A robust federated learning abnormal client detection method based on spectral clustering

Abstract

The application belongs to the field of federated learning anomaly detection, and discloses a robust federated learning anomaly client detection method based on spectral clustering. The server constructs an undirected graph by establishing a prediction model and calculating the cosine similarity of the local model and the prediction model; obtains a sample set by calculating the Laplacian matrix of the undirected graph; the server cuts the sample set by using a spectral clustering method based on K-means, divides the clients into three categories, and calculates the trust score according to different client categories; at the same time, the server uses a behavior-based trust redemption mechanism to process different clients. The application uses spectral clustering to accurately divide the clients and perform trust evaluation, uses a behavior-based trust redemption mechanism to dynamically adjust the trust value of the client, avoids the client being completely isolated from the federated learning process due to being misjudged as malicious, fully utilizes the data resources of the client, ensures the integrity of the federated learning process, and thus ensures the accuracy of the global model.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection in federated learning, and more particularly to a robust client-side anomaly detection method for federated learning based on spectral clustering. Background Technology

[0002] Federated learning (FL) is an emerging learning paradigm based on distributed data. In a federated learning scenario, multiple clients (e.g., smartphones, IoT devices, edge data centers) collaboratively learn a machine learning model, called a global model, without sharing their local training data with a cloud server. FL iteratively executes the following three steps: the server sends the current global model to selected clients; each selected client fine-tunes the received global model on its local training data and sends the updated model parameters or gradients back to the server; the server aggregates the received model updates according to aggregation rules and updates the global model.

[0003] Federated learning (FL) is vulnerable to poisoning attacks. Malicious clients use poisoned data to train local models, then send these poisoned local model updates to the server, thus corrupting the global model. Researchers identify malicious nodes by comparing the differences between malicious and normal models and provide a trust-based defense scheme to resist malicious attacks in federated learning, thereby ensuring the accuracy of the global model.

[0004] In 2021, Xiaoyu Cao et al. proposed a trust-guided Byzantine robust federated learning method, FLTrust, in their paper "FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping." By collecting prior datasets and training the model, the server is guided to perform trust assessments by comparing client model similarities. The assessment results and normalized model updates are then used to detect malicious clients, resisting malicious attacks and improving global model accuracy. In 2022, Zehui Zhang et al. proposed a privacy-preserving momentum federated learning method, DetectPMFL, in their paper "DetectPMFL: Privacy-Preserving Momentum Federated Learning Considering Unreliable Industrial Agents." This method uses the CKKS scheme to encrypt local data and employs cosine similarity to distinguish industrial agents. It identifies unreliable industrial agents based on cosine similarity, addressing the problem of low-quality data collected by unreliable industrial agents reducing model accuracy.

[0005] In low-density network federated learning scenarios, client deployment is sparse, and there are not only malicious clients but also low-quality clients due to natural failures. To complete the normal federated learning task, clients should be reasonably classified and given the opportunity to rejoin the federated learning process. FLTrust can resist adaptive attacks from malicious clients and perform trust assessments, but it does not consider the impact of naturally failed nodes (unreliable clients); DetectPMFL distinguishes unreliable or low-quality clients for industrial agents, but it lacks a corresponding redemption mechanism to allow them to rejoin the federated learning process.

[0006] Therefore, the federated learning client detection mechanism still has some shortcomings, mainly in the following aspects: (1) It does not consider network density. In scenarios with sparse clients, isolating malicious nodes will lead to an insufficient number of federated learning clients, affecting the performance of the global model. (2) It does not consider the special characteristics of the scenario. The quality of clients in federated learning is affected by multiple factors such as the environment and malicious attacks. Malicious client detection ignores the distinction between naturally faulty nodes and malicious nodes. (3) It does not consider maximizing resource utilization. Naturally faulty nodes are affected by the environment and communication conditions and may be misidentified as malicious nodes. At the same time, there is a lack of corresponding redemption mechanisms, which wastes the data resources of naturally faulty nodes. These defects make the existing federated learning abnormal client detection methods face the challenge of poor universality and inability to maximize the utilization of available resources in practical applications. Summary of the Invention

[0007] The purpose of this invention is to propose a robust federated learning anomaly client detection method based on spectral clustering to solve the above-mentioned technical problems.

