An amplitude alignment personalized and robust aggregation method for federated learning

Abstract

An amplitude alignment personalized and robust aggregation method for federated learning, a novel personalized federated learning pFL technology is proposed, wherein the local classification loss of the client is minimized, and for the categories shared with other clients, the local prototype of the client is aligned with the global prototype. The method adopts a hierarchical training method to realize more fine-grained personalization, and converts the local prototype to the frequency domain to prevent source data leakage; secondly, in order to prevent the FL model from incorrectly classifying some test samples, a robust aggregation technology is designed to ensure that the weight of the benign client which can provide reliable prediction for its local data is much larger than that of the malicious client in the aggregation process.

Description

Technical Field

[0001] This invention relates to the field of machine learning, and more particularly to an amplitude alignment personalization and robust aggregation method for federated learning. Background Technology

[0002] In the field of computer-aided diagnosis, Federated Learning (FL) currently provides reliable and efficient support for clinicians in diagnosing diseases. However, many challenges remain in FL applications, such as statistical heterogeneity of data, also known as the Non-independent and identically distributed (Non-IID) problem, poisoning attacks, and inference attacks. When the client dataset is Non-IID, all clients sharing the same global model parameters may lead to inconsistent optimization directions. This means that if the model is optimized in the same way, the resulting knowledge may contradict the client's local knowledge, which will ultimately slow down the process of reaching a stable solution. Furthermore, significant statistical differences among users can further degrade model performance. To address the problems caused by Non-IID data, early research proposed a clustered FL strategy to maintain multiple global models on a server to meet the needs of various clients. Simultaneously, a knowledge distillation-based approach has also been proposed to address this issue. Specifically, an additional public dataset is placed on the server to align the outputs of the student and teacher models, with the aim of incentivizing the student model to learn from the teacher model. However, when the heterogeneity between datasets is high, the knowledge of teacher models trained on public datasets may be affected by interference from some clients, leading to a significant drop in performance.

[0003] In distributed FL scenarios, servers lack access to the internal structure of clients and need to aggregate model information from them, a process vulnerable to poisoning attacks by malicious clients. Any client could potentially attack the FL model by violating training protocols and tampering with local data or labels, causing the FL model to indiscriminately produce low accuracy on the main task (untargeted poisoning attack) or misclassify test samples of specific categories (targeted poisoning attack). Furthermore, numerous studies have shown that sharing model updates or gradients among FL clients makes them susceptible to potential inference attacks launched by malicious external attackers. Attackers could be external eavesdroppers located on the communication link. Besides gradients, embeddings, implemented by mapping raw input data to low-dimensional vector representations, also contain important semantic information about the input, thus embeddings can also lead to privacy breaches. Privacy issues severely hinder the development and implementation of artificial intelligence, urgently requiring effective defense strategies. Traditional solutions primarily rely on encrypting model information to protect privacy, such as homomorphic encryption and secure multi-party computation. However, this approach increases data storage costs and cannot guarantee the reliability of third parties during key distribution. Another protection method is to incorporate slight noise perturbations. While data perturbation can achieve the same level of privacy protection as encryption, it also compromises data availability irreversibly and leads to a decline in model performance. Summary of the Invention

[0004] To address the above problems, this invention proposes an amplitude alignment personalization and robust aggregation method for federated learning, aiming to solve the following three problems: (1) statistical heterogeneity of participating customer data, (2) model efficiency degradation caused by targeted poisoning attacks, and (3) privacy leakage caused by inference attacks.

[0005] A method for amplitude alignment personalization and robust aggregation for federated learning is proposed. It employs a bottom-up, greedy hierarchical mechanism to train the federated learning model, comprising a two-layer architecture. The first layer is the client layer. To obtain the global prototype, the client performs an inverse fast Fourier transform (IFFT) using the global amplitude received from the server and the locally preserved phase. Next, each client performs local training, including minimizing the local cross-entropy loss and the distance between the local prototype and the global prototype. Furthermore, in each round of communication, each client continuously records the difference between the local cross-entropy loss and the inverse cross-entropy loss. Simultaneously, the client computes the local class prototype and converts it into a frequency-space signal using IFFT. The phase component remains local, while the amplitude component, along with the difference between the cross-entropy loss and the inverse cross-entropy loss, is sent to the server. The second layer is the edge server layer, which receives the information sent by the clients. Based on the difference between the cross-entropy loss and the inverse cross-entropy loss uploaded by all clients, it evaluates the label quality and credibility of each client, and then the server reassigns client weights according to these two metrics. To obtain the global amplitude, the server aggregates the local amplitudes uploaded by the clients based on the reassigned weights and the global amplitude from the previous round.

