DFL approach to byzantine attack resistant based on performance evaluation and committee voting

Abstract

The application discloses a DFL method resisting Byzantine attack based on performance evaluation and committee voting, a consensus algorithm based on reputation randomly selects a master node CM, and the master node CM coordinates other participants to participate in model training; the privacy of parameters in the model training process is protected based on DP and secret random number disturbance; the Byzantine node in a training node TN is detected based on performance evaluation; the Byzantine node in a candidate node CN is detected by analyzing secret random disturbance aggregation results; and the model aggregated by the master node CM is verified based on a committee voting mechanism, and whether the master node CM is a Byzantine node is detected. The application can solve the problems of Byzantine attack and privacy protection under data distribution heterogeneity and the problem of model training failure caused by single-point failure under the architecture of a center-based federated learning system. The application improves the performance of a federated learning model and accelerates the convergence speed of federated learning.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of physics, and further relates to an anti-BYZANTINE attack decentralized federated learning (DFL) method based on performance evaluation and committee voting in the technical field of electric digital data. The application can realize anti-BYZANTINE attack and privacy protection of model training of participants in DFL. BACKGROUND

[0002] Federal learning has shown excellent performance in traffic and medical scenarios, but in some federal learning scenarios, data owners have difficulty finding reliable third-party servers as central servers for model aggregation, and due to the single point failure problem of the traditional centralized federal learning system architecture, the model training fails. In decentralized federal learning, it is difficult for each node to check the data sent by other nodes, so it faces a more serious Byzantine attack problem. For example, the traditional centralized federal learning system architecture is used in the automatic driving scenario, and the model training failure problem caused by Byzantine attack is particularly prominent. In federal learning, even a small number of malicious participants can destroy global training, leading to serious traffic accidents and threatening the safety of drivers. In engineering practice, the data distribution characteristics collected by different intelligent vehicles present Non-IID (Non-Independent and Identically Distributed), which leads to a large difference in the knowledge shared by different training nodes, increasing the difficulty of identifying Byzantine nodes. In addition, even if each participant does not share the original data in federal model training, attackers can still infer the user's privacy information through shared model parameters or gradient updates, leading to privacy leakage.

[0003] The University of Electronic Science and Technology proposed an anti-Byzantine attack federal learning method based on cosine similarity in its applied patent document "Anti-Byzantine attack federal learning method for protecting user data privacy" (application number: 202111589802.7, application publication number: CN 114239862 A). The method divides the server side into two servers, each calculating the cosine similarity of the server model gradient and the local model gradient, calculating the trust score according to the cosine similarity, and aggregating the global model using the obtained trust score and local model. Two servers cannot obtain the client's local data through their own data, protecting the user's data privacy. However, this method still has the following deficiencies: the traditional centralized federal learning system architecture will have a single point failure problem, which is easy to cause model training failure.

[0004] Che C et al. in their published paper "A decentralized federated learning framework via committee mechanism with convergence guarantee" (IEEE Transactions on Parallel and Distributed Systems, 2022, 33(12): 4783-4800) proposed a CMFL scheme, which designs two selection strategies based on the consideration of model accuracy and robustness, and designs a committee mechanism to aggregate the local gradients uploaded by the training nodes by using appropriate selection strategies, and updates the committee members through the election strategy. However, the method still has the following shortcomings: the method cannot resist the Byzantine attack under the Non-IID data set with distribution characteristics, and the selection strategy designed based on the Euclidean distance score is not robust enough to the Byzantine attack; secondly, the training nodes upload the plaintext information of the local gradient in the CMFL algorithm, and the committee nodes have privacy leakage problems when detecting Byzantine and aggregating gradients. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art, and to provide an anti-Byzantine attack DFL method based on performance evaluation and committee voting, which is used to solve the problem of model training failure caused by single point failure in the traditional centralized federated learning system architecture, and to solve the problems of Byzantine attack and privacy protection under heterogeneous data distribution.

