A federated learning secure aggregation method, device and electronic equipment

Abstract

The application provides a federated learning security aggregation method and device and electronic equipment, the method comprising: obtaining model parameter update information of all users participating in federated learning for a current sample category; updating the model parameters of a preset global model according to the model parameter update information to obtain a new global model corresponding to each user; extracting a test sample corresponding to the current sample category from a preset test set and inputting the test sample into the new global model to obtain a neuron average activation value corresponding to each new global model; determining a user clustering result according to the neuron average activation value corresponding to each new global model; and determining a malicious user currently participating in federated learning according to the user clustering result. By determining a malicious user according to the model neuron activation of different users for a certain sample category, the identity of a user participating in federated learning is verified, and the reliability of the aggregation result of federated learning is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a federated learning security aggregation method and device and electronic equipment. BACKGROUND

[0002] Federated learning can solve the problem of updating the model locally by the user of the Android mobile phone. The goal of federated learning is to realize common modeling and improve the effect of the model on the basis of ensuring data privacy security and legal compliance. The essence is a kind of distributed machine learning technology.

[0003] However, in actual application, a malicious user may steal some training data of other users through a GAN attack, which reduces the reliability of the federated learning aggregation result. SUMMARY

[0004] The present application provides a federated learning security aggregation method, device and electronic equipment to solve the defects that the prior art reduces the reliability of the federated learning aggregation result.

[0005] The first aspect of the present application provides a federated learning security aggregation method, comprising:

[0006] Obtaining model parameter update information of all users participating in federated learning for a current sample category;

[0007] According to the model parameter update information, updating the model parameters of a preset global model to obtain a new global model corresponding to each user;

[0008] Extracting a test sample corresponding to the current sample category from a preset test set, and inputting the test sample into the new global model to obtain a neuron average activation value corresponding to each new global model;

[0009] According to the neuron average activation value corresponding to each new global model, determining a user clustering result;

[0010] According to the user clustering result, determining a malicious user currently participating in federated learning.

[0011] Optionally, the method further comprises:

[0012] According to the generation order of the neuron average activation value corresponding to each new global model, constructing the neuron average activation value into time series data corresponding to different users;

[0013] According to the similarity between the time series data corresponding to each user, determining a clustering centroid of different categories;

[0014] Determine the user clustering result according to the similarity between the time series data of other users and the cluster centroids.

[0015] Optionally, the method further comprises:

[0016] According to the number of users contained in each category in the clustering result, determine the category containing the least number of users as an abnormal category.

[0017] Determine the users in the abnormal category as malicious users currently participating in federated learning.

[0018] Optionally, the method further comprises:

[0019] Monitor the model training results of all users participating in federated learning for the current sample category, wherein the model training results include the intersection of neurons of the current local model of each user and the current sample category.

[0020] Determine whether the model training results obtained by each user are the same.

[0021] If not, determine the malicious users currently participating in federated learning according to the distribution of the model training results obtained by each user.

[0022] Optionally, the method further comprises:

[0023] When the model training results obtained by each user are the same, execute the step of obtaining the model parameter update information of all users participating in federated learning for the current sample category.

[0024] Optionally, the method further comprises:

[0025] Determine the distribution proportion of each model training result according to the distribution of the model training results obtained by each user.

[0026] Determine the user corresponding to the model training result with the smallest distribution proportion as the malicious user currently participating in federated learning.

[0027] Optionally, the method further comprises:

[0028] Add the currently determined malicious user to a malicious user list.

[0029] When the number of times a user is added accumulatively reaches a preset threshold, remove the user so that the user cannot participate in subsequent federated learning.

[0030] The second aspect of the application provides a federated learning security aggregation device, comprising:

[0031] an acquisition module, configured to acquire model parameter update information of all users participating in federated learning for a current sample category;

[0032] an update module, configured to update a preset global model in model parameters according to the model parameter update information, to obtain a new global model corresponding to each user;

[0033] a test module, configured to extract a test sample corresponding to the current sample category from a preset test set, and input the test sample into the new global model to obtain a neuron average activation value corresponding to each new global model;

[0034] a clustering module, configured to determine a user clustering result according to the neuron average activation value corresponding to each new global model;

[0035] an aggregation module, configured to determine a malicious user currently participating in federated learning according to the user clustering result.

