A clustering federated learning method and system that does not rely on gradients

Abstract

The present invention discloses a clustering federated learning method and system that does not rely on gradients. The method includes: a client separately calculates data distribution information and mutual intersection similarity and constructs an intersection similarity vector; a server collects the intersection similarity vectors and constructs a similarity matrix, clusters the clients and performs model training. After the server detects a decrease in model accuracy and identifies malicious clusters, it selects clients to form a verification committee, verifies and votes to exclude malicious models and retain benign models. In the present invention, the server does not need to rely on the client's gradient information for clustering, but instead clusters based on the intersection similarity between the client's data distributions. This avoids the problem of gradient information leakage on the client, protects the client's gradient security, enhances the security and reliability of the clustering federated learning process, and improves training accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of clustering federated learning of artificial intelligence, and in particular to a clustering federated learning method and system that does not rely on gradients. Background Art

[0002] Although information is becoming increasingly abundant with the development of informatization, it essentially exists in isolated islands due to its high sensitivity. A typical application area is the medical field. Medical data is extremely sensitive, potentially involving important patient privacy issues. This data is often retained by different hospitals. Furthermore, the data held by different hospitals may have different focuses (for example, some hospitals specialize in heart disease treatment, while others specialize in kidney treatment), resulting in data non-IID issues. In recent years, federated learning has attracted attention for resolving the conflict between model training and data privacy protection. However, traditional federated learning does not effectively address the non-IID issue of data across clients. To address this issue, cluster federated learning has been proposed. It uses gradients to measure the similarity of data distributions between clients and clusters them to address the non-IID issue. However, recent research has shown that client privacy information and even the original training data can be recovered through gradients, and the gradient dimensionality often explodes with increasing model complexity. Furthermore, existing cluster federated learning solutions are unable to group clients with diverse data into multiple clusters, resulting in an inability to fully utilize the diverse data held by some clients. Furthermore, compared to federated learning, the cluster structure in cluster federated learning provides malicious clients with the opportunity to collude in a cluster and poison the aggregated cluster model by launching local model poisoning attacks, resulting in model training failure. Therefore, protecting client privacy in cluster federated learning and leveraging the diversity and availability of client data will have a crucial impact on the development of the industry. At the same time, improving the detection efficiency of malicious models, reducing detection overhead, and enhancing security during training are also important issues that need to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is as follows: In response to the above-mentioned problems in the prior art, a clustering federated learning method and system that does not rely on gradients is provided. In the present invention, the server does not need to rely on the client's gradient information for clustering, but instead performs clustering based on the intersection similarity between the client's data distributions, thereby avoiding the problem of gradient information leakage on the client, protecting the client's gradient security, enhancing the security and reliability of the clustering federated learning process, and improving the training accuracy.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A clustering federated learning method that does not rely on gradients, including:

[0006] S1, the client calculates the data distribution information of its own labeled samples, obtains the intersection similarity between its own data distribution information and other clients' data distribution information, and constructs the intersection similarity vector;

[0007] S2, the server collects the intersection similarity vectors of each client and constructs a similarity matrix;

[0008] In step S3, the server clusters the clients using a diversity-enhancing clustering method based on the similarity matrix and performs the model training step. If the server detects a decrease in model accuracy, it jumps to the next step.

[0009] S4, the server detects malicious clusters, and after determining the malicious clusters, selects clients with data distribution most similar to that of the clients in the malicious cluster and not in the malicious cluster to form a verification committee;

[0010] S6, uses the model whose members of the verification committee are members of the malicious cluster to verify and vote to determine the benign model and the malicious model, excluding the malicious model and retaining the benign model.