[0008] To achieve the above objectives, the technical solution of this invention is as follows: A robust federated learning anomaly client detection method based on spectral clustering, comprising the following steps:

[0009] Step 1: Establish a scene model;

[0010] The network model consists of 1 server and N client nodes; the server communicates with each client node within the communication range, the clients do not communicate with each other, and each client node has the same required energy, computing and storage resources, and the clients move within the deployment area;

[0011] In the federated learning process, each client collects data and stores it locally; the server sends an initial model to the client, and the client uses the local data to train the initial model; the client periodically sends the model parameter values ​​to the server, and the server creates a global model by aggregating the updates of each model; after multiple iterations of training, the final global model is obtained.

[0012] The server is a trusted server, and the clients include malicious clients, faulty clients, and normal clients.

[0013] Step 2: Abnormal client detection;

[0014] Step 2.1) Establish a prediction model;

[0015] In the initial iteration of federated learning, each client is set to be a normal client; the server sends the initial model ω0 to the client; after receiving the initial model, the client uses its own local data Data... l Train the initial model and then calculate the gradient of the trained local model. Uploaded to the server; the server performs local model aggregation to obtain the global model ω. t The polymerization process is as follows:

[0016]

[0017] Where, ω t Let ω represent the global model obtained in the t-th iteration. k,t-1 Let n represent the local model uploaded by client k in round t-1. k Let n represent the number of samples from client k, n represent the sum of the number of samples from all clients, and N represent the total number of clients.

[0018] After t-1 iterations, the server obtains the local model gradient. Aggregation yields the global model ω t As the next round of prediction model M p ;

[0019] Step 2.2) Establish the Laplace matrix;

[0020] Starting from the t-th round of training, there are faulty clients and / or malicious clients among the clients. The Laplacian matrix of the clients is established as the basis for spectral clustering to distinguish client categories.

[0021] (2.2.1) Constructing an undirected graph: In the t-th round and subsequent training processes, the client receives the model sent by the server, trains a local model using local data, and uploads it to the server; after receiving the local models uploaded by each client, the server calculates the gradient of each local model. With prediction model M p cosine similarity q i The cosine similarity set q = {q1, q2, q3, ..., q N The calculation process is as follows:

[0022]

[0023] Define an undirected graph G(V,E), with a local model. Let V be the vertex in an undirected graph, and E be the edge matrix. Calculate the similarity difference between vertex i and vertex j to obtain the similarity difference matrix S:

[0024] S ij =q i -q j .

[0025] Set a similarity difference threshold δ, compare the similarity difference between vertex i and vertex j with the threshold δ. If the similarity difference does not exceed the threshold δ, connect the two vertices in the undirected graph and update E. ij and E ji It is 1; that is:

[0026]

[0027] (2.2.2) Adjacency Matrix Update: Establish the adjacency matrix R. Based on the updated edge matrix E, calculate the cosine similarity of the local models of adjacent vertices i and j, and use it as the edge weight to update the adjacency matrix R. The process is as follows:

[0028]

[0029] (2.2.3) Degree Matrix Update: Construct a degree matrix D. For an undirected graph G with edge weights, each element of the degree matrix is ​​the sum of the weights of the vertices. The process is as follows:

[0030]

[0031] (2.2.4) Laplacian Matrix Update: Based on the adjacency matrix and degree matrix of the undirected graph G with N vertices, calculate the Laplacian matrix L of the undirected graph G. The process is as follows:

[0032] L=DR

[0033] Step 2.3) Perform spectral clustering based on the Laplacian matrix;

[0034] Based on the Laplacian matrix L, find its eigenvalues ​​λ and their corresponding eigenvectors p. Sort the eigenvalues ​​in ascending order, and the corresponding eigenvectors are ordered as p1, p2, ..., p. N Take the eigenvectors corresponding to the first two non-zero eigenvalues ​​to form an eigenvector matrix F (N*2). Each row in F is a 2-dimensional sample, and a total of N samples are output to form a sample set.