[0036] Optionally, the clustering module is specifically configured to:

[0037] construct the neuron average activation value into time series data corresponding to different users according to a generation order of the neuron average activation value corresponding to each new global model;

[0038] determine clustering centroids of different categories according to a similarity between the time series data corresponding to each user;

[0039] determine a user clustering result according to a similarity between time series data of other users and each clustering centroid.

[0040] Optionally, the aggregation module is specifically configured to:

[0041] determine a category containing the least number of users as an abnormal category according to a number of users contained in each category in the clustering result;

[0042] determine a user in the abnormal category as a malicious user currently participating in federated learning.

[0043] Optionally, the device further comprises:

[0044] The monitoring module is configured to monitor model training results of all users participating in federated learning for a current sample category, wherein the model training results include intersections of neurons of current local models of the users and the current sample category; determine whether the model training results of the users are the same; and if not, determine a malicious user currently participating in federated learning according to a distribution of the model training results of the users.

[0045] Optionally, the monitoring module is further configured to:

[0046] The step of obtaining model parameter update information of all users participating in federated learning for the current sample category is performed when the model training results of the users are the same.

[0047] Optionally, the monitoring module is specifically configured to:

[0048] determine a distribution proportion of the model training results according to the distribution of the model training results of the users;

[0049] determine a user corresponding to the model training result with the smallest distribution proportion as the malicious user currently participating in federated learning.

[0050] Optionally, the aggregation module is further configured to:

[0051] add the malicious user currently determined to a malicious user list.

[0052] When a number of times of adding of any user accumulatively reaches a preset threshold, the user is removed so that the user cannot participate in subsequent federated learning.

[0053] The third aspect of the present application provides an electronic device, comprising at least one processor and a memory.

[0054] The memory stores computer execution instructions.

[0055] The at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the method according to the first aspect and various possible designs of the first aspect.

[0056] The fourth aspect of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and when a processor executes the computer execution instructions, the method according to the first aspect and various possible designs of the first aspect is implemented.

[0057] The technical solution of the present application has the following advantages:

[0058] The application provides a federated learning security aggregation method, device and electronic equipment, the method comprising: obtaining model parameter update information of all users participating in federated learning for a current sample category; updating the model parameters of a preset global model according to the model parameter update information to obtain a new global model corresponding to each user; extracting a test sample corresponding to the current sample category from a preset test set and inputting the test sample into the new global model to obtain a neuron average activation value corresponding to each new global model; determining a user clustering result according to the neuron average activation value corresponding to each new global model; and determining a malicious user currently participating in federated learning according to the user clustering result. The above scheme provides a result, which determines a malicious user according to the model neuron activation of different users for a certain sample category, realizes verification of the identity of a federated learning participating user, and improves the reliability of a federated learning aggregation result. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0060] Figure 1 Structure diagram of a federated learning security aggregation system based on the embodiments of the present application;

[0061] Figure 2 Flow diagram of a federated learning security aggregation method provided by the embodiments of the present application;

[0062] Figure 3 Flow diagram of an exemplary federated learning security aggregation method provided by the embodiments of the present application;

[0063] Figure 4 Structure diagram of a federated learning security aggregation device provided by the embodiments of the present application;

[0064] Figure 5 Structure diagram of an electronic equipment provided by the embodiments of the present application.

[0065] The above drawings have shown the specific embodiments of the present application, and will be described in more detail hereinafter. These drawings and textual descriptions are not intended to limit the scope of the present disclosure concept by any means, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0066] In order to make the purposes, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0067] In addition, the terms "first", "second", and the like are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. In the description of the following embodiments, the meaning of "a plurality of" is two or more, unless otherwise explicitly and specifically limited.

[0068] In actual application, the federal learning may have a case that a malicious user steals some training data of other users through a GAN attack, which reduces the reliability of the federal learning aggregation result. If there is a malicious user, the neuron activation value of the model must be abnormal, and therefore the abnormality can be detected in some way to achieve the effect of detecting the malicious user.