[0011] Optionally, in step S1, the function expression for the client to calculate the data distribution information of its own label samples is:

[0012]

[0013] In the above formula, as well as The data distribution information of a single label of the 1st, 2nd and i-th clients is represented respectively, and the calculation function expression of the data distribution information of a single label of any i-th client is:

[0014]

[0015] in, Indicates the amount of data for the i-th index of the i-th client, idx i represents the index of label i, Q max Indicates a predefined maximum number of any tags, and the number of any tag cannot exceed this maximum value. i Represents the data distribution information constructed by the i-th client, and j is the sequence number of the j-th index of the i-th client.

[0016] Optionally, the function expression of the intersection similarity vector constructed in step S1 is:

[0017]

[0018] In the above formula, ISM i is the intersection similarity vector of the i-th client, ISM i [1]~ISM i [j] represents the data distribution similarity between the i-th client and the 1st to j-th clients, |X i ∩X j | represents the intersection of the data distribution between the i-th client and the j-th client, X i represents the data distribution information constructed by the i-th client, X j Represents the data distribution information constructed by the j-th client.

[0019] Optionally, the function expression of the similarity matrix constructed in step S2 is:

[0020]

[0021] In the above formula, M sim is a similarity matrix, and any i-th row represents the intersection similarity vector of the data distribution similarity of the i-th client to the 1st to n-th clients.

[0022] Optionally, in step S3, the server clusters the clients based on the similarity matrix using a clustering method that ensures diversity, including: clustering all clients whose intersection similarity is higher than a threshold α into a candidate cluster set and removing duplicates, so that the candidate cluster set contains all possible clustering results; in the candidate cluster set, calculating the weight of each candidate cluster, and using a greedy algorithm, each time selecting the candidate cluster that can minimize the load to add to the final cluster set until all clients are assigned to the final cluster set.

[0023] Optionally, the function expression for calculating the weight of each candidate cluster is:

[0024]

[0025] In the above formula, Cost(S′ i ) represents the calculation of candidate cluster S′ i The cost, ID is the client number, M sim [i][ID] is the element in the i-th row and ID-th column of the similarity matrix; the calculation function expression of the load is:

[0026]

[0027] In the above formula, Payload represents the load, S′\I represents the set of candidate clusters that have not been selected into the final cluster, S′ represents the set of candidate clusters, and I represents the number of the client that has been selected into the final cluster.

[0028] Optionally, the server detecting malicious clusters in step S4 means that the server detects the accuracy of each cluster in the final cluster set according to its own local data, and selects the cluster with the lowest accuracy as the malicious cluster.

[0029] Optionally, in step S6, using members of the verification committee to verify the models of members in the malicious cluster and vote to determine whether they are benign models or malicious models includes: using members of the verification committee to verify the model accuracy of each member in the malicious cluster based on their own local data, and treating model members with accuracy lower than the average as malicious models and voting, and finally adding up all voting results. The model with more votes than the average number of votes will be identified as a malicious model by the verification committee, otherwise it will be identified as a benign model by the verification committee.

[0030] In addition, the present invention also provides a gradient-independent clustering federated learning system, comprising a plurality of interconnected clients, wherein the clients comprise interconnected microprocessors and memories, and the microprocessors are programmed or configured to execute the gradient-independent clustering federated learning method.

[0031] In addition, the present invention also provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be programmed or configured by a microprocessor to execute the gradient-independent clustering federated learning method.

[0032] Compared with the prior art, the present invention mainly has the following advantages:

[0033] 1. During the clustering process of the present invention, the server does not need to rely on the client's gradient information for clustering. Instead, it performs clustering based on the intersection similarity between the client's data distribution, thereby avoiding the problem of gradient information leakage of the client, protecting the client's gradient security, enhancing the security and reliability of the clustering federated learning process, and improving training accuracy.

[0034] 2. During the clustering process, the present invention innovatively allows the same client to appear in multiple clusters, thereby finding the most suitable cluster for each client and making full use of the diversity of client data to enhance model accuracy.