[0006] The method specifically includes the following steps:

[0007] (001) The client uses the global amplitude received from the server and the locally retained phase to perform an inverse fast Fourier transform to obtain the global prototype;

[0008] (002) Each client trains a local model, minimizes the local cross-entropy loss, and calculates the local class prototype. For categories shared with other clients, the client aligns the local prototype of the class data with the global prototype.

[0009] (003) In each round of communication, the client continuously records the difference between the local cross-entropy loss and the inverse cross-entropy loss. Simultaneously, for the local class prototype calculated by the client, it is converted into a frequency-space signal using a Fast Fourier Transform. The phase component remains local, while the amplitude component, along with the difference between the cross-entropy loss and the inverse cross-entropy loss, is sent to the server.

[0010] (004) The server receives the information sent by the client. Based on the difference between the cross-entropy loss uploaded by the client and the inverse cross-entropy loss, the server evaluates the label quality and credibility of each client respectively. Then the server reassigns the client weights according to these two indicators.

[0011] (005) The server aggregates the local amplitudes uploaded by the clients based on the reassigned weights and the global amplitude of the previous round to obtain the global amplitude, and then sends the global amplitude to all clients so that they can enter the next round of training.

[0012] Compared with the prior art, the present invention has the following beneficial effects:

[0013] (1) A novel amplitude-aligned pFL paradigm is designed to address the Non-IID data and inference attack problem in FL. The client introduces Fast Fourier Transform to prevent data leakage and exchanges local and global amplitudes on the communication link, instead of the local prototype. During local training, each client aligns the local and global prototypes layer by layer, allowing for efficient information transfer between heterogeneous clients. Therefore, this method produces more accurate personalized models, significantly improving privacy and performance in FL.

[0014] (2) To eliminate the threat of malicious poisoning attacks, this method designs a robust aggregation approach. The server defines dataset quality and client credibility metrics based on label noise levels. Based on these metrics, weights are dynamically assigned to each client to increase the contribution of benign clients that provide credible predictions for local data. This method can reduce the attack success rate and improve the robustness of the FL model.

[0015] (3) This method proposes a novel pFL technique, in which the client minimizes the local classification loss while aligning the local prototype of the data with the global prototype for categories shared with other clients. This technique employs a hierarchical training approach to achieve finer-grained personalization and transforms the local prototype to the frequency domain to prevent source data leakage. Attached Figure Description

[0016] Figure 1 This is the federated learning paradigm based on amplitude alignment for personalized and robust aggregation as described in the embodiments of the present invention.

[0017] Figure 2 This is a schematic diagram of the framework of the greedy layered amplitude alignment local training method described in an embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram of the robust polymerization method described in an embodiment of the present invention.

[0019] Figure 4 This is a comparison chart showing the decrease in accuracy of various methods when n=5, compared to when n=3, as described in the embodiments of the present invention.

[0020] Figure 5 This is a comparison chart of the average test accuracy of the method described in this embodiment of the invention on the MNIST dataset compared to the FedProto and FedAvg methods.

[0021] Figure 6This is a comparison chart showing the defensive effectiveness of the method described in this embodiment of the invention against inference attacks compared to the FedProto and FedAvg methods.

