A federated learning method for eliminating malicious clients

Abstract

The application discloses a federated learning method for eliminating malicious clients, and relates to the field of image classification. A preset proportion of clients are selected from all clients and a check command is sent, and a ResNet-101 classification model of a current round is sent to unselected clients; the selected clients perform dataset distillation according to the ResNet-101 classification model of the last round and a local dataset, and a server eliminates the selected clients with a cumulative score less than a score threshold; the unselected clients perform local training, and the server updates the ResNet-101 classification model according to the gradients uploaded by all the unselected clients; finally, the ResNet-101 classification model is obtained through multiple iterations. The application can screen and eliminate malicious clients that intentionally upload wrong gradients, and ensure the reliability and safety of the training among multiple clients without reducing the training accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of image classification, and in particular to a federated learning method for eliminating malicious clients. BACKGROUND

[0002] In recent years, with the rapid development of big data and the Internet of Things, the amount of data has shown explosive growth, and artificial intelligence technology based on big data has also developed rapidly. In the vast amount of data, the problem of user privacy protection is particularly prominent. In the training process of ordinary distributed machine learning, the local data of several clients will be directly sent to the server for unified training, which will undoubtedly increase the risk of user privacy leakage. Moreover, due to industry competition, privacy security, complex administrative procedures and other problems, data often exists in the form of an island, making it difficult to directly use the data of each client for training. Therefore, researchers consider whether the above training process can be completed without uploading the local data of the client. Thus, federated learning emerges as the times require. Federated learning technology was first proposed by Google in 2016, and then applied to the training and deployment of the next word association model of mobile device input method. The design goal of federated learning is to train a machine learning model without centralizing all data to the central server under the premise of ensuring the security of each participant's training data. Therefore, the data of the client can be trained locally, thereby solving the problem of privacy protection to some extent, allowing the data of the client to interact and learn safely under the participation of multiple clients, thereby achieving ideal common benefits.

[0003] However, in the actual application environment of federated learning, malicious clients will have the following effects on the training of federated learning: affecting the performance of the model, leading to privacy leakage, disrupting the global model aggregation process, and uploading incorrect gradients to cause the model to be unable to converge quickly. The existence of lazy clients also poses a risk of privacy leakage.

[0004] Therefore, how to screen clients is of great significance to improve the security of the federated learning process and ensure the efficiency of the federated learning process. SUMMARY

[0005] The purpose of the present application is to provide a federated learning method for eliminating malicious clients, which can ensure the reliability and security of the training between multiple clients without reducing the training accuracy.

[0006] To achieve the above purpose, the present application provides the following scheme:

[0007] A federated learning method for eliminating malicious clients, comprising:

[0008] The ImageNet dataset is divided into multiple subsets and allocated to each client as a local dataset of each client;

[0009] A preset proportion of clients are selected from all clients and a verification command is sent, and a ResNet-101 classification model of the current round is sent to the clients that are not selected;

[0010] The selected clients perform dataset distillation based on the ResNet-101 classification model of the previous round and the local dataset, and upload the distilled dataset obtained after the dataset distillation to the server;

[0011] The server scores based on the distilled dataset, in combination with the ResNet-101 classification model of the previous round and the gradients uploaded by the selected clients of the previous round, to obtain the cumulative scores of the selected clients;

[0012] The selected clients with cumulative scores greater than or equal to a score threshold are allowed to participate in the next round of federated training, and the selected clients with cumulative scores less than the score threshold are removed;

[0013] The clients that are not selected perform local training based on their local dataset and the ResNet-101 classification model of the current round, and upload the gradients obtained after the training to the server;

[0014] The server calculates the ResNet-101 classification model of the next round based on the gradients uploaded by all clients that are not selected;

[0015] When the number of rounds reaches a global iteration number, the federated training is stopped, and a final ResNet-101 classification model is obtained.