[0069] To solve the above problems, the federal learning secure aggregation method, device and electronic equipment provided in the embodiments of the present application obtain model parameter update information of all users participating in the federal learning for a current sample category; update the model parameters of a preset global model according to the model parameter update information to obtain new global models corresponding to each user; extract test samples corresponding to the current sample category from a preset test set and input the test samples into the new global models to obtain neuron average activation values corresponding to each new global model; determine a user clustering result according to the neuron average activation values corresponding to each new global model; and determine a malicious user currently participating in the federal learning according to the user clustering result. That is, the malicious user is determined according to the model neuron activation of different users for a certain sample category, the identity of the user participating in the federal learning is verified, and the reliability of the federal learning aggregation result is improved.

[0070] The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0071] First, the structure of the federal learning secure aggregation system based on the present application is described:

[0072] The federal learning secure aggregation method, device and electronic equipment provided in the embodiments of the present application are suitable for detecting malicious users participating in the federal learning to achieve secure aggregation. For example, Figure 1As shown in the figure, it is a structural schematic diagram of a federated learning secure aggregation system based on which the embodiments of the present application are based, mainly including a data acquisition device and a federated learning secure aggregation device, wherein the federated learning secure aggregation system can be embedded in a central server of federated learning. Specifically, the model parameter update information of all users participating in the federated learning for the current sample category is acquired by using the data acquisition device, and the acquired information is sent to the federated learning secure aggregation device, and the device detects malicious users currently participating in the federated learning according to the obtained information.

[0073] The embodiments of the present application provide a federated learning secure aggregation method for detecting malicious users participating in federated learning to realize secure aggregation. The execution subject of the embodiments of the present application is an electronic device, such as a server, a desktop computer, a notebook computer, a tablet computer and other electronic devices that can be used to detect malicious users participating in federated learning, such as a central server of federated learning.

[0074] As Figure 2 shown, it is a flowchart of the federated learning secure aggregation method provided by the embodiments of the present application, which comprises:

[0075] Step 201, acquiring model parameter update information of all users participating in federated learning for a current sample category.

[0076] Specifically, in the process of participating in federated learning, the user will download the model parameters of the current global model from the central server of the federated learning system, and establish a corresponding local model locally according to the obtained model parameters, and train the current local model based on local data, and finally send the model parameter update information of the trained local model to the central server.

[0077] Among them, the federated learning secure aggregation method provided by the embodiments of the present application can be mainly applied in the power environment, and the central server can be a power central server, and the user can include other power subsystems, and can be the power system of other related power enterprises.

[0078] Step 202, updating the model parameters of the preset global model according to the model parameter update information, to obtain a new global model corresponding to each user.

[0079] Specifically, after obtaining the model parameter update information of all users participating in federated learning for the current sample category, the model parameters of the preset global model in the central server can be updated accordingly according to these model parameter update information. Among them, since each user generates a model parameter update information, the central server will generate a new global model for each user.

[0080] Step 203, extracting test samples corresponding to the current sample category from the preset test set, and inputting the test samples into the new global model to obtain the neuron average activation value corresponding to each new global model.

[0081] It should be noted that since a user usually stores a large amount of local model training data (local data) locally, before performing local model training, the local data is generally classified first, and each time model training is performed for a certain type of sample data (local data).

[0082] Specifically, after obtaining the new global model corresponding to the trained local model of any user, test samples of the same category as the local data used by the user are extracted from the test set pre-stored in the center server, and these test samples are used to test the global model to obtain the activation value of each neuron in the neuron set strongly related to the current sample category in the global model, and the activation values are averaged at the sample level to obtain the neuron average activation value.

[0083] Wherein, how to determine the neuron activation value can refer to the prior art, and the embodiments of the present application do not limit it.

[0084] Step 204, determining the user clustering result according to the neuron average activation value corresponding to each new global model.

[0085] It should be noted that since the local data of different users is different, the final neuron average activation value also has certain differences.

[0086] Specifically, when the obtained neuron average activation value data accumulates to a certain amount, such as reaching a certain preset number threshold, the current existing clustering algorithm, such as density-based clustering algorithm (DBSCAN), can be used to determine the user clustering result according to the neuron average activation value corresponding to each new global model, to obtain normal class and abnormal class respectively.

