A federated learning method, apparatus and electronic device

Abstract

Embodiments of the present application provide a federated learning method, device and electronic equipment. The method comprises: obtaining model parameters obtained by training a to-be-trained model by a plurality of clients respectively as candidate model parameters; determining densities of the candidate model parameters in the neighborhood of each candidate model parameter in a model parameter space with the values of each parameter in the model parameters as dimensions as local reachable densities corresponding to the candidate model parameters respectively; performing weighted aggregation on each candidate model parameter according to the local reachable densities corresponding to each candidate model parameter to obtain updated model parameters; and updating the model parameters of the to-be-trained model to the updated model parameters to obtain a trained model. The influence of a model poisoning attack on a model obtained by federated learning training can be reduced, and the performance of the trained model can be improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a federated learning method, apparatus, and electronic device. Background Technology

[0002] In some application scenarios, it is necessary to use data from multiple users to jointly train a model for specific business operations, such as models for face recognition, speech recognition, and image restoration. To prevent one user's data from being accessed by other users, related technologies involve each user training the same model using their own client based on their own data, obtaining model parameters, and then uploading these parameters to a common device (referred to as the coordinator in this paper). The coordinator updates the model based on the parameters uploaded by each client and redistributes the updated model to each client. Each client then uses the updated model as the new model to be trained, retrains it based on its own data, and uploads the resulting parameters back to the coordinator. This process continues until training is complete. This training method is referred to as federated learning.

[0003] However, if a user uploads forged malicious model parameters through the client during the federated learning process (hereinafter referred to as model poisoning attack, and malicious model parameters as abnormal model parameters), it will cause the performance of the updated model to decline, resulting in poor performance of the trained model and failure to achieve the expected business. Summary of the Invention

[0004] The purpose of this application is to provide a federated learning method, apparatus, and electronic device to reduce the impact of model poisoning attacks on the performance of the trained model. The specific technical solution is as follows:

[0005] In a first aspect of this application, a federated learning method is provided, the method comprising:

[0006] Obtain the model parameters obtained by multiple clients from training the model to be trained, and use them as candidate model parameters;

[0007] In the model parameter space, which is dimensional by the value of each parameter in the model parameters, the density of the candidate model parameters in the neighborhood of each candidate model parameter is determined as the local reachability density corresponding to the candidate model parameter.

[0008] Based on the local reachability density corresponding to each candidate model parameter, the candidate model parameters are weighted and aggregated to obtain updated model parameters, wherein the weight of the candidate model parameter in the weighted aggregation process is positively correlated with the local reachability density corresponding to the candidate model parameter;

[0009] The model parameters of the model to be trained are updated to the updated model parameters to obtain the trained model.

[0010] In one possible embodiment, determining the density of each candidate model parameter within the neighborhood of each candidate model parameter in the model parameter space, which is dimensional by the values ​​of each parameter in the model parameters, as the local reachability density corresponding to the candidate model parameter, includes:

[0011] In the model parameter space of the dimension of each parameter in the model parameter, other candidate model parameters existing in the neighborhood of each candidate model parameter are determined and used as the neighborhood model parameters corresponding to the candidate model parameter.

[0012] Based on the distance between the neighborhood model parameters corresponding to each candidate model parameter and the candidate model parameters, the local reachability density corresponding to each candidate model is determined, wherein the local reachability density is negatively correlated with the distance.

[0013] In one possible embodiment, determining the other candidate model parameters existing in the neighborhood of each candidate model parameter as the neighborhood model parameters corresponding to the candidate model parameters includes:

[0014] In the model parameter space, which is dimensional by the values ​​of each parameter in the model parameters, the k nearest model parameters to each candidate model parameter are determined from each candidate model parameter and are used as the neighborhood model parameters corresponding to the candidate model parameter, where k is a preset integer greater than 1.

[0015] In one possible embodiment, determining the local reachability density of each candidate model based on the distance between the neighboring model parameters and the candidate model parameters corresponding to each candidate model parameter includes:

[0016] Based on the reachability distance from the neighboring model parameter to the candidate model parameter corresponding to each candidate model parameter, the local reachability density corresponding to each candidate model is determined respectively, wherein the local reachability density is negatively correlated with the reachability distance, and the reachability distance is the larger value of the k-nearest neighbor distance of the neighboring model parameter and the Euclidean distance between the neighboring model parameter and the candidate model parameter.

[0017] In one possible embodiment, the step of weighted aggregation of the candidate model parameters based on the local reachability density corresponding to each candidate model parameter to obtain updated model parameters includes:

[0018] Based on the local reachability density corresponding to each candidate model parameter, the weights of each candidate model parameter are determined respectively, wherein the weights are positively correlated with the local reachability density of the candidate model parameter and negatively correlated with the local reachability density of the neighborhood model parameters corresponding to the candidate model parameter.

[0019] The candidate model parameters are weighted and aggregated according to their respective weights to obtain the updated model parameters.

[0020] In one possible embodiment, the method further includes:

[0021] Among the candidate model parameters, the model parameters whose local reachability density satisfies the preset abnormal density condition are determined as abnormal model parameters;

[0022] Until no new abnormal model parameters can be determined, the model parameters other than the abnormal model parameters among the candidate model parameters are taken as new candidate model parameters, and the process returns to the step of determining the density of the candidate model parameters in the neighborhood of each candidate model parameter in the model parameter space with the value of each parameter in the model parameters as the local reachability density corresponding to the candidate model parameter.

[0023] The step of weighted aggregation of the candidate model parameters based on the local reachability density corresponding to each candidate model parameter to obtain the updated model parameters includes:

[0024] Based on the latest local reachability density corresponding to the initial candidate model parameters, the candidate model parameters are weighted and aggregated to obtain the updated model parameters.

[0025] In one possible embodiment, the method further includes:

[0026] Until the preset training end condition is met, the trained model is used as the new model to be trained, and the step of obtaining the model parameters obtained by each client from training the model to be trained, and using them as candidate model parameters, is returned.

[0027] Based on the local reachability density corresponding to the candidate model parameters obtained from each client, the confidence level of each client as a normal client is determined, and the confidence level is positively correlated with the local reachability density.

[0028] In a second aspect of this application, an image recognition method is provided, the method comprising:

[0029] Acquire the image to be recognized;

[0030] The image to be recognized is input into the trained model to obtain the recognition result output by the trained model. The trained model is a model that has been trained in advance according to any of the methods described in the first aspect above.

[0031] In a third aspect of this application, a federated learning apparatus is provided, the apparatus comprising:

[0032] The model parameter acquisition module is used to acquire the model parameters obtained by multiple clients from training the model to be trained, and use them as candidate model parameters.

[0033] An anomaly detection module is used to determine the density of each candidate model parameter in the neighborhood of each candidate model parameter in the model parameter space, which is dimensional by the value of each parameter in the model parameters, and use it as the local reachability density corresponding to the candidate model parameter.

[0034] The weighted aggregation module is used to perform weighted aggregation on each candidate model parameter according to the local reachability density corresponding to each candidate model parameter to obtain updated model parameters, wherein the weight of the candidate model parameter in the weighted aggregation process is positively correlated with the local reachability density corresponding to the candidate model parameter;

[0035] The model update module is used to update the model parameters of the model to be trained to the updated model parameters, thereby obtaining the trained model.

[0036] In one possible embodiment, the anomaly detection module determines the density of each candidate model parameter within the neighborhood of each candidate model parameter in a model parameter space with the values ​​of each parameter in the model parameters as dimensions, as the local reachability density corresponding to the candidate model parameter, including:

[0037] In the model parameter space of the dimension of each parameter in the model parameter, other candidate model parameters existing in the neighborhood of each candidate model parameter are determined and used as the neighborhood model parameters corresponding to the candidate model parameter.

[0038] Based on the distance between the neighborhood model parameters corresponding to each candidate model parameter and the candidate model parameters, the local reachability density corresponding to each candidate model is determined, wherein the local reachability density is negatively correlated with the distance.