[0035] Perform spectral clustering on the above samples; divide the sample set into 3 clusters according to the distance between samples, with the requirement that the sum of the weights of the edges within the cluster is maximized and the weights of the edges between the clusters are minimized.

[0036] Sum of squared errors of each sample from the center of its cluster:

[0037]

[0038] Where, x m Let c represent the m-th sample. m It is x m The cluster to which it belongs represents the center point of the cluster, is the mean of all points in the cluster, and N is the total number of samples;

[0039] The largest cluster c1 obtained by clustering is the local model uploaded by a normal client; the cluster closer to c1 is the classification cluster c2, which corresponds to the client with natural failure; the classification cluster c3, which is far from the above two clusters, corresponds to the malicious client.

[0040] Step 3: Client-side trust mechanism;

[0041] For the clients already categorized above, three different trust assessment and redemption mechanisms are adopted. By dynamically updating the trust value of the client in each iteration, the client that has been redeemed and restored to normal is redeemed, thus maximizing the integrity of federated learning.

[0042] Step 3.1) Trust assessment model;

[0043] Based on the above spectral clustering results, the server calculates the cosine similarity q between the client's local model and the prediction model within each cluster. i Normalization is then performed, and the normalization process is as follows:

[0044]

[0045] Where, q min Let q be the minimum cosine similarity. max This represents the maximum value of the cosine similarity.

[0046] Before each round of local model aggregation, the server obtains the client based on the above normalization. i q i Received client location Transmission latency of uploading partial models to the client The comprehensive calculation results in a trust score, which is used to assess the trust of normal clients and clients that have experienced natural failures. When a client is classified as a malicious client, the trust score is 0.

[0047] The trust score is calculated as follows:

[0048]

[0049] Where α, β, γ are the weights of local model cosine similarity, client location, and model transmission delay, and α+β+γ=1, ρ is the behavior factor;

[0050] Set trust threshold θ The server calculates the trust score for each client. When a client's trust score is greater than the trust score, the client is considered trusted. θ At that time, it was determined to be a trusted client and participated in this round of global model aggregation;

[0051] Step 3.2) Behavior-based trust redemption mechanism;

[0052] Establish a trust redemption mechanism for naturally faulty clients and malicious clients whose trust scores are below the trust threshold;

[0053] For all clients, the behavior factor ρ is initially set to 1: when a client is classified as malicious, the behavior factor is set to 0; as the federated learning iterations increase, the behavior factor is increased when the client is classified as a normal client for ε consecutive iterations; when the behavior factor reaches σ, the client's trust score is recalculated, and when the client's trust score exceeds the trust threshold, the trust factor is increased. θ If the client's behavior factor is set to 0.5, the local model uploaded by the client will participate in the global model aggregation again; if the client's behavior factor is 0 for ε consecutive rounds, the client will no longer participate in the federated learning process.

[0054] If a client is classified as a natural fault client in a given instance, the behavior factor is set to 0.5. As the federated learning iterations increase, if a client is classified as a normal client for ε / 2 consecutive iterations, the behavior factor is set to 1, and the local model uploaded by that client participates in the global model aggregation again.

[0055] The malicious client mainly launches label flipping attacks through local data, modifying the labels of the local data, causing the local model trained by the malicious client to deviate from the direction of the normal model;

[0056] Faulty client: The data collected by the faulty client is missing, redundant or partially erroneous, and the local model trained by it differs from the normal model. However, the faulty client will recover to normal over time or as the training iterations change.

