An image classification method against byzantine attacks in a federated learning scenario

Abstract

The application discloses an image classification method resisting Byzantine attack in a federated learning scenario, comprising the following steps: 1, a central server initializes a global image classification model and sends it to participants; 2, participants train local image classification models and upload them to the central server; 3, the central server calculates the cosine similarity between the local image classification model update and the global image classification model update and performs normalization processing; 4, the central server calculates a trust score and uses an improved K-means algorithm for clustering, and the cluster with the smallest mean is classified as a malicious participant and its uploaded model update is deleted; 5, the central server updates the global image classification model; 6, steps 1-5 are repeated for iteration to obtain an optimal global image classification model, and the model is used for image classification prediction. The application can resist Byzantine attack in federated learning, ensure the accuracy of the image classification model under Byzantine attack, and thus improve the security of federated learning.

Description

Technical Field

[0001] This invention belongs to the field of federated learning technology, and specifically relates to an image classification method resistant to Byzantine attacks in a federated learning scenario. Background Technology

[0002] With the continuous development of the information society, various industries have accumulated massive amounts of data. Due to limitations in technology, security, and regulation, private data cannot be effectively shared and aggregated, forming isolated data silos that severely hinder the development of machine learning. Therefore, federated learning technology has emerged. As an emerging distributed machine learning paradigm, federated learning does not require centralized data collection. Each participant trains its model locally using its private data and improves the performance of the global model through collaborative learning. As an excellent model training method, federated learning is currently widely used in image classification tasks. For example, in the medical field, medical image classification models trained through federated learning can accurately identify key information such as tumors and lesion areas, providing doctors with important auxiliary diagnostic information.

[0003] While federated learning effectively addresses the issues of data silos and data privacy, its reliance on participant model training and local model updates makes it vulnerable to Byzantine attacks. In image classification tasks, Byzantine attackers manipulate the training process of multiple participants' local image classification models to disrupt the performance of the global model, resulting in poor image classification performance. Existing defenses against Byzantine attacks mainly fall into two categories: one is anomaly detection based on model weights. Typically, honest participants' model updates align with the global model, while malicious participants' updates deviate. Therefore, the Euclidean distance between the global and local models can distinguish between benign and malicious participants. The other category uses Byzantine robust aggregation rules based on statistical features, which optimally aggregate the local models uploaded by participants. However, both of these methods are effective against single or small numbers of attackers and are ineffective against large-scale Byzantine attacks.

[0004] In summary, Byzantine attacks pose a significant threat to the training of image classification models in federated learning scenarios, and current defense methods are limited and subject to strong preconditions. Therefore, designing an image classification method resistant to Byzantine attacks in federated learning scenarios remains a challenge. Summary of the Invention

[0005] This invention addresses the shortcomings of existing technologies by proposing an image classification method resistant to Byzantine attacks in federated learning scenarios. The aim is to achieve defense against Byzantine attacks without requiring additional knowledge, thereby enhancing the ability of image classification to resist Byzantine attacks in federated learning scenarios and improving the robustness and security of federated learning.

[0006] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0007] The present invention discloses an image classification method for resisting Byzantine attacks in a federated learning scenario. The method is characterized by its application in a network environment consisting of a central server and N participating parties. The central server stores a test image dataset and is used to test a global image classification model. The central server is also used to detect malicious participants and aggregate local image classification models uploaded by benign participants to obtain a global image classification model. The N participating parties store local image datasets and are used to train their local image classification models. The image classification method includes the following steps:

[0008] Step S1: Define the current iteration round number as t, and initialize t = 1;

[0009] Step S2: The central server randomly selects n participants from all participants in the (t-1)th round according to a certain ratio;

[0010] The central server initializes the parameters θ of the global image classification model in the (t-1)th round. t-1 And send it to each of the n participants, n <N;

[0011] The kth participant receives the parameters θ of the global image classification model for round t-1 from the central server. t-1 , and used as parameters of the local image classification model in round t.

[0012] The k-th participant uses the local image dataset to evaluate the parameters of its local image classification model in round t. Internal training continues until the maximum number of training iterations is reached, thus obtaining the updated parameters of the local image classification model in the t-th round. And upload it to the central server;

[0013] The central server receives n updated parameters from the local image classification model in round t. And aggregated into the parameters θ of the global image classification model in the t-th round. t ;

[0014] Step S3: The central server uses formula (1) to calculate the update parameters of the local image classification model of the k-th participant in the t-th round. The parameters θ updated by the global image classification model in the (t-1)th round t-1 Cosine similarity between This yields the set of cosine similarities in the t-th iteration. After normalization, the normalized cosine similarity set for the t-th iteration is obtained. in, Let the normalized cosine similarity of the k-th participant in the t-th iteration be:

[0015]

[0016] Step S4: The central server uses equation (2) to calculate the trust score of the global image classification model of the k-th participant in the t-th round. This yields the set of trust scores for the t-th iteration.