[0039] In one possible embodiment, the anomaly detection module determines other candidate model parameters existing in the neighborhood of each candidate model parameter, as the neighborhood model parameters corresponding to the candidate model parameters, including:

[0040] In the model parameter space, which is dimensional by the values ​​of each parameter in the model parameters, the k nearest model parameters to each candidate model parameter are determined from each candidate model parameter and are used as the neighborhood model parameters corresponding to the candidate model parameter, where k is a preset integer greater than 1.

[0041] In one possible embodiment, the anomaly detection module determines the local reachability density corresponding to each candidate model based on the distance between the neighboring model parameters and the candidate model parameters corresponding to each candidate model parameter, including:

[0042] Based on the reachability distance from the neighboring model parameter to the candidate model parameter corresponding to each candidate model parameter, the local reachability density corresponding to each candidate model is determined respectively, wherein the local reachability density is negatively correlated with the reachability distance, and the reachability distance is the larger value of the k-nearest neighbor distance of the neighboring model parameter and the Euclidean distance between the neighboring model parameter and the candidate model parameter.

[0043] In one possible embodiment, the weighted aggregation module performs weighted aggregation on each candidate model parameter based on the local reachability density corresponding to each candidate model parameter to obtain updated model parameters, including:

[0044] Based on the local reachability density corresponding to each candidate model parameter, the weights of each candidate model parameter are determined respectively, wherein the weights are positively correlated with the local reachability density of the candidate model parameter and negatively correlated with the local reachability density of the neighborhood model parameters corresponding to the candidate model parameter.

[0045] The candidate model parameters are weighted and aggregated according to their respective weights to obtain the updated model parameters.

[0046] In one possible embodiment, the anomaly detection module is further configured to determine, among each of the candidate model parameters, the model parameter whose local reachability density satisfies the preset anomaly density condition, as the anomaly model parameter;

[0047] Until no new abnormal model parameters can be determined, the model parameters other than the abnormal model parameters among the candidate model parameters are taken as new candidate model parameters, and the process returns to the step of determining the density of the candidate model parameters in the neighborhood of each candidate model parameter in the model parameter space with the value of each parameter in the model parameters as the local reachability density corresponding to the candidate model parameter.

[0048] The step of weighted aggregation of the candidate model parameters based on the local reachability density corresponding to each candidate model parameter to obtain the updated model parameters includes:

[0049] Based on the latest local reachability density corresponding to the initial candidate model parameters, the candidate model parameters are weighted and aggregated to obtain the updated model parameters.

[0050] In one possible embodiment, the device further includes a post-training control module, which is used to return to the step of obtaining the model parameters obtained by the multiple clients from training their respective models as candidate model parameters until a preset training end condition is met.

[0051] Based on the local reachability density corresponding to the candidate model parameters obtained from each client, the confidence level of each client as a normal client is determined, and the confidence level is positively correlated with the local reachability density.

[0052] In a fourth aspect of this application, an image recognition apparatus is provided, the apparatus comprising:

[0053] The acquisition module is used to acquire the image to be recognized;

[0054] The input module is used to input the image to be recognized into the trained model and obtain the recognition result output by the trained model. The trained model is a model that has been trained in advance according to any of the methods described in the first aspect above.

[0055] In a fifth aspect of this application, an electronic device is provided, comprising:

[0056] Memory, used to store computer programs;

[0057] When a processor executes a program stored in memory, it implements the steps of the method described in either the first or second aspect above.

[0058] In a sixth aspect of this application, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the steps of the method described in either the first or second aspect above.

[0059] Beneficial effects of the embodiments in this application:

[0060] The federated learning method, apparatus, and electronic device provided in this application can determine the density of candidate model parameters in the neighborhood of each candidate model parameter in the model parameter space. Since the model parameter space is dimensional by the values ​​of each parameter in the model parameters, other candidate model parameters in the neighborhood of a candidate model parameter can be considered as model parameters similar to that candidate model parameter. Therefore, if the density of candidate model parameters in the neighborhood of a candidate model parameter is greater, that is, the local reachability density is greater, then more candidate model parameters are considered to be similar to that candidate model parameter. Conversely, if the local reachability density of a candidate model parameter is smaller, then fewer candidate model parameters are considered to be similar to that candidate model parameter. Clients that launch model poisoning attacks are usually a minority. Therefore, most, if not all, of the candidate model parameters are based on training. Theoretically, these trained candidate model parameters should approximate the most accurate theoretical model parameters. Thus, these candidate model parameters have a certain degree of similarity. The more similar a candidate model parameter is to other candidate model parameters, the lower the probability that it is an anomalous model parameter resulting from a model poisoning attack. Conversely, the fewer similar a candidate model parameter is to other candidate model parameters, the higher the probability that it is an anomalous model parameter resulting from a model poisoning attack. Therefore, the higher the local reachability density of a candidate model parameter, the less likely it is to be an anomalous model parameter. In this embodiment, during weighted aggregation, lower weights are assigned to candidate model parameters with lower local reachability densities. This reduces the impact of candidate model parameters with lower local reachability densities on the updated model parameters. In other words, the more likely a candidate model parameter is to be an anomalous model parameter, the smaller its impact on the updated model parameters, and consequently, the smaller its impact on the trained model based on the updated model parameters. As can be seen, this embodiment can effectively reduce the impact of model poisoning attacks on the performance of models trained by federated learning and improve the stability of federated learning.

[0061] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0063] Figure 1 A schematic diagram illustrating an application scenario of the federated learning method provided in this application;

[0064] Figure 2 A flowchart illustrating the federated learning approach provided for this application;

[0065] Figure 3 A schematic flowchart illustrating the local reachability density calculation method provided in this application;

[0066] Figure 4 Another flowchart illustrating the federated learning approach provided for this application;

[0067] Figure 5 A flowchart illustrating the federated learning approach for achieving proactive defense through post-event control, as provided in this application.

[0068] Figure 6a A schematic diagram showing the model parameters uploaded by the two clients participating in federated learning for this application;

[0069] Figure 6b An interactive diagram illustrating the federated learning method provided in this application;

[0070] Figure 6c A flowchart illustrating the weighted aggregation process in the federated learning method provided in this application;

[0071] Figure 7 A flowchart illustrating the image recognition method provided in this application;

[0072] Figure 8 A schematic diagram of the federal learning device provided in this application;

[0073] Figure 9 A schematic diagram of the image recognition device provided in this application;

[0074] Figure 10 A schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0075] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0076] To more clearly illustrate the federated learning method provided in this application, an exemplary application scenario of the federated learning method provided in this application will be described below. It should be understood that the following example is only one possible application scenario of the federated learning method provided in this application. In other possible embodiments, the federated learning method provided in this application can also be applied to other possible application scenarios. The following example does not impose any limitations on this.

[0077] See Figure 1 , Figure 1 The diagram illustrates the principle of federated learning provided in this application. This example includes two clients and a coordinator, Arbiter. The two clients are denoted as Client1 and Client2, and it is assumed that Client1 belongs to user 1 and Client2 belongs to user 2. Client1 and Client2 each maintain their local models, while Arbiter maintains the global model.

[0078] Initially, each local model and the global model are models to be trained. Client1 trains the local model based on user 1's data, obtains model parameter 1, and uploads it to Arbiter. Client2 trains the local model based on user 2's data, obtains model parameter 2, and uploads it to Arbiter.

[0079] Arbiter aggregates model parameter 1 and model parameter 2 to obtain aggregated model parameters, and then sends the aggregated model parameters to Client1 and Client2. Arbiter, Client1, and Client2 update the model parameters of their respective models with the aggregated model parameters to obtain new local and global models.

[0080] The above process is repeated with the new local model and global model until training is complete. The latest global model maintained by Arbiter is then used as the trained model to implement specific business logic. Because user 1's data is only used by user 1's own client (Client1) and user 2's data is only used by user 2's own client (Client2), user 1 and user 2 have difficulty accessing each other's data, effectively improving data security.