[0016] Optionally, the selected clients perform dataset distillation based on the ResNet-101 classification model of the previous round and the local dataset, specifically including:

[0017] The selected clients randomly initialize a learning rate η and a distilled dataset D consisting of m data

[0018] The selected clients randomly select b data from the local dataset D to form a small batch D batch ;

[0019] According to the learning rate η and the distilled dataset D The gradient descent method is used to update the parameters of the ResNet-101 classification model of the previous round to obtain updated model parameters θ upd ;

[0020] Based on the small batch D batchand the updated model parameters θ upd Gradient descent was used on the distillation dataset. Update the learning rate η;

[0021] Based on the updated distillation dataset and updated model parameters θ upd Calculate the cross-entropy loss function

[0022] like If the maximum number of iterations T has not been reached, then the learning rate η is replaced with the updated learning rate, and the dataset is distilled. Replace with the updated distillation dataset and return "The selected client randomly selects b data points from the local dataset D to form a mini-batch D". batch "; where, end f The upper bound of the loss function;

[0023] like If the maximum number of iterations T is reached, the dataset distillation ends, and the updated distilled dataset is output.

[0024] Optionally, the step of basing the data on the learning rate η and the distillation dataset... The parameters of the ResNet-101 classification model from the previous round are updated using gradient descent to obtain the updated model parameters θ. upd Specifically, it includes:

[0025] Based on distillation dataset Using formula Calculate the parameters θ of the ResNet-101 classification model from the previous round. orig The gradient; where, For the selected client based on the distillation dataset and parameter θ orig The calculated cross-entropy loss function, for Regarding the parameter θ orig The gradient is obtained by taking the partial derivative;

[0026] Based on the learning rate η and the parameters θ of the previous ResNet-101 classification model. orig The gradient, using the formula Calculate the updated model parameters θ upd .

[0027] Optionally, the server scores the selected client based on the distillation dataset, combined with the ResNet-101 classification model from the previous round and the gradients uploaded by the selected client from the previous round, to obtain the cumulative score of the selected client, specifically including:

[0028] The server calculates the gradient of the ResNet-101 classification model of the last round according to the distillation data set and the ResNet-101 classification model of the last round;

[0029] The cosine similarity between the gradient of the ResNet-101 classification model of the last round and the gradient uploaded by the selected client in the last round is calculated.

[0030] According to the cosine similarity, the score of the selected client in the current round is calculated.

[0031] The score in the current round is added to the cumulative score before the current round to obtain the updated cumulative score of the selected client.

[0032] Optionally, the calculation formula of the cosine similarity is

[0033]

[0034] In the formula, C k is the cosine similarity, is the distillation data set uploaded by the selected client k in the current round (the tth round) based on the server, is the gradient of the ResNet-101 classification model of the (t-1)th round calculated, is the gradient uploaded by the selected client k in the (t-1)th round;

[0035] The calculation formula of the score of the selected client in the current round is

[0036]

[0037] In the formula, S k，t is the score of the selected client k in the tth round, L is a scaling factor of the score, L>0, Q is a tolerance factor, B is a critical factor, V is a completely malicious factor, and K is a speed factor of the score, K>1.

[0038] Optionally, the calculation formula of the ResNet-101 classification model of the next round is

[0039]

[0040] In the formula, θ t+1 is the ResNet-101 classification model of the (t+1)th round, θ t is the ResNet-101 classification model of the tth round, is the gradient uploaded by the client i in the tth round, α is a learning rate used when the model parameter is updated by using the gradient descent method, n i is the local data set size of the client i, and Sinit S is an initial accumulated score of the client i i S is an accumulated score of the client i in the tth round limit S is a score threshold.

[0041] Optionally, the preset proportion of the clients are selected from all the clients and a verification command is sent, and the ResNet-101 classification model of the current round is sent to the clients not selected, and the previous further comprises:

[0042] The server initializes the ResNet-101 classification model θ0, and initializes the accumulated scores of the clients to S init ;

[0043] If it is the first iteration, the ResNet-101 classification model θ0 is sent to each client.

[0044] Optionally, the same client cannot be selected for two consecutive rounds.

