A method, device and computer-readable storage medium for enhancing federated learning model defense based on historical global model

Abstract

The present invention belongs to the technical field of information security, and more specifically, it relates to a method, device and computer-readable storage medium for enhancing the defense of a federated learning model based on a historical global model. The method includes the server sending a global model to the client, the attacker client intercepting each round of the global model and putting it into a historical global model storage pool; the server randomly selects some clients to use the local data set of the client for training to obtain a client local model, and the attacker client selects a historical global model in the historical global model storage pool as the attack target model; the client uploads the trained local local model to the server, the server aggregates it, and then sends it to each client; a dynamic weighted aggregation mechanism is introduced to obtain the parameters of the optimal global model. The present invention solves the problem that the effectiveness and attack success rate of the current defense method in a non-independent and identically distributed environment are low, and the effectiveness of the existing defense mechanism is low.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and more specifically, relates to a method, device and readable computer storage medium for enhancing federated learning model defense based on a historical global model. Background Art

[0002] Since its introduction in 2016, federated learning has attracted widespread attention in the industry for its advantages of protecting user data and privacy, distributed characteristics, and strong generalization. This method allows multiple clients to jointly train a global model without directly sharing data, so it is suitable for various intelligent edge devices and provides new possibilities for cross-domain data cooperation, showing broad application prospects.

[0003] Chinese invention patent CN113468264A discloses a blockchain-based federated learning method and device for poisoning defense and poisoning tracing, including: screening nodes introduce model similarity comparison methods to achieve trusted user judgment and divide suspicious poisoned users, and conduct security reviews in the early stage of aggregation to improve the computational efficiency of the framework. Utilize the blockchain accounting function to detect and verify the historical models of the participants, provide historical verification information for the detection nodes, reduce the computational pressure of real-time detection, and retain legal evidence for attack tracing. Model pruning of the participants' models reduces model complexity and reduces the communication cost of the model on the chain. Super aggregation nodes are generated by voting and are not fixed, removing fixed centralized settings to achieve an overall secure sharing framework.

[0004] However, federated learning also faces some challenges. First, the non-independent and identically distributed nature of data may lead to "data drift" during the client training process, thereby reducing the generalization ability of the final global model. Second, the distributed nature of the federated learning system provides an opportunity for attacker clients to exploit and attack the performance or convergence speed of the global model. This poisoning attack is divided into two categories: one is the data poisoning attack that changes the labels of training samples, and the other is the model poisoning attack that tampered with the local model update. In addition, the effectiveness and attack success rate of current defense methods in non-independent and identically distributed environments are low. They are only effective in independent and identically distributed environments. The potential security issues of federated learning systems in non-independent and identically distributed environments and the low effectiveness of existing defense mechanisms. Summary of the invention

[0005] The present invention aims to overcome at least one defect of the above-mentioned prior art and provide a method, device and readable computer storage medium for enhancing the defense of a federated learning model based on a historical global model, so as to solve the problem that the effectiveness and attack success rate of the defense method in the prior art are low in a non-independent and identically distributed environment.

[0006] The detailed technical scheme of the present invention is as follows:

[0007] The strategy of the present invention does not immediately manipulate the local model in the first step. On the contrary, the attacker client first captures the global model and deeply analyzes the differences between the historical model and the current model, which lays the foundation for more accurately customizing the attack strategy in the subsequent steps. In this process, the attacker client may also be selected as one of the participants, so that it can intercept the global model after each round of updates and store it in its historical model library. In this way, the attacker client is able to use the historical global model to launch an attack while still maintaining concealment from benign clients. The strategy of selecting the historical global model is intended to make the model update uploaded by the attacker client appear to be merely a performance degradation caused by data heterogeneity, rather than an attack behavior, thereby effectively hiding the traces of the attack, and finally by amplifying the impact of the malicious model on the global model, a model poisoning attack on the federated learning system under non-independent and identically distributed data is achieved.

[0008] Specifically, a method for enhancing federated learning model defense based on a historical global model is as follows:

[0009] S1. In each round of iteration, the server sends the global model to the client. The attacker client intercepts the global model of each round and puts it into the historical global model storage pool.