[0081] However, if either Client1 or Client2 uploads model parameters that were not obtained through training a local model—for example, suppose Client2 uploads abnormal model parameters forged by User 2—then the aggregated model parameters will converge towards the incorrect model parameters, resulting in a poor-performing trained model that cannot be used to implement specific business logic. Therefore, a model poisoning attack during federated learning will lead to poor-performing trained models.

[0082] Based on this, this application provides a federated learning method, such as Figure 2 As shown, it includes:

[0083] S201: Obtain the model parameters obtained by multiple clients from training the model to be trained, and use them as candidate model parameters.

[0084] S202, in the model parameter space with the values ​​of each parameter in the model parameters as dimensions, determine the density of candidate model parameters in the neighborhood of each candidate model parameter, which is used as the local reachability density of the candidate model parameter.

[0085] S203, based on the local reachability density corresponding to each candidate model parameter, perform weighted aggregation on each candidate model parameter to obtain the updated model parameters. The weight of the candidate model parameter in the weighted aggregation process is positively correlated with the local reachability density corresponding to the candidate model parameter.

[0086] S204 updates the model parameters of the model to be trained to the updated model parameters, thus obtaining the trained model.

[0087] Using this embodiment, the density of candidate model parameters within the neighborhood of each candidate model parameter can be determined in the model parameter space. Since the model parameter space is dimensioned by the values ​​of each parameter in the model parameters, other candidate model parameters within the neighborhood of a candidate model parameter can be considered as model parameters similar to that candidate model parameter. Therefore, if the density of candidate model parameters within the neighborhood of a candidate model parameter is greater, i.e., the greater the local reachability density, the more candidate model parameters are considered to be similar to that candidate model parameter. Conversely, if the local reachability density of a candidate model parameter is smaller, the fewer candidate model parameters are considered to be similar to that candidate model parameter. Clients that launch model poisoning attacks are usually a minority. Therefore, most, if not all, of the candidate model parameters are based on training. Theoretically, these trained candidate model parameters should approximate the most accurate theoretical model parameters. Thus, these candidate model parameters have a certain degree of similarity. The more similar a candidate model parameter is to other candidate model parameters, the lower the probability that it is an anomalous model parameter resulting from a model poisoning attack. Conversely, the fewer similar a candidate model parameter is to other candidate model parameters, the higher the probability that it is an anomalous model parameter resulting from a model poisoning attack. Therefore, the higher the local reachability density of a candidate model parameter, the less likely it is to be an anomalous model parameter. In this embodiment, during weighted aggregation, lower weights are assigned to candidate model parameters with lower local reachability densities. This reduces the impact of candidate model parameters with lower local reachability densities on the updated model parameters. In other words, the more likely a candidate model parameter is to be an anomalous model parameter, the smaller its impact on the updated model parameters, and consequently, the smaller its impact on the trained model based on the updated model parameters. As can be seen, this embodiment can effectively reduce the impact of model poisoning attacks on the performance of models trained by federated learning and improve the stability of federated learning.

[0088] The following will explain S201-204 respectively, wherein:

[0089] In S201, each client trains the model to be trained based on the data of its own user. For example, suppose there are 100 clients, labeled client 1-100, where client 1 belongs to user 1, client 2 belongs to user 2, and so on. Then client 1 trains the model to be trained based on user 1's data, client 2 trains the model to be trained based on user 2's data, and so on.

[0090] Each candidate model parameter includes one or more parameters, and the number of parameters included in each candidate model parameter should be equal to the number of parameters that the model to be trained needs to obtain through training. For example, in one application scenario, the model to be trained needs to obtain the parameter values ​​of a total of 20 parameters for 3 convolutional layers through training, then each candidate model parameter in this application scenario includes 20 parameters. In another application scenario, the model to be trained needs to obtain the parameter values ​​of a total of 10 parameters for 1 convolutional layer and 1 pooling layer through training, then each candidate model parameter in this application scenario includes 10 parameters.

[0091] In S202, the model parameter space is an N-dimensional space, where N is the number of parameters included in the candidate model parameters. The first dimension represents the value of the first parameter in the candidate model parameters, the second dimension represents the value of the second parameter in the candidate model parameters, and so on. For example, assuming that there are four parameters in the model to be trained, the candidate model parameters should include four parameters, denoted as parameter 1, parameter 2, parameter 3, and parameter 4. Then, the first dimension of the model parameter space is the value of parameter 1, the second dimension is the value of parameter 2, the third dimension is the value of parameter 3, and the fourth dimension is the value of parameter 4. Assuming that the values ​​of parameters 1-4 in a candidate model parameter are 0.1, 0.8, 0.6, and 0.5 respectively, the position of the candidate model parameter in the model parameter space can be represented as a one-dimensional vector (0.1, 0.8, 0.6, 0.5) or as a one-dimensional matrix |0.1, 0.8, 0.6, 0.5|. In the following text, distance, density, and coordinates refer to distance, density, and coordinates within the model parameter space.

[0092] As can be seen, a candidate model parameter can be considered as a point in the model parameter space, and therefore each obtained candidate model parameter can be considered as multiple points in the model parameter space. The neighborhood of a candidate model parameter is the spatial region in the model parameter space that includes the point corresponding to the candidate model parameter. The size and shape of this spatial region can vary depending on the application scenario. For example, in one possible embodiment, the spatial region is a cube region with a preset length L as its side length and the point corresponding to the candidate model parameter as its center. In another possible embodiment, the spatial region is an ellipsoidal region with a preset size and the point corresponding to the candidate model parameter as its focus. In yet another possible embodiment, the spatial region is a spherical region with the point corresponding to the candidate model parameter as its center and the k-nearest neighbor distance of the candidate model parameter as its radius.

[0093] In this paper, the k-nearest neighbor distance of a candidate model parameter refers to the distance between the candidate model parameter and the other candidate model parameter located at the k-th position when sorted in ascending order of distance from the candidate model parameter. For example, suppose there are 100 candidate model parameters, denoted as candidate model parameters 1-100. The distance between candidate model parameter 2 and candidate model parameter 1 is denoted as distance 2, the distance between candidate model parameter 3 and candidate model parameter 1 as distance 3, and so on. If distance 2 < distance 3 < distance 4 < ... < distance 99 < distance 100, and k = 5, since the other candidate model parameter located at the 5th position when sorted in ascending order of distance from candidate model parameter 1 is candidate model parameter 6, and the distance between candidate model parameter 6 and candidate model parameter 1 is distance 6, the 5-nearest neighbor distance of candidate model parameter 1 is distance 6. The same logic applies to other values ​​of k, which will not be elaborated further below.

[0094] The neighborhood is a spatial region in the model parameter space. Therefore, each candidate model parameter in the neighborhood can be regarded as a model parameter in the same spatial region. That is, the positions of each candidate model parameter in the neighborhood are close. Since the model parameter space is based on the value of each parameter, the values ​​of each parameter in the candidate model parameters that are close in position are also similar. That is, the candidate model parameters in the neighborhood are similar.

[0095] Furthermore, the density of candidate model parameters within the neighborhood of a candidate model parameter is positively correlated with the number of other candidate model parameters included in that neighborhood. Therefore, the higher the local reachability density of a candidate model parameter, the more other candidate model parameters are considered to be similar to that candidate model parameter. Since normal model parameters (i.e., the model parameters of non-abnormal model parameters) are obtained by training the same model, although the data they are based on are different, they have a certain degree of similarity. Abnormal model parameters, on the other hand, are forged and therefore often inconsistent with normal model parameters. Even if a model poisoning attack occurs, only a small number of clients carry out the attack; therefore, most candidate model parameters can be considered normal model parameters. Thus, the more similar a candidate model parameter is to other candidate model parameters, the higher the probability that the candidate model parameter is a normal model parameter.

[0096] In S203, the positive correlation between weight and local reachability density means that, with other factors affecting weight remaining constant except for local reachability density, the weight increases as local reachability density increases. This increase in weight can be monotonically increasing or non-monotonic.