[0035] 3. Unlike the pre-detection commonly used in existing federated learning, this invention innovatively uses a post-detection mechanism to detect malicious clusters in the system, allowing detection after the attack begins, thereby saving costs and further improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Schematic diagram of the basic process of the method of the embodiment of the present invention.

[0037] Figure 2Schematic diagram of the principle of an embodiment of the present invention.

[0038] Figure 3 It is the test accuracy of the embodiment of the present invention on the MNIST dataset.

[0039] Figure 4 This is the test accuracy of the embodiment of the present invention on the FMNIST dataset.

[0040] Figure 5 This is the test accuracy of the embodiment of the present invention on the CIFAR10 dataset.

[0041] Figure 6 The figure shows the comparison of the test accuracy of the embodiments of the present invention using three methods.

[0042] Figure 7 This is the main overhead when calculating intersection similarity in the embodiment of the present invention.

[0043] Figure 8 This is the test accuracy of each cluster when a malicious client acts maliciously in the embodiment of the present invention.

[0044] Figure 9 This is the test accuracy of the global model after detection using different detection methods in the embodiments of the present invention.

[0045] Figure 10 It is the accuracy of the global model of the embodiment of the present invention in different protection noises. DETAILED DESCRIPTION

[0046] The present invention can be applied in medical industry scenarios. Each hospital uses the present invention as a client of federated learning to efficiently utilize the diversity of the hospital's sensitive data and ensure the availability of sensitive data. It has solved the non-independent and identically distributed problem between hospitals and efficiently obtained several cluster models suitable for each hospital. Below, each hospital will be used as a client of federated learning, and the machine learning of cancerous cell identification based on CT images by the client will be taken as an example. The present invention will be further described in conjunction with the drawings and specific preferred embodiments of the specification, but the scope of protection of the present invention is not limited thereto. In this example, the system includes a server and several clients, and the server and the device communicate through a secure channel to realize the interaction of information and data. Not limited to the federated learning system in this embodiment, ordinary personnel in this field can implement the deployment of the federated learning system according to actual conditions.

[0047] like Figure 1 As shown, the cluster federated learning method that does not rely on gradients in this embodiment includes:

[0048] S1, the client calculates the data distribution information of its own labeled samples, obtains the intersection similarity between its own data distribution information and other clients' data distribution information, and constructs the intersection similarity vector;

[0049] S2, the server collects the intersection similarity vectors of each client and constructs a similarity matrix;

[0050] In step S3, the server clusters the clients using a diversity-enhancing clustering method based on the similarity matrix and performs the model training step. If the server detects a decrease in model accuracy, it jumps to the next step.

[0051] S4, the server detects malicious clusters, and after determining the malicious clusters, selects clients with data distribution most similar to that of the clients in the malicious cluster and not in the malicious cluster to form a verification committee;

[0052] S6, uses the model whose members of the verification committee are members of the malicious cluster to verify and vote to determine the benign model and the malicious model, excluding the malicious model and retaining the benign model.

[0053] Based on the content disclosed in this embodiment, it is understood by those skilled in the art that data transmission between the server and the client, and between the clients, is achieved through a secure channel, such as publishing a global model, uploading a local model, uploading a similarity vector, and calculating an intersection using the RSA-PSI scheme. In step S1 of this embodiment, the method for the client to obtain the intersection of the data distribution between itself and other clients includes: using the RSA-PSI scheme to obtain the intersection between itself and other clients. As mentioned above, the existing clustering federated learning scheme relies on the use of gradients for clustering. This gradient-dependent scheme may leak the client's privacy information or even the original training data. Therefore, in order to circumvent this problem, the RSA-PSI scheme is used in this embodiment to allow the client to obtain the intersection between itself and other clients' data without leaking the training data, and calculate the intersection similarity vector between itself and other clients based on this intersection.