[0045] According to the specific embodiments provided by the application, the following technical effects are disclosed:

[0046] The application discloses a federated learning method for eliminating malicious clients. First, a preset proportion of clients are selected from all the clients and a verification command is sent, and the ResNet-101 classification model of the current round is sent to the clients not selected. Second, the selected clients perform dataset distillation according to the ResNet-101 classification model of the last round and the local dataset, and the server scores the selected clients according to the distilled dataset, and eliminates the selected clients with an accumulated score less than a score threshold. The clients not selected perform local training based on the local dataset and the ResNet-101 classification model of the current round, and the server updates the ResNet-101 classification model according to the gradients uploaded by all the clients not selected. Finally, the final ResNet-101 classification model is obtained through multiple iterations. The application can screen and eliminate malicious clients that intentionally upload incorrect gradients, and ensure the reliability and security of the training among multiple clients without reducing the training accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0048] Figure 1A flowchart of a federated learning method for eliminating malicious clients provided by an embodiment of the present application;

[0049] Figure 2 A principle diagram of a federated learning method for eliminating malicious clients provided by an embodiment of the present application;

[0050] Figure 3 A federated learning process framework diagram provided by an embodiment of the present application;

[0051] Figure 4 A data set distillation flowchart provided by an embodiment of the present application;

[0052] Figure 5 A cumulative scoring process flowchart provided by an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0054] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0055] The malicious client is likely to be an aggressive or threatening bad client. Such a client is a great threat to the federated learning algorithm, and in serious cases, it can lead to the leakage of the privacy of the client. Therefore, in order to eliminate the malicious client, the present application provides a federated learning method for eliminating the malicious client, which mainly screens and eliminates malicious clients that intentionally upload wrong gradients and lazy clients that only obtain models but do not participate in training. The method can ensure the reliability and security of training between multiple clients without reducing the training accuracy.

[0056] The federated learning method for eliminating malicious clients provided by an embodiment of the present application is based on the server and the client for federated training, and scores each client during the training process to evaluate the client that meets the requirements and eliminate the malicious client. As shown in the figure, Figures 1 to 3 The method includes the following steps:

[0057] Step S1, divide the ImageNet data set into multiple subsets and assign them to each client as the local data set of each client.

[0058] Step S2, select a preset proportion of clients from all clients and send a verification command, and send the ResNet-101 classification model of the current round to the clients not selected.

[0059] The server initializes the ResNet-101 classification model (hereinafter referred to as the global model) θ0, and initializes the cumulative scores of each client to S init In the embodiment, S init = 5.

[0060] If it is the first round of iteration, the initial global model θ0 of the current round is sent to each client. Otherwise, select a proportion of p clients from all clients (the same client cannot be selected for two consecutive rounds), send a verification command to these selected clients, and then send the global model θ t of the current round to other clients not selected.

[0061] Step S3, the selected client performs dataset distillation according to the ResNet-101 classification model of the last round and the local data set, and uploads the distilled data set obtained after dataset distillation to the server.

[0062] Each selected client is subjected to dataset distillation to obtain a distilled data set for scoring the client. In this case, the parameters required for training are: the local data set D of the client, the model parameter θ, the distilled data set the number of distilled data m, the learning rate η, the small batch D batch , the batch size b, the loss function f, the end condition end f , and the maximum number of iterations T. Wherein, D means the data set composed of all local data participating in training by the client, in the embodiment, the ImageNet (ISLVRC2012) data set is divided into several subsets and allocated to each client; θ means the parameter of the ResNet-101 classification model used, wherein θ orig represents the initial parameter of the model before dataset distillation, in this method, it specifically refers to the global model parameter of the last round, and θ upd represents the model parameter obtained after updating the initial model parameter θ orig using the gradient descent method; represents the distilled data set obtained by dataset distillation; m represents the number of data in the distilled data set; η represents the hyperparameter used to control the amplitude of parameter update when updating the model parameter; D represents the data set participating in training by the client; b represents the batch size; f represents the loss function; end represents the end condition; and T represents the maximum number of iterations. batchrepresents a small batch randomly selected from the local data set; b represents the number of data in the small batch; f represents a loss function used in model training, which is cross-entropy loss function in the embodiment; end f represents an end condition of data set distillation, that is, model parameters θ upd at the end of training. on the loss function, which is the loss function f(θ t-1 ; D k ) of the client at the end of the last iteration in the embodiment; T represents the maximum number of iterations of data set distillation.

[0063] Referring to Figure 4 , the detailed process of data set distillation is as follows:

[0064] 3.1 The client randomly initializes the learning rate η and the distillation data set composed of m data

[0065] 3.2 The client randomly selects b data from the local data set D to form a small batch D batch .