[0057] Normal client: The data collected by the normal client is normal, and the local model trained conforms to the update direction of the global model, which can improve the accuracy of the global model and accelerate the convergence of the global model.

[0058] The spectral clustering uses the K-means clustering method, and the process is as follows:

[0059] (1) Randomly select 3 vertices as the initial cluster centers, denoted as .

[0060] (2) Calculate x for each sample i The distance to each initial cluster center is used to assign it to the cluster closest to it:

[0061]

[0062] τ is the current iteration step, b is the b-th cluster, b = 1, 2, 3;

[0063] (3) For each cluster, recalculate the cluster center using samples from that cluster:

[0064]

[0065] (4) Repeat steps (2) and (3) above until the clustering result remains unchanged.

[0066] The beneficial effects of this invention are as follows: This invention uses spectral clustering to accurately classify clients and perform trust assessment, and adopts a behavior-based trust redemption mechanism to dynamically adjust the trust value of clients, avoiding clients being misjudged as malicious and completely isolated from the federated learning process, making full use of client data resources, ensuring the integrity of the federated learning process, and thus ensuring the accuracy of the global model. Attached Figure Description

[0067] Figure 1 This is a diagram of the federated learning scenario described in this invention;

[0068] Figure 2 This is a flowchart of a robust federated learning anomaly client detection method based on spectral clustering, which is an embodiment of the present invention.

[0069] Figure 3 This is a flowchart of the abnormal client detection process based on spectral clustering in an embodiment of the present invention. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0071] A robust federated learning anomaly client detection method based on spectral clustering is applied to federated learning scenarios where client deployment is sparse, some clients are subject to malicious label-flipping attacks, or are faulty due to environmental and mobile factors. For example... Figure 1As shown, clients are sparsely deployed within a certain area, randomly distributed, and can move dynamically within the deployment area. Clients can receive the global model from the server and upload locally trained local models, along with information such as location and transmission latency, to the server.

[0072] The process of this invention is as follows Figure 2 As shown, this embodiment of the invention provides a robust federated learning anomaly client detection method based on spectral clustering, including:

[0073] Step 101: The server sends out the initial global model, the client uses local data to train a local model, and uploads the local model, along with its location and transmission latency, to the server.

[0074] Step 102: The server receives the local model uploaded by the client and builds a prediction model based on the parameters of the local model.

[0075] Step 103: The server constructs an undirected graph based on the cosine similarity between the local model uploaded by the client and the prediction model.

[0076] Step 104: The server uses spectral clustering to segment the undirected graph and classifies the clients into three categories: normal, faulty, and malicious.

[0077] Step 105: The server performs trust assessments on the three types of clients and adopts different trust redemption mechanisms.

[0078] In this embodiment of the invention, the server needs to build a prediction model and compare it with the local model uploaded by the client. Therefore, the server needs to receive the local model uploaded by the client, along with information such as its location and transmission latency, through steps 101 and 102. The prediction model is then built using the parameters of the local model uploaded by the client.

[0079] After the server builds the prediction model, it distributes the global model again. The client trains its local model using local data and uploads it to the server. The server constructs a graph structure from the client's model by calculating the cosine similarity between the local model and the prediction model, and uses methods such as... Figure 3 The spectral clustering method shown cuts the undirected graph formed by clients, resulting in three types of clients: normal, faulty, and malicious.

[0080] After client category detection is completed, the server normalizes the cosine similarity between the local client model and the predicted model within each cluster. Before each round of local model aggregation, the server calculates a trust score based on the normalized client cosine similarity, the received client location, and the transmission latency of the client's uploaded local model. This trust score is then used to assess the trust of normal clients and naturally failing clients. If a client is classified as malicious, its trust score is 0. After the trust assessment, different trust redemption mechanisms are applied to failing and malicious clients, allowing them to rejoin the network or be permanently isolated.