[0010] In the first round, the server sends a global model to the client, and this global model is the initial model, and the initial model is a pre-trained model or a randomly initialized model;

[0011] S2. The server randomly selects some clients to use the local data set of the client to train and obtain the client local model, and the randomly selected clients include at least one attacker client; wherein the attacker client selects a historical global model in the historical global model storage pool as the attack target model; the local data set is an image data set, and the data set data is image sample data;

[0012] S3. After the local model training is completed, the selected client uploads the trained local model to the server. After receiving the model, the server aggregates and updates the global model and sends it to each client.

[0013] S4. In each round of model update, a dynamic weighted aggregation mechanism is introduced to dynamically adjust the aggregation weight according to the client's historical performance and the contribution of the current update. The iteration ends when the threshold is reached, and the parameters of the optimal global model are obtained.

[0014] In this way, the attacker client can use the historical global model to perform the following attacks while maintaining disguise to the benign client. The purpose of selecting the historical global model is to enable the local model update uploaded by the attacker client to be disguised as the model performance degradation caused by the heterogeneous environment, thereby achieving the purpose of concealing the attack.

[0015] Furthermore, the attacker client scores each historical global model in the historical global model storage pool based on cosine similarity;

[0016] After the attacked benign client completes the current round of local model training, the attacker client evaluates the cosine similarity between all intercepted historical global models and the local model, and scores all historical global models. The purpose of selecting historical global models is to make the attacker client's uploaded model update confuse the central server as much as possible, making it mistakenly believe that the degradation of model performance is due to natural heterogeneity rather than attacks.

[0017] (1);

[0018] In formula (1), It is A historical global model, The client is updated normally. The angle between the historical global models, is the local model trained by the attacked benign client k in round t, yes and The cosine similarity score of ;

[0019] After all historical global models are scored, the attacker client selects the historical global model with the largest difference from the local model of this round. , that is, the model with the lowest score, is used as the target model for this round of attack

[0020] (7);

[0021] In formula (7), Is the client The calculation of The score is the minimum score.

[0022] The historical global model with the lowest score is selected to maximize the attack effect. The attacker client can more effectively introduce interference to the global model, thereby achieving the purpose of destroying the performance of the global model.

[0023] The cosine similarity is used to score the similarity between the historical global model and the current local model to select the most suitable historical global model for the attack. Selecting a model in the historical global model can disguise the model performance degradation caused by the heterogeneous environment, thereby achieving the purpose of concealing the attack. At the same time, the historical global model with the lowest score is selected to maximize the attack effect.

[0024] Furthermore, the selected historical model is randomly scaled:

[0025] Since the data is not independent and identically distributed, some participants’ updates may have a greater impact on the global model than others. The attacker client can take advantage of this by randomly amplifying the parameters of the selected attack model, with the goal of finding a scaling factor , this scaling factor will maximize the impact of the attack on the global model performance while ensuring that the attack behavior will not be detected. The following formula is expressed as the objective function of the attacker client:

[0026] (2);

[0027] In formula (2), is the ideal state that the attacker client wants the global model to achieve. The attacker client uses the selected scaling factor to select the lowest-scoring historical global model. Adjustments are made to amplify the effect of the attack:

[0028] (3);

[0029] In formula (3), is the local model uploaded by the attacked benign client k in the tth round. The overall optimization problem of the attacker’s client is expressed as:

[0030] (4);

[0031] (5);

[0032] In formulas (4) to (5), n is the number of clients selected by the server to participate in the training. is the threshold set by the detection mechanism of the defense method, It represents the range of the scaling factor, which is set according to the attack success rate of the experiment;

[0033] Randomly scale up or down the selected historical model parameters to enhance the attack effect and have a greater impact on the global model. Due to the characteristics of non-independent and identically distributed, the local models of some clients may have a greater impact on the global model than the local models of other clients. By randomly scaling up the parameters of the selected historical global model, the global model update direction tends to the attack direction, which maximizes the impact of the attack while achieving the effectiveness and concealment of the attack.

[0034] Furthermore, the server receives the local model uploaded by the randomly selected client and uses the aggregation rule Update the global model:

[0035] (6);

[0036] In formula (5), Indicates Client No. The local model uploaded in round robin, Indicates the updated The global model of the wheel.

