Recommendation method based on federated matrix factorization

Abstract

The present invention discloses a recommendation method based on federated matrix decomposition, comprising the following steps: S1, current global model parameter P τ Broadcast to all clients; S2, each client uses the global model parameter P τ As the initial local model parameters, the local model parameters are trained locally and the local model parameters M of the training process are uploaded to the server; S3, the server forms a reporting list of the corresponding clients based on the local model parameters M, finds the honest clients based on the reporting list, aggregates the local model parameters M of the honest clients, and updates the global model parameters P of the τ+1th round τ+1 , detect the global model parameters P τ+1 If the test result is yes, then execute step S4; if the test result is no, then the global model parameter P τ+1 Using the converged global model parameters P, we execute step S1. S4 predicts each user's rating for each item based on the converged global model parameters P, and recommends the item with the highest predicted rating to the corresponding customer. Malicious updates are eliminated, and the proportion of honest clients in the aggregate is increased to improve recommendation accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of personalized recommendation technology, and more specifically, the present invention relates to a recommendation method based on federated matrix decomposition. Background Art

[0002] With the rapid development of artificial intelligence (AI), various emerging technologies are controlled by different companies. The data held by these companies holds enormous potential value, but these companies are reluctant to share their data with the public, resulting in data silos. Publicizing the data held by individual companies risks leaking user privacy and failing to guarantee both personal privacy and data security. To address the data silo problem while protecting user privacy, a new distributed machine learning (ML) method called federated learning (FL) has been proposed. In an FL system, all participants own their own data, ensuring equal status and inaccessibility to each other's data. Aggregators also lack access to individual participant data. Recommendation systems (RS) also face the data silo problem. Data generated by users across different applications cannot be aggregated for analysis, making it difficult to accurately analyze user behavior and preferences, or accurately predict user ratings for items and make targeted recommendations. To protect user data within recommendation systems, recommendation systems are combined with federated learning to form federated recommendation systems. Federated recommendation systems can address the data silo problem while protecting user privacy. FL training involves multiple participants, but the reliability of these participants cannot be guaranteed, making it easy for attackers to infiltrate and compromise model performance. While FL protects user privacy by keeping sensitive data private, malicious clients still pose a threat to model security.

[0003] In a federated learning system, the central server cannot manage client behavior or access their private data. Federated learning achieves a global model through repeated iterative learning, randomly selecting client information for interaction during the learning process. In a large-scale federated learning environment, numerous endpoints possess sensitive data and model parameters. Once exploited, attackers can use this information to infer the global model and modify it to their own advantage, thereby impacting the accuracy of the model output. After identifying the source of the vulnerability, attackers will develop different attack schemes tailored to the specific vulnerabilities. Generally speaking, the client is a relatively vulnerable component in federated learning. Attackers exploit this vulnerability to manipulate model parameters on the client side, thereby controlling the model training process and ultimately gaining control of the global model. If a malicious attacker exists on the client side of a federated recommendation system, they will likely tamper with or generate false data locally, or modify local parameters during upload, disrupting training and reducing the performance of the recommendation model. Summary of the Invention

[0004] The present invention provides a recommendation method based on federated matrix decomposition, aiming to improve the above problems.

[0005] The present invention is implemented as follows: a recommendation method based on federated matrix decomposition, the method comprising the following steps:

[0006] S1, the first round of global model parameters P τ As the current global parameter, it is broadcast to all clients;

[0007] S2, each client uses the global model parameter P τ As the initial local model parameters, the local model parameters are trained locally, and the local model parameters M of the training process are uploaded to the server;

[0008] S3. The server forms a report list of the corresponding client based on the local model parameter M, finds the honest client based on the report list, aggregates the local model parameter M of the honest client, and updates the global model parameter P of the τ+1 round. τ+1 , detect the global model parameters P τ+1 If the test result is yes, then execute step S4; if the test result is no, then the global model parameter P τ+1 As the current global model parameters, execute step S1;

[0009] S4. Predict each user's rating of each item based on the converged global model parameter P, and recommend the item with the highest predicted rating to the corresponding user.

[0010] Furthermore, the method for forming the report list of the i-th client is as follows:

[0011] Based on the local model parameter M i The similarity of the item preference updates between the i-th client and other clients is calculated based on the item preference vector update difference in the i-th client. The malicious client of the i-th client is identified based on the similarity and added to the report list R of the i-th client. i .