[0081] The specific steps are as follows:

[0082] Step 1: Establish a scene model;

[0083] The network model consists of 1 server and N client nodes; the server communicates with each client node within the communication range, the clients do not communicate with each other, and each client node has the same required energy, computing and storage resources, and the clients move within the deployment area;

[0084] In the federated learning process, each client collects data and stores it locally; the server sends an initial model to the client, and the client uses the local data to train the initial model; the client periodically sends the model parameter values ​​to the server, and the server creates a global model by aggregating the updates of each model; after multiple iterations of training, the final global model is obtained.

[0085] The server is a trusted server, and the clients include malicious clients, faulty clients, and normal clients.

[0086] Step 2: Abnormal client detection;

[0087] Step 2.1) Establish a prediction model;

[0088] In the initial iteration of federated learning, each client is set to be a normal client; the server sends the initial model ω0 to the client; after receiving the initial model, the client uses its own local data Data... l Train the initial model and then calculate the gradient of the trained local model. Uploaded to the server; the server performs local model aggregation to obtain the global model ω. t The polymerization process is as follows:

[0089]

[0090] Where, ω t Let ω represent the global model obtained in the t-th iteration. k,t-1 Let n represent the local model uploaded by client k in round t-1.k Let n represent the number of samples from client k, n represent the sum of the number of samples from all clients, and N represent the total number of clients.

[0091] After t-1 iterations, the server obtains the local model gradient. Aggregation yields the global model ω t As the next round of prediction model M p ;

[0092] Step 2.2) Establish the Laplace matrix;

[0093] Starting from the t-th round of training, there are faulty clients and / or malicious clients among the clients. The Laplacian matrix of the clients is established as the basis for spectral clustering to distinguish client categories.

[0094] (2.2.1) Constructing an undirected graph: In the t-th round and subsequent training processes, the client receives the model sent by the server, trains a local model using local data, and uploads it to the server; after receiving the local models uploaded by each client, the server calculates the gradient of each local model. With prediction model M p cosine similarity q i The cosine similarity set q = {q1, q2, q3, ..., q N The calculation process is as follows:

[0095]

[0096] Define an undirected graph G(V,E), with a local model. Let V be the vertex in an undirected graph, and E be the edge matrix. Calculate the similarity difference between vertex i and vertex j to obtain the similarity difference matrix S:

[0097] S ij =q i -q j .

[0098] Set a similarity difference threshold δ, compare the similarity difference between vertex i and vertex j with the threshold δ. If the similarity difference does not exceed the threshold δ, connect the two vertices in the undirected graph and update E. ij and E ji It is 1; that is:

[0099]

[0100] (2.2.2) Adjacency Matrix Update: Establish the adjacency matrix R. Based on the updated edge matrix E, calculate the cosine similarity of the local models of adjacent vertices i and j, and use it as the edge weight to update the adjacency matrix R. The process is as follows:

[0101]

[0102] (2.2.3) Degree Matrix Update: Construct a degree matrix D. For an undirected graph G with edge weights, each element of the degree matrix is ​​the sum of the weights of the vertices. The process is as follows:

[0103]

[0104] (2.2.4) Laplacian Matrix Update: Based on the adjacency matrix and degree matrix of the undirected graph G with N vertices, calculate the Laplacian matrix L of the undirected graph G. The process is as follows:

[0105] L=DR

[0106] Step 2.3) Perform spectral clustering based on the Laplacian matrix;

[0107] Based on the Laplacian matrix L, find its eigenvalues ​​λ and their corresponding eigenvectors p. Sort the eigenvalues ​​in ascending order, and the corresponding eigenvectors are ordered as p1, p2, ..., p. N Take the eigenvectors corresponding to the first two non-zero eigenvalues ​​to form an eigenvector matrix F (N*2). Take each row of F as a 2-dimensional sample and output a total of N samples to form a sample set.