[0097] It is understandable that the larger the weight of a candidate model parameter in the weighted aggregation process, the greater its influence on the updated model parameters obtained by weighted aggregation. Combining this with the analysis in S202 above, it is evident that the higher the probability that a candidate model parameter is a normal model parameter in this application, the greater its influence on the updated model parameters obtained by weighted aggregation; conversely, the higher the probability that a candidate model parameter is an abnormal model parameter in this application, the smaller its influence on the updated model parameters obtained by weighted aggregation.

[0098] In S204, since the model parameters of the trained model are the same as the updated model parameters, the greater the influence of the candidate model parameters on the updated model parameters obtained by weighted aggregation, the greater the influence of the candidate model parameters on the trained model. Combining this with the analysis in S202 and S203, it is evident that the higher the probability that the candidate model parameters are anomalous, the smaller their influence on the trained model. In other words, this application can effectively reduce the impact of anomalous model parameters generated by model poisoning attacks on the trained model obtained through federated learning. The trained model can be applied to various scenarios according to actual needs, such as image recognition, audio recognition, and text recognition.

[0099] The following will provide examples of how to calculate the aforementioned local reachability density and weights:

[0100] In one possible embodiment, for the aforementioned local reachability density, the number of other candidate model parameters included in the neighborhood of a candidate model parameter can be counted, and the ratio of this number to the volume of the neighborhood can be used as the local reachability density corresponding to the candidate model parameter.

[0101] In another possible embodiment, the local reachability density is calculated as follows: Figure 3 As shown, it includes:

[0102] S301, in the model parameter space, determine the other candidate model parameters existing in the neighborhood of each candidate model parameter, and use them as the neighborhood model parameters corresponding to the candidate model parameters.

[0103] Here, other candidate model parameters refer to candidate model parameters other than the candidate model parameter itself. For example, assuming that the neighborhood of candidate model parameter 1 includes candidate model parameters 1-6, then the neighborhood model parameters corresponding to candidate model parameter 1 include candidate model parameters 2-6.

[0104] S302, based on the distance between the neighboring model parameters and the candidate model parameters, determine the local reachability density of each candidate model, where the local reachability density is negatively correlated with the distance.

[0105] The negative correlation between local reachability density and distance means that, assuming other factors affecting local reachability density remain constant, local reachability density decreases as distance increases. This decrease can be monotonically decreasing or non-monotonic.

[0106] For ease of description, let p be the point in the model parameter space corresponding to the candidate model parameter, and let N be the set of points in the model parameter space corresponding to each neighboring model parameter of the candidate model parameter. k (p), then the local reachability density corresponding to the parameters of the candidate model satisfies formula (1):

[0107] LRD(p)=f(dist(p,q1),dist(p,q2),…,dist(p,q m ))… (1)

[0108] Where LRD(p) is the local reachability density corresponding to the parameters of the candidate model, and f() is an arbitrary decreasing function, that is, the value of LRD(p) changes with dist(p, q1), dist(p, q2), ..., dist(p, q3). m The value of ) decreases as it increases, and q1 is N. k The first point in (p), q2 is N k The first point in (p), and so on, m being N k The number of points included in (p) can be understood as follows, based on the aforementioned explanation of k-nearest neighbor distance, if the neighborhood is a spherical space centered on the candidate model parameters and with k-nearest neighbor distance as its radius, then N k (p) includes k points, i.e., m = k. dist(p, q1) is the distance between point p and point q1, dist(p, q2) is the distance between point p and point q2, and so on.

[0109] The decreasing function f() can be different functions depending on the application scenario. For example, in one possible embodiment, formula (1) is specifically formula (2):

[0110]

[0111] In another possible embodiment, formula (1) is specifically formula (3):

[0112]

[0113] Understandably, although the neighborhood model parameters are all located within the neighborhood of the corresponding candidate model parameters, the neighborhood model parameters are clearly more similar to the candidate model parameters when they are all located closer to them than when they are all located at the boundaries of the neighborhood. As analyzed earlier, local reachability density can reflect the similarity of a candidate model parameter to other candidate model parameters to a certain extent. Therefore, the calculated local reachability density should be higher when the neighborhood model parameters are all located closer to the candidate model parameters than when they are all located at the boundaries of the neighborhood. However, if the local reachability density is calculated by counting the number of other candidate model parameters included in the neighborhood of a candidate model parameter and using the ratio of this number to the volume of the neighborhood as the local reachability density for that candidate model parameter, the calculated local reachability densities are the same in both cases, which is obviously inaccurate. Therefore, choosing... Figure 3 The embodiment shown solves this technical problem by calculating the local reachability density through the distance between the neighborhood model parameters and the candidate model parameters. This allows the calculated local reachability density to better reflect the similarity between a candidate model parameter and other candidate model parameters, and thus more reasonably perform weighted summation on each candidate model parameter to further reduce the impact of abnormal model parameters on the trained model.

[0114] The aforementioned dist(p, q) can be the Euclidean distance or Mahalanobis distance between points p and q. In another possible embodiment, it can also be the reachable distance from point q to point p. The reachable distance from point q to point p refers to the larger of the k-nearest neighbor distance of point q and the Euclidean distance between point p and point q. For details on the k-nearest neighbor distance, please refer to the relevant explanation in S202 above, which will not be repeated here. If the k-nearest neighbor distance of point q is denoted as dist... k (q), let dist be the Euclidean distance between points p and q. o (p, q), let dist be the reachable distance from point q to point p. r If (p, q), then formula (4) exists:

[0115] dist r (p,q)=max{dist o (p,q),dist k (q)}… (4)

[0116] For example, suppose dist k (q) is 5, if dist o If (p, q) is 6, then dist r (p, q) is 6, and if dist o If (p, q) is 4, then dist r (p, q) is 5.

[0117] In one possible embodiment, the aforementioned weights can be calculated according to formula (5):

[0118] a i =LRD(p i ) / LRD max … (5)

[0119] Among them, a i p represents the weight of the i-th candidate model parameter during the weighted aggregation process. i Let LRD(p) be the point in the model parameter space corresponding to the i-th candidate model parameter. i Let p be a point. i Local reachability density, i.e., the local reachability density corresponding to the parameters of the i-th candidate model, LRD max This represents the maximum value of the local reachability density corresponding to the parameters of each candidate model.

[0120] In another possible embodiment, it can also be calculated according to formula (6):

[0121]

[0122] Where N is the total number of candidate model parameters.

[0123] In another possible embodiment, the weights of the candidate model parameters can be determined based on the local reachability density corresponding to each candidate model parameter, wherein the weights are positively correlated with the local reachability density of the candidate model parameters and negatively correlated with the local reachability density of the neighboring model parameters corresponding to the candidate model parameters.

[0124] For information on the neighborhood model parameters, please refer to the relevant explanation in S301 above, which will not be repeated here. In this example, the weights satisfy formula (7):

[0125] a i =g(LRD(p) i ),LRD(q1),LRD(q2),…,LRD(q m ))… (7)

[0126] Where g() is positively correlated with LRD(pi) and also with LRD(q1), LRD(q2), ..., LRD(q m The negative correlation function. LRD(q1) is the local reachability density corresponding to the first neighboring model parameter of the i-th candidate model parameter, LRD(q2) is the local reachability density corresponding to the second neighboring model parameter of the i-th candidate model parameter, and so on. As analyzed above, for the case where the k closest other candidate model parameters to the candidate model parameter are selected as the neighboring model parameters, m = k.

[0127] In one possible embodiment, formula (7) is specifically formula (8):

[0128] a i =1-P(w i (8)

[0129] Among them, P(w i The result is obtained by calculation using formula (9):

[0130]

[0131] Among them, LOF i The result is obtained by calculation using formula (10):

[0132]

[0133] Where p is the point in the model parameter space corresponding to the i-th candidate model parameter, with respect to N k (p) Refer to the relevant explanation in S302 above, which will not be repeated here. As explained above, the higher the local reachability density corresponding to a candidate model parameter, the higher the probability that the candidate model parameter is a normal model parameter. Therefore, when the local reachability density corresponding to a candidate model parameter is greater than a certain threshold, the candidate model parameter is considered to be a normal model parameter. However, this certain threshold is difficult to determine accurately.