[0087] Step 205, determining the malicious user currently participating in federated learning according to the user clustering result.

[0088] It should be noted that among the many users participating in federated learning, the malicious user is generally less, and there may be only one or two, and most of the users are normal users, so the user clustering result can be used to preliminarily estimate which user is a malicious user.

[0089] Specifically, in an embodiment, the category containing the least number of users can be determined as the abnormal class according to the number of users contained in each category in the clustering result; the user in the abnormal class is determined as the malicious user currently participating in federated learning.

[0090] Specifically, the users can be divided into two categories, normal category and abnormal category, by a clustering algorithm, where the number of users in the abnormal category is much smaller than that in the normal category, and finally the users in the abnormal category are determined as the malicious users currently participating in federated learning.

[0091] On the basis of the above embodiments, in order to improve the reliability of the user clustering result, as an implementable way, in an embodiment, the user clustering result is determined according to the neuron average activation values corresponding to each new global model, comprising:

[0092] Step 2041, constructing the neuron average activation values as time series data corresponding to different users according to the generation order of the neuron average activation values corresponding to each new global model;

[0093] Step 2042, determining clustering centroids of different categories according to the similarity between the time series data corresponding to each user;

[0094] Step 2043, determining the user clustering result according to the similarity between the time series data of other users and each clustering centroid.

[0095] For example, if two time series data X=[x1, x2,..., x n ] and Y=[y1, y2,..., y n ] are obtained, respectively, from the neuron average activation values of the new global model corresponding to the local model of user x and user y, in order to solve the left-right translation problem, an offset s needs to be considered, and then the inner product between them is calculated. Through this offset s, the maximum similarity can be calculated, and then the distance (similarity) between the two time series can be calculated: SBD(X, Y)=1-NCC(X, Y), where NCC∈[-1, 1] refers to the Normalized version of Cross-Correlation, and SBD∈[0, 2] refers to Shape-based distance.

[0096] In order to make the clustering result two categories (normal category and abnormal category), the hyperparameter ε (density radius) of DBSCAN needs to be determined based on a heuristic algorithm. Another important indicator of clustering is the selection of the centroid. Here, the centroid (clustering centroid) of each category can be determined according to the formula:

[0097] Finally, after obtaining the clustering centroids of each class, for each time series data, the SBD (similarity or distance) between the time series data and each clustering centroid is calculated, and it is assigned to the class closest to the clustering centroid. Finally, all user corresponding time series data is divided into two classes, and all participants (users) corresponding to the class with a small base are determined as malicious users.

[0098] Specifically, in an embodiment, since the data quality of the directly obtained time series data is difficult to guarantee, before the user clustering processing is performed, the time series data can be preprocessed and baseline extracted to improve the data quality of the time series data participating in user clustering.

[0099] Among them, the preprocessing mainly includes missing value processing and standardization processing. The missing value refers to that there is no corresponding data reporting at the timestamp of the reported data, and the data is in a missing state. The usual method is to fill in the data, and there are many methods for data filling. The simplest one is to use linear interpolation to fill in the data. For a time series data, its mean value may be 100,000, and its mean value may be only 10, but their trends may be the same. Therefore, normalization operation is needed at this time. The most common two normalization methods are standardization and maximum and minimum value normalization. If [x1, x2,..., x n ] represents the original time series data, the standardization refers to where μ and σ represent the mean and standard deviation, respectively, and the maximum and minimum value normalization refers to where max and min represent the maximum and minimum values in this period of time, respectively.

[0100] Specifically, the data noise can be eliminated by extracting the baseline. The baseline extraction refers to dividing the time series data into baseline and residual two parts. Assuming that the time series data is [x1, x2,..., x n ], the baseline extraction is: x i =baseline i +residual i where baseline i and residual i respectively refer to the baseline and residual of x i . In the process of baseline extraction, some obviously abnormal values need to be removed, and then linear interpolation and other methods are used to fill in these removed values. A simple moving average algorithm is used to extract the baseline by adding a window value w. Assuming that the time series data is [x1, x2,..., x n ], R i =x i -SMAi , that is, x i =SMA i +R i .