[0012] Furthermore, the similarity calculation method between the i-th client and the j-th client is as follows:

[0013] Determine the sparsity of the user-item matrix;

[0014] If the user-item matrix is dense, the parameter gradient θ of the item preference vector of the i-th client and the j-th client is i ,θ j The cosine similarity between them is used as the similarity Sim of the item preference update between the i-th client and the j-th client i,j If the user-item matrix is sparse, the similarity of the parameter gradient of the item preference vector of the same item between the i-th client and the j-th client is used as the similarity Sim′ of the item preference update between the i-th client and the j-th client. i,j .

[0015] Furthermore, the similarity Sim i,j The calculation formula is as follows:

[0016]

[0017] in, Coming soon to Concatenate them into a vector, represents the kth parameter gradient of the item preference vector of the i-th client, Will to Concatenate them into a vector, represents the kth parameter gradient of the item preference vector of the jth client. ||θ i ||、||θ j || represents the vector θ i ,θ j The mold length.

[0018] Furthermore, the similarity Sim′ i,j The calculation formula is as follows:

[0019] The parameter gradient θ from the i-th client and the j-th client i , parameter gradient θ j Select the items O whose parameter gradient values are not zero i、Project O j , from Project O i and Project O j Filter out n name The same project, from the parameter gradient θ i , parameter gradient θ j Read the corresponding parameter gradients and record them in vector δ i , vector δ j In , the similarity calculation formula of the item preference updates of the i-th client and the j-th client is as follows:

[0020]

[0021] Furthermore, the method for obtaining the honest client is as follows:

[0022] The server counts the number of times all clients have been reported in the current round τ based on the reporting list of all clients;

[0023] The clients whose reporting times are less than the threshold are recorded in the candidate honest list H in the τth round. τ In the τth round, the clients whose reporting times are greater than or equal to the threshold are recorded in the candidate attack list A τ middle;

[0024] If the candidate honest list H τ If the total number of recorded clients exceeds the threshold ξ, the total number of times each client appears in the candidate attack list A is counted. The total number of times a client appears in the candidate attack list A is greater than the average number of times all clients in the candidate attack list A are reported (avg). A , then put the client into attack list A τ′ ;

[0025] If candidate attack list A τ If the total number of recorded clients exceeds the threshold ξ, the candidate attack list A will be τ The client in the attack list A τ′ Attack List A τ′ The clients other than the .

[0026] Furthermore, based on attack list A τ′ The other clients use the weighted average algorithm to aggregate parameters, and after aggregation, the global parameter P of the τ+1 round is formed. τ+1 , and its calculation formula is as follows:

[0027]

[0028] Among them, s kis the number of evaluation items of the i-th client, s is the total number of evaluation items of the selected n′ honest clients, represents the local model parameters formed by the i-th client in the τ-th round.

[0029] Furthermore, the score of client i on project o is predicted based on the following formula:

[0030]

[0031] Among them, μ o represents the average rating of all clients for item o, b user 、b item 、p user ,q item They represent the user preference vector, item preference vector, user vector, and item vector in the converged global model parameters P, respectively.

[0032] Furthermore, the t-th parameter gradient θ of the item preference vector t The calculation formula is as follows:

[0033]

[0034] in, Represent the item preference vectors after the t-th and t-1-th training respectively, represents the initial value of the item preference vector, and k is the total number of training times.

[0035] Each client only has its own local data, updated parameters and global model parameters broadcast from the server. Without other circumstances, a single client cannot obtain the data and parameters of other clients. The difference between clients is calculated by the server. Each client is only responsible for uploading local model parameters and receiving global parameters from the server. During the local training phase, the client uses the global parameters as the initial parameters and uses local data for training to complete the e t After a round of local training, the historical parameters are uploaded to the server, which does not involve the content of local data. Therefore, the server can only grasp the model parameter values of the client and cannot obtain the client's local data to protect the client's data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the structure of a recommendation system based on federated matrix decomposition provided by an embodiment of the present invention;

[0037] Figure 2 A flowchart of a recommendation method based on federated matrix decomposition provided in an embodiment of the present invention;

[0038] Figure 3Figure 3 shows the RMSE trend of the example of the present invention and three other defense algorithms against data poisoning attacks and category attacks: (a) shows the defense against data poisoning attacks in MovieLens-100K, (b) shows the defense against category attacks in MovieLens-100K, (c) shows the defense against data poisoning attacks in Book Crossing, and (d) shows the defense against category attacks in Book Crossing.