[0108] Perform spectral clustering on the above samples; divide the sample set into 3 clusters according to the distance between samples, with the requirement that the sum of the weights of the edges within the cluster is maximized and the weights of the edges between the clusters are minimized.

[0109] Sum of squared errors of each sample from the center of its cluster:

[0110]

[0111] Where, x m Let c represent the m-th sample. m It is x m The cluster to which it belongs represents the center point of the cluster, is the mean of all points in the cluster, and N is the total number of samples;

[0112] The largest cluster c1 obtained by clustering is the local model uploaded by a normal client; the cluster closer to c1 is the classification cluster c2, which corresponds to the client with natural failure; the classification cluster c3, which is far from the above two clusters, corresponds to the malicious client.

[0113] Step 3: Client-side trust mechanism;

[0114] For the clients already categorized above, three different trust assessment and redemption mechanisms are adopted. By dynamically updating the trust value of the client in each iteration, the client that has been redeemed and restored to normal is redeemed, thus maximizing the integrity of federated learning.

[0115] Step 3.1) Trust assessment model;

[0116] Based on the above spectral clustering results, the server calculates the cosine similarity q between the client's local model and the prediction model within each cluster. i Normalization is then performed, and the normalization process is as follows:

[0117]

[0118] Where, q min Let q be the minimum cosine similarity. max This represents the maximum value of the cosine similarity.

[0119] Before each round of local model aggregation, the server obtains the client based on the above normalization. i q i Received client location Transmission latency of uploading partial models to the client The comprehensive calculation results in a trust score, which is used to assess the trust of normal clients and clients that have experienced natural failures. When a client is classified as a malicious client, the trust score is 0.

[0120] The trust score is calculated as follows:

[0121]

[0122] Where α, β, γ are the weights of local model cosine similarity, client location, and model transmission delay, and α+β+γ=1, ρ is the behavior factor;

[0123] Set trust threshold θ The server calculates the trust score for each client. When a client's trust score is greater than the trust score, the client is considered trusted. θ At that time, it was determined to be a trusted client and participated in this round of global model aggregation;

[0124] Step 3.2) Behavior-based trust redemption mechanism;

[0125] Establish a trust redemption mechanism for naturally faulty clients and malicious clients whose trust scores are below the trust threshold;

[0126] For all clients, the behavior factor ρ is initially set to 1: when a client is classified as malicious, the behavior factor is set to 0; as the federated learning iterations increase, the behavior factor is increased when the client is classified as a normal client for ε consecutive iterations; when the behavior factor reaches σ, the client's trust score is recalculated, and when the client's trust score exceeds the trust threshold, the trust factor is increased. θIf the client's behavior factor is set to 0.5, the local model uploaded by the client will participate in the global model aggregation again; if the client's behavior factor is 0 for ε consecutive rounds, the client will no longer participate in the federated learning process.

[0127] If a client is classified as a natural fault client in a given instance, the behavior factor is set to 0.5. As the federated learning iterations increase, if a client is classified as a normal client for ε / 2 consecutive iterations, the behavior factor is set to 1, and the local model uploaded by that client participates in the global model aggregation again.

[0128] During each iteration of federated learning training, anomaly detection is performed on clients, and benign clients are selected for global model aggregation. At the same time, a trust redemption mechanism is used to dynamically adjust the trust value of clients so that clients that have recovered can be added to the federated learning training in a timely manner.