[0022] Figure 7 This is a comparison chart of the server-side CPU runtime (in seconds) per round of the method described in this embodiment of the invention compared to the Median, TMean, MKrum, and FGold methods. Detailed Implementation

[0023] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0024] The blockchain-assisted V2G security authentication and privacy data aggregation method described in this invention, such as... Figure 1 , Figure 2 and Figure 3 As shown, the system includes five entities: a trusted edge server, a benign client, a malicious client, and an external eavesdropper. It is first assumed that the entire federated system has K clients, each with its own local private Non-IID dataset D. k The client-side local convolutional neural network model Φ has parameters θ. k It consists of two parts: (1) a representation layer with parameters as follows: (2) The input instance is converted into a feature representation space, i.e., an embedding space; (3) The classification layer has the following parameters: Make a classification decision for a given representation. This is to obtain the global prototype. The client uses the global amplitude received from the server. and locally retained phase F P Perform an inverse fast Fourier transform. Then, each client performs local training, including minimizing the local cross-entropy loss. and the local prototype C (j) and global prototype The distance between them. Furthermore, in each round of communication, each client continuously records its local cross-entropy loss. With reverse cross-entropy loss The difference. Simultaneously, the client calculates the local class prototype C. (j) It is then converted into a frequency-space signal using a Fast Fourier Transform (FFT). Phase component F P Maintain local amplitude components The difference between cross-entropy loss and inverse cross-entropy loss Together, they are sent to the server. A trusted edge server receives information from the client, based on the difference between the cross-entropy loss and the inverse cross-entropy loss uploaded by all clients. Evaluate the label quality of each dataset separately. And credibility P kThis is to redistribute the weight of each customer. To obtain the global amplitude The server adjusts the weights accordingly. And the global amplitude of the previous round Aggregate the local amplitudes uploaded by the client.

[0025] 001. Obtaining the global prototype includes the following steps:

[0026] (1) During the first round of training, the global amplitude set It was initialized to 0 by the edge server.

[0027] (2) Taking the communication round t≥1 as an example, the edge server will set the global amplitude. Send it to the client participating in the training, k∈[K].

[0028] (3) If it is the first round of training, the global amplitude is {0,0,...}, which means that the global prototype is also {0,0,...}.

[0029] (4) In communication round t (t≥1), the client set retains the phase components that were stored locally in the previous communication round. And the global amplitude collected from the edge server. The global prototype of category j is calculated by converting the frequency domain signal back to the time domain signal. The calculation process is as follows:

[0030]

[0031] 002. Local training on the client side includes the following steps:

[0032] (1) If it is the first round of training, the client does not need to send the local prototype C. (j) Close to global prototype We only need to minimize the cross-entropy loss during local training. The training objectives are as follows:

[0033]

[0034]

[0035] in, For the i-th input instance, That is its corresponding label. The total number of samples across all clients is represented by... Represented as Θ={θ1,...,θ K} represents a set of model parameters customized for the client. This represents the loss function for client k, also known as the CE loss, which measures the difference between the predicted label and the true label.

[0036] (2) In communication round t (t≥1), the client introduces MMD as a measure of distance between local and global class prototypes. Compared with Euclidean distance, MMD can more accurately quantify the distance between representations. This invention takes client k running to block l as an example; the client's objective function is as follows:

[0037]

[0038]

[0039] in Let m be the prototype extracted from block l. The number of points it possesses; k(·) is the Gaussian kernel.

[0040] 003. The calculation of the local prototype amplitude includes the following steps:

[0041] (1) During local training, the input data x passes through the representation layer of the CNN model Φ. At that time, the client needs to calculate the local prototype, the prototype It is the average embedding vector of instances belonging to class j, calculated as follows:

[0042]

[0043] Where D k,j It is D k The set of all training data from class j.

[0044] (2) At the same time, the client needs to record the cross-entropy. and reverse cross-entropy The difference between The calculation formula is as follows:

[0045]

[0046]

[0047]

[0048] (3) External attackers may lurk in the communication link attempting to reconstruct client-side private data. According to published research, the leakage of data representation is the root cause of data leaks. This is because data representations that retain important semantic information about the input... Embedded in shared local gradients middle:

[0049]

[0050]

[0051] Where b is the model's predicted value; x' and y' are the attacker's reconstructed virtual input and label, respectively. The attacker minimizes the virtual data representation and... The distance between them is used to make the virtual input resemble the real input.