[0017]

[0018] In equation (2), T t This represents the total number of rounds that the k-th participant has participated in training the global image classification model before round t. This indicates that the k-th participant is in the T-th... t -i rounds of local image classification model update parameters With the Tth t -i rounds of global image classification model update parameters Normalized cosine similarity between them;

[0019] Step S5: The central server uses the improved K-means algorithm to analyze TS. t Perform clustering to obtain the clusters under the inter-th clustering in the t-th iteration, which are the M optimal clusters in the t-th iteration;

[0020] Step S6: The central server calculates the average trust score among the M optimal clusters in the t-th iteration, and identifies all participants in the optimal cluster with the smallest average trust score as malicious participants in the t-th iteration, and the remaining participants as benign participants in the t-th iteration. It then deletes the update parameters of the local image classification model uploaded by all malicious participants in the t-th iteration to obtain the update parameters of the benign image classification model in the t-th iteration. in, This represents the update parameters of the benign image classification model uploaded by the j-th benign participant in the t-th round; J represents the number of benign participants.

[0021] Step S7: The central server updates the parameters θ of the global image classification model in the (t-1)th round. t-1 The parameters θ of the global image classification model in the t-th round are obtained.t ;

[0022] Step S8: Assign t+1 to t, then return to step S2 for sequential execution until the maximum number of iteration rounds is reached, so as to obtain the optimal global image classification model, which enables the central server to perform classification prediction on the test image dataset using the optimal global image classification model.

[0023] Said step S5 comprises:

[0024] Step S5.1: Define the total number of clustering centers as M, the serial number of the current clustering center as m, and initialize m=1; M<n; the maximum number of clustering times as S; the termination condition error of clustering as ε; the current number of clustering times as inter, and initialize inter=1;

[0025] Step S5.2: The central server selects a trust score at random from TS t as the m-th clustering center of the inter-th clustering in the t-th iteration round

[0026] Step S5.3: Obtain the (m+1)-th clustering center of the inter-th clustering in the t-th iteration round using formula (3) so as to obtain M clustering centers of the inter-th clustering in the t-th iteration round

[0027]

[0028] In formula (3), c is a set control parameter;

[0029] Step S5.4: The central server calculates by using formula (4) the nearest clustering center and divides into the corresponding cluster, so as to divide each trust score in TS t into the corresponding cluster, and obtain each cluster of the inter-th clustering in the t-th iteration round, where near∈[1,M]:

[0030]

[0031] In formula (4), represents and the Euclidean distance therebetween;

[0032] Step S5.5: The central server calculates the average value of all trust scores in each cluster of the inter-th clustering in the t-th iteration round, and takes it as M clustering centers of the (inter+1)-th clustering in the t-th iteration round;

[0033] Step S5.6: If the difference between the M cluster centers of the inter-th cluster in the t-th iteration and the M cluster centers of the inter+1-th cluster in the t-th iteration is less than ε, then each cluster in the inter-th cluster in the t-th iteration is the M optimal cluster in the t-th iteration; otherwise, assign inter+1 to inter and return to step 5.3 until inter = M.

[0034] Step S7 includes:

[0035] Step S7.1, the central server accesses W t Perform ascending sorting to obtain the updated parameters after sorting.

[0036] Step S7.2: The central server determines the tail-cutting factor to be β∈(0,0.5), thereby removing... Find β×J maxima and β×J minima in the data to obtain the updated parameters after removal.

[0037] Step S7.3: The central server uses equation (5) to obtain the parameters θ of the global image classification model in the t-th round. t :

[0038]

[0039] In equation (5), s represents The total number of updated parameters. express The updated parameters of the local image classification model in round t uploaded by the l-th benign participant.

[0040] The present invention provides an electronic device, including a memory and a processor, wherein the memory is used to store a program that supports the processor in executing the image classification method, and the processor is configured to execute the program stored in the memory.

[0041] The present invention discloses a computer-readable storage medium on which a computer program is stored, wherein the computer program is executed by a processor to perform the steps of the image classification method.