[0129] In summary: The server constructs an undirected graph by building a prediction model and calculating the cosine similarity between the local model and the prediction model; then, it calculates the Laplacian matrix of the undirected graph to obtain the sample set; the server uses a K-means-based spectral clustering method to segment the sample set, classifying clients into three categories: normal, faulty, and malicious, and calculating trust scores for each client category; after trust evaluation, the server employs a behavior-based trust redemption mechanism to handle faulty and malicious clients differently. The robust federated learning anomaly client detection method based on spectral clustering can accurately classify clients, distinguishing between normal clients, naturally faulty clients, and malicious clients, achieving higher accuracy in client detection; different redemption mechanisms for different clients prevent naturally faulty clients from being misjudged as malicious clients and completely isolated from the federated learning process, thus avoiding waste of client data resources. This invention uses a behavior-based trust redemption mechanism to dynamically adjust the client's trust value, enabling clients that recover to normal status to promptly join the federated learning training, fully utilizing client data resources, ensuring the integrity of the federated learning process, and thus ensuring the accuracy of the global model.

Claims

1. A robust federated learning anomaly client detection method based on spectral clustering, characterized in that, The steps are as follows: Step 1: Establish a scene model; Network models include One server and One client node; The server communicates with each client node within the communication range, while the clients do not communicate with each other. Each client node has the same required energy, computing, and storage resources, and the clients move within the deployment area. During the federated learning process, each client collects data and stores it locally; The server sends the initial model to the client, and the client uses local data to train the initial model; The client periodically sends model parameter values ​​to the server, which then creates a global model by aggregating updates from various models; the final global model is obtained after multiple iterations of training. The server is a trusted server, and the clients include malicious clients, faulty clients, and normal clients. Step 2: Abnormal client detection; Step 2.1) Establish a prediction model; In the initial iteration of federated learning, each client is set to be a normal client; the server distributes the initial model. To the client; after receiving the initial model, the client uses its own local data Train the initial model and then calculate the gradient of the trained local model. Uploaded to the server; the server performs local model aggregation to obtain the global model. The polymerization process is as follows: ； in, Indicates the first The global model obtained from rounds of iteration, Indicates the first Wheel Client Uploaded local model, Indicates the client The number of samples, This represents the sum of the number of samples from all clients. Indicates the total number of clients; go through After rounds of iteration, the server obtains the local model gradient. Aggregation yields a global model As the next round of prediction model ; Step 2.2) Establish the Laplace matrix; From the At the start of the training round, there are faulty and / or malicious clients among the clients. The Laplacian matrix of the clients is established as the basis for spectral clustering to distinguish client categories. (2.2.1) Constructing an undirected graph: In the first... During the initial training round and subsequent training processes, the client receives the model from the server, trains a local model using local data, and uploads it to the server. After receiving the local models uploaded by each client, the server calculates the gradient of each local model. With predictive models cosine similarity , The calculation process is as follows: ； Define an undirected graph Local model gradient Vertices in an undirected graph The edge matrix of an undirected graph is ; Calculate vertices With vertex The similarity difference between the two is used to obtain the similarity difference matrix. : Set a similarity difference threshold Compare vertices With vertex Similarity difference and threshold The relationship is such that the similarity difference does not exceed the threshold. Then connect two vertices in the undirected graph and update... and for ;Right now: ； (2.2.2) Adjacency Matrix Update: Establishing the Adjacency Matrix Based on the updated edge matrix described above Calculate adjacent vertices and vertex The cosine similarity of the local model is used as the edge weight in the adjacency matrix. The update process is as follows: ； (2.2.3) Degree Matrix Update: Establishing the degree matrix For an undirected graph with edge weights The degree matrix consists of the sum of the weights of the vertices, and the process is as follows: ； (2.2.4) Laplace matrix update: Based on the above, An undirected graph with vertices Given the adjacency matrix and degree matrix, calculate the undirected graph. Laplace matrix The process is as follows: ； Step 2.3) Perform spectral clustering based on the Laplacian matrix; According to the Laplace matrix above Find its eigenvalues and its corresponding eigenvectors Sort by eigenvalues ​​from smallest to largest, the