[0054] In this embodiment, each client needs to count the number of samples of each label in the local data and process the number information to prevent leakage of its own real data distribution information. In step S1, the function expression for calculating the data distribution information of its own label samples is:

[0055]

[0056] In the above formula, as well as The data distribution information of a single label of the 1st, 2nd and i-th clients is represented respectively, and the calculation function expression of the data distribution information of a single label of any i-th client is:

[0057]

[0058] in, Indicates the amount of data for the i-th index of the i-th client, idx i represents the index of label i, Q max Indicates a predefined maximum number of any tags, and the number of any tag cannot exceed this maximum value. i represents the data distribution information constructed by the i-th client, and j is the sequence number of the j-th index of the i-th client. After the above transformation, the client can obtain the intersection without exposing its own real data distribution information.

[0059] In this embodiment, the method for the client to obtain the intersection of data distributions with other clients in step S1 includes: using the RSA-PSI scheme (an RSA-based privacy set intersection scheme) to calculate the intersection of data distributions with other clients and construct a similarity vector. As an optional implementation, the function expression of the intersection similarity vector constructed in step S1 of this embodiment is:

[0060]

[0061] In the above formula, ISM i is the intersection similarity vector of the i-th client, ISM i [1]~ISM i [j] represents the data distribution similarity between the i-th client and the 1st to j-th clients, |X i ∩X j | represents the intersection of the data distribution between the i-th client and the j-th client, X i represents the data distribution information constructed by the i-th client, X j Represents the data distribution information constructed by the jth client. Based on the content disclosed in this embodiment, those skilled in the art can also use different privacy set intersection schemes to implement intersection calculation, and this specific embodiment does not limit the scope of the technology claimed in this application.

[0062] In this embodiment, the function expression of the similarity matrix constructed in step S2 is:

[0063]

[0064] In the above formula, M simis a similarity matrix, and any i-th row represents the intersection similarity vector of the data distribution similarity of the i-th client to the 1st to n-th clients.

[0065] In this embodiment, in step S3, the server clusters the clients based on the similarity matrix using a clustering method that ensures diversity, including: clustering all clients whose intersection similarity is higher than a threshold α into a candidate cluster set and removing duplicates, so that the candidate cluster set contains all possible clustering results; in the candidate cluster set, calculating the weight of each candidate cluster, and using a greedy algorithm, each time selecting the candidate cluster that can minimize the load to add to the final cluster set until all clients are assigned to the final cluster set.

[0066] In this embodiment, the function expression for calculating the weight of each candidate cluster is:

[0067]

[0068] In the above formula, Cost(S′ i ) represents the calculation of candidate cluster S′ i The cost, ID is the client number, M sim [i][ID] is the element in the i-th row and ID-th column of the similarity matrix; the calculation function expression of the load is:

[0069]

[0070] In the above formula, Payload represents the load, S′\I represents the set of candidate clusters that have not been selected into the final cluster, S′ represents the set of candidate clusters, and I represents the number of the client that has been selected into the final cluster.

[0071] In this embodiment, the server detecting malicious clusters in step S4 means that the server detects the accuracy of each cluster in the final cluster set according to its own local data, and selects the cluster with the lowest accuracy as the malicious cluster.

[0072] In this embodiment, the method for detecting whether a malicious cluster exists includes: whether the accuracy of the global model detected by the server has dropped significantly (dropped by more than a set value). In this embodiment, the method for determining a malicious cluster includes: the server detects the accuracy of each cluster based on its own local data, and selects the cluster with the lowest accuracy as the malicious cluster. Of course, ordinary technicians in this field can also choose different methods to detect malicious clusters as needed; for example, whether the cluster model meets preset standards, etc. The scope of the technology claimed for protection in this application is not limited by this specific embodiment.