[0042] Compared with the prior art, the present invention can achieve the following beneficial effects:

[0043] 1. This invention proposes an image classification method resistant to Byzantine attacks in a federated learning scenario, which realizes the defense against Byzantine attacks, enhances the ability of image classification to resist Byzantine attacks in a federated learning scenario, and thus improves the robustness and security of federated learning.

[0044] 2. This invention is an unsupervised learning method that does not increase the computational burden or communication overhead of the participants. Compared with existing technologies, this invention has simple implementation steps and low time and space complexity; moreover, the implementation of this invention is based solely on publicly available information and does not involve other private information, thereby ensuring the data privacy and security of all participants.

[0045] 3. To improve the clustering effect, this invention proposes an improved K-means algorithm, which makes the selection of initial cluster centers more reasonable, accelerates the convergence speed and avoids local optima, thereby speeding up the training of the global image classification model and improving the performance of the global image classification model. Attached Figure Description

[0046] Figure 1 This is a basic framework diagram of the present invention;

[0047] Figure 2 This is a detailed flowchart of the present invention;

[0048] Figure 3 This is a basic flowchart of the present invention. Detailed Implementation

[0049] In this embodiment, an image classification method resistant to Byzantine attacks in a federated learning scenario is applied to a network environment consisting of a central server and N participants. The central server stores a test image dataset and is used to test a global image classification model. The central server is used to detect malicious participants and aggregate local image classification models uploaded by benign participants to obtain a global image classification model. The N participants store local image datasets and are used to train local image classification models, such as... Figure 1 As shown, the basic idea is that during the training of the federated learning image classification model, a trust score is calculated for each participant based on the historical cosine similarity between the update parameters of the local image classification model and the update parameters of the global image classification model. An improved K-means algorithm is used to cluster the trust scores, classifying the cluster with the smallest average trust score as a malicious participant and removing its uploaded model updates. Finally, the remaining benign models are aggregated based on security aggregation rules to update the global image classification model. Specifically, as... Figure 2 and Figure 3 As shown, this image classification method proceeds according to the following steps:

[0050] Step S1: Define the current iteration round number as t, and initialize t = 1;

[0051] Step S2: The central server randomly selects n participants from all participants in the (t-1)th round according to a certain proportion;

[0052] The central server initializes the parameters θ of the global image classification model in the (t-1)th round. t-1 And send it to each of the n participants, n <N;

[0053] The k-th participant receives the parameters θ of the global image classification model for round t-1 from the central server. t-1 , and used as parameters of the local image classification model in round t.

[0054] The k-th participant uses the local image dataset to evaluate the parameters of its local image classification model in round t. Internal training continues until the maximum number of training iterations is reached, thus obtaining the updated parameters of the local image classification model in the t-th round. And upload it to the central server;

[0055] The central server receives n updated parameters from the local image classification model in round t. And aggregated into the parameters θ of the global image classification model in the t-th round. t .

[0056] Step S3: The central server uses formula (1) to calculate the parameters of the local image classification model update for the k-th participant in the t-th round. The parameters θ updated by the global image classification model in the (t-1)th round t-1 Cosine similarity between This yields the set of cosine similarities in the t-th iteration.

[0057]

[0058] In equation (1), θ represents the parameters of the global image classification model in the (t-1)th round. t-1 The parameters of the local image classification model of the k-th participant in round t The angle between them.

[0059] Step S4: The central server uses formula (2) to process the CS. t After normalization, we obtain the normalized cosine similarity set for the t-th iteration. in, Let the normalized cosine similarity of the k-th participant in the t-th iteration be:

[0060]

[0061] Step S5: The central server uses equation (3) to calculate the trust score of the global image classification model of the k-th participant in the t-th round. This yields the set of trust scores for the t-th iteration.

[0062]

[0063] In Equation (3), T t denotes the total number of rounds that the k-th participant has participated in the training of the global image classification model before the t-th iteration, denotes the parameter of the k-th participant for the local image classification model update at the T t -i-th round and the parameter of the global image classification model update at the T t -i-th round the normalized cosine similarity between them.

[0064] Step S6: The central server uses the improved K-means algorithm to perform clustering on TS t :

[0065] Step S6.1: Define the total number of clustering centers as M, the serial number of the current clustering center as m, and initialize m=1; M<n; the maximum number of clustering times as S; the termination condition error of clustering as ε; the current number of clustering times as inter, and initialize inter=1;

[0066] Step S6.2: The central server randomly selects a trust score from TS t as the m-th clustering center of the inter-th clustering in the t-th iteration

[0067] Step S6.3: Use Equation (4) to obtain the (m+1)-th clustering center of the inter-th clustering in the t-th iteration so as to obtain M clustering centers of the inter-th clustering in the t-th iteration

[0068]

[0069] In Equation (4), c is a set control parameter.