[0039] Figure 4 The following are the accuracy trend charts of the present invention and three other defense algorithms against data poisoning attacks and category attacks, where (a) represents the defense against data attacks in MovieLens-100K, (b) represents the defense against category attacks in MovieLens-100K, (c) represents the defense against data attacks in Book Crossing, and (d) represents the defense against category attacks in Book Crossing.

[0040] Figure 5 Figure 3 shows the RMSE trend of the example of the present invention and three other defense algorithms against noise attacks and sign-flip attacks. (a) shows the defense against noise attack in MovieLens-100K, (b) shows the defense against sign-flip attack in MovieLens-100K, (c) shows the defense against noise attack in Book Crossing, and (d) shows the defense against sign-flip attack in Book Crossing.

[0041] Figure 6 The following are the accuracy trend charts of the example of the present invention and three other defense algorithms against noise attacks and sign flip attacks, where (a) represents the defense against noise attacks in MovieLens-100K, (b) represents the defense against sign flip attacks in MovieLens-100K, (c) represents the defense against noise attacks in Book Crossing, and (d) represents the defense against sign flip attacks in Book Crossing. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0043] Unless otherwise defined, all technical terms used in the embodiments of the present application have the same meanings as commonly understood by those skilled in the art.

[0044] Figure 1 A schematic diagram of the structure of a recommendation system based on federated matrix decomposition provided in an embodiment of the present invention is shown. For ease of explanation, only the parts related to the embodiment of the present invention are shown.

[0045] The system includes: n clients, which are connected to the server for communication.

[0046] The client trains its local model based on the global model parameters of the current round broadcast by the server and uploads the trained local model parameters to the server. The server identifies local malicious clients relative to the local client based on the updated differences in the item preference vectors in the local model parameters, and further identifies global malicious clients and honest clients. It then aggregates the local model parameters of the honest clients to form the global model parameters for the next round. It should be noted that once the local model parameters on the client are uploaded to the server, they are essentially local model parameters relative to the server.

[0047] Figure 2 A flowchart of a recommendation method based on federated matrix decomposition provided in an embodiment of the present invention, which specifically includes the following steps:

[0048] S1, the first round of global model parameters P τ As the current global parameter, it is broadcast to all clients;

[0049] S2, each client based on the global model parameter P τ As the initial local model parameters, the local model parameters are trained locally, and the local model parameters M of the training process are uploaded to the server;

[0050] M={M τ_1 ,…,M τ_t ,,M τ_k}

[0051] Among them, M τ_t It represents the local model parameters formed by the t-th training in the τ-th round. During each round of global update, each client needs to train the local model parameters k times locally. p user is the user vector, q item is the item vector, b user is the user preference vector, b item is the item preference vector.

[0052] There are differences between the updates of the local model parameters M from malicious clients and the updates from honest clients. By comparing the changes in parameters during local training, we can determine which updates are malicious. During the training process of the local model parameters M, the user vector p in the local model parameters M is user , item vector q item, user preference vector b user , item preference vector b item Update using the SGD algorithm.

[0053] S3. The server forms a report list of the corresponding client based on the local model parameter M, finds the honest client based on the report list, aggregates the local model parameter M of the honest client, and updates the global model parameter P of the τ+1 round. τ+1 , detect the global model parameters P τ+1 If the test result is yes, then execute step S4; if the test result is no, then the global model parameter P τ+1 As the current global model parameters, execute step S1;

[0054] (1) Formation of each client's reporting list

[0055] Because attacks that tamper with local data can cause changes in user preferences for items, the parameter change rate of abnormal updates is high. Attacks that tamper with model parameters also affect the parameter changes of item preferences. To defend against attacks that tamper with local data and model parameters, this paper designs two methods for calculating update similarity, starting from the perspective of calculating the parameter changes of item preferences in each local update.