[0006] The idea to achieve the purpose of the present application is: the consensus protocol Ouroboros based on reputation degree in the present application randomly selects a master node CM (Current Master) in each iteration, and the master node CM coordinates other participants to participate in model training. Based on DP and secret random number perturbation, the privacy of the parameters in the model training process is protected. After local training, each training node TN generates a secret random number perturbation with the same shape as the model parameters, and adds it to the local model to obtain a secret random number perturbation local model. The training node TN (Training Node) shares the generated secret random number perturbation with the candidate node CN (Candidate Node), thereby helping the master node CM to restore the global model from the secret random number perturbation local model. The Byzantine nodes in the training nodes TN are detected based on the performance evaluation method. The Byzantine nodes in the candidate nodes CN are detected by analyzing the aggregation result of the secret random perturbation. Finally, the correctness of the model aggregated by the master node CM is verified based on the committee voting mechanism, the master node CM is detected whether it is a Byzantine node, and it is ensured that all participants in the decentralized federated learning reach a consensus on the model update and the result of the Byzantine node detection.

[0007] To achieve the above object, the specific implementation steps of the present application include the following:

[0008] Step 1, generate a discriminant sample set for each participant:

[0009] Each participant in model training sends L small data samples randomly, and each participant in model training aggregates the small data samples sent by other participants with its own small data samples to form a discriminant sample set for the participant, wherein L≤3;

[0010] Step 2, randomly select a master node CM from the candidate master node CN, and the master node CM broadcasts a global model;

[0011] Step 3, the training node TN respectively trains the global model using its own local data set to obtain a local model;

[0012] Step 4, the training node TN generates a differentially private local model using DP;

[0013] Step 5, the training node TN adds a secret random number perturbation term in each local model to obtain a secret random number perturbation local model of the training node TN;

[0014] Step 6, the master node CM detects the Byzantine node based on a performance evaluation method:

[0015] The master node CM calculates the loss value of the differentially private local model of each training node TN on the discriminant sample set in the current iteration; the master node CM calculates the average loss value of the differentially private local model of each training node TN in the current iteration; the master node CM groups the benign training nodes TN with model loss values less than the average loss value avglv into a benign node index set and sends the benign index set to the candidate master node CN;

[0016] Step 7, the candidate master node CN aggregates the secret random perturbation terms, and the master node CM updates the global model parameters:

[0017] Step 7.1, the master node CM aggregates the secret random number perturbation local models in the benign node index set to obtain an encrypted global model;

[0018] Step 7.2, the candidate master node CN receives the benign node index set sent by the master node CM, and the candidate master node CN aggregates the secret random perturbation terms sent by the training nodes TN corresponding to the benign node index set to obtain a secret random perturbation aggregation value R k, the candidate master node CN will randomly perturb the aggregation value R k to the master node CM;

[0019] Step 7.3, the master node CM receives the secret random perturbation aggregation value R k , selects the same and majority R k as the secret random perturbation aggregation value R of the group of nodes, R = mode(R k ), selects the candidate master node CN node corresponding to the aggregation value as a benign node, and sends the candidate master node CN of other aggregation values as a Byzantine node, wherein R represents the secret random perturbation aggregation value, and mode(·) represents the mode operation;

[0020] Step 7.4, the master node CM subtracts the secret random perturbation aggregation value R from the encrypted global model to obtain the updated global model;

[0021] Step 7.5, the master node CM combines the loss value loss i of the differential privacy local model of each training node TN and the secret random perturbation aggregation result R k returned by the candidate master node CN, and divides the training node TN into the following three trust states: when loss i ∈(0, avglv), the training node TN is a benign node, when loss i ≥avgle and R k ≠R, the training node TN is a Byzantine node, otherwise, the training node TN is a normal node;

[0022] Step 7.6, the master node CM updates the credibility and reputation of each training node TN;

[0023] Step 7.7, the master node CM broadcasts the global model to the system network;

[0024] Step 8, the candidate master node CN votes on the updated global model:

[0025] Step 8.1, each candidate master node CN calculates the loss value of the updated global model on the discriminant sample set;

[0026] Step 8.2, each candidate master node CN votes on the global model through a fluctuation threshold, if the absolute value of the difference between the loss value of the updated global model on the discriminant sample set calculated by the candidate master node CN and the loss value of the last round iteration is not more than the fluctuation threshold, it indicates that the global model parameter is in the correct convergence direction, the candidate master node CN votes for the updated global model and broadcasts it to the system network; otherwise, the candidate master node CN broadcasts the opposing information in the system network;