[0066] 3.3 The gradient value of the initial model parameters θ is calculated based on the distillation data set orig using the gradient descent method, and the updated model parameters θ upd are obtained by updating the gradient value. The expression of the gradient descent method is as follows:

[0067]

[0068]

[0069]

[0070] wherein, is the cross-entropy loss function calculated by the client based on the distillation data set and the initial model parameters θ orig ; N is the data quantity of the distillation data set ; C is the total number of labels; y is the original label list of the data x in the distillation data set ; y i is the i-th original label of the data x; p θ (x) is the label list of the data x predicted by the model with parameters θ, p θ (x) i is the i-th predicted label of the data x; is the gradient obtained by taking the partial derivative of the loss function with respect to θ orig ; θupd The model parameters obtained after the update are used to update the model parameters.

[0071] 3.4 Based on small batch D batch and the updated model parameters θ upd The loss function is calculated, and the gradient descent method is used to update and η. The expression of the gradient descent method is as follows:

[0072]

[0073]

[0074] Where f(θ upd ; D n ) is the loss function calculated by the client based on small batch D batch and the updated model parameters θ upd ; is the gradient obtained by taking the partial derivative of the loss function with respect to ; is the gradient obtained by taking the partial derivative of the loss function with respect to η; λ is the step size (learning rate) used when updating the distillation dataset and the learning rate η using the gradient descent method.

[0075] 3.5 Based on distillation dataset and the updated model parameters θ upd The loss function

[0076] If or the number of iterations T is reached, the data set distillation is ended, and Otherwise, go back to step 1.2 for the next iteration.

[0077] Step S4, the server scores according to the distillation dataset, combined with the ResNet-101 classification model of the last round and the gradient uploaded by the selected client of the last round, to obtain the cumulative score of the selected client.

[0078] Based on the gradient uploaded by the client and the distillation dataset, each client is scored, and the cumulative score of the client is calculated. Figure 5 is the cumulative score process flowchart. It is assumed that the parameters needed for training are: global model θ t-1 , cumulative score S, cosine similarity C, tolerance factor Q, critical factor B, and complete malicious factor V. Among them, θ t-1represents the global model used for scoring the clients, in this embodiment, the initial global model used in the last iteration; S represents the cumulative score of the client in multiple rounds of testing; C represents the cosine similarity between the gradient uploaded by the client and the gradient based on the distilled dataset and the initial global model t-1 ; Q represents the minimum value of the cosine similarity when the client is completely normal, in this embodiment, cos 15°; B represents the critical value of the cosine similarity when the client is normal or malicious, in this embodiment, cos 30°; and V represents the maximum value of the cosine similarity when the client is completely malicious, in this embodiment, cos 90°.

[0079] With reference to Figure 5 , the cumulative scoring process is as follows:

[0080] 4.1 The server receives the distilled dataset of the client k After that, based on the global model θ t-1 of the last round, one step of gradient descent is performed, and the gradient of the global model is calculated

[0081] 4.2 The cosine similarity C between the gradient and the gradient uploaded by the client in the last round is calculated k The expression of the cosine similarity C k is as follows:

[0082]

[0083] wherein θ is the gradient uploaded by the client k in the last round (round t-1).

[0084] 4.3 The round score S k，t of the client is calculated. The expression of the round score S k，t is as follows:

[0085]

[0086] wherein L>0 is a scaling factor of the score, which limits the range of S k，t to [L, -L], and in this embodiment, L=5; and K>1 is a speed factor of the score, which can control the descending speed of S k，t in addition to preventing the argument of the logarithmic function from going out of bounds, and in this embodiment, K=2. The descending speed of S k，t is related to the distance between C k and B, and the farther the distance, the faster the descending speed. In the expression, the smaller K is, the faster the descending speed of S k，t is about C​k The greater the acceleration of the distance between A and B is.

[0087] 4.4 Update the cumulative score S of the client k The cumulative score S k The expression is as follows:

[0088] S k = S k + S k，t (8)

[0089] Step S5, the selected client with the cumulative score greater than or equal to the score threshold participates in the next round of federated training, and the selected client with the cumulative score less than the score threshold is eliminated.