[0052] (4) If the prototype, as the average value of representations belonging to the same class, is not protected, it can also lead to data privacy leaks. To address this issue, the local class prototype calculated by the client is converted into a frequency space signal, and the amplitude spectrum is decomposed. This process uses Fast Fourier Transform. The amplitude component F of the generated parameters A and phase component F P As shown below:

[0053]

[0054] Where, j 2 =-1.

[0055] 004. The redistribution of client-side weights includes the following steps:

[0056] (1) The client will calculate the difference. And the amplitude component is submitted to the server, and the server, based on... Assess label quality And client trustworthiness P k .

[0057] The server allows M k and B k These represent the frequency with which a client is identified as malicious or benign, respectively, and are calculated as follows:

[0058]

[0059] Where α is a threshold;

[0060] (3) Then, the Beta distribution is used to assess the confidence level P. k probability distribution U k Modeling:

[0061] U k Beta (M) k B k )

[0062] Credibility P k The coordinates at which the Beta distribution reaches its maximum value are determined by M. k and B kThe initial values ​​of all are 1. Because Beta(1,1) is uniformly distributed on (0,1), this means that each client could start as either a malicious or benign client.

[0063] (4) Difference Consider the CE loss based on the labels given in the dataset and the RCE loss predicted by the FL model. Therefore, This represents the difference in distributional similarity between the predicted label and the label provided in the dataset. Smaller... This indicates a closer distribution, while a larger one... This indicates a more distant distribution. A closer distribution suggests that customers are more honest and less likely to falsify labels corresponding to local data. Furthermore, It is also affected by the model learning efficiency, which is determined by the amount of time spent in each round of communication. The rate of decline is used as a metric. Learning efficiency is directly proportional to label quality. Considering both dataset quality and model efficiency, label quality... It can be represented as:

[0064]

[0065] (5) During the aggregation phase, the server uses label quality and credibility to redistribute the weights of each client. In the collaborative learning process, clients can learn more from benign clients while learning less from malicious clients with poor label quality and low credibility. This ensures that the model can correctly classify samples to a certain extent, achieving robust federated collaboration. The weights assigned to client k in t can be expressed as:

[0066]

[0067]

[0068] Where η is the coefficient of the additional term.

[0069] (005) The server aggregates the local amplitudes uploaded by the clients based on the reassigned weights and the global amplitude of the previous round to obtain the global amplitude, and then sends the global amplitude to all clients so that they can enter the next round of training.

[0070] 005. Global amplitude aggregation includes the following steps:

[0071] (1) The knowledge distribution of the client in each round of learning is dynamically weighted. The server aggregates the local amplitude from the client as follows:

[0072]

[0073] (2) The server aggregates the local amplitudes uploaded by the clients to obtain the global amplitude, and then sends the global amplitude to all clients so that they can enter the next round of training. With each training iteration, the contribution of malicious clients gradually decreases, while the model of benign clients improves towards a local optimum.

[0074] The FedAPRA performance optimization technique for federated learning in this embodiment provides strong support for improving model performance, enhancing system robustness, and achieving a more stable convergence speed in FL.

[0075] The Fourier transform-based personalization technology in this embodiment solves the problem of statistical heterogeneity in data while effectively defending against inference attacks located on the communication link, thus protecting the privacy of client data.

[0076] The robust aggregation algorithm in this embodiment, based on the quality of client dataset labels and client trustworthiness, allows clients to learn more from benign clients during collaborative learning, while reducing the amount of knowledge learned from malicious clients with poor label quality and low trustworthiness. This ensures that the model can correctly classify samples to a certain extent, achieving robust federated collaboration.

[0077] The amplitude alignment-based personalization method FedGLA, based on the above design, was compared with several popular personalized federated learning methods in terms of performance in a practical application.

[0078] Each client is assigned an average of 100 samples belonging to a particular class. To ensure clients have varying amounts of data, this method fixes the standard deviation of k to either 1 or 2. In this experimental setting, the method adjusts the factor n to compare performance under different levels of class distribution heterogeneity. Tables 1 and 2 show the average test accuracy of the FL method on the MNIST and CIFAR10 datasets, respectively. The results show that FedGLA achieves the highest accuracy under different classification distribution conditions. In most cases, the FedGLA method also exhibits the smallest variance. This can be explained by the fact that this method can correct for and reduce local drift between distributed clients by adjusting the amplitude.