[0027] Step 8.3, if more than half of the candidate master nodes CN in the system network vote in favor of the updated global model parameters, the master node CM is determined as a benign node, and step 8.4 is performed; otherwise, the master node CM is determined as a Byzantine node, a master node CM is reselected, the master node CM broadcasts the global model, and step 3 is performed;

[0028] Step 8.4, the master node CM broadcasts the global model, the credibility and reputation of the training node TN to all nodes in the network, and the model training participants reach a consensus on the updated parameters;

[0029] Step 9, update the credibility and reputation of the master node CM, select a new master node CM and a candidate master node CN:

[0030] The master node CM selects x model training participants with higher reputation as candidate master nodes CN; the new master node CM is selected from the candidate master nodes CN according to the consensus protocol of the reputation; the new master node CM updates the credibility and reputation of the last round of master node CM and broadcasts it to the system network; the new master node CM broadcasts the global model;

[0031] Step 10, judge whether the global model converges, if yes, perform step 11; otherwise, perform step 3;

[0032] Step 11, end the collaborative training and obtain the global model.

[0033] Compared with the prior art, the present application has the following advantages:

[0034] Firstly, the present application is based on performance evaluation on the discriminant sample set, secret random disturbance aggregation result analysis, committee voting mechanism to resist Byzantine attack, which overcomes the shortcomings of Byzantine attack under heterogeneous data distribution; and makes the present application able to resist Byzantine attack under Non-IID data set, and ensures the availability of the centerless federated learning model.

[0035] Secondly, the present application generates differential privacy local model and secret random number disturbed local model based on DP and secret random disturbance, which overcomes the problem of privacy leakage of participants caused by the original local model parameters of participants obtained by the Byzantine node in the model training process of the prior art, so that the present application protects the privacy of intermediate parameters in the local model aggregation and Byzantine node identification process, and can accurately identify the Byzantine node and protect the privacy information of the participants in the model training process, realizing the safe aggregation of model parameters and the accurate training of the model. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 The flowchart of the present application. DETAILED DESCRIPTION

[0037] The following will be described in conjunction with the drawingsFigure 1 And the implementation steps of the present application are further described in the embodiments.

[0038] There are 11 model training participants in the embodiments of the present application, A, B, C, D, E, F, G, H, I, J, and K.

[0039] Step 1, generate each participant's discriminant sample set.

[0040] Each model training participant randomly sends L small data samples, and each model training participant aggregates the small data samples received from other participants with its own small data samples to form the participant's discriminant sample set, wherein L≤3. In the embodiments of the present application, participant A sends 10 data samples to participants B, C, D, E, F, G, H, I, J, and K, respectively, while A receives 10 data samples sent by each participant. A aggregates the 100 data samples received from the 10 participants and the 10 data samples sent by A to form A's discriminant sample set, which contains a total of 110 data samples and approximately conforms to the IID distribution characteristics.

[0041] Step 2, randomly select a master node CM from the candidate master nodes CN, and the master node CM broadcasts the global model.

[0042] Step 2.1, randomly select one of all model training participants as the master node CM. The master node CM broadcasts the initialization parameters of the global model. In the embodiments of the present application, participant A is selected as the master node CM. Participant A constructs a convolutional neural network with the following structure in series: input layer, first layer convolution, first pooling layer, second layer convolution, second pooling layer, and full connection layer. The hyperparameters of the network structure and the size of the model parameters are set as follows: the number of input layer neurons is set to 28x28, the window size of the first and second pooling layers is set to 2x2, the sliding step is set to 2, the convolution kernel size of the first and second convolution layers is set to 5x5, and the activation function is ReLu. The number of output layer neurons is set to 10, and the activation function is SoftMax. The CM randomly initializes the weight matrix of each layer of the network (the size of the model parameters). Participant A broadcasts the initialized global model to all training nodes TN. All training nodes TN have consistent model parameter sizes, but different model parameter sizes.

[0043] Step 2.2, randomly select x nodes from all participants except the master node CM to form a candidate master node CN, x = n x a, where n represents the total number of model training participants, and a represents the ratio of candidate master nodes CN to all model training participants, and 0 < a < 1. In the embodiment of the application, 4 nodes B, C, D, and E are randomly selected from participants B, C, D, E, F, G, H, I, J, and K except participant A to form a candidate master node CN.

[0044] Step 3, the training node TN respectively trains the global model using its own local data set to obtain a respective local model.