[0037] The above attack methods gradually cause the global model to deviate from the correct update direction. This interference reduces the accuracy and robustness of the global model, thereby affecting the overall performance and security of the federated learning system.

[0038] Furthermore, the dynamic weighted aggregation mechanism is introduced to dynamically adjust the aggregation weight according to the historical performance of the client and the contribution of the current update, including: first, the server calculates the similarity between the local model uploaded by the client participating in each round of training and the baseline global model after average aggregation in this round as the model contribution and stores it; secondly, the server allocates the weight of the client in this round according to the percentage of similarity between the client's local model and the baseline global model based on the average model contribution of each client in the past few rounds. The higher the similarity between the local model and the baseline global model, the higher the weight, indicating that the local model of the client has a high contribution; finally, the server aggregates according to the reallocated weights and updates the global model of this round.

[0039] In another aspect of the present invention, a device for enhancing federated learning model defense based on a historical global model is provided, the device comprising:

[0040] at least one processor; and

[0041] A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute a method for enhancing federated learning model defense based on a historical global model as described above.

[0042] In another aspect of the present invention, a readable computer storage medium is provided, which stores executable instructions, and when the instructions are executed, the machine executes the method for enhancing federated learning model defense based on a historical global model as described above.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] (1) The present invention proposes a method, device and computer-readable storage medium for enhancing the defense of a federated learning model based on a historical global model. The method utilizes the "client drift" phenomenon caused by the non-independent and identically distributed environment of data in federated learning to carry out a covert attack on the global model, filling the gap of existing attack methods under this condition, improving the effectiveness and attack success rate in a non-independent and identically distributed environment, and effectively reducing the performance of the global model even when the attack is carried out under the defense mechanism; further in-depth analysis of the security challenges that a federated learning system may encounter when facing the non-independent and identically distributed nature of data distribution not only helps to evaluate and strengthen existing security protection measures, but also lays the foundation for designing more stable and efficient security solutions.

[0045] (2) The present invention proposes a method, device and computer-readable storage medium for enhancing the defense of a federated learning model based on a historical global model. The method calculates the score by using the similarity between the historical global model and the local model, and scales the parameters of the selected historical model to implement the attack, thereby maximizing the impact of the attack while achieving the effectiveness and concealment of the attack. Through this in-depth exploration, a dynamic weighted aggregation mechanism is used to dynamically adjust the aggregation weight according to the historical performance of the client and the contribution of the current update, which can better understand the risks that the model may encounter in a diversified data environment, thereby promoting the innovation of security technology, ensuring that the federated learning system can maintain a high degree of data security and model reliability under various complex conditions, and enhancing the defense of the federated learning model. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart of the method for poisoning a federated learning model based on a historical global model described in the present invention.

[0047] Figure 2 It is a schematic diagram of the process of determining the final attack model of the present invention.

[0048] Figure 3 This is a comparison of the test accuracy of the global model under attack and non-attack on the MNIST dataset, in independent and identically distributed environments and non-independent and identically distributed environments.

[0049] Figure 4 It is a schematic diagram of the test accuracy of the global model of each attack method under the median aggregation method.

[0050] Figure 5 It is a schematic diagram of the test accuracy of the global model of each attack method under the Trimmed-mean aggregation method.

[0051] Figure 6 It is a schematic diagram of the attack success rate of the three attack methods under the median aggregation method. DETAILED DESCRIPTION

[0052] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0053] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0054] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0055] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0056] Example 1

[0057] This embodiment provides a method for enhancing the defense of a federated learning model based on a historical global model. Figure 1 As shown, the method includes:

[0058] S1, intercept the global model of each round and put it into the historical global model storage pool;

[0059] In each round of iteration, the server sends the global model to the client, where the attacker client intercepts the global model of each round and puts it into the historical global model storage pool;

[0060] In the first round, the server sends a global model to the client, and this global model is the initial model. The initial model is a pre-trained model or a randomly initialized model; the client includes a benign client and an attacker client.

[0061] Specifically, one round of iteration refers to the server sending a global model to the client, selecting some clients to use their local data sets for training to obtain client local models, the selected clients uploading the trained local local models to the server, and the server receiving the models aggregates and updates the new global model, and then sends the new global model to each client, which is a technology well known to people in this field.