[0070] Step S6.4: The central server uses Equation (5) to calculate the distance to the nearest clustering center and assign it to the corresponding cluster, so as to assign each trust score in TS t to the corresponding cluster, and obtain each cluster of the inter-th clustering in the t-th iteration, where near∈[1,M]:

[0071]

[0072] In Equation (5), denotes and The Euclidean distance between them.

[0073] Step S6.5: The central server uses equation (6) to calculate the average of all trust scores in each cluster of the interth cluster under the tth iteration and uses it as the M cluster centers of the inter+1th cluster under the tth iteration.

[0074]

[0075] In equation (6), This represents the e-th trust score in the m-th cluster of the inter-th cluster in the t-th iteration;

[0076] Step S6.6: If the difference between the M cluster centers of the inter-th cluster in the t-th iteration and the M cluster centers of the inter+1-th cluster in the t-th iteration is less than ε, then each cluster in the inter-th cluster in the t-th iteration is the M optimal cluster in the t-th iteration; otherwise, assign inter+1 to inter and return to step S6.3 until inter = M.

[0077] Step S7: The central server calculates the average trust score among the M optimal clusters in the t-th iteration, and identifies all participants in the optimal cluster with the smallest average trust score as malicious participants in the t-th iteration, and the remaining participants as benign participants in the t-th iteration. It then deletes the update parameters of the local image classification model uploaded by all malicious participants in the t-th iteration to obtain the update parameters of the benign image classification model in the t-th iteration. in, This represents the update parameters of the benign image classification model uploaded by the j-th benign participant in the t-th round; J represents the number of benign participants.

[0078] Step S8: The central server updates the parameters θ of the global image classification model in round t-1. t-1 The parameters θ of the global image classification model in the t-th round are obtained. t :

[0079] Step S8.1, the central server accesses W t Perform ascending sorting to obtain the updated parameters after sorting.

[0080] Step S8.2: The central server determines the tail-cutting factor as β∈(0,0.5), thereby removing... Find β×J maxima and β×J minima in the data to obtain the updated parameters after removal.

[0081] Step S8.3: The central server uses equation (7) to obtain the parameters θ of the global image classification model in the t-th round. t :

[0082]

[0083] In equation (7), s represents The total number of updated parameters. express The updated parameters of the local image classification model in round t uploaded by the l-th benign participant.

[0084] Step S9: After assigning t+1 to t, return to step S2 and execute sequentially until the maximum number of iterations is reached, thereby obtaining the optimal global image classification model. The central server uses this model to classify and predict the test image dataset.

[0085] In this embodiment, an electronic device includes a memory and a processor. The memory stores a program for the image classification method described above, and the processor runs the program stored in the memory.

[0086] In this embodiment, a readable storage medium is used to store computer program instructions, which are read by a processor and executed to perform the steps of the image classification method described above.

[0087] It should be emphasized that the above embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any changes, modifications, and variations made within the scope of the present invention should be within the protection scope of the present invention.