[0079] Table 1

[0080]

[0081] Table 2

[0082]

[0083] Furthermore, the model's accuracy steadily decreases as the value of n increases. This is because, with increasing n, fewer samples are allocated to each client for each class, leading to a more heterogeneous class distribution across clients. This heterogeneity makes it more difficult for FL methods to learn a model that performs well on all clients. Figure 4 The results show that the accuracy of various methods decreases when n=5 compared to n=3. Except for FedProto, FedGLA shows a smaller decrease in accuracy compared to other FL methods.

[0084] Furthermore, this method fixes n=5 and explores the accuracy reduction rate for different sample sizes k, such as... Figure 5 As shown, it is clear that on the MNIST dataset, the degradation rate of the FedGLA method is comparable to that of FedProto, and its degradation rate is significantly lower than that of FedAvg as the number of available training samples decreases. This indicates that the FedGLA method has stronger robustness and effectiveness in handling Non-IID data distributions in FL scenarios.

[0085] Tables 3 and 4 show the parameters for each communication round and the number of communication rounds required for convergence in the FL method. It can be seen that FedGLA requires the fewest communication rounds. Although the number of communication rounds per round for FedGLA is slightly higher than that for FedProto, it is significantly less than other compared methods. Its rapid convergence is due to FedGLA's use of a greedy hierarchical training framework, which enables it to find local optima faster and more accurately than other methods. This training framework allows each client to update its local model with only one communication round with the server, thus greatly reducing the number of communication rounds. Furthermore, the essence of FedGLA's moderate-amplitude communication is to approximate the local prototype with the global prototype, aiming to utilize global knowledge to assist local training.

[0086] Overall, FedGLA demonstrates good performance in terms of model accuracy, communication efficiency, and convergence speed by using hierarchical training and amplitude communication.

[0087] Table 3

[0088]

[0089] Table 4

[0090]

[0091]

[0092] Next, the personalized FedGLA based on amplitude alignment and the robust aggregation method FedLQC designed based on the above method for federated learning are demonstrated in practical applications to counteract attacks. To better illustrate the attack and defense effects, this method sets the local epoch and batch size for client-side local training to 1. At this time, as shown in Equation (3), when the batch size is 1, the prototype is the embedding vector. Figure 6 The defensive performance of the FedProto method, which employs a direct interactive prototype, and the proposed FedGLA method were compared on two baseline datasets. Clearly, the images reconstructed by an external attacker in FedProto are very similar to the original images, but the source data in FedGLA cannot be reconstructed. Because the client preserves the phase locally, even if the amplitude is intercepted, the external attacker cannot obtain the prototype.

[0093] This method defines three data distribution scenarios: MNIST-Non-IID, CIFAR10-IID, and CIFAR10-Non-IID, and evaluates the robustness of the proposed FedLQC to LFA and BA under these scenarios. Furthermore, this method compares FedLQC with other robust aggregation methods. To ensure experimental fairness, the average results from five runs are used.

[0094] Evaluation Metrics: This method uses the following metrics to evaluate the impact of poisoning attacks on the FL learning model:

[0095] (1) CE: The client uses the CE loss function to record the error between the model's predicted value and the true value. The smaller the CE value, the stronger the robustness of the method to poisoning attacks.

[0096] (2) Model accuracy (Mod-Acc): This is the average test accuracy of the model across all client test sets.

[0097] (3) Source Class Accuracy (Sou-Acc): In the attack experiments of this method, LFA and BA modify the labels of the source class samples to the target class. In addition to model accuracy, this method also needs to evaluate the impact of poisoning attacks on source class accuracy.

[0098] (4) Poisoning success rate (PSR): This method defines it as the proportion of samples with source labels that are misclassified by the model as the attacker's target label among all samples with source labels.