[0045] Step 3.1, the participants except the master node CM form the training node TN. In the embodiment of the application, participants B, C, D, E, F, G, H, I, J, and K except A form the training node TN.

[0046] Step 3.2, each training node TN updates its own local model with the received global model.

[0047] Step 3.3, each training node TN inputs its own local data set into its own local model and uses the SGD gradient descent algorithm for τ rounds of iteration to obtain the optimal local model.

[0048] Step 4, the training node TN generates a differentially private local model using DP.

[0049] Step 4.1, each training node TN selects a privacy budget ε i and a relaxation constant δ i according to the local privacy requirement The standard deviation of the Gaussian noise is set to where C is the clipping threshold of the local model parameter, DS i is the local data set of the i-th training node TN. In the embodiment of the application, the privacy budget ε i is set to 0.01 by default, and the relaxation constant δ i is set to 0.5 by default. The training node TN can set the local appropriate privacy parameters according to the local privacy requirement. The smaller the privacy budget ε i , the larger the generated Gaussian noise value, and the higher the security, but the noise is larger and is not conducive to the detection of the Byzantine node. Therefore, the training node TN should set appropriate parameters according to the local privacy requirement to prevent the added noise from being too large and being misjudged as a Byzantine node. At the same time, as long as the privacy requirement is met, the noise of the local model added by the TN in each training is independent.

[0050] Step 4.2, each training node TN generates Gaussian noise Compliance distribution

[0051] Step 4.3, the training node TN adds the respective generated Gaussian noise to the local model to obtain a differential privacy local model, which is used to detect whether each training node TN is a Byzantine node.

[0052] Step 4.4, the training node TN sends the differential privacy local model parameters to the master node CM.

[0053] Step 5, the training node TN adds a secret random number perturbation item in its each local model to obtain a secret random number perturbation local model of the training node TN.

[0054] Step 5.1, each training node TN generates a secret random perturbation item R i , which is any element non-zero. i The secret random perturbation item R i is added to the local model to generate the secret random number perturbation local model. The secret random perturbation item R is of the same shape as the model parameters.

[0055] Step 5.2, the training node TN sends the secret random perturbation item to all candidate master nodes CN, and transmits the secret random number perturbation local model parameters to the master node CM.

[0056] Step 6, the master node CM detects the Byzantine node based on performance evaluation.

[0057] The master node CM calculates the loss value of the differential privacy local model of each training node TN on the discriminant sample set at this round of iteration according to the following formula.

[0058]

[0059] Where, loss i i represents the model loss value of the i-th training node TN on the discriminant sample set dds, |·| represents the modulo operation, L i (·) represents the loss function of the i-th training node TN, represents the parameters of the differential privacy local model of the i-th training node TN, dds j represents the j-th sample in dds.

[0060] The master node CM calculates the average loss value of the differential privacy local model of each training node TN at this round of iteration according to the following formula.

[0061]

[0062] Wherein, avglv represents the average loss value of the differential privacy local model of the i-th training node TN on the discriminant sample set, and S represents the set of training nodes TN.

[0063] The main node CM groups benign training nodes TN with model loss values less than avglv into a benign node index set And sends the benign index set To the candidate master node CN. In the embodiment of the application, the model loss values less than avglv are {C, D, E, H, I, K}, which are sent to the candidate master node CN as a set Send to the candidate master node CN: B, C, D, E.

[0064] Step 7, the candidate master node CN aggregates the secret random perturbation item, and the main node CM updates the global model parameter.

[0065] Step 7.1, the main node CM aggregates the secret random perturbation local model in the benign node index set According to the following formula, to obtain the encrypted global model.

[0066]

[0067] Wherein, represents the parameter in the encrypted global model, represents the parameter in the secret random number perturbation local model.

[0068] Step 7.2, the candidate master node CN receives the benign node index set The candidate master node CN aggregates the secret random perturbation item sent by the training node TN corresponding to the benign node index set Obtains the secret random perturbation aggregation value R k The candidate master node CN sends the secret random perturbation aggregation value R k To the main node CM. The candidate master node CN may be a Byzantine node, which may return an incorrect secret random perturbation aggregation value. Normally, the secret random perturbation aggregation values returned by normal nodes should be consistent, and the Byzantine node may return a randomly generated incorrect secret random perturbation aggregation value. Participant B sends an arbitrary error value to participant A, and participants C, D, and E send correct values to participant A.