[0101] There are many ways to extract the baseline. The baseline can be extracted using a weighted moving average algorithm or an exponential moving average algorithm. Even the Autoencoder or VAE algorithm in deep learning can be used to extract the baseline. The specific baseline extraction method is not limited in this embodiment of the application.

[0102] Based on the above embodiment, in order to further improve the rigor of malicious user detection results, as an implementable approach, in one embodiment, before obtaining model parameter update information for the current sample category from all users participating in federated learning, the method further includes:

[0103] Step 301: Monitor the model training results of all users participating in federated learning for the current sample category, where the model training results include the intersection of neurons that are strongly correlated between each user's current local model and the current sample category;

[0104] Step 302: determine whether the model training results obtained by each user are the same;

[0105] Step 303: If they are different, the malicious users currently participating in the federated learning are determined based on the distribution of the model training results obtained by each user.

[0106] On the contrary, when the model training results obtained by each user are the same, the step of obtaining the model parameter update information of all users participating in the federated learning for the current sample category is executed.

[0107] For example, if the accuracy of the model on the test set is not less than 0.6 for the first time, the local model on the user side can be controlled to execute the Grad-CAM algorithm, using the gradient information of the last convolutional layer in CNN+ to find a set of neurons S in the last convolutional layer that are strongly correlated with each sample category. jc , the specific steps are as follows:

[0108] For each sample category, first calculate the class score y c (Before the softmax layer) about the feature map activation value A k Gradient These gradients are globally average pooled in the width and height dimensions (indexed by i and j respectively) to obtain the neuron importance weights

[0109] Weight represents the local linearization of the deep network downstream of A and captures the importance of feature map k for the target class c. A weighted combination of the forward activation maps is then performed and passed through a Relu to obtain the heat map

[0110] After obtaining the coarse-grained heat map of the same size as the convolutional feature map, a Relu is applied to the linear combination of the heat map, because we are usually only interested in the features that have a positive impact on class c, i.e. those that should be increased in intensity to increase y c for the pixel (negative pixels can belong to other classes).

[0111] Then, take the top 10% of neurons in as the set of strongly relevant neurons S jc to the class of the current sample. Each neuron in the set is represented by its coordinates in the neural network. Without loss of generality, assume that the last convolutional layer is the first layer of the neural network, and the output of this layer is three-dimensional. Each neuron in this layer can be represented by the coordinates (l, x, y, z), where x, y, and z are the indices of the neuron in the three dimensions of the output of this layer, respectively.

[0112] Since there may be overlap in the local data categories owned by the participants, after all participants j (0≤j≤n-1) who own c-class sample data have calculated their respective S jc , n participants need to cooperate to perform n-1 PSI (Private Set Intersection) protocols to obtain the intersection S jc of all S c (model training result). The Private Set Intersection (PSI) protocol allows two parties holding their respective data sets to perform the intersection operation of the two sets. After the PSI protocol ends, one or both parties can obtain the intersection result, but neither party can obtain any information about the other party's set data other than the intersection.

[0113] where, in order to better understand the calculation principle of the model training result by those skilled in the art, the present application provides the following execution principle of the PSI protocol:

[0114] 1. Initialization phase

[0115] The sender P1 and the receiver P2 jointly negotiate two hash functions H1 and H2 and a pseudo-random number function F k , and both parties hold the same key k corresponding to F, and the parties also jointly negotiate the protocol parameters m and w. The output of the pseudo-random number function F k is a string of w x logm bits in length. That is, before the start of the protocol, both parties have the same H1, H2, and Fk m, w, k.

[0116] 2. Pre-computation phase

[0117] Sender P1 : Randomly choose a string S of length w bits.

[0118] Receiver P2 : Generate a w x m binary identity matrix D (i.e. the elements of the matrix are either 0 or 1). This matrix has w rows and m columns. Generate a random key k, which will be used as input to the pseudo-random function F. For each element y of the data set Y, compute v = F k (H1(y)). V is a random string of length w x log m bits. Split v into w parts of length log m bits, i.e. obtain w random numbers in the range [0, m-1], denoted by v[i]. Set D[i][v[i]] to 0. Note that D[x][y] denotes the value in the x-th row and y-th column of the matrix.