[0090] This step can eliminate malicious clients that intentionally upload wrong gradients with a cumulative score less than the score threshold, reduce the interference of malicious clients on the federated learning process, and further improve the accuracy of the federated learning algorithm, so that the model can quickly reach a convergent state.

[0091] Step S6, the unselected client performs local training based on the local data set and the ResNet-101 classification model of the current round, and uploads the obtained gradient after training to the server.

[0092] After receiving the global model sent by the server, the unselected client performs E times of local training based on the local data and the global model; wherein E is the number of times of updating the model parameters using the gradient descent method by the unselected client locally in each round.

[0093] Step S7, the server calculates the ResNet-101 classification model of the next round according to the gradient uploaded by all unselected clients.

[0094] The calculation formula of the ResNet-101 classification model of the next round is

[0095]

[0096] In the formula, θ t+1 is the ResNet-101 classification model of round t+1, θ t is the ResNet-101 classification model of round t, is the gradient uploaded by the client i in round t, α is the learning rate used when updating the model parameters using the gradient descent method, n i is the size of the local data set of the client i, S init is the initial cumulative score of the client i, S i is the cumulative score of the client i in round t, S limit is the score threshold.

[0097] Step S8, when the number of rounds reaches the global iteration number, stop federated training, and obtain the final ResNet-101 classification model.

[0098] In the training process of the present application, there may be lazy clients that do not perform model training but always obtain the global model. In order to achieve its purpose, the lazy client often sends a random gradient close to 0. Because such a client cannot predict the correct update direction of the model, the random gradient it uploads is likely to deviate from the correct direction. If the scoring rule is set to be relatively strict (in this embodiment, the angle between two gradients is within 30 degrees to score positive), the score is most likely to be negative. In addition, if the uploaded gradient is 0, the score is directly negative. Therefore, this method also has a certain elimination effect on lazy clients and can prevent such clients from eavesdropping to a certain extent.

[0099] The present application first requires each client to record the global model of the last round and the loss function obtained at the last local update in the training process of the client. Secondly, at the beginning of each round, the server randomly selects a certain proportion of clients from the clients participating in the training, requires them not to perform the next round of update, but needs to perform data set distillation based on the global model of the last round and the local data set, and the termination condition is that the loss function is less than the loss function of the client at the end of the last round. Then, the server calculates the model gradient using the distillation data set uploaded by the selected client, and calculates the cosine similarity according to the gradient and the gradient uploaded by the client in the last round, and updates the cumulative score of the client. If the cumulative score is less than a specified threshold, we will prohibit (eliminate) the client to participate in subsequent federated learning, and only use the gradient uploaded by the client that meets the evaluation result to update the global model until the model converges. This method not only can eliminate malicious clients that deliberately upload incorrect gradients and lazy clients that only obtain models but do not participate in training, but also can ensure that the training accuracy is not reduced to a certain extent, and can effectively guarantee the security of the federated learning process.

[0100] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts are described in the method part.

[0101] The principles and implementation manners of the present application are described by applying specific examples in the embodiments above, and the above description of the embodiments is only used for helping to understand the method of the present application and its core idea; meanwhile, for the general technical personnel in the art, the specific implementation manners and application ranges will be changed according to the idea of the present application. In conclusion, the content of the present description should not be understood as the limitation of the present application.

Claims

1. A federated learning method for pruning malicious clients, characterized in that, The method comprises the following steps: dividing an ImageNet dataset into multiple subsets and assigning each subset to a client as a local dataset of the client; selecting a preset proportion of clients from all clients and sending a verification command, and sending a ResNet-101 classification model of a current round to clients not selected; selected clients performing dataset distillation according to a ResNet-101 classification model of a previous round and the local dataset, and uploading a distillation dataset obtained after the dataset distillation to a server; the server scoring according to the distillation dataset, in combination with the ResNet-101 classification model of the previous round and gradients uploaded by the selected clients of the previous round, to obtain cumulative scores of the selected clients; selected clients with cumulative scores greater than or equal to a score threshold are allowed to participate in a next round of federated training, and selected clients with cumulative scores less than the score threshold are removed; clients not selected perform local training based on their local dataset and the ResNet-101 classification model of the current round, and upload gradients obtained after the training to the server; the server calculates a ResNet-101 classification model of a next round according to the gradients uploaded by all clients not selected; when the number of rounds reaches a global iteration number, the federated training is stopped, and a final ResNet-101 classification model is obtained.