[0069] Step 7.3, after the main node CM receives the secret random perturbation aggregation value R k , select the same and majority R k As the aggregation value R of the secret random perturbation of this group of nodes, R = mode(R k), selects the candidate master node CN node corresponding to the aggregation value as a benign node, and sends the candidate master node CN of other aggregation values as a Byzantine node, wherein R represents the aggregation value of the secret random disturbance, and mode(·) represents the mode operation. In the embodiment of the application, the participant A receives the arbitrary error value sent by the participant B and the correct value sent by the participants C, D and E, and the correct value sent by the participants C, D and E is the mode. At this time, it can be determined that the participant B is a Byzantine node.

[0070] Step 7.4, the master node CM subtracts the aggregation value R of the secret random disturbance from the encrypted global model to obtain the updated global model.

[0071] Step 7.5, the master node CM combines the loss value loss of each training node TN node model i and the secret random disturbance aggregation result R returned by the candidate master node CN node k , and divides the training node TN node into the following three trust states: when loss i ∈(0, avglv), it is benign, when loss i ≥avglv and R k ≠R, it is Byzantine, otherwise, it is ordinary. In the embodiment of the application, B satisfies the condition of loss i ≥avglv and R k ≠R, so B is determined as a Byzantine node, C, D, E, H, I and K satisfy the condition of loss i ∈(0, avglv), so C, D, E, H, I and K are determined as benign nodes, and the remaining nodes F, G and J are ordinary nodes.

[0072] Step 7.6, the master node CM updates the credibility and reputation of each training node TN according to the following formula.

[0073]

[0074]

[0075] wherein, represents the credibility of the i-th training node TN at the t-th iteration, represents the reputation of the i-th training node TN at the t-th iteration, and a, b and c are standard parameters of the Gompertz function. Gompertz represents a function for describing the relationship between the gradient credibility and the reputation. In the embodiment of the application, the credibility of all participants is initialized as the credibility of B is updated the credibility of C, D, E, H, I and K is updated the credibility of F, G and J is updated

[0076] Step 7.7, the master node CM broadcasts the global model to the system network.

[0077] Step 8, the candidate master nodes CN vote for the updated global model.

[0078] Step 8.1, each candidate master node CN calculates the loss value of the updated global model on the discriminant sample set.

[0079] Step 8.2, each candidate master node CN votes for the global model by fluctuation threshold according to the following formula: if the absolute value of the difference between the loss value and the last round iteration loss value does not exceed the fluctuation threshold, it indicates that the global model parameter is in the correct convergence direction, the candidate master node CN votes for the updated global model and broadcasts it to the system network; otherwise, the candidate master node CN broadcasts retraining information in the system network.

[0080]

[0081] wherein, represents the loss value of the i-th training node TN at the t-th round, and μ represents the fluctuation threshold of the global model loss value.

[0082] Step 8.3, if more than half of the candidate master nodes CN vote for the updated global model parameter, the master node CM is determined as a benign node, and step 8.4 is executed; otherwise, the master node CM is determined as a Byzantine node, and a master node CM is reselected, which broadcasts the global model and executes step 3. In the embodiment of the application, the participants C, D and E vote for the updated global model parameter, and the participant B does not support it, more than half of the candidate master nodes CN vote for the updated global model parameter, and step 8.4 is executed.

[0083] Step 8.4, the master node CM broadcasts the global model, the credibility and reputation of the training node TN to all nodes in the network, and the model training participants reach a consensus on the updated parameter.

[0084] Step 9, update the credibility and reputation of the master node CM, and select a new master node CM and candidate master node CN.

[0085] The master node CM selects x model training participants with higher reputation as candidate master nodes CN; the new master node CM is selected from the candidate master nodes CN according to the consensus protocol of the reputation; the new master node CM updates the credibility and reputation of the last round master node CM and broadcasts it to the system network; and the new master node CM broadcasts the global model.

[0086] Step 10, judging whether the global model converges or not, if yes, executing step 11; otherwise, executing step 3.

[0087] Step 11, ending the cooperative training, and obtaining the global model.