[0134] In this embodiment, as can be seen from formula (10), LOF i It can be viewed as the reciprocal of the ratio of the local reachability density corresponding to the i-th candidate model parameter to the local reachability density corresponding to the other model parameters surrounding the i-th candidate model parameter, therefore LOF i When the value is greater than 1, it indicates that the local reachability density corresponding to the i-th candidate model parameter is relatively smaller than that corresponding to the local reachability densities of other surrounding model parameters. Therefore, the i-th candidate model parameter has a certain probability of being an anomalous model parameter. When LOF... i If the value is less than or equal to 1, it means that the local reachability density corresponding to the i-th candidate model parameter is comparable to or even larger than the local reachability density corresponding to the surrounding model parameters. Therefore, the i-th candidate model parameter is considered to be a normal model parameter.

[0135] As can be seen, LOF i The LOF parameter can reflect, to some extent, whether the i-th candidate model parameter is an anomalous model parameter. Therefore, the following text will refer to it as an anomalous model parameter. i This is called the local anomaly factor of the i-th candidate model parameter. See equation (9), LOF... i When less than or equal to 1, P(w) i ) is 0, while LOF iWhen it is greater than 1, P(w) i ) is not 0 and follows LOF i It changes with the changes, combined with the aforementioned information about LOF i This shows that P(w) i P(w) can be used to represent the probability that the i-th candidate model parameter is an anomalous model parameter, therefore, it is referred to as P(w) in the following text. i ) represents the probability that the i-th candidate model parameter is an abnormal model parameter.

[0136] See formula (8), since P(w) i The probability that the i-th candidate model parameter is an anomalous model parameter, therefore 1-P(w i ) is the probability that the i-th candidate model parameter is a normal model parameter. It can be seen that the weights calculated according to formula (8) can still make the candidate model parameter that is more likely to be a normal model parameter have a greater impact on the trained model, while the candidate model parameter that is more likely to be an abnormal model parameter has a smaller impact on the trained model, thereby reducing the impact of abnormal parameter models on the trained model.

[0137] Furthermore, according to formulas (9) and (10), it can be seen that P(w) i The weights calculated according to formula (8) are negatively correlated with LRD(p) and positively correlated with LRD(q). Therefore, the weights are positively correlated with the local reachability density corresponding to the candidate model parameters and negatively correlated with the local reachability density corresponding to the neighborhood model parameters.

[0138] By comparing the local reachability densities of candidate model parameters with those of other surrounding model parameters, this embodiment accurately determines whether the local reachability density of the candidate model parameters is large or small. This allows for the reasonable setting of weights for the candidate model parameters based on the magnitude of the local reachability density, further reducing the impact of abnormal model parameters on federated learning.

[0139] The weighted aggregation in this article can refer to weighted summation, which is achieved through formula (11):

[0140]

[0141] in, For the updated model parameters, w i Let be the parameters of the i-th candidate model. If the weights are calculated according to the aforementioned formula (8), formula (11) can be rewritten as formula (12):

[0142]

[0143] It is understandable that if a candidate model parameter is similar to one or more anomalous model parameters, it may result in a large local reachability density of the candidate model parameter. However, the candidate model parameter is likely to be an anomalous model parameter. According to the aforementioned explanation, based on the local reachability density, the candidate model parameter may be considered to be a normal model parameter, which in turn leads to the anomalous model parameter having a significant impact on the trained model.

[0144] Based on this, in one possible embodiment, such as Figure 4 As shown, in Figure 2 In addition to the above, it also includes S205-S206, wherein:

[0145] S205, among the candidate model parameters, determine the model parameters whose local reachability density satisfies the preset abnormal density condition, and use them as abnormal model parameters.

[0146] The preset anomaly conditions may vary depending on the application scenario, but model parameters that meet the preset anomaly conditions should be considered as abnormal model parameters. For example, as described above regarding local anomaly factors, in one possible embodiment, the preset anomaly condition is that the local anomaly factor is greater than 1. As shown in formula (9), the local anomaly factor is calculated based on the local reachability density; therefore, a local anomaly factor greater than 1 can be considered a condition for local reachability density. In another possible embodiment, the preset anomaly condition may also be that the local reachability density is less than a preset threshold, which can be set based on user experience and / or actual needs.

[0147] S206, until no new abnormal model parameters can be determined, take the model parameters other than the abnormal model parameters from the candidate model parameters as the new candidate model parameters, and return to execute S202.

[0148] The inability to determine new anomalous model parameters means that the local reachability densities corresponding to all candidate model parameters do not meet the preset anomalous density condition. In this example, the local reachability density in S203 refers to the latest local reachability density, and each candidate model parameter refers to the initial candidate model parameters. Therefore, even if a candidate model parameter is determined to be an anomalous model parameter, it will still participate in the weighted aggregation. For example, suppose there are a total of 100 candidate model parameters, denoted as candidate model parameters 1-100, and the preset anomalous condition is that the local anomaly factor is greater than 1. Suppose the local anomaly factors corresponding to candidate model parameters 1-100 are respectively LOF. 1-100 And the LOF is determined by executing S201-S202. 1-80 Less than or equal to 1, LOF 81-100If the value is greater than 1, then candidate model parameters 81-100 are considered anomalous model parameters. Candidate model parameters 1-80 are then used as new candidate model parameters, and execution returns to step S202 to redetermine the local reachability density of candidate model parameters 1-80. Since the candidate model parameters have changed during the second execution of S202, other candidate model parameters within the neighborhood of each candidate model parameter may have changed. This leads to a difference between the redetermined local reachability density (i.e., the local reachability density of candidate model parameters 1-80) and the first execution of S202. Therefore, LOF... 1-80 This will also lead to corresponding changes, with some local anomaly factors potentially exceeding 1. Therefore, the second round may further identify new anomalous model parameters from candidate model parameters 1-80, and so on. This continues until no new anomalous model parameters can be identified from the candidate model parameters. At this point, the remaining candidate model parameters are considered normal model parameters, but in S203, candidate model parameters 1-100 are still weighted and aggregated. It is evident that using this embodiment can more effectively detect anomalous model parameters among the candidate model parameters, thereby further reducing the impact of anomalous model parameters on the trained model.

[0149] It is understandable that although the aforementioned solutions reduce the impact of abnormal model parameters on the trained model by decreasing the weights of these parameters, effectively resisting model poisoning attacks, model poisoning attacks still occur. Therefore, the aforementioned solutions can be considered a means of defending against model poisoning attacks during federated learning, i.e., in-process defense. In one embodiment, this application also provides a method for reducing the probability of model poisoning attacks, i.e., defending against model poisoning attacks before federated learning, i.e., a method for achieving pre-emptive defense, such as... Figure 5 As shown, in Figure 2 The example shown also includes S207-S208, where:

[0150] S207, until the preset training termination condition is met, return to step S201 with the trained model as the new model to be trained.

[0151] The preset training termination condition can refer to the convergence of the model after training reaching a preset convergence threshold, or the number of times the model parameters are adjusted reaching a preset number threshold, or other training termination conditions. This application does not impose any restrictions on this.

[0152] S208. Based on the local reachability density corresponding to the candidate model parameters obtained from each client, determine the confidence level of each client as a normal client.

[0153] The confidence level is positively correlated with the local reachability density. In this application, a normal client refers to a client that will not (or almost never) engage in model poisoning attacks. Since S207 will return to S201, theoretically, multiple candidate model parameters are obtained from each client, and each candidate model parameter corresponds to a local reachability density, meaning there are multiple local reachability densities. The client's confidence level can be determined based on each of these multiple local reachability densities, or it can be determined based on some of these multiple local reachability densities. For ease of description, the following explanation will only focus on the case where the client's confidence level is determined based on each of these multiple local reachability densities. The principle is the same for the case where the client's confidence level is determined based on some of these multiple local reachability densities, so it will not be elaborated further.