Claims

1. An image classification method resistant to Byzantine attacks in a federated learning scenario, characterized in that, is applied to a network environment composed of a central server and N participants. The central server stores a test image dataset and is configured to test a global image classification model. The central server is configured to detect malicious participants and aggregate local image classification models uploaded by benign participants to obtain the global image classification model. The N participants store local image datasets and are configured to train local image classification models. The image classification method includes the following steps: Step S1: Define the current iteration number as t, and initialize t=1; Step S2: The central server randomly selects n participants for the (t-1)-th round from all participants according to a certain ratio; The central server initializes the parameters θ of the global image classification model in the (t-1)th round. t-1 And send it to each of the n participants, n <N; The kth participant receives the parameters θ of the (t-1)th round global image classification model from the central server. t-1 , and used as parameters of the local image classification model in round t. The k-th participant uses the local image dataset to evaluate the parameters of its local image classification model in round t. Internal training continues until the maximum number of training iterations is reached, thus obtaining the updated parameters of the local image classification model in the t-th round. And upload it to the central server; The central server receives n updated parameters from the local image classification model in round t. And aggregated into the parameters θ of the global image classification model in the t-th round. t ; Step S3: The central server uses formula (1) to calculate the update parameters of the local image classification model of the k-th participant in the t-th round. The parameters θ updated by the global image classification model in the (t-1)th round t-1 Cosine similarity between This yields the set of cosine similarities in the t-th iteration. After normalization, the normalized cosine similarity set for the t-th iteration is obtained. in, Let the normalized cosine similarity of the k-th participant in the t-th iteration be: Step S4: The central server uses equation (2) to calculate the trust score of the global image classification model of the k-th participant in the t-th round. This yields the set of trust scores for the t-th iteration. In equation (2), T t This represents the total number of rounds that the k-th participant has participated in training the global image classification model before round t. This indicates that the k-th participant is in the T-th... t -i rounds of local image classification model update parameters With the Tth t -i rounds of global image classification model update parameters Normalized cosine similarity between them; Step S5: The central server uses the improved K-means algorithm to analyze TS. t Perform clustering to obtain the clusters under the inter-th clustering in the t-th iteration, which are the M optimal clusters in the t-th iteration; Step S6: The central server calculates the average trust score among the M optimal clusters in the t-th iteration, and identifies all participants in the optimal cluster with the smallest average trust score as malicious participants in the t-th iteration, and the remaining participants as benign participants in the t-th iteration. It then deletes the update parameters of the local image classification model uploaded by all malicious participants in the t-th iteration to obtain the update parameters of the benign image classification model in the t-th iteration. in, This represents the update parameters of the benign image classification model uploaded by the j-th benign participant in the t-th round; J represents the number of benign participants. Step S7: The central server updates the parameters θ of the global image classification model in the (t-1)th round. t-1 The parameters θ of the global image classification model in the t-th round are obtained. t ; Step S8: Assign t+1 to t, then return to Step S2 for sequential execution until the maximum number of iteration rounds is reached, so as to obtain the optimal global image classification model, such that the central server uses the optimal global image classification to perform classification prediction on the test image dataset.

2. The image classification method for resisting Byzantine attacks in a federated learning scenario according to claim 1, characterized in that, The Step S5 includes: Step S5.1: Define the total number of clustering centers as M, the serial number of the current clustering center as m, and initialize m=1; M<n; the maximum number of clustering times is S; the termination condition error for clustering is ε; the current number of clustering times is inter, and initialize inter=1; Step S5.2, the central server from TS t A trust score is randomly selected as the m-th cluster center in the inter-th clustering of the t-th iteration. Step S5.3: Use equation (3) to obtain the (m+1)th cluster center of the interth cluster in the tth iteration. Thus, the M cluster centers of the inter-th clustering in the t-th iteration are obtained. In formula (3), c is a set control parameter; Step S5.4: The central server calculates using formula (4). With the nearest cluster center And Classified to In the corresponding cluster, thus TS t Each trust score is assigned to a corresponding cluster, resulting in the clusters of the inter-th clustering in the t-th iteration, where near∈[1,M]: In equation (4), express and The Euclidean distance between them; Step S5.5: The central server calculates the average value of all trust scores in each cluster of the inter-th clustering under the t-th iteration, and takes it as the M clustering centers for the (inter+1)-th clustering under the t-th iteration; Step S5.6: If the differences between the M clustering centers of the inter-th clustering under the t-th iteration and the M clustering centers of the (inter+1)-th clustering under the t-th iteration are all less than ε, it indicates that each cluster obtained in the inter-th clustering under the t-th iteration is the M optimal clusters under the t-th iteration; otherwise, assign inter+1 to inter, then return to Step 5.3 until inter=M.

3. The image classification method for resisting Byzantine attacks in a federated learning scenario according to claim 1, characterized in that, The Step S7 includes: Step S7.1, the central server accesses W t Perform ascending sorting to obtain the updated parameters after sorting. Step S7.2: The central server determines the tail-cutting factor to be β∈(0,0.5), thereby removing... Find β×J maxima and β×J minima in the data to obtain the updated parameters after removal. Step S7.3: The central server uses equation (5) to obtain the parameters θ of the global image classification model in the t-th round. t : In equation (5), s represents The total number of updated parameters. express The updated parameters of the local image classification model in round t uploaded by the l-th benign participant.

4. An electronic device, comprising a memory and a processor, characterized in that, The memory is configured to store a program that supports the processor to execute the image classification method according to any one of claims 1 to 3, and the processor is configured to execute the program stored in the memory.

5. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is run by a processor, the steps of the image classification method according to any one of claims 1 to 3 are performed.

Images