[0056] (1) Cosine similarity calculation for item preference vector update

[0057] According to the characteristics of matrix decomposition, the project preference reflects the user's interest preference in the project. The present invention analyzes the project preference vector b uploaded by the client. item , the item preference parameter gradient of each round of local update is shown in formula (1):

[0058]

[0059] Among them, θ t represents the t-th parameter gradient of the item preference vector, Represents the initial value of the item preference vector, that is, the global model parameter P τ The item preference vector in , Represent the item preference vectors after the t-th and t-1-th training respectively.

[0060] The server calculates the parameter gradient θ of the item preference vector of all clients. The parameter gradient of the item preference vector of the i-th client is θ i Indicates that the parameter gradient θ is calculated i ,θ j Cosine similarity Sim i,j , using cosine similarity Sim i,jMeasure the similarity of the item preference vector updates between the i-th client and the j-th client, Sim i,j The calculation formula is shown in (2)

[0061]

[0062] In formula (2), Coming soon to Concatenate them into a vector, represents the kth parameter gradient of the item preference vector of the i-th client, Will to Concatenate them into a vector, represents the tth parameter gradient of the item preference vector of the jth client. ||θ i ||、||θ j || represents the vector θ i ,θ j The mold length.

[0063] (2) Similarity calculation based on updating item preference vectors of the same item

[0064] Due to the nature of item preference parameters, if no client has rated an item, the parameters will not be updated. Unchanged parameters can affect similarity determination. To eliminate this effect, this article provides a similarity calculation method based on identical items.

[0065] Calculate the parameter gradient θ of the item preference vector of the i-th client i ,θ i Reflects the item preference parameter gradient update of the item owned by the i-th client in the k-th local training.

[0066]

[0067] in, represents the item preference parameter gradient of the i-th client for item m in the t-th local training, t∈[1,k].

[0068] θ i Each row in represents the parameter gradient of the project preference vector of the i-th client for a project. For the convenience of description, the parameter gradient of the project preference vector can be referred to as the project preference parameter gradient. The preference parameter gradient of the i-th client is is the tth parameter gradient of the item preference vector of the oth item of the ith client, m is the number of items, and k is the number of local training times.

[0069] To compare the differences between two clients’ updates, we can compare the preferences of the clients for the same items based on the parameter changes of the same items, thus reducing the influence of non-existent items on the similarity of the updates between the two clients. i , parameter gradient θ j Select the items O whose parameter gradient values are not zero i 、Project O j , from Project O i and Project O j Filter out n name The same project, from the parameter gradient θ i , parameter gradient θ j Read the corresponding parameter gradients and record them in vector δ i , vector δ j Then the similarity between the i-th client and the j-th client is calculated as shown in formula (4):

[0070]

[0071] The server understands the client's project preference updates and changes, and designs a reporting strategy based on similarity, that is, calculating the similarity between other client updates and its own. If the similarity is lower than the set similarity threshold, the corresponding other clients will be regarded as malicious clients of this client and added to its own reporting list R. The server collects the reporting list of each client.

[0072] In this embodiment of the present invention, if formula (2) is used to calculate the similarity of item preference updates between two clients, the similarity threshold of the i-th client is: Set the similarity below the similarity threshold avg i The other clients are regarded as malicious clients of the i-th client and added to the i-th client reporting list R i If formula (4) is used to calculate the similarity of item preference updates between two clients, the similarity threshold of the i-th client is: The similarity is higher than the similarity threshold avg′ i The other clients are regarded as malicious clients of the i-th client and added to the i-th client reporting list R i middle;

[0073] Based on the sparsity of the user-item matrix, formula (2) or formula (4) is selected to calculate the similarity of the project preference updates between the two clients. The user-item matrix refers to the ratings of each client on each project. If the i-th client has not rated project O, the value of the element at the corresponding position in the user-item matrix is zero. The sparsity of the user-item matrix refers to the proportion of non-zero elements in the user-item matrix in the user-item matrix. If the proportion is greater than the set proportion threshold, the user-item matrix is considered dense, otherwise it is considered sparse. If the user-item matrix is dense, formula (2) is selected to calculate the similarity of the project preference updates between the two clients. If the user-item matrix is sparse, formula (4) is selected to calculate the similarity of the project preference updates between the two clients. The two similarities are applicable to different matrix sparsity conditions, which improves the calculation accuracy of the project preference update similarity between clients.

[0074] (2) The server identifies honest clients and malicious clients based on the reporting list of all clients;

[0075] The server reports based on the report list of all clients Count the number of times n clients are reported in the current τ round. Take the i-th client as an example.