[0073] In this embodiment, in step S6, the verification of the models of the malicious cluster members by using the verification committee members to vote to determine whether they are benign models or malicious models includes: using the verification committee members to verify the model accuracy of each member in the malicious cluster based on their own local data, and the model members with accuracy lower than the average value will be regarded as malicious models and voted, and finally all the voting results will be summed up, and the model with a higher number of votes than the average number of votes will be identified as a malicious model by the verification committee, otherwise it will be identified as a benign model by the verification committee. The method of selecting the verification committee in step S6 of this embodiment includes: the server takes a client with the most similar data distribution but not in the malicious cluster for each client in the malicious cluster. The method of voting by the verification committee includes: the verification committee members verify the accuracy of each model in the malicious cluster based on their own local data, and the model with accuracy lower than the average value will be regarded as a malicious model by this committee member and cast one vote. The voting method of the verification committee also includes: after each member of the verification committee votes, all the voting results are summed up, and the model with a higher number of votes than the average number of votes will be identified as a malicious model by the committee.

[0074] In this embodiment, a specific simulation experiment was conducted to verify this embodiment. Federated learning simulation was performed based on PyTorch. In the simulation experiment, one server and 100 clients were set up. The server used the Federated Averaging algorithm to aggregate the local models in each cluster. Each client performed one iteration on the local data during training. The server had a portion of independent and identically distributed data that could be used to detect malicious clusters. Three different training methods were set up: GCFL, FedAvg, and GICFL. In the GCFL method, the system clustered clients using a gradient-based clustering method. In the FedAvg method, the system did not cluster clients, but only used the most basic method for federated learning training. In GICFL, the client clustering method described above was used. For each training method, the MNIST, FMNIST, and CIFAR-10 datasets were used as benchmark datasets, respectively. For each training set, the client data was initialized using two different initialization methods: pathological non-IID and Dirichlet non-IID. In the pathological non-IID initialization method, each client can obtain random data with two labels, that is, the parameter of pathological non-IID is set to k = 2. In the Dirichlet non-IID initialization method, the data of each client follows the Dirichlet distribution with β = 0.5. The test accuracy of the model under the three training methods is as follows Figure 3 、 Figure 4 and Figure 5 shown. Figure 3 In the figure, (a) is the test accuracy on the pathological initialization distribution, and (b) is the test accuracy on the Dirichlet initialization distribution; Figure 4In the figure, (a) is the test accuracy on the pathological initialization distribution, and (b) is the test accuracy on the Dirichlet initialization distribution; Figure 5 In , (a) is the test accuracy on the pathological initialization distribution, and (b) is the test accuracy on the Dirichlet initialization distribution. Figure 3 、 Figure 4 and Figure 5 It can be seen that under the GICFL training method of this embodiment, for various data sets and data distributions, the test accuracy of the model is better than the test accuracy of the other two training methods.

[0075] In the simulation experiment of this embodiment, the efficiency of the technical solution of the present invention is tested by setting a more extreme data initialization method. Figure 6 The figure shows the test accuracy of three different training methods after convergence on the MNIST and FMNIST datasets when the parameter of the Dirichlet initialization method is set to β = 0.1, where (a) is the test accuracy on the MNIST dataset and (b) is the test accuracy on the FMNIST dataset. Figure 6 It can be seen that under a more extreme data initialization method, the test accuracy of this embodiment is still excellent.

[0076] In the simulation experiment of this embodiment, Figure 7 The main cost of computing the intersection of data distributions between clients when using different data distribution initialization methods is shown, where (a) is the cost on the pathologically initialized distribution and (b) is the cost on the Dirichlet initialized distribution. Figure 7 As can be seen, in this embodiment, calculating the intersection similarity takes some time. However, since this phase occurs before training, it is negligible compared to the training time. Furthermore, when a new member joins, the intersection between existing members does not need to be recalculated. Considering the training time and the need for privacy protection, the overhead of this protocol is acceptable.