corresponding eigenvectors are sorted as follows: Take the eigenvectors corresponding to the first two non-zero eigenvalues ​​to form the eigenvector matrix. , Each row in the output is treated as a 2D sample, and the total output is... Each sample forms a sample set; Perform spectral clustering on the above samples; divide the sample set into 3 clusters according to the distance between samples, with the requirement that the sum of the weights of the edges within the cluster is maximized and the weights of the edges between the clusters are minimized. Sum of squared errors of each sample from the center of its cluster: , in, Representing the One sample, yes The cluster to which it belongs This represents the center point of the cluster, and is the mean of all points within the cluster. The total number of samples; The largest cluster obtained by clustering A partial model uploaded by a normal client; and Clusters that are closer in distance are classified as taxonomic clusters. This corresponds to the faulty client; the classification clusters that are far away from the two clusters mentioned above. This corresponds to a malicious client; Step 3: Client-side trust mechanism; For the clients already categorized above, three different trust assessment and redemption mechanisms are adopted. By dynamically updating the trust value of the client in each iteration, the client that has been redeemed and restored to normal is redeemed, thus maximizing the integrity of federated learning. Step 3.1) Trust assessment model; Based on the above spectral clustering results, the server calculates the cosine similarity between the client's local model and the prediction model within each cluster. Normalization is then performed, and the normalization process is as follows: ； in, This represents the minimum value of the cosine similarity. This represents the maximum value of the cosine similarity. Before each round of local model aggregation, the server obtains the client's data based on the above normalization. of Received client location Transmission latency of uploading partial models to the client The comprehensive calculation results in a trust score, which is used to assess the trust between normal and faulty clients; when a client is classified as a malicious client, the trust score is 0. The trust score is calculated as follows: ； in, These are the weights of local model cosine similarity, client location, and model transmission latency, and , Behavioral factors; Set trust threshold The server calculates the trust score for each client. When a client's trust score is greater than a certain threshold, the client is considered trustworthy. At that time, it was determined to be a trusted client and participated in this round of global model aggregation; Step 3.2) Behavior-based trust redemption mechanism; Establish a trust redemption mechanism for faulty and malicious clients whose trust scores are below the trust threshold; Set behavioral factors for all clients. The initial value is 1: when a client is classified as malicious, the behavior factor is set to 0; as the number of federated learning iterations increases, when consecutive... If the client is identified as a normal client, a behavior factor is added; when the behavior factor is... When the client's trust score exceeds the trust threshold, the trust score is recalculated. If the client's behavior factor is set to 0.5, the local model uploaded by the client will participate in the global model aggregation again; when the client's behavior factor is continuously... If the round value is 0, the client will no longer participate in the federated learning process; When a client is classified as a faulty client in a given instance, the behavior factor is set to 0.5; as the number of federated learning iterations increases, when consecutive If the client is identified as a normal client and its behavior factor is set to 1, the local model uploaded by this client will participate in the global model aggregation again.

2. The robust federated learning anomaly client detection method based on spectral clustering according to claim 1, characterized in that, The malicious client: launches a label flipping attack through local data, modifies the labels of the local data, and causes the local model trained by the malicious client to deviate from the direction of the normal model; Faulty client: The data collected by the faulty client is missing, redundant or partially erroneous, and the local model trained by it differs from the normal model. However, the faulty client will recover to normal over time or as the training iterations change. Normal client: The data collected by the normal client is normal, and the local model trained conforms to the update direction of the global model, which can improve the accuracy of the global model and accelerate the convergence of the global model.

3. The robust federated learning anomaly client detection method based on spectral clustering according to claim 1 or 2, characterized in that, The spectral clustering uses the K-means clustering method, and the process is as follows: (1) Randomly select 3 vertices as the initial cluster centers, denoted as . ; (2) Calculate each sample The distance to each initial cluster center is used to assign it to the cluster closest to it: , This represents the current iteration step. For the first Cluster (3) For each cluster, recalculate the cluster center using samples from that cluster: ； (4) Repeat steps (2) and (3) above. The process ends when the clustering results remain unchanged.

Images