[0062] S2, selecting a historical global model in the historical global model storage pool as an attack target model;

[0063] The server randomly selects some clients to train with the local data set of the client to obtain the client local model. The randomly selected clients include at least one attacker client. Among them, the attacker client selects a historical global model in the historical global model storage pool as the attack target model, that is, selects a historical global model to upload the model parameters to the server for aggregation and distribution. This behavior is an attack.

[0064] The local data set is an image data set, and the data set data is image sample data.

[0065] The attacker client can randomly select a historical global model in the historical global model storage pool. In this embodiment, the attacker client selects a historical global model in the historical global model storage pool in the following steps: Figure 2 As shown, the details are as follows:

[0066] S21, the attacker client scores each historical global model in the historical global model storage pool based on cosine similarity;

[0067] After the attacked benign client completes the current round of local model training, the attacker client evaluates the cosine similarity between all intercepted historical global models and the local model, and scores all historical global models, such as Figure 2 As shown in (a), It is The historical global model is shown in the figure , , The client is updated normally. The angle between the historical global models is shown in the figure , , is the local model trained by the attacked benign client k in round t, yes and The cosine similarity score of is:

[0068] (1);

[0069] In formula (1), It is A global historical model.

[0070] After all historical global models are scored, the attacker client will use the following formula to select the historical global model with the largest difference from the local model of this round , that is, the model with the lowest score, is used as the target model for this round of attack:

[0071] (7);

[0072] In formula (7) Is the client The calculation of The score is the minimum score, such as Figure 2 (b) Select the model with the lowest score In this embodiment The model with the lowest score is not selected as the target model.

[0073] The historical global model with the lowest score is selected to maximize the attack effect. The attacker client can more effectively introduce interference to the global model, thereby achieving the purpose of destroying the performance of the global model.

[0074] S22, randomly scale the selected historical model, such as Figure 2 (c) The selected attack target model Scaling to get the final attack model And upload it to the server, that is :

[0075] Since the data is not independent and identically distributed, some clients’ updates may have a greater impact on the global model than other participants’ updates. The attacker client takes advantage of this by randomly amplifying the parameters of the selected attack model, with the goal of finding a scaling factor , this factor will maximize the impact of the attack on the global model performance while ensuring that the attack behavior will not be detected. The following formula is expressed as the objective function of the attacker client:

[0076] (2);

[0077] In formula (2) is the ideal state that the attacker client wants the global model to achieve. The attacker client uses the selected scaling factor to select the lowest-scoring historical global model. Adjustments are made to amplify the effect of the attack:

[0078] (3);

[0079] In formula (3) is the local model uploaded by the attacked benign client k in the tth round, that is, the scaled historical model. The overall optimization problem of the attacker’s client is expressed as:

[0080] (4);

[0081] (5);

[0082] In formulas (4) to (5), n is the number of clients selected by the server to participate in the training. There are N clients in total. is the threshold set by the detection mechanism of the defense method, It represents the range of scaling factors, which is set according to the attack success rate of the experiment.

[0083] S23, using the randomly scaled historical model as the attack model of the attacker's client;

[0084] S3: The client performs local model training locally and uploads it to the server for aggregation before sending it to each client.

[0085] After the local model training is completed, the selected client uploads the trained local model to the server. After receiving it, the server aggregates and updates the new global model and then sends it to each client.

[0086] Specifically, the server receives the local model uploaded by the randomly selected client and uses the aggregation rule Update the global model:

[0087] (6);

[0088] In formula (6) Indicates Client No. The local model uploaded in round robin, Indicates the updated The global model of the wheel.

[0089] According to the above-mentioned federated learning training process, this embodiment designs a method for enhancing the defense of the federated learning model based on the historical global model to explore the weaknesses and loopholes of the federated learning system in order to improve the existing defense methods; by utilizing the characteristics of the historical global model, it is possible to launch poisoning attacks more accurately and hide the attack intentions, further revealing the potential security issues of the federated learning system in a non-independent and identically distributed environment. In this way, it is possible to verify the effectiveness of the existing defense mechanism and provide guidance for the development of more robust and efficient defense strategies.