[0077] In the simulation experiment of this embodiment, the situation where someone in the client is malicious is simulated. The malicious client adds Gaussian noise with a variance of 1 to its local model, that is, δ = 1. The test accuracy of each cluster model after the malicious client is malicious is as follows: Figure 8 As shown, (a) is the test accuracy on the pathological initialization distribution, and (b) is the test accuracy on the Dirichlet initialization distribution. Figure 8 It can be seen that after the malicious client has done something malicious, the server can still detect the malicious cluster through its local data.

[0078] In the simulation experiment of this embodiment, three methods are used to form the verification committee. In the first method, the server selects clients outside the malicious cluster that are most similar to the client data distribution in the cluster to form the verification committee, which is the method selected in this embodiment. In the second method, the server selects random clients outside the malicious cluster to form the verification committee. In the third method, the server selects clients outside the malicious cluster that are least similar to the clients in the cluster to form the verification committee. After the verification committee votes, the clients identified as malicious clusters are removed, and the remaining clients are re-clustered. The model accuracy after re-clustering is as follows: Figure 9 As shown, (a) is the test accuracy on the pathological initialization distribution, and (b) is the test accuracy on the Dirichlet initialization distribution. Figure 9 It can be seen that under the detection method of this embodiment, excellent detection effects of malicious clusters and malicious clients can be achieved.

[0079] In the simulation experiment of this embodiment, we also verify the robustness of our test method by gradually adding different degrees of Gaussian noise to the client model, such as Figure 10 As shown, (a) is the test accuracy on the pathological initialization distribution, and (b) is the test accuracy on the Dirichlet initialization distribution. Figure 10 It can be seen that when Gaussian noise with a variance of 0.006 is added to the Dirichlet initialization distribution, malicious models in malicious clusters can still be accurately identified. In the pathological initialization distribution, Gaussian noise with a variance of 0.01 can even be tolerated.

[0080] In summary, in the clustering process of the gradient-independent clustering federated learning method of this embodiment, the server does not need to rely on the client's gradient information for clustering, but clusters according to the intersection similarity between the client's data distribution, thereby avoiding the problem of gradient information leakage of the client, protecting the client's gradient security, enhancing the security and reliability of the clustering federated learning process, and improving the training accuracy. In the clustering process of the gradient-independent clustering federated learning method of this embodiment, the server does not need to rely on the client's gradient information for clustering, but clusters according to the intersection similarity between the client's data distribution, thereby avoiding the problem of gradient information leakage of the client, protecting the client's gradient security, enhancing the security and reliability of the clustering federated learning process, and improving the training accuracy. In the clustering process of the gradient-independent clustering federated learning method of this embodiment, the server innovatively allows the same client to appear in multiple clusters, thereby finding the most suitable cluster for each client, and making full use of the diversity of client data to enhance the model accuracy. The gradient-independent clustering federated learning method of this embodiment is different from the pre-detection commonly used in existing federated learning. It innovatively uses a post-detection mechanism to detect malicious clusters in the system, allowing detection after the attack begins to save overhead and further improve the security of the system. The gradient-independent clustering federated learning method of this embodiment can be applied in medical industry scenarios. Each hospital uses the present invention as a client of federated learning to efficiently utilize the diversity of the hospital's sensitive data and ensure the availability of sensitive data. This solves the non-independent and identically distributed problem among hospitals and efficiently obtains several cluster models suitable for each hospital.

[0081] In addition, this embodiment also provides a gradient-independent cluster federated learning system, comprising a plurality of interconnected clients, each of which includes an interconnected microprocessor and memory, wherein the microprocessor is programmed or configured to execute the aforementioned gradient-independent cluster federated learning method. Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program for being programmed or configured by the microprocessor to execute the aforementioned gradient-independent cluster federated learning method.