[0099] Robustness to LFA: Experimental results for defending against LFA in CIFAR10-IID and CIFAR10-Non-IID scenarios are shown in Tables 5 and 6. When the number of attackers is zero, the performance of the proposed FedLQC is comparable to FedAvg. As the proportion of malicious clients gradually increases, the model accuracy of other methods decreases significantly, while the performance decline of FedLQC is almost negligible. FedLQC has the highest source class accuracy and the lowest attack success rate in the presence of attackers. FoolsGold's PSR is also significantly lower than other methods, but it sacrifices the most model accuracy among the compared methods. FedLQC performs best because the scheme dynamically evaluates the quality of labels within each client. It reduces the contribution of noisy clients, focuses more on clients with clean datasets and efficient models, and the entire process is unaffected by the degree of data heterogeneity.

[0100] In addition, Tables 5 and 6 provide experimental results of the proposed FedAPRA methods (including FedGLA and FedLQC) under LFA conditions. FedAPRA exhibits, to varying degrees, the same robustness against poisoning attacks as FedLQC.

[0101] Table 5

[0102]

[0103]

[0104] Table 6

[0105]

[0106] Finally, the runtime was compared on the MNIST and CIFAR10 datasets. Figure 7 The server-side runtime (in seconds) for each aggregation method in each communication round is shown. The results indicate that, except for the baseline method FedAvg, FedLQC and TMean have significantly shorter runtimes than other methods. The main reason for this is that FedLQC uses two evaluation metrics to assign weights to clients. For the weight reallocation process, only a few predefined formulas need to be calculated.

[0107] The above description is only a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. Any equivalent modifications or changes made by those skilled in the art based on the content disclosed in the present invention should be included within the scope of protection set forth in the claims.

Claims

1. A federated learning oriented amplitude alignment personalized and robust aggregation method, characterized in that: The method comprises the following steps: Step 1, the client performs an inverse fast Fourier transform using the global amplitude received from the server and the locally reserved phase to obtain a global prototype; Step 2, each client trains a local model, minimizes the local cross-entropy loss while calculating the local class prototype, and aligns the local prototype of the class data with the global prototype for the class shared with other clients, and obtains the distance between the local prototype and the global prototype; Step 3, in each round of communication, the client continuously records the difference between the local cross-entropy loss and the reverse cross-entropy loss; at the same time, for the local class prototype calculated by the client, it is converted into a frequency space signal through fast Fourier transform; the phase component remains local, and the amplitude component is sent to the server together with the difference between the cross-entropy loss and the reverse cross-entropy loss; Step 4, the server receives the information sent by the client, evaluates the label quality and credibility of each client based on the difference between the cross-entropy loss and the reverse cross-entropy loss uploaded by the client, and then the server reassigns the client weight according to the two indexes; The step 4 comprises the following steps: Step 4-1, the server receives the difference and the amplitude set of the local prototype sent by the client; Step 4-2, the server lets M k and B k represent the frequency at which the client is identified as malicious or benign, respectively, and are calculated as follows: Wherein, α is a threshold value; Step 4 - 3, then the credibility P is modeled using a Beta distribution k probability distribution U k : U k :Beta(M k ,B k ) The credibility P k determined by the coordinate values at which the Beta distribution reaches a maximum; M k and B k The initial values of both A and B are 1 ; since Beta(1,1 ) is uniformly distributed over (0,1 ), this means that each client is equally likely to be a malicious or benign client at the start; Step 4-4, difference value Consider the CE loss based on the label given in the data set and the RCE loss predicted by the FL model; therefore, represents the difference in the proximity of the distribution between the predicted label and the label provided in the data set; a smaller represents a closer distribution, while a larger represents a farther distribution; a closer distribution means that the customer is more honest, and the possibility of forging the label corresponding to the local data is low; in addition, is also affected by the learning efficiency of the model, which is measured by the rate of decrease of in each round of communication; the learning efficiency is proportional to the label quality; considering the data set quality and model efficiency, the label quality is represented as: Wherein, t is the current communication round; Step 4-5, in the aggregation stage, the server reallocates the weight of each client using label quality and credibility ; in the process of federated learning, the client learns more knowledge from benign clients and reduces the knowledge learned from malicious clients with poor label quality and low credibility; it ensures that the model can correctly classify samples to a certain extent and realizes robust federated collaboration; the weight of the client k in t is: Wherein, η is the coefficient of the additional term; Step 5, the server aggregates the local amplitude uploaded by the client according to the re-assigned weight and the global amplitude of the last round, obtains the global amplitude, and sends the global amplitude to all clients to enter the next round of training.

