter of the target model based on the first global parameter and the first target update information, and complete a federated learning task in response to the target model with the first aggregated parameter satisfying a target termination condition.

12. The apparatus of claim 11, wherein, The number of candidate update information is at least two, and the first obtaining unit is configured to determine at least two candidate update information groups based on the at least two candidate update information, any candidate update information group including at least one candidate update information. determine a parameter change indicator corresponding to any candidate update information group based on the first global parameter and the first local parameter corresponding to each candidate update information included in the any candidate update information group; determine a first update information group corresponding to a parameter change indicator satisfying a first condition in the at least two candidate update information groups based on the parameter change indicators respectively corresponding to the at least two candidate update information groups; and determine a target update information group in the first update information group, and take each candidate update information included in the target update information group as the first target update information satisfying the attack defense condition.

13. The apparatus of claim 12, wherein, The number of the first update information groups is at least two, and the first obtaining unit is configured to take a sum of target quality indicators corresponding to each candidate update information included in any first update information group as a summary quality indicator corresponding to the any first update information group. determine a second update information group corresponding to a summary quality indicator satisfying a second condition in the at least two first update information groups based on the summary quality indicators respectively corresponding to the at least two first update information groups; and determine a target update information group in the second update information group.

14. The apparatus of any of claims 11-13, wherein, The target quality indicator corresponding to the first local update information includes a first quality indicator, and the first obtaining unit is configured to summarize all local update information returned by a first terminal returning the first local update information to obtain first summary update information corresponding to the first local update information. obtain second summary update information corresponding to the first global parameter, the second summary update information being used to indicate an update situation of the target model by the server; and determine a first quality indicator corresponding to the first local update information based on a similarity between the first summary update information and the second summary update information, the first quality indicator being used to measure a credibility of the first local update information being non-attack update information from the perspective of the similarity between the summary update information.

15. The apparatus of any of claims 11-13, wherein, The target quality indicator corresponding to the first local update information includes a second quality indicator, and the first obtaining unit is configured to determine the second quality indicator corresponding to the first local update information based on a distribution distance between the first local parameter corresponding to the first local update information and the first global parameter, the second quality indicator being used to measure the credibility of the first local update information being non-attack update information from the perspective of the distribution distance between the parameters.

16. The apparatus of claim 11, wherein, The first obtaining unit is further configured to, in a case where the first local update information is update information obtained by quantizing original update information using a target quantization threshold and a target quantization level, dequantize the first local update information based on the target quantization threshold and the target quantization level to obtain dequantized information of the first local update information; and select first target update information that satisfies an attack defense condition from the dequantized information of the first local update information; wherein the original update information is unquantized update information determined based on the first local parameter and the first global parameter, and the target quantization threshold is used to ensure that the dequantized information of the first local update information and the original update information satisfy a symmetry condition; and the first terminal is further configured to return the target quantization threshold and the target quantization level.

17. The apparatus of any of claims 11-13, 16, wherein, The second obtaining unit is configured to obtain geometric median information corresponding to the first target update information; and aggregate the geometric median information corresponding to the first target update information based on the first global parameter to obtain a first aggregated parameter of the target model.

18. The apparatus of any of claims 11-13, 16, wherein, The federated learning task is a semi-supervised federated learning task, the first data set is a data set without standard labels, and the server has a second data set with standard labels for training the target model; and the apparatus further includes: A training unit configured to train the target model with a reference parameter based on the second data set to obtain a first global parameter of the target model.

19. The apparatus of claim 18, wherein, The training unit is configured to perform data enhancement processing on the second data set to obtain an enhanced data set, the enhanced data set including enhanced samples, and the enhanced samples corresponding to standard labels. The target model with the reference parameter is called to obtain a prediction result corresponding to the enhanced samples. A target loss function is obtained based on the prediction result corresponding to the enhanced samples and the standard labels corresponding to the enhanced samples; the reference parameter is updated using the target loss function to obtain an updated parameter; and the first global parameter of the target model is obtained based on the updated parameter.

20. The apparatus of claim 18, wherein, The training unit is further configured to, in response to the target model with the first aggregated parameter not satisfying the target termination condition, train the target model with the first aggregated parameter based on the second data set to obtain a second global parameter of the target model. The sending unit is further configured to send the second global parameter of the target model to a second terminal, and the second terminal is configured to train the target model with the second global parameter based on the first data set without standard labels, obtain second local update information for updating the second global parameter based on second local parameters obtained through training, and return the second local update information. The first obtaining unit is further configured to obtain second target update information that satisfies an attack defense condition based on the second local update information. The first obtaining unit is further configured to obtain second target update information that satisfies an attack defense condition based on the second local update information. The second obtaining unit is further configured to obtain a second aggregated parameter of the target model based on the second global parameter and the second target update information; and complete the semi-supervised federated learning task in response to the target model with the second aggregated parameter satisfying the target termination condition.

21. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores at least one computer program, which is loaded and executed by the processor to implement the federated learning method according to any one of claims 1 to 10.

22. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one computer program, which is loaded and executed by the processor to implement the federated learning method according to any one of claims 1 to 10.

23. A computer program product, characterised in that, The computer program product comprises computer instructions stored in a computer readable storage medium, and a processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the federated learning method according to any one of claims 1 to 10.

Images