[0090] S4, dynamically adjust the aggregation weight to obtain the optimal global model and its parameters;

[0091] In each round of model update, a dynamic weighted aggregation mechanism is introduced to dynamically adjust the aggregation weight according to the client's historical performance and the contribution of the current update. The iteration ends when the threshold is reached, and the optimal global model and its parameters are obtained.

[0092] Using FedAvg, Median, and Trimmed-mean aggregation methods can alleviate the impact of malicious updates on the global model to a certain extent. However, these defense methods show obvious deficiencies when facing the federated learning model poisoning attack method based on the historical global model. For example, FedAvg cannot effectively defend against malicious updates when the data distribution is severely biased. The Median and Trimmed-mean aggregation methods may not be able to identify and filter malicious updates in time when facing attacks with strong concealment. In order to make up for the shortcomings of the existing methods, this embodiment proposes the following improvement suggestions for the above methods:

[0093] Preferably, first, the server can calculate the similarity between the local model uploaded by the client participating in each round of training and the averaged aggregated benchmark global model of the round as the model contribution and store it. Secondly, the server allocates the weight of the client in this round according to the percentage of similarity between the client's local model and the benchmark global model based on the average model contribution of each client in the past few rounds. The higher the similarity between the local model and the benchmark global model, the higher the weight, indicating that the local model contribution of the client is high. Finally, the server aggregates according to the reallocated weights and updates the global model of this round.

[0094] The dynamic weighted aggregation mechanism can effectively reduce the negative impact of "client drift" caused by differences in data distribution of each client on the global model by considering historical performance and current credibility, especially in a non-independent and identically distributed data environment. In addition, dynamic adjustment of client weights can make the defense mechanism more flexible and reduce the impact of malicious updates on the global model, thereby improving the security and robustness of the federated learning system. Some existing defense mechanisms such as Median and Trimmed-mean may show shortcomings in the face of complex and hidden attacks. This method reduces the reliance on a single defense strategy and improves the overall defense effect by adjusting the weights based on the historical performance of each client.

[0095] In summary, this embodiment compares the defense situations of various attack methods through experiments:

[0096] Preferably, two data sets MNIST and CIFAR-10 are selected, where the MNIST data set is divided into two cases: iid and non-iid. In the case of iid, the data is randomly shuffled and distributed to 100 clients, with 600 training data for each client. In the non-iid case, the data is grouped by label and divided into 200 segments of size 300, and each client is assigned two label segments to simulate the imbalance and uneven distribution of data. The CIFAR-10 data set exhibits certain non-independent and identically distributed characteristics in its data distribution.

[0097] Figure 3 The test accuracy comparison results of the global model under attack and without attack on the MNIST dataset are shown in two environments: independent and identically distributed and non-independent and identically distributed. It can be seen that on the MNIST dataset, the unattacked global model shows a high test accuracy in both iid and non-iid environments. However, when the attack method of the present invention is introduced into the non-iid environment, the test accuracy of the global model drops by about 87%. This result emphasizes that in the real world, due to the diversity of data distribution, federated learning systems may face greater security threats.

[0098] Figure 4 and Figure 5 The effects of three different attack methods, namely the patented method, label reversal attack, and min-max attack, on the performance of the global model under the median and trimmed-mean aggregation methods are shown in detail. These two aggregation methods are designed specifically to defend against model poisoning attacks, and they protect the stability and accuracy of the global model by reducing the impact of outliers. However, by training and testing the model, the attack strategy of the present invention still shows strong attack capabilities in the face of these defense methods. In the median aggregation method, the attack of the present invention reduces the test accuracy of the final trained global model by about 15%, and in the Tr-mean method, it affects the convergence of the global model.

[0099] Figure 6 The attack success rates of the three attack methods under the median aggregation method are shown. Compared with the other two attack methods, the attack of the present invention is more covert and has a higher attack success rate, which can reach 50% in 200 rounds, indicating that the attack of the present invention can quietly erode the performance of the model without triggering the detection system alarm.