Claims

1. A DFL method against Byzantine attacks based on performance evaluation and committee voting, characterized in that, The main node CM detects the Byzantine node based on the performance evaluation method, and the candidate main node CN votes for the updated global model; the specific steps of the DFL method against the Byzantine attack include the following: Step 1, generate a discrimination sample set for each participant: Each participant of model training randomly sends L small data samples, and each participant of model training aggregates the small data samples sent by other participants with its own small data samples to form a discriminant sample set of the participant. ; Step 2, randomly select a main node CM and a candidate main node CN, and the main node CM broadcasts the global model; Step 3, the training node TN respectively trains the global model using its own local data set to obtain its own local model; Step 4, the training node TN generates a differentially private local model using DP; Step 5, the training node TN adds a secret random number perturbation item to each local model to obtain a secret random number perturbation local model of the training node TN; Step 6, the main node CM detects the Byzantine node based on the performance evaluation method: The master node CM calculates the loss value of the differential privacy local model of each training node TN on the discriminant sample set in the current iteration; the master node CM calculates the average loss value of the differential privacy local model of each training node TN in the current iteration; the master node CM selects benign training nodes TN whose model loss values are less than the average loss value to form a benign node index set , and sends the benign index set to the candidate master node CN . Step 7, the candidate main node CN aggregates the secret random perturbation item, and the main node CM updates the global model parameters: Step 7.1, the primary node CM aggregates the benign node index set with the secret random number to perturb the local model, obtaining the encrypted global model; Step 7.2, the candidate master node CN receives the benign node index set sent by the master node CM , the candidate master node CN aggregates the secret random perturbation items sent by the training nodes TN corresponding to the benign node index set , to obtain a secret random perturbation aggregation value , the candidate master node CN sends the secret random perturbation aggregation value to the master node CM; Step 7.3, the primary node CM receives the aggregated value of secret random perturbation After, select the same and majority The aggregated value of secret random perturbation as the group node , , select the candidate primary node CN node corresponding to the aggregated value as benign node, send other candidate primary nodes CN as Byzantine nodes, wherein Indicates the aggregated value of secret random perturbation Indicates the mode operation; Step 7.4, the principal node CM subtracts the aggregated value of the encrypted global model minus the secret random perturbation The updated global model is obtained. Step 7.5, the master node CM combines the loss value of the differential privacy local model of each training node TN and the secret random perturbation aggregation result returned by the candidate master node CN node , the training node TN node is divided into the following three trust states: when , the training node TN is a benign node, when and , the training node TN is a Byzantine node, otherwise, the training node TN is a normal node; Step 7.6, the main node CM updates the credibility and reputation of each training node TN; Step 7.7, the main node CM broadcasts the global model to the system network; Step 8, the candidate main node CN votes for the updated global model: Step 8.1, each candidate main node CN calculates the loss value of the updated global model on the discrimination sample set; Step 8.2, each candidate main node CN votes for the global model by the fluctuation threshold, if the absolute value of the difference between the loss value of the updated global model on the discrimination sample set calculated by the candidate main node CN and the last round iteration loss value does not exceed the fluctuation threshold, it indicates that the global model parameters are in the correct convergence direction, the candidate main node CN votes for the updated global model and broadcasts it to the system network; otherwise, the candidate main node CN broadcasts the opposing information in the system network; Step 8.3, if more than half of the candidate main nodes CN in the system network vote for the updated global model parameters, the main node CM is determined to be a benign node, and step 8.4 is executed; otherwise, the main node CM is determined to be a Byzantine node, and a new main node CM is selected, which broadcasts the global model and executes step 3; Step 8.4, the main node CM broadcasts the global model, the credibility and reputation of the training node TN to all nodes in the network, and the model training participants reach a consensus on the updated parameters; Step 9, update the credibility and reputation of the main node CM, and select a new main node CM and a candidate main node CN: Master node CM should be selected based on its reputation. Each model trains participants as candidate master nodes (CNs); among the candidate master nodes (CNs), a new master node (CM) is selected based on a consensus protocol of credibility; the new master node (CM) updates the credibility and reputation of the previous master node (CM) and broadcasts it to the system network; the new master node (CM) broadcasts the global model. Step 10, judge whether the global model converges, if yes, execute step 11; otherwise, execute step 3; Step 11, end the collaborative training to obtain the global model.