[0154] For example, in one possible embodiment, the confidence level can be calculated according to formula (13):

[0155] Confidence clienti =h(LRD1,LRD2,…,LRD) x (13)

[0156] Among them, Confidence clienti Let be the confidence that the i-th client is a normal client, h() is an incrementing function, LRD1 is the local reachability density corresponding to the first candidate model parameter obtained from the i-th client, LRD2 is the local reachability density corresponding to the second candidate model parameter obtained from the i-th client, and so on, and x is the number of candidate model parameters obtained from the i-th client.

[0157] In another possible embodiment, since the local reachability density is negatively correlated with the probability that the candidate model parameters are anomalous model parameters, equation (13) can also be rewritten as equation (14):

[0158] Confidence clienti =h(P1,P2,…,P) x (14)

[0159] Where P1 is the probability that the first candidate model parameter obtained from the i-th client is an abnormal model parameter, P2 is the probability that the second candidate model parameter obtained from the i-th client is an abnormal model parameter, and so on. t() is a decreasing function.

[0160] For the case involving only two clients (Client1 and Client2), see 6a. Figure 6aIn the example shown, a total of E iterations were performed, meaning S201 was executed E times. The candidate model parameters uploaded by Client1 in each iteration included w1, w2, ..., w i There are a total of x, and the candidate model parameters uploaded by Client2 in each iteration include w1, w2, ..., w j If there are a total of y, then the above formula (14) can be rewritten as formula (15).

[0161]

[0162] Among them, Confidence client1 P represents the confidence level that Client1 is a normal client. ei Let be the probability that the i-th model parameter obtained from Client1 during the e-th iteration is an abnormal model parameter. In this example, the confidence that Client2 is a normal client can be obtained in the same way and can be calculated according to formula (16).

[0163]

[0164] Among them, Confidence client2 P represents the confidence level that Client2 is a normal client. ej This represents the probability that the j-th model parameter obtained from Client2 during the e-th iteration is an abnormal model parameter.

[0165] As analyzed above, the local reachability density corresponding to candidate model parameters is positively correlated with the probability that the candidate model parameter is a normal model parameter. Therefore, the larger the local reachability density corresponding to each candidate model parameter obtained from the client, the greater the probability that the local model parameter obtained from the client is a normal model parameter, and thus the higher the confidence that the client is a normal client. Conversely, the smaller the local reachability density corresponding to each candidate model parameter obtained from the client, the lower the confidence that the client is a normal client.

[0166] In this embodiment, the confidence level of each client as a normal client is obtained by statistically analyzing the local reachability density corresponding to the parameters of each candidate model obtained from each client. This allows users participating in federated learning to see the confidence level of each client before subsequent federated learning, enabling them to anticipate the possibility of clients exhibiting model poisoning behavior. This helps prevent potentially poisoning clients from joining the federated learning process, thus achieving pre-emptive defense. For example, users can allow only clients with a confidence level greater than a preset confidence threshold to participate in federated learning. Furthermore, since this embodiment achieves pre-emptive defense by statistically analyzing local reachability density after the model is trained through federated learning, this example can be considered a scheme that achieves pre-emptive defense through post-event control.

[0167] To more clearly explain the federal learning approach provided in this application, the following will combine... Figure 1 The application scenario shown illustrates the execution flow between the client and the coordinator in the federated learning method provided in this application. See [link to relevant documentation]. Figure 6b .

[0168] Client1 trains the model to be trained based on user 1's data, and obtains the candidate model parameters W. i The data is then uploaded to Arbiter. Client2 uses User 1's data to train the model to be trained, obtaining the candidate model parameters W. j And upload it to Arbiter. Arbiter receives W i and W j This is equivalent to executing the aforementioned S201. The Arbiter calculates W. i and W j The corresponding LOF, and aggregated W based on 1 / LOF. i and W j To obtain the updated model parameters This is equivalent to executing the aforementioned S202-S203. For the calculation of LOF, please refer to the relevant explanation of the aforementioned formula (10). Arbiter aggregates W based on 1 / LOF. i and W j For the aggregation method, please refer to the relevant explanations of formulas (8), (9), and (12) above, which will not be repeated here.

[0169] Arbiter will Sending to Client1 and Client2 is equivalent to the aforementioned S207, with Client1 and Client2 receiving respectively. and with As new model parameters, retraining yields new candidate model parameters W. i 'and Wj ', and upload it to Arbiter, Arbiter receives W i 'and W j 'and with W i 'and W j 'Repeat the above process as a new candidate model parameter.'

[0170] In this example, the weighted aggregation process, namely S203 mentioned above, is as follows: Figure 6c As shown, it includes:

[0171] S2031, Based on the local reachability density corresponding to each candidate model parameter, determine the local anomaly factor corresponding to each candidate model parameter.

[0172] For instructions on how to calculate the local anomaly factor, please refer to the relevant explanation of the aforementioned formula (10), which will not be repeated here.

[0173] S2032, calculate the probability that each candidate model parameter is an anomalous model parameter based on the local anomaly factor corresponding to each candidate model parameter.

[0174] For details on how to calculate the probability that the candidate model parameters are abnormal model parameters, please refer to the relevant explanation of the aforementioned formula (9), which will not be repeated here.

[0175] S2033, based on the probability that each candidate model parameter is an abnormal model parameter, the candidate model parameters are weighted and aggregated to obtain the updated model parameters.

[0176] For details on how to perform weighted aggregation based on probability, please refer to the relevant explanation of the aforementioned formula (12), which will not be repeated here.

[0177] The acquisition, storage, use, processing, transmission, provision and disclosure of target data involved in the technical solutions provided in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals. Furthermore, the target data in the embodiments of this application is not personal data of a specific user and does not reflect the personal information of a specific user.

[0178] Corresponding to the aforementioned federated learning method, this application also provides an image recognition method, such as... Figure 7 As shown, it includes:

[0179] S701, acquire the image to be recognized.

[0180] S702, input the image to be recognized into the trained model to obtain the recognition result output by the trained model. The trained model is a model pre-trained using the aforementioned federated learning method.

[0181] By using this embodiment, a pre-trained model can be obtained by training according to the aforementioned federated learning method. As analyzed above, the federated learning method can effectively reduce the impact of model poisoning attacks on the performance of the model trained by federated learning and improve the stability of federated learning. Therefore, the pre-trained model trained according to the aforementioned federated learning method has higher accuracy. Consequently, when the acquired image to be recognized is input into the pre-trained model to obtain the recognition result output by the pre-trained model, the accuracy of the recognition result is also higher due to the higher accuracy of the pre-trained model trained according to the aforementioned federated learning method.

[0182] The aforementioned federated learning method can be applied to image recognition as well as to various other scenarios. Examples of application scenarios for the aforementioned federated learning method will be given below.

[0183] In application scenario one, a model capable of recognizing as many animal species as possible needs to be trained. Due to the large number and wide distribution of animal species, multiple photographers operating in different regions need to capture animal images from different areas to serve as sample data for model training. Since the animal images captured by the photographers may not be publicly available, to prevent the leakage of any single photographer's images, each photographer can train the animal image recognition model using federated learning. During federated learning, each photographer can use their own client (e.g., computer, mobile phone) to train the same model based on the animal images they captured and stored on their client, along with the corresponding animal species. This yields the model parameters, which are then uploaded to a coordinating end via their respective clients. The coordinating end updates the model based on these parameters and redistributes the updated model to each client. Each client uses the updated model as a new training model and retrains it based on its stored animal images and corresponding animal species, uploading the resulting parameters back to the coordinating end. This process continues until training is complete, resulting in a trained animal image recognition model.

[0184] However, during federated learning, if a photographer provides incorrect or forged animal images through the client, such as intentionally presenting a cat image as a snake image—a poisoning attack—this will cause a decline in the performance of the updated model. Consequently, the trained animal image recognition model will perform poorly and be unable to accurately identify the animal species in the images. Therefore, the aforementioned federated learning method can be used to train the model and obtain an animal image recognition model. This effectively reduces the impact of poisoning attacks on the performance of the federated learning-trained animal image recognition model, improves the stability of federated learning, and results in a more accurate animal image recognition model that can more accurately identify the animal species in the images.