[0100] Example 2

[0101] This embodiment provides a device for implementing an enhanced federated learning model defense based on a historical global model, the device comprising:

[0102] at least one processor; and

[0103] A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute a method for enhancing federated learning model defense based on a historical global model as described above.

[0104] In this embodiment, the device includes but is not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, etc.

[0105] Example 3

[0106] This embodiment also provides a computer-readable storage medium storing executable instructions, which, when executed, cause the machine to execute the method for enhancing federated learning model defense based on a historical global model as described above.

[0107] Specifically, a system or device equipped with a readable storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer or processor of the system or device can read and execute instructions stored in the readable storage medium.

[0108] In this case, the program code itself read from the machine-readable medium can realize the function of any one of the above embodiments, and thus the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification.

[0109] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Optionally, the program code may be downloaded from a server computer or a cloud via a communication network.

[0110] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0112] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0114] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A method for enhancing federated learning model defense based on a historical global model, characterized in that: The method comprises: S1. In a non-IID environment, in each round of iteration, the server sends the global model to the client. The attacker's client intercepts the global model of each round and puts it into the historical global model storage pool. S2. The server randomly selects some clients to use the local data set of the client to train and obtain the client local model, and the randomly selected clients include at least one attacker client; wherein the attacker client selects a historical global model in the historical global model storage pool as the attack target model; S3. After the local partial model training is completed, the selected client uploads the trained local partial model to the server. After receiving it, the server aggregates and updates the global model and sends it to each client. S4. In each round of model update, a dynamic weighted aggregation mechanism is introduced to dynamically adjust the aggregation weight according to the client's historical performance and the contribution of the current update. The iteration ends when the threshold is reached, and the optimal global model and its parameters are obtained. When the attacker client selects a historical global model in the historical global model storage pool, the attacker client scores each historical global model in the historical global model storage pool based on cosine similarity; After the attacked benign client completes the current round of local model training, the attacker client evaluates the cosine similarity between all intercepted historical global models and the attacked benign client local models, and scores all historical global models: （1）； In formula (1), It is A historical global model, The client is updated normally. The angle between the historical global models, is the local model trained by the attacked benign client k in round t, yes and The cosine similarity score of ; The attacker client selects the historical global model that differs most from the local model of the benign client. , that is, the model with the lowest score, is used as the target model for this round of attack; The model with the lowest score is randomly scaled and then used as the target model for attack; （2）； In formula (2), is the ideal state that the attacker client wants the global model to achieve. The attacker client uses the scaling factor The lowest scoring historical global model for the selection Adjustments are made to amplify the effect of the attack: （3）； In formula (3), is the local model uploaded by the attacked benign client k in the tth round. The overall optimization of the attacker’s client is expressed as: （4）； （5）； In formulas (4) to (5), n is the number of clients selected by the server to participate in the training. is the threshold set by the detection mechanism of the defense method, It represents the range of scaling factors, which is set according to the attack success rate of the experiment.

2. According to claim 1, a method for enhancing federated learning model defense based on a historical global model is characterized in that: The server receives the local model uploaded by the randomly selected client and uses the aggregation rule Update the global model: （6）； In formula (5), Indicates Client No. The local model uploaded in round robin, Indicates the updated The global model of the wheel.

3. The method for enhancing federated learning model defense based on a historical global model according to claim 1, characterized in that: The dynamic weighted aggregation mechanism introduced herein dynamically adjusts the aggregation weight according to the client's historical performance and the contribution of the current update, including: First, the server calculates the similarity between the local model uploaded by the client participating in each round of training and the benchmark global model after aggregation in that round as the model contribution and stores it; Secondly, the server assigns the weight of the client in this round according to the average model contribution of each client in the historical rounds and the percentage of similarity between the client's local model and the benchmark global model. The higher the similarity between the local model and the benchmark global model, the higher the weight, indicating that the client's local model contribution is high; Finally, the server aggregates according to the redistributed weights and updates the global model of this round.

4. A device for enhancing federated learning model defense based on a historical global model, characterized in that: The device comprises: processor; a memory having stored thereon a computer program executable on the processor; Wherein, when the computer program is executed by the processor, the steps of a method for enhancing federated learning model defense based on a historical global model as described in any one of claims 1 to 3 are implemented.

5. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images