2. The DFL method against Byzantine attacks based on performance evaluation and committee voting according to claim 1, characterized in that, The steps of randomly selecting the main node CM and the candidate main node CN in step 2 are as follows: First, randomly select one participant from all model training participants, and select the participant as the main node CM; Secondly, randomly select from all participants except the master node CM a node as a candidate master node CN; wherein, represents the total number of model training participants, represents the ratio of the candidate master node CN to all model training participants, and . 3.The DFL method against Byzantine attacks based on performance evaluation and committee voting of claim 1, wherein, The steps of training the global model by the training node TN using its own local data set in step 3 are as follows: First, the participants other than the main node CM form the training node TN; Second, each training node TN updates its own local model with the received global model; In the third step, each training node TN inputs its own local dataset into its own local model, using the SGD gradient descent algorithm to iteratively derive the optimal local model. the optimal local model.

4. The DFL method against Byzantine attacks based on performance evaluation and committee voting of claim 1, wherein, The steps of generating the differential privacy local model by the training node TN in step 4 are as follows: In the first step, each training node TN selects a privacy budget according to local privacy requirements and a relaxation constant , the sensitivity of the model parameters , the standard deviation of the Gaussian noise is set to , wherein is the clipping threshold of the local model parameters, is the local data set of the training node TN; Second step, each training node TN generates Gaussian noise Subject distribution ; Third step, the training node TN adds the respective generated Gaussian noise to the local model to obtain the differential privacy local model for detecting whether each training node TN is a Byzantine node; Fourth step, the training node TN sends the differential privacy local model parameters to the master node CM.

5. The DFL method against Byzantine attacks based on performance evaluation and committee voting according to claim 1, characterized in that, The steps of adding the secret random number perturbation item in each local model in step 5 are as follows: In the first step, each training node TN randomly generates a secret random perturbation item with any element non-zero and adds it to the local model to generate a secret random number perturbed local model; Second step, the training node TN sends the secret random perturbation item to all candidate master nodes CN, and transmits the secret random number perturbation local model parameters to the master node CM.

6. The DFL method of resistance to Byzantine attacks based on performance evaluation and committee voting according to claim 1, characterized in that, The loss value of the differential privacy local model of each training node TN on the discriminant sample set at this round of iteration in step 6 is obtained by the following formula: ； wherein, denotes the model loss value of the th training node TN on the discriminating sample set dds, denotes a modulo operation, denotes the loss function of the th training node TN, denotes the parameters of the differential privacy local model of the th training node TN, denotes the th sample in dds. 7.The DFL method of resisting Byzantine attacks based on performance evaluation and committee voting according to claim 1, wherein, The average loss value of the differential privacy local model of each training node TN at this round of iteration in step 6 is obtained by the following formula: ； wherein, denotes the average loss value of the differential privacy local model of the th training node TN on the discriminant sample set, and S denotes the set of training nodes TN. 8.The DFL method of resisting Byzantine attacks based on performance evaluation and committee voting according to claim 1, wherein, The set of aggregated benign node indices described in step 7.1 The secret random perturbation local model in step 7.2 is implemented by the following equation: ； wherein, denotes the parameters in the encrypted global model, denotes the parameters in the locally model perturbed by a secret random number.

9. The DFL method of resistance to Byzantine attacks based on performance evaluation and committee voting according to claim 1, characterized in that, The update of the credibility and reputation of each training node TN in step 7.6 is obtained by the following formula: ； ； wherein, represents the credibility of the i-th training node TN at the j-th iteration, represents the credibility of the i-th training node TN at the j-th iteration, represents the credibility of the i-th training node TN at the j-th iteration, represents the credibility of the i-th training node TN at the j-th iteration, represents the credibility of the i-th training node TN at the j-th iteration, represents the credibility of the i-th training node TN at the j-th iteration, is a standard parameter of the Gompertz function, Gompertz representing a function that characterizes the relationship between the gradient credibility and the reputation.

10. The DFL method against Byzantine attacks based on performance evaluation and committee voting of claim 1, wherein, The evaluation of the global model by the fluctuation threshold in step 8.2 is realized by the following formula: ； wherein, represents the loss value of the i-th training node TN at the j-th round, represents the loss value of the i-th training node TN at the j-th round, represents the loss value of the i-th training node TN at the j-th round, represents the fluctuation threshold of the global model loss value.

Images