[0076]

[0077] As shown in formula (5), if the report list of the jth client in round τ is If there is the i-th client in the i =num i +1, if the report list is in round τ If there is no client i in the , then the number of reports is num i =num i +0, traverse the report list of all other clients except the i-th client, and finally get the number of reports of the i-th client in round τ.

[0078] And set a threshold ξ (usually set to n / 2), and in the τth round of update, put all clients into the candidate honest list H τ or Candidate Attack List A τ , if the number of times the i-th client is reported The server considers the i-th client to be an honest client and records it in the candidate honest list H in the τ-th round. τ , if the number of times the i-th client is reported The server considers the i-th client to be a malicious client and records it in the candidate attack list A in the τth round. τ ;

[0079] If the candidate honest list H τ The total number of recorded clients exceeds ξ. At this time, the update similarity of honest clients is high, and most honest clients can be screened out. As the number of iterations increases, the similarity between honest clients gradually decreases. Detecting malicious clients requires the total candidate attack list A recorded during the early training period = (A 1 ,A 2 ,...,A τ ). Count the total number of times each client appears in the candidate attack list A. The total number of times the j-th client appears in the candidate attack list A is Calculate the average number of times all clients in the candidate attack list A have been reported, avg A ,like Then put the jth client into the attack list A τ′ ,like Then put the jth client into the honest list H τ′ ; If candidate attack list A τ If the total number of recorded clients exceeds ξ, the candidate attack list A τ The client in the attack list A τ′ Attack List A τ′ The clients in do not participate in the second round of aggregation.

[0080] (3) Aggregate honest clients using federated average aggregation;

[0081] Based on attack list A τ′ The other clients use the weighted average algorithm to aggregate parameters, and after aggregation, the global parameter P of the τ+1 round is formed. τ+1 , and its calculation formula is as follows:

[0082]

[0083] Among them, s k is the number of evaluation items of the i-th client, and s is the total number of evaluation items of the n′ honest clients selected.

[0084] S4. Predict each user's rating of each item based on the converged global model parameter P, and recommend the item with the highest predicted rating to the corresponding customer.

[0085] Based on formula (7), the score of client i on item o is predicted

[0086]

[0087] Among them, μ o represents the average rating of all clients for item o, b user 、bitem 、p user ,q item They represent the user preference vector, item preference vector, user vector, and item vector in the converged global model parameter P respectively. Based on formula (7), the scores of all items by the i-th client can be predicted, and the item with the highest score can be recommended to the i-th client.

[0088] The recommendation method based on federated matrix decomposition provided by the present invention has the following beneficial technical effects:

[0089] (1) This paper finds that the changes in the item preference gradient parameters of malicious updates differ significantly from those of honest updates. Therefore, a local malicious client identification method based on the changes in local model parameter updates is designed. Specifically, the method calculates the client whose item preference parameter gradient similarity is lower than the mean, and calculates the client whose item preference gradient difference is lower than the mean for the same item with a non-zero gradient. Based on these two objectives, malicious clients can be effectively detected.

[0090] (2) A server-side identification method is designed to identify clients that are significantly different from itself, and then filter out honest clients based on the frequency of each client being reported. This strategy filters out the local malicious clients that each client considers and generates a report list of all clients. Based on the report list of all clients, the number of reports of each client is counted to generate a global malicious client list, i.e., an attacker list. Malicious updates are removed, and the proportion of honest clients in the aggregation is increased to improve recommendation accuracy.

[0091] This paper considers implementing recommendation tasks on two datasets:

[0092] The MovieLens-100K dataset contains user IDs, item IDs, and 100,000 ratings on 1,682 movies from 963 users, with ratings ranging from 1 to 5. The Book Crossing dataset removes all users and items with fewer than 20 and 10 interactions, respectively. This leaves 62,657 ratings on 14,684 books from 1,295 users, with ratings ranging from 1 to 10. 80% of the dataset is divided into the training set, and the remaining 20% is used as the test set.

[0093] This invention is a federated matrix decomposition recommendation method with a detection mechanism, referred to as DM-FedMF. The server uses the parameter gradient differences of the project in the client's local model as a measure of the honesty of the client's update. The present invention considers two aspects: one is to compare the parameter gradient differences of all projects, and the other is to filter out the parameter gradients of the same projects and calculate the average difference of changes. The server then generates a report list for each client based on the differences between the clients, and then updates the global attacker list based on the report list, eliminating updates from clients on the attacker list, thereby achieving the effect of filtering out malicious updates.