[0185] In application scenario two, an image recognition model needs to be trained to identify the presence of people in surveillance footage for area intrusion detection. The training process requires a large amount of surveillance footage as sample data. Since a single company can only provide a limited number of surveillance videos, multiple companies need to share their footage. However, company surveillance footage involves company privacy. To prevent the leakage of footage from any single company, each company can train the image recognition model using federated learning. During federated learning, each company can use its own client (e.g., a company server, a computer) to train the same model based on the surveillance videos stored on its client, obtaining the model parameters. Each company then uploads its trained model parameters to the coordinating end. The coordinating end updates the model based on the uploaded parameters and redistributes the updated model to each client. Each client uses the updated model as the new model to retrain based on its stored surveillance footage, and then uploads the trained model parameters back to the coordinating end. This process continues until training is complete, resulting in a trained image recognition model.

[0186] However, during federated learning, if a company provides fake surveillance footage through the client—a case of model poisoning attacks—the updated model's performance will degrade, resulting in a poorly performing image recognition model that cannot accurately analyze whether anyone is in the surveillance video. Therefore, the aforementioned federated learning method can be used to train the image recognition model, effectively reducing the impact of model poisoning attacks on the performance of the federated learning-trained image recognition model, improving the stability of federated learning, and enabling the trained image recognition model to more accurately analyze whether anyone is in the surveillance video, thus providing better security protection.

[0187] Corresponding to the aforementioned federated learning method, this application also provides a federated learning apparatus, such as... Figure 8 As shown, it includes:

[0188] The model parameter acquisition module 801 is used to acquire the model parameters obtained by multiple clients from training the model to be trained, and use them as candidate model parameters.

[0189] The anomaly detection module 802 is used to determine the density of the candidate model parameters in the neighborhood of each candidate model parameter in the model parameter space with the value of each parameter in the model parameters as the local reachability density corresponding to the candidate model parameter.

[0190] The weighted aggregation module 803 is used to perform weighted aggregation on each candidate model parameter according to the local reachability density corresponding to each candidate model parameter to obtain updated model parameters, wherein the weight of the candidate model parameter in the weighted aggregation process is positively correlated with the local reachability density corresponding to the candidate model parameter;

[0191] The model update module 804 is used to update the model parameters of the model to be trained to the updated model parameters, so as to obtain the trained model.

[0192] In one possible embodiment, the anomaly detection module determines the density of each candidate model parameter within the neighborhood of each candidate model parameter in a model parameter space with the values ​​of each parameter in the model parameters as dimensions, as the local reachability density corresponding to the candidate model parameter, including:

[0193] In the model parameter space of the dimension of each parameter in the model parameter, other candidate model parameters existing in the neighborhood of each candidate model parameter are determined and used as the neighborhood model parameters corresponding to the candidate model parameter.

[0194] Based on the distance between the neighborhood model parameters corresponding to each candidate model parameter and the candidate model parameters, the local reachability density corresponding to each candidate model is determined, wherein the local reachability density is negatively correlated with the distance.

[0195] In one possible embodiment, the anomaly detection module determines other candidate model parameters existing in the neighborhood of each candidate model parameter, as the neighborhood model parameters corresponding to the candidate model parameters, including:

[0196] In the model parameter space, which is dimensional by the values ​​of each parameter in the model parameters, the k nearest model parameters to each candidate model parameter are determined from each candidate model parameter and are used as the neighborhood model parameters corresponding to the candidate model parameter, where k is a preset integer greater than 1.

[0197] In one possible embodiment, the anomaly detection module determines the local reachability density corresponding to each candidate model based on the distance between the neighboring model parameters and the candidate model parameters corresponding to each candidate model parameter, including:

[0198] Based on the reachability distance from the neighborhood model parameter to the candidate model parameter corresponding to each candidate model parameter, the local reachability density corresponding to each candidate model is determined respectively, wherein the local reachability density is negatively correlated with the reachability distance, and the reachability distance is the larger value of the k-nearest neighbor distance of the neighborhood model parameter and the Euclidean distance between the neighborhood model parameter and the candidate model parameter.

[0199] In one possible embodiment, the weighted aggregation module performs weighted aggregation on each candidate model parameter based on the local reachability density corresponding to each candidate model parameter to obtain updated model parameters, including:

[0200] Based on the local reachability density corresponding to each candidate model parameter, the weight of each candidate model parameter is determined, wherein the weight is positively correlated with the local reachability density of the candidate model parameter and negatively correlated with the local reachability density of the neighborhood model parameters corresponding to the candidate model parameter.

[0201] The candidate model parameters are weighted and aggregated according to their respective weights to obtain the updated model parameters.

[0202] In one possible embodiment, the anomaly detection module is further configured to determine, among each of the candidate model parameters, the model parameter whose local reachability density satisfies the preset anomaly density condition, as the anomaly model parameter;

[0203] Until no new abnormal model parameters can be determined, the model parameters other than the abnormal model parameters among the candidate model parameters are taken as new candidate model parameters, and the process returns to the step of determining the density of the candidate model parameters in the neighborhood of each candidate model parameter in the model parameter space with the value of each parameter in the model parameters as the local reachability density corresponding to the candidate model parameter.

[0204] The step of weighted aggregation of the candidate model parameters based on the local reachability density corresponding to each candidate model parameter to obtain the updated model parameters includes:

[0205] Based on the latest local reachability density corresponding to the initial candidate model parameters, the candidate model parameters are weighted and aggregated to obtain the updated model parameters.

[0206] In one possible embodiment, the device further includes a post-training control module, which is used to return to the step of obtaining the model parameters obtained by the multiple clients from training their respective models as candidate model parameters until a preset training end condition is met.

[0207] Based on the local reachability density corresponding to the candidate model parameters obtained from each client, the confidence level of each client as a normal client is determined, and the confidence level is positively correlated with the local reachability density.

[0208] Corresponding to the aforementioned image recognition method, this application also provides an image recognition device, such as... Figure 9 As shown, it includes:

[0209] The acquisition module 901 is used to acquire the image to be recognized;

[0210] The input module 902 is used to input the image to be recognized into the trained model to obtain the recognition result output by the trained model. The trained model is a model that has been trained in advance according to the aforementioned federated learning method.

[0211] This application also provides an electronic device, such as... Figure 10 As shown, it includes:

[0212] Memory 1001 is used to store computer programs;

[0213] When processor 1002 executes a program stored in memory 1001, it performs the following steps:

[0214] Obtain the model parameters obtained by multiple clients from training the model to be trained, and use them as candidate model parameters;

[0215] In the model parameter space, which is dimensional by the value of each parameter in the model parameters, the density of the candidate model parameters in the neighborhood of each candidate model parameter is determined as the local reachability density corresponding to the candidate model parameter.

[0216] Based on the local reachability density corresponding to each candidate model parameter, the candidate model parameters are weighted and aggregated to obtain updated model parameters, wherein the weight of the candidate model parameter in the weighted aggregation process is positively correlated with the local reachability density corresponding to the candidate model parameter;

[0217] The model parameters of the model to be trained are updated to the updated model parameters to obtain the trained model.

[0218] Furthermore, the aforementioned electronic device may also include a communication bus and a communication interface, wherein the communication interface, memory 1001, and processor 1002 achieve data interaction through the communication bus.

[0219] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0220] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0221] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0222] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0223] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described federated learning methods.

[0224] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the federated learning methods described above.

[0225] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0226] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0227] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, embodiments of devices, electronic devices, computer-readable storage media, and computer program products are basically similar to the method embodiments, and therefore the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0228] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A federated learning method, characterized in that, The method comprises: obtaining model parameters of a plurality of clients respectively trained on a to-be-trained model as candidate model parameters; determining, in a model parameter space with dimensions of values of parameters in the model parameters, densities of the candidate model parameters in neighborhoods of the candidate model parameters respectively as local reachable densities corresponding to the candidate model parameters; performing weighted aggregation on the candidate model parameters according to the local reachable densities corresponding to the candidate model parameters, to obtain updated model parameters, wherein the weight of the candidate model parameters in the weighted aggregation process is positively correlated with the local reachable density corresponding to the candidate model parameters; updating model parameters of the to-be-trained model to the updated model parameters to obtain a trained model; the trained model is used for image recognition, or speech recognition, or image restoration.