2. The federated learning method of removing malicious clients according to claim 1, wherein, The selected clients perform dataset distillation according to the ResNet-101 classification model of the previous round and the local dataset, specifically comprising: The selected client randomly initializes a learning rate η and a distillation dataset consisting of m data sets The selected clients randomly select b data from the local dataset D to form a mini-batch D batch ; According to the learning rate η and the distillation dataset The parameters of the ResNet-101 classification model of the last round are updated by using the gradient descent method to obtain updated model parameters θ upd ; Based on small batch D batch and updated model parameters θ upd , using gradient descent method to update distillation dataset and learning rate η; based on the updated distillation dataset and the updated model parameters θ upd computing a cross-entropy loss function If and the maximum number of iterations T is not reached, the learning rate η is replaced by the updated learning rate, the distillation dataset is replaced by the updated distillation dataset, and the function returns "the selected client randomly selects b data from the local dataset D to form a mini-batch D batch "; where end f is the upper limit of the loss function; If or a maximum number of iterations T is reached, the dataset distillation is ended and the updated distilled dataset is output.

3. The federated learning method of removing malicious clients according to claim 2, characterized in that, The learning rate η and the distillation dataset The parameters of the ResNet-101 classification model of the last round are updated by using the gradient descent method to obtain updated model parameters θ upd , specifically comprising: Based on distillation dataset Using formula Calculate the parameters θ of the ResNet-101 classification model from the previous round. orig The gradient; where, For the selected client based on the distillation dataset and parameter θ orig The calculated cross-entropy loss function, for Regarding the parameter θ orig The gradient is obtained by taking the partial derivative; According to the learning rate η and the gradient of the parameters θ of the ResNet-101 classification model in the last round orig , the updated model parameters θ are calculated using the formula upd .

4. The federated learning method of malicious client pruning according to claim 1, characterized in that, The server scores according to the distillation dataset, in combination with the ResNet-101 classification model of the previous round and the gradients uploaded by the selected clients of the previous round, to obtain cumulative scores of the selected clients, specifically comprising: The server calculates gradients of the ResNet-101 classification model of the previous round according to the distillation dataset and the ResNet-101 classification model of the previous round; The cosine similarity between the gradients of the ResNet-101 classification model of the previous round and the gradients uploaded by the selected clients of the previous round is calculated. According to the cosine similarity, the score of the selected clients in the current round is calculated. The score of the current round is added to the cumulative score before the current round to obtain an updated cumulative score of the selected clients.

5. The federated learning method of malicious client pruning according to claim 4, characterized in that, The formula for calculating the cosine similarity is In the formula, C k is the cosine similarity, is the distillation dataset uploaded by the selected client k in the tth round based on the server the gradient of the ResNet-101 classification model in the t-1th round calculated, is the gradient uploaded by the selected client k in the t-1th round. The formula for calculating the score of the selected clients in the current round is In the formula, S k,t is the score of the selected client k in the tth round, L is a scaling factor of the score, L > 0, Q is a leniency factor, B is a critical factor, V is a full malicious factor, and K is a speed factor of the score, K > 1.

6. The federated learning method of malicious client pruning according to claim 1, characterized in that, The formula for calculating the ResNet-101 classification model of the next round is In the formula, θ t+1 is the ResNet-101 classification model of the t+1th round, θ t is the ResNet-101 classification model of the tth round, is the gradient uploaded by the client i in the tth round, α is the learning rate used when the model parameter is updated by using the gradient descent method, n i is the local data set size of the client i, S init is the initial cumulative score of the client i, S i is the cumulative score of the client i in the tth round, S limit is the score threshold.

7. The federated learning method of malicious client pruning according to claim 1, characterized in that, The method further comprises the following steps before the step of selecting a preset proportion of clients from all clients and sending a verification command, and sending a ResNet-101 classification model of a current round to clients not selected: The server initializes the ResNet-101 classification model θ0, and initializes the cumulative score of each client to S init ; If it is the first round of iteration, the ResNet-101 classification model θ0 is sent to each client. 8.The federated learning method of eliminating malicious clients according to claim 1, wherein, The same client cannot be selected for two consecutive rounds.

Images