[0082] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0083] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A clustering federated learning method that does not rely on gradients, characterized by: include: S1, the client calculates the data distribution information of its own labeled samples, obtains the intersection similarity between its own data distribution information and other clients' data distribution information, and constructs the intersection similarity vector; S2, the server collects the intersection similarity vectors of each client and constructs a similarity matrix; In step S3, the server clusters the clients using a diversity-enhancing clustering method based on the similarity matrix and performs the model training step. If the server detects a decrease in model accuracy, it jumps to the next step. S4, the server detects malicious clusters, and after determining the malicious clusters, selects clients with data distribution most similar to that of the clients in the malicious cluster and not in the malicious cluster to form a verification committee; S6, using the model whose members of the verification committee are members of the malicious cluster to verify and vote to determine whether it is a benign model or a malicious model, excluding the malicious model and retaining the benign model; In step S3, the server clusters the clients using a clustering method that ensures diversity based on the similarity matrix, including: clustering all the clients whose intersection similarity is higher than the threshold The clients are aggregated into a candidate cluster set and duplicates are removed so that the candidate cluster set contains all possible clustering results; in the candidate cluster set, the weight of each candidate cluster is calculated, and a greedy algorithm is used to select the candidate cluster that can minimize the load each time and add it to the final cluster set until all clients are assigned to the final cluster set; The function expression for calculating the weight of each candidate cluster is: ， In the above formula, Indicates the calculation of candidate clusters the cost, The client number. is the element in the ith row and the IDth column of the similarity matrix; the calculation function expression of the load is: ， In the above formula, Indicates load, represents the set of candidate clusters that have not yet been selected into the final cluster, represents the candidate cluster set, Indicates the number of the client that has been selected into the final cluster.

2. The gradient-independent clustering federated learning method according to claim 1, characterized in that: In step S1, the function expression for the client to calculate the data distribution information of its own label samples is: ， In the above formula, 、 as well as Represents the 1st, 2nd and i The data distribution information of a single tag of a client, and any i The calculation function expression of the data distribution information of a single label of a client is: ， in, Indicates the Client's The number of indexed data, Representation Label Index ， Indicates a predefined maximum number of any tags, and the number of any tag cannot exceed this maximum value. Indicates the Data distribution information built by each client, For the Client's The sequence number of the index.

3. The gradient-independent clustering federated learning method according to claim 2, characterized in that: The function expression of the intersection similarity vector constructed in step S1 is: ， In the above formula, For the The intersection similarity vector of the clients, ~ Indicates the Clients to the 1st~ The data distribution similarity of each client, Indicates the Client and The intersection of data distribution among clients, Indicates the Data distribution information built by each client, Indicates the Data distribution information built by each client.

4. The gradient-independent clustering federated learning method according to claim 3, characterized in that: The function expression of the similarity matrix constructed in step S2 is: ， In the above formula, is the similarity matrix, any Row represents the Clients to the 1st~ The intersection similarity vector is composed of the data distribution similarities of the clients.

5. The gradient-independent clustering federated learning method according to claim 4, characterized in that: In step S4, the server detects malicious clusters, which means that the server detects the accuracy of each cluster in the final cluster set based on its own local data, and selects the cluster with the lowest accuracy as the malicious cluster.

6. The gradient-independent clustering federated learning method according to claim 5, characterized in that: In step S6, the members of the verification committee are used to verify the models of the members of the malicious cluster and vote to determine whether they are benign models or malicious models. The method includes: using the members of the verification committee to verify the model accuracy of each member of the malicious cluster based on their own local data, and considering the model members with accuracy lower than the average as malicious models and voting. Finally, all voting results will be summed up. The model with more votes than the average will be identified as a malicious model by the verification committee, otherwise it will be identified as a benign model by the verification committee.

7. A clustering federated learning system that does not rely on gradients, comprising a plurality of interconnected clients, each of which comprises an interconnected microprocessor and a memory, characterized in that: The microprocessor is programmed or configured to execute the gradient-independent clustering federated learning method according to any one of claims 1 to 6.

8. A computer-readable storage medium storing a computer program, wherein: The computer program is used to be programmed or configured by a microprocessor to execute the gradient-independent clustering federated learning method according to any one of claims 1 to 6.

Images