[0094] Krum algorithm: Machine learning with adversaries: byzantine tolerantgradient descent; Blanchard P, El Mhamdi EM, Guerraoui R; Proceedings of the31st International Conference on Neural Information Processing Systems; 2017; 118-128;

[0095] FoolsGold algorithm: The limitations of federated learning in sybilsettings; Fung C, Yoon CJM, Beschastnikh I; 23rd International Symposium onResearch in Attacks, Intrusions and Defenses (RAID 2020); 2020; 301-316;

[0096] MUD-Hog algorithm: Long-Short History of Gradients Is All You Need: DetectingMalicious and Unreliable Clients in Federated Learning; Gupta A, Luo T, Ngo MV; European Symposium on Research in Computer Security; 2022; 445-465;

[0097] The present invention targets four types of attacks, namely noise attack, sign flipping, data poisoning, and category attack. The number of participating training clients n=20, the attack ratio a=0.3, the threshold ξ=n / 2, the number of local training times k=20, and the number of global training times τ=100 are selected to compare the defense effects of the Krum algorithm, the FoolsGold algorithm, the MUD-Hog algorithm, and the present invention.

[0098] Figure 3 Figure 2 shows the RMSE trends for defending against local data tampering attacks using two datasets. The experimental results show that DM-FedMF achieves a final RMSE value within 1% of the MUD-Hog result when defending against data poisoning attacks, but with more stable convergence. Compared to the Krum and FoolGold algorithms, DM-FedMF achieves RMSE reductions of 17.6% and 9.2% respectively. This is because DM-FedMF uses item preference parameters to determine client update differences, resulting in a more accurate calculation than other methods. Furthermore, a reporting mechanism designed based on update characteristics in the later stages of iteration ensures stable convergence.

[0099] To verify the prediction performance of DM-FedMF, we used different datasets to compare the changes in the model's prediction accuracy after using four defense algorithms. Figure 4 The experimental results of (a) and (b) show that DM-FedMF achieves approximately 7% higher accuracy than other algorithms when defending against local data tampering attacks using the MovieLens-100K dataset. This indicates that filtering malicious clients based on item preference parameter updates has minimal impact on model performance when responding to attacks. Figure 4 (d) shows the prediction accuracy of the DM-FedMF model using the Book Crossing dataset in the context of defense category attacks, which differs by about 2% from the performance achieved by the MUD-Hog algorithm. This indicates that the use of filtering malicious clients based on item preference parameter updates has a certain impact on the prediction accuracy of the model in the defense category attack.

[0100] Figure 5 The present invention is superior to the MUD-Hog algorithm and the FoolsGold algorithm in defending against attacks on model parameters. Figure 5 In the noise attack defense shown in (a), the RMSE value of the present invention is about 5% lower than that of other algorithms on average. Figure 5In the defense against the sign-flip attack (shown in (b),) while the final performance of Krum's algorithm differed from that of our algorithm by less than 1%, the overall downward trend was more jittery and less stable than our algorithm. This is because our algorithm considers that the differences among honest clients increase with increasing training rounds. If we then determine based on gradient changes, most clients will be identified as malicious. Our algorithm achieves superior results when the number of honest clients identified is less than the threshold and uses the historical attack list to exclude malicious updates.

[0101] Figure 6 This shows the accuracy change trend of the model in the context of defending against attacks that tamper with model parameters. In defense against noise attacks, DM-FedMF achieved the highest accuracy compared to the three algorithms, outperforming the other algorithms by about 4% in the MovieLens-100K dataset and by about 8% in the Book crossing dataset. In defense against sign flip attacks, the difference with the best-performing Krum algorithm was less than 1%. This shows that the present invention more accurately screens out malicious updates and prevents them from participating in global aggregation. The present invention aggregates more updates from honest clients to ensure the prediction accuracy of the model.

[0102] The present invention has been described exemplarily. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the scope of protection of the present invention.