[0119] 3. OT phase

[0120] Sender P1 : The details of the OT phase are ignored. After the OT phase is completed, a matrix C is obtained, which has w rows and m columns.

[0121] Receiver P2 : Randomly choose a w x m matrix A, and compute a matrix B such that The details of the OT phase are ignored. Each row of the matrix C is related to the random number S. If S[i] = 0, then the i-th row of the matrix A is chosen as the i-th row of the matrix C; if S[i] = 1, then the i-th row of the matrix B is chosen as the i-th row of the matrix C; here i ranges from 0, 1,..., w-1.

[0122] 4. PSI phase

[0123] Receiver P2 : Send the key k to P1. For each element y of the data set Y, compute v = F k (H1(y)). Receive a set of hash values CX from P1. In this embodiment, a i is used to represent the value of A[i][v[i]], a i is an element of the matrix A, either 0 or 1, and || denotes concatenation of bits. Compute the value of H2(a0||a1||...||a w -1), where the input to H2() is a random string of length w bits. All these values form a set of hash values AY. Compute the intersection AY CX, and then deduce X Y.

[0124] Sender P1: for each element x of the data set X, calculate v = F k (H1(y)). The embodiment of the application uses c i to represent the value of C[i][v[i]]. Calculate the value of H2(a0||a1||…||a w -1) and send the values to P2.

[0125] It should be noted that the participant 0 and the participant 1 perform a PSI protocol to obtain S 0c ∩S 1c The participant 1 performs a PSI protocol with the participant 2 again to obtain S 0c ∩S 1c ∩S 2c . In this way, until n-1 times of PSI protocol are performed to obtain S 0c ∩S 1c …S n-1c . Here, each time the PSI protocol is performed, each participant is both a sender and a receiver, so each participant has a copy of the final intersection S 0c ∩S 1c …S n-1c , and all participants send S 0c ∩S 1c …S n-1c to the central server. Since there is a malicious participant, if only one participant sends S 0c ∩S 1c …S n-1c to the power central server, it is possible that the participant is a malicious user, and the malicious user can arbitrarily tamper with the result of the intersection.

[0126] Specifically, in an embodiment, according to the distribution of the model training results obtained by each user, the distribution proportion of each model training result is determined; the user corresponding to the model training result with the smallest distribution proportion is determined as the malicious user currently participating in federated learning.

[0127] It should be noted that the malicious user participating in federated network learning may not strictly follow the control instructions issued by the central server, that is, the malicious user may not perform the PSI protocol according to the standard, so the model training result obtained by the malicious user is certainly different from that obtained by the normal user.

[0128] For example, if 10 model training results sent by users are currently obtained, of which 9 model training results of users are the same, and 1 model training result of a user is different from the others, it can be determined that the distribution proportions of the two cases are 9 / 10 and 1 / 10 respectively, and therefore the user whose model training result is different from the others can be determined as the malicious user.

[0129] Specifically, in an embodiment, in order to avoid false alarms due to the possibility of certain randomness in the malicious user detection result, the currently determined malicious user can be added to the malicious user list; when the cumulative number of times of adding any user reaches a preset threshold, the user is removed, so that the user cannot participate in subsequent federated learning.

[0130] Similarly, the user can also be removed when the cumulative number of times of adding any user reaches a preset threshold.

[0131] Further, the center server averages the update parameters of the local models of all normal users to obtain the parameter update of the global model, and sends the updated model parameters to each participant to complete federated learning.

[0132] Among them, the model structure, learning rate, parameter upload ratio, parameter download ratio and training process (order, asynchronous, etc.) of each user participating in federated learning are consistent, and the categories of the local data owned by each user can be public, such as user A claims to own categories [a, b] and user B claims to own categories [b, c].

[0133] For example, as shown in Figure 3 , it is a flowchart of an exemplary federated learning security aggregation method provided by the embodiments of the present application, wherein the method shown in Figure 3 is an exemplary implementation of the method shown in Figure 2 , and both have the same principle and will not be described again.