2. The method of claim 1, wherein, The method comprises: determining, in a model parameter space with dimensions of values of parameters in the model parameters, other candidate model parameters existing in neighborhoods of the candidate model parameters as neighborhood model parameters corresponding to the candidate model parameters respectively; determining local reachable densities corresponding to the candidate model parameters respectively according to distances between the neighborhood model parameters corresponding to the candidate model parameters and the candidate model parameters, wherein the local reachable density is negatively correlated with the distance.

3. The method of claim 2, wherein, The method comprises: determining, in a model parameter space with dimensions of values of parameters in the model parameters, k model parameters closest to the candidate model parameters from the candidate model parameters as neighborhood model parameters corresponding to the candidate model parameters respectively, wherein k is a preset integer greater than 1.

4. The method of claim 2, wherein, The method comprises: determining local reachable densities corresponding to the candidate model parameters respectively according to reachable distances of the neighborhood model parameters corresponding to the candidate model parameters to the candidate model parameters, wherein the local reachable density is negatively correlated with the reachable distance, and the reachable distance is a larger value of a k-neighbor distance of the neighborhood model parameters and a Euclidean distance between the neighborhood model parameters and the candidate model parameters.

5. The method of claim 1, wherein, The method comprises: determine a weight of each of the candidate model parameters according to the local reachable density corresponding to the candidate model parameter, wherein the weight is positively correlated with the local reachable density corresponding to the candidate model parameter, and is negatively correlated with the local reachable density corresponding to a neighborhood model parameter of the candidate model parameter; perform weighted aggregation on each of the candidate model parameters according to the weight of the candidate model parameter, to obtain an updated model parameter.

6. The method of claim 1, wherein, The method further comprises: determine a model parameter corresponding to the local reachable density satisfying a preset abnormal density condition as an abnormal model parameter from each of the candidate model parameters; until a new abnormal model parameter cannot be determined, use the model parameters in each of the candidate model parameters except the abnormal model parameter as a new candidate model parameter, and return to perform the step of determining the density of each of the candidate model parameters in the neighborhood of the candidate model parameter as the local reachable density corresponding to the candidate model parameter in the model parameter space with the value of each parameter in the model parameter as a dimension; the step of determining the weight of each of the candidate model parameters according to the local reachable density corresponding to the candidate model parameter, comprises: perform weighted aggregation on each of the candidate model parameters according to the latest local reachable density corresponding to each of the candidate model parameters, to obtain an updated model parameter.

7. The method of claim 1, wherein, The method further comprises: until a preset training end condition is satisfied, use the trained model as a new to-be-trained model to return to perform the step of obtaining the model parameters of each of the candidate model parameters trained by each of the clients, as a candidate model parameter; determine a confidence degree of each of the clients being a normal client according to the local reachable density corresponding to each of the candidate model parameters obtained from each of the clients, wherein the confidence degree is positively correlated with the local reachable density.

8. An image recognition method characterized by, The method comprises: obtain a to-be-recognized image; input the to-be-recognized image into the trained model to obtain a recognition result output by the trained model, wherein the trained model is a model trained according to the method in any one of claims 1-7.

9. A federated learning apparatus, comprising: The device comprises: a model parameter obtaining module, configured to obtain model parameters of a to-be-trained model trained by each of a plurality of clients, as candidate model parameters; an abnormality detecting module, configured to determine a density of each of the candidate model parameters in a neighborhood of the candidate model parameter as a local reachable density corresponding to the candidate model parameter in a model parameter space with the value of each parameter in the model parameter as a dimension; a weighted aggregation module, configured to perform weighted aggregation on each of the candidate model parameters according to the local reachable density corresponding to the candidate model parameter, to obtain an updated model parameter, wherein a weight of the candidate model parameter in the weighted aggregation process is positively correlated with the local reachable density corresponding to the candidate model parameter; a model updating module, configured to update the model parameters of the to-be-trained model to the updated model parameters, to obtain a trained model, wherein the trained model is used for image recognition, or speech recognition, or image restoration.

10. The apparatus of claim 9, wherein, The anomaly detection module respectively determines the density of each candidate model parameter in the neighborhood of the candidate model parameter in the model parameter space with the value of each parameter in the model parameter as the dimension, as the local reachable density corresponding to the candidate model parameter, including: In the model parameter space with the value of each parameter in the model parameter as the dimension, the other candidate model parameters existing in the neighborhood of each candidate model parameter are determined as the neighborhood model parameters corresponding to the candidate model parameter; According to the distance between the neighborhood model parameters corresponding to each candidate model parameter and the candidate model parameter, the local reachable density corresponding to each candidate model is determined respectively, wherein the local reachable density is negatively correlated with the distance; The anomaly detection module respectively determines the other candidate model parameters existing in the neighborhood of each candidate model parameter as the neighborhood model parameters corresponding to the candidate model parameter, including: In the model parameter space with the value of each parameter in the model parameter as the dimension, the k model parameters closest to each candidate model parameter are determined from each candidate model parameter as the neighborhood model parameters corresponding to the candidate model parameter, wherein k is a preset integer greater than 1; The anomaly detection module respectively determines the local reachable density corresponding to each candidate model according to the distance between the neighborhood model parameters corresponding to each candidate model parameter and the candidate model parameter, including: According to the reachable distance of the neighborhood model parameters corresponding to each candidate model parameter to the candidate model parameter, the local reachable density corresponding to each candidate model is determined respectively, wherein the local reachable density is negatively correlated with the reachable distance, and the reachable distance is the larger value of the k-neighbor distance of the neighborhood model parameter and the Euclidean distance between the neighborhood model parameter and the candidate model parameter; The weighted aggregation module aggregates each candidate model parameter according to the local reachable density corresponding to each candidate model parameter to obtain updated model parameters, including: According to the local reachable density corresponding to each candidate model parameter, the weight of each candidate model parameter is determined respectively, wherein the weight is positively correlated with the local reachable density of the candidate model parameter, and negatively correlated with the local reachable density of the neighborhood model parameter corresponding to the candidate model parameter; Each candidate model parameter is weighted and aggregated according to the weight of each candidate model parameter to obtain updated model parameters; The anomaly detection module is also used to determine the model parameter corresponding to the local reachable density satisfying the preset abnormal density condition in each candidate model parameter as the abnormal model parameter; until a new abnormal model parameter cannot be determined, taking the model parameters in each of the candidate model parameters except the abnormal model parameter as a new candidate model parameter, and returning to performing the step of determining the density of each of the candidate model parameters in the neighborhood of each of the candidate model parameters in the model parameter space with the value of each parameter in the model parameter as the dimension, as the local reachable density corresponding to the candidate model parameter; The weighting aggregation module performs weighted aggregation on each of the candidate model parameters according to the local reachable density corresponding to each of the candidate model parameters to obtain an updated model parameter, including: According to the latest local reachable density corresponding to each of the initial candidate model parameters, the candidate model parameters are weighted aggregated to obtain an updated model parameter; The device further comprises a post-control module configured to, until a preset training end condition is met, take the trained model as a new to-be-trained model and return to performing the step of obtaining the model parameters obtained by each of the clients in training the to-be-trained model as candidate model parameters; According to the local reachable density corresponding to each of the candidate model parameters obtained from each of the clients, the confidence of each of the clients as a normal client is determined, and the confidence is positively correlated with the local reachable density.

11. An image recognition apparatus characterized by comprising: The device comprises: An acquisition module configured to acquire a to-be-identified image; An input module configured to input the to-be-identified image into a trained model to obtain an identification result output by the trained model, the trained model being a model trained in advance according to the method of any one of claims 1-7.

12. An electronic device, comprising: including: A memory configured to store a computer program; A processor configured to, when executing the program stored on the memory, implement the method steps of any one of claims 1-7 or 8.

13. A computer-readable storage medium, characterized in that, The computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the method steps of any one of claims 1-7 or 8. The computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the method steps of any one of claims 1-7 or 8.

Images