Claims

1. A recommendation method based on federated matrix decomposition, characterized in that: The method comprises the following steps: S1, the first round of global model parameters P τ As the current global parameter, it is broadcast to all clients; S2, each client uses the global model parameter P τ As the initial local model parameters, the local model parameters are trained locally, and the local model parameters M of the training process are uploaded to the server; S3. The server forms a report list of the corresponding client based on the local model parameter M, finds the honest client based on the report list, aggregates the local model parameter M of the honest client, and updates the global model parameter P of the τ+1 round. τ+1 , detect the global model parameters P τ+1 If the test result is yes, then execute step S4; if the test result is no, then the global model parameter P τ+1 As the current global model parameters, execute step S1; S4. Predict each user's rating of each item based on the converged global model parameter P, and recommend the item with the highest predicted rating to the corresponding user; The method for forming the reporting list of the i-th client is as follows: Based on the local model parameter M i The similarity of the item preference updates between the i-th client and other clients is calculated based on the item preference vector update difference in the i-th client. The malicious client of the i-th client is identified based on the similarity and added to the report list R of the i-th client. i ; The method for obtaining an honest client is as follows: The server counts the number of times all clients have been reported in the current round τ based on the reporting list of all clients; The clients whose reporting times are less than the threshold are recorded in the candidate honest list H in the τth round. τ In the τth round, the clients whose reporting times are greater than or equal to the threshold are recorded in the candidate attack list A τ middle; If the candidate honest list H τ If the total number of recorded clients exceeds the threshold ξ, the total number of times each client appears in the candidate attack list A is counted. The total number of times a client appears in the candidate attack list A is greater than the average number of times all clients in the candidate attack list A are reported (avg). A , then put the client into attack list A τ′ ; If candidate attack list A τ If the total number of recorded clients exceeds the threshold ξ, the candidate attack list A will be τ The client in the attack list A τ′ Attack List A τ′ The clients other than the above are honest clients; Predict client i's score for item o based on the following formula Among them, μ o represents the average rating of all clients for item o, b user 、b item 、p user ,q item They represent the user preference vector, item preference vector, user vector, and item vector in the converged global model parameters P, respectively.

2. The recommendation method based on federated matrix decomposition according to claim 1, characterized in that: The similarity calculation method between the i-th client and the j-th client is as follows: Determine the sparsity of the user-item matrix; If the user-item matrix is dense, the parameter gradient θ of the item preference vector of the i-th client and the j-th client is i ,θ j The cosine similarity between them is used as the similarity Sim of the item preference update between the i-th client and the j-th client i,j If the user-item matrix is sparse, the similarity of the parameter gradient of the item preference vector of the same item between the i-th client and the j-th client is used as the similarity Sim′ of the item preference update between the i-th client and the j-th client. i,j .

3. The recommendation method based on federated matrix decomposition according to claim 2, characterized in that: SimilaritySim i,j The calculation formula is as follows: in, Coming soon to Concatenate them into a vector, represents the kth parameter gradient of the item preference vector of the i-th client, Will to Concatenate them into a vector, represents the kth parameter gradient of the item preference vector of the jth client, ||θ i ||、||θ j || represents the vector θ i ,θ j The mold length.

4. The recommendation method based on federated matrix decomposition according to claim 2, wherein: Similarity Sim′ i,j The calculation formula is as follows: The parameter gradient θ from the i-th client and the j-th client i , parameter gradient θ j Select the items O whose parameter gradient values are not zero i 、Project O j , from Project O i and Project O j Filter out n name The same project, from the parameter gradient θ i , parameter gradient θ j Read the corresponding parameter gradients and record them in vector δ i , vector δ j In , the similarity calculation formula of the item preference updates of the i-th client and the j-th client is as follows:

5. The recommendation method based on federated matrix decomposition according to claim 1, characterized in that: Based on attack list A τ′ The other clients use the weighted average algorithm to aggregate parameters, and after aggregation, the global parameter P of the τ+1 round is formed. τ+1 , and its calculation formula is as follows: Among them, s i is the number of evaluation items of the i-th client, s is the total number of evaluation items of the selected n′ honest clients, represents the local model parameters formed by the i-th client in the τ-th round.

6. The recommendation method based on federated matrix decomposition according to claim 1, wherein: The gradient of the tth parameter of the item preference vector θ t The calculation formula is as follows: in, Represent the item preference vectors after the t-th and t-1-th training respectively, represents the initial value of the item preference vector, and k is the total number of training times.

Images