[0134] The federated learning security aggregation method provided by the embodiments of the present application obtains model parameter update information of all users participating in federated learning for a current sample category; updates the preset global model according to the model parameter update information to obtain new global models corresponding to each user; extracts test samples corresponding to the current sample category from a preset test set, and inputs the test samples into the new global models to obtain neuron average activation values corresponding to each new global model; determines a user clustering result according to the neuron average activation values corresponding to each new global model; and determines a malicious user currently participating in federated learning according to the user clustering result. That is, by determining the malicious user according to the model neuron activation of different users for a certain sample category, the identity of the user participating in federated learning is verified, and the reliability of the federated learning aggregation result is improved. Moreover, the identity of all users is detected according to the model training results of all users participating in federated learning, which further improves the accuracy of the malicious user detection result and is beneficial to further improve the reliability of the federated learning aggregation result.

[0135] The embodiment of the application provides a federated learning security aggregation device for performing the federated learning security aggregation method provided by the above embodiment.

[0136] As shown in Figure 4 FIG. 1 is a structural schematic diagram of the federated learning security aggregation device provided by the embodiment of the application. The federated learning security aggregation device 40 comprises an acquisition module 401, an update module 402, a test module 403, a clustering module 404 and an aggregation module 405.

[0137] The acquisition module is configured to acquire model parameter update information of all users participating in federated learning for a current sample category; the update module is configured to update a preset global model according to the model parameter update information to obtain a new global model corresponding to each user; the test module is configured to extract a test sample corresponding to the current sample category from a preset test set and input the test sample into the new global model to obtain a neuron average activation value corresponding to each new global model; the clustering module is configured to determine a user clustering result according to the neuron average activation value corresponding to each new global model; and the aggregation module is configured to determine a malicious user currently participating in federated learning according to the user clustering result.

[0138] Specifically, in an embodiment, the clustering module is specifically configured to:

[0139] construct the neuron average activation values into time series data corresponding to different users according to a generation order of the neuron average activation values corresponding to each new global model;

[0140] determine clustering centroids of different categories according to similarities between the time series data corresponding to each user;

[0141] determine the user clustering result according to similarities between time series data of other users and the clustering centroids.

[0142] Specifically, in an embodiment, the aggregation module is specifically configured to:

[0143] determine a category containing the least number of users as an abnormal category according to a number of users contained in each category in the clustering result;

[0144] determine a user in the abnormal category as a malicious user currently participating in federated learning.

[0145] Specifically, in an embodiment, the device further comprises:

[0146] The monitoring module is used to monitor the model training results of all users participating in federated learning for the current sample category, where the model training results include the intersection of neurons that are strongly correlated with the current sample category of each user's current local model; determine whether the model training results obtained by each user are the same; if different, determine the malicious users currently participating in federated learning based on the distribution of the model training results obtained by each user.

[0147] Specifically, in one embodiment, the monitoring module is further configured to:

[0148] When the model training results obtained by each user are the same, the step of obtaining the model parameter update information of all users participating in the federated learning for the current sample category is executed.

[0149] Specifically, in one embodiment, the monitoring module is specifically configured to:

[0150] According to the distribution of model training results obtained by each user, determine the distribution ratio of each model training result;

[0151] The user corresponding to the model training result with the smallest distribution ratio is identified as the malicious user currently participating in federated learning.

[0152] Specifically, in one embodiment, the aggregation module is further configured to:

[0153] Add the currently identified malicious user to the malicious user list;

[0154] When the cumulative number of times any user is added reaches a preset threshold, the user is removed and cannot participate in subsequent federated learning.

[0155] Regarding the federated learning security aggregation device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method and will not be elaborated here.

[0156] The federated learning security aggregation device provided in the embodiment of the present application is used to execute the federated learning security aggregation method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0157] An embodiment of the present application provides an electronic device for executing the federated learning security aggregation method provided in the above embodiment.

[0158] like Figure 5 FIG. 1 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 50 includes: at least one processor 51 and a memory 52;

[0159] The memory stores computer-executable instructions; and the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the federated learning secure aggregation method provided in the above embodiments.

[0160] The electronic device provided in the embodiments of the present application is used to perform the federated learning secure aggregation method provided in the above embodiments, and the implementation manners and principles are the same, and will not be repeated here.