2. The amplitude alignment personalized and robust aggregation method for federated learning according to claim 1, characterized in that: The method trains a federated learning model using a bottom-up and greedy hierarchical mechanism, including a two-layer architecture, the first layer is the client layer, and the second layer is the edge server layer.

3. The amplitude alignment personalized and robust aggregation method for federated learning according to claim 2, characterized in that: The step 1 comprises the following steps: Step 1-1, the server sends a set of global amplitudes to the client; Step 1-2, the client configures an auxiliary classifier for each representation layer l Except for the last layer R, 1≤l<R; the training process is divided into R blocks according to the number of representation layers; starting from the first block, it is trained until convergence, and then the representation layer parameters are frozen in it, and then the next block is entered; by freezing the parameters of the early blocks, the model retains the high-level features learned in these blocks, while continuing to learn more specific features in the later blocks; Step 1-3, each client combines the global amplitude for the class j it owns locally and the phase it kept from the previous round perform inverse Fourier transform to get the global prototype for this class 4. The amplitude alignment personalized and robust aggregation method for federated learning according to claim 3, characterized in that: The step 2 comprises the following steps: Step 2-1, the private dataset of client k is 1≤k≤K, where is the i-th input sample, is its corresponding label; the total number of samples on all clients is denoted by ; the distance between the local prototype and the global prototype is measured using the maximum mean difference MMD k ; the optimization objective of the entire personalized federated learning is set as: wherein, is the total loss of the entire federated learning; is the model parameter of the k-th client for the l-th block; is the prototype extracted from the l-th block; m is the number of points owned by the k-th client; k(·) is a Gaussian kernel; represents the loss function of the k-th client, i.e., the cross-entropy loss that measures the gap between the predicted label and the true label; λ is the weight coefficient of the regularization term; a, b are the vector elements of the vector elements of Step 2-2, during the training process, each client also calculates its local prototype; take client k as an example, the parameters are θ k The convolutional neural network model model Φ is composed of two parts: the representation layer, the parameters are Convert the input instance into a feature representation space, i.e. the embedding space; the classification layer, the parameters are Make a classification decision on the given representation; for client k, the prototype is the average embedding vector of instances belonging to class j, and the calculation formula is as follows: where D k,j is D k all training data from class j.

5. The amplitude alignment personalized and robust aggregation method for federated learning according to claim 4, characterized in that: The step 3 comprises the following steps: Step 3-1, in the local training process, the client needs to record the local cross-entropy loss continuously the difference with the reverse cross-entropy loss The cross-entropy loss function is as follows:​ Wherein, p is the label class distribution, and q is the predicted class distribution; Step 3-2, for the client-calculated local class prototype, convert it to a frequency space signal and decompose the amplitude spectrum; this process uses a fast Fourier transform Generate the amplitude component F of the parameter A and the phase component F P ; Step 3-3, the phase component remains local, and the amplitude component is sent to the server together with the difference between the cross-entropy loss and the reverse cross-entropy loss.

6. The amplitude alignment personalized and robust aggregation method for federated learning according to claim 5, characterized in that: The step 5 comprises the following steps: Step 5-1, the knowledge distribution of the client in each round of learning is dynamically weighted; the server aggregates the local amplitude from the client as follows: where v is the proportion of the amplitude in the current communication round t; is the amplitude of the client k in the communication round t belonging to the class j; Step 5-2, the server aggregates the local amplitude uploaded by the client to obtain the global amplitude, and sends the global amplitude to all clients to enter the next round of training; with each training iteration, the contribution of malicious clients gradually decreases, while the benign client model improves in the direction of local optimum.

Images