[0161] The computer-readable storage medium provided in the embodiments of the present application stores computer-executable instructions, and when the processor executes the computer-executable instructions, the federated learning secure aggregation method provided in any one of the above embodiments is implemented.

[0162] The storage medium containing computer-executable instructions in the embodiments of the present application can be used to store the computer-executable instructions of the federated learning secure aggregation method provided in the above embodiments, and the implementation manners and principles are the same, and will not be repeated here.

[0163] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic, and the division of the units is merely a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0164] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0165] In addition, each functional unit in the embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware, or in the form of hardware plus software functional units.

[0166] The integrated unit implemented in the form of the software function unit can be stored in a computer readable storage medium. The software function unit is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of steps of the method described in each embodiment of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0167] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional module is taken as an example, and in actual application, the above-mentioned functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0168] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A federated learning secure aggregation method, characterized in that, The method is applied to a power environment, and the method comprises: obtaining model parameter update information of all users participating in federated learning for a current sample category; wherein the users include power subsystems; updating model parameters of a preset global model according to the model parameter update information to obtain new global models corresponding to the users; extracting test samples corresponding to the current sample category from a preset test set and inputting the test samples into the new global models to obtain neuron average activation values corresponding to the new global models; determining a user clustering result according to the neuron average activation values corresponding to the new global models; determining a malicious user currently participating in federated learning according to the user clustering result; The method comprises: constructing the neuron average activation values as time series data corresponding to different users according to a generation order of the neuron average activation values corresponding to the new global models; determining clustering centroids of different categories according to similarities between the time series data corresponding to the users; determining a user clustering result according to similarities between time series data of other users and the clustering centroids; The method comprises: determining an abnormal category as a category containing the least number of users in the clustering result; determining users in the abnormal category as malicious users currently participating in federated learning.

2. The method of claim 1, wherein, Before obtaining the model parameter update information of all users participating in federated learning for the current sample category, the method further comprises: monitoring model training results of all users participating in federated learning for the current sample category, wherein the model training results include intersections of neurons of current local models of the users and the current sample category; determining whether the model training results obtained by the users are the same; if not, determining a malicious user currently participating in federated learning according to a distribution of the model training results obtained by the users.

3. The method of claim 2, wherein, The method further comprises: when the model training results obtained by the users are the same, performing the step of obtaining the model parameter update information of all users participating in federated learning for the current sample category.

4. The method of claim 2, wherein, The method comprises: determining a distribution proportion of each model training result according to the distribution of the model training results obtained by the users; determining a user corresponding to a model training result with the smallest distribution proportion as a malicious user currently participating in federated learning.

5. The method of claim 1, wherein, The method further comprises: adding the currently determined malicious user to a malicious user list; when a number of times of adding a user reaches a preset threshold, removing the user so that the user cannot participate in subsequent federated learning.

6. A federated learning secure aggregation apparatus, comprising: The device is applied to a power environment, and the device comprises: An acquisition module is configured to acquire model parameter update information of all users participating in federated learning for a current sample category, wherein the users include power subsystems; An update module is configured to update model parameters of a preset global model according to the model parameter update information to obtain new global models corresponding to the users; A test module is configured to extract test samples corresponding to the current sample category from a preset test set and input the test samples into the new global models to obtain neuron average activation values corresponding to the new global models; A clustering module is configured to determine a user clustering result according to the neuron average activation values corresponding to the new global models; An aggregation module is configured to determine malicious users currently participating in federated learning according to the user clustering result; The clustering module is specifically configured to: construct the neuron average activation values into time series data corresponding to different users according to a generation order of the neuron average activation values corresponding to the new global models; determine clustering centroids of different categories according to similarities between the time series data corresponding to the users; determine the user clustering result according to similarities between time series data of other users and the clustering centroids; The aggregation module is specifically configured to: determine an abnormal category as a category containing the least number of users according to a number of users contained in each category in the clustering result; determine users in the abnormal category as the malicious users currently participating in federated learning.

7. An electronic device, comprising: comprise: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the method in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and when the processor executes the computer execution instructions, the method in any one of claims 1 to 5 is realized.

Images