A trusted semi-asynchronous federated learning method with heterogeneous clients

Abstract

The application discloses a trusted semi-asynchronous federated learning method with heterogeneous clients, which comprises the following steps: S1, uploading sub-model updates and outdated conditions by the client; S2, predicting the expected model updates of each client by the server, filling and cutting the updates of the sub-model by using the expected model updates, and finally detecting and eliminating malicious clients; S3, the server performs semi-asynchronous aggregation. The application is superior to the existing representative heterogeneous FL method in terms of global model performance, enables each client to run a sub-model to train a global model, and completes aggregation in asynchronous communication. From the analysis of attack resistance: the detection method in the application has the ability to accurately detect malicious clients in a semi-asynchronous environment and a resource-limited scene.

Description

Technical Field

[0001] The present invention relates to the field of federated learning in artificial intelligence Internet of Things, and in particular to a trusted semi-asynchronous federated learning method with heterogeneous clients. Background Art

[0002] The proliferation of smart mobile devices and advances in intelligent computing technology have ushered in a new era. These intelligent sensor devices, such as smartphones and smartwatches, integrate communication, sensing, computing, and control capabilities. As these devices interact with the real world, they generate, collect, store, and analyze data generated by each user, including activity and health status. To provide services, the traditional approach is to collect user data and send it to a cloud server for model training, then transfer the trained model back to the user's device for use. In recent years, federated learning has been proposed to address the privacy concerns of these approaches. In particular, with the rapid increase in the amount of data generated by massive mobile and IoT devices, cross-device federated learning has become a popular distributed computing paradigm.

[0003] In real-world cross-device federated learning (FL) scenarios, mobile devices are typically equipped with limited computing and communication resources, which severely limits the convergence performance of FL algorithms. For resource-limited clients, running a full model in FL can be challenging and costly, especially for large models like ChatGPT. Therefore, various techniques such as model compression, model pruning, and split learning have been introduced to reduce model size or communication costs and make cross-device federated learning feasible. Y. Jiang et al. (Model pruning enables efficient federated learning on edge devices, 2023, 10374-10386) proposed PruneFL, which uses adaptive pruning to select important parameters for training; C. Thapa et al. (Splitfed: When federated learning meets split learning, 2022, 8485-8493) proposed SplitFL, which combines split learning with federated learning, dividing the full model into smaller parts and training them on the server, with distributed clients processing each part. These techniques aim to reduce model size or communication costs and promote the feasibility of cross-device federated learning.

[0004] In addition, to improve the efficiency of FL systems, asynchronous and semi-asynchronous FL have been proposed. A key challenge faced by AFL and SAFL is to mitigate the delay caused by outdated models. Currently, these frameworks mainly adopt two strategies to solve this problem: (1) assigning lower weights to updates of outdated models during aggregation; (2) discarding extremely outdated model updates on the server; (3) selecting consistent gradients and adaptively adjusting the learning rate on the server. However, existing asynchronous federated learning (AFL) and semi-asynchronous federated learning (SAFL) systems cannot solve the problem of limited client model size in resource-constrained scenarios. In addition, they lack the ability to resist poisoning attacks against the model.

[0005] With the popularity of large models, the classic FL framework can no longer meet the needs of local devices with limited resources, and it is difficult to run the complete model under the classic framework. In order to solve this problem, various methods have been proposed in recent years to solve the resource constraint problem. E. Diao et al. (Heterofl: Computation and communication efficient federated learning for heterogeneous clients, 2021, 3-7) designed a stable framework to train heterogeneous fixed sub-networks, but lacked theoretical convergence analysis; Y. Wang et al. (Theoretical convergence guaranteed resource-adaptive federated learning with mixed heterogeneity, 2023, 2444-2455) randomly allocated neuron clusters for training according to the local resources of the client, but the accuracy of this method depends on the design of the neuron clusters. According to their convergence theorem, when a neuron cluster has a small number of sub-models, it indicates that the cluster is undertrained, and the global model will have difficulty converging. J. Hong et al. (Efficient split-mix federated learning for on-demand and in-situ customization, 2022, 25-29) proposed using a streamlined neural network in FL to dynamically adjust the size of sub-models. However, their design relies on a specific neural network model and lacks general applicability. However, none of these methods have been extended to the more realistic AFL and SAFL scenarios. To our knowledge, the most relevant work on heterogeneous models and SAFL is FedSEA. J. Sun et al. (FedSEA: A semi-asynchronous federated learning framework for extremely heterogeneous devices, 2023, 106-119) proposed the FedSEA algorithm, which applies knowledge distillation to SAFL to provide heterogeneous models for resource-constrained clients. However, their approach relies on an unlabeled public dataset on the server side. The performance of the client-side sub-models is limited by this public dataset, and in most cases, the assumption of a public dataset violates privacy regulations.

[0006] Poisoning attacks occur when a malicious client sends deliberately crafted gradient updates that affect the outcome of the global model decision process. Summary of the Invention

[0007] The purpose of this paper is to provide a trusted semi-asynchronous federated learning method with heterogeneous clients, with a unique mechanism for handling resource heterogeneity and staleness, and further provide a trusted FL framework for all clients.

[0008] The technical solution adopted in the present invention is:

[0009] A trusted semi-asynchronous federated learning method with heterogeneous clients, comprising the steps of:

[0010] S1, client uploads sub-model updates and outdated status;

[0011] S2, the server predicts the expected model update for each client, uses the expected model update to fill and trim the sub-model update, and finally detects and eliminates malicious clients;

[0012] S3, the server performs semi-asynchronous aggregation.

[0013] Furthermore, the client uploading the sub-model update and outdated status in step S1 specifically includes the following steps:

[0014] S10, the client receives the model from the server at iteration l The calculation formula is as follows:

[0015]

[0016] in, represents the global model, q represents the width capability of the global model, q=1; l represents the number of iterations; represents the model of client i in the first iteration, d i Indicates the width capability of client i, d i ∈(0,1], defined by the ratio to the original model. is the width capacity d i The corresponding global model shape. ⊙ Operation is defined as the custom global model Specifically, for q, we also have:

[0017] w q =w q ⊙m q (2);

[0018] Among them, m q is the model shape of the global model.

[0019] The gradient can also be customized in the same way, and the calculation formula is as follows:

[0020]

[0021] in, respectively represent the model and w q gradient of.

[0022] S11. The client performs gradient descent according to the sample ξ l,i to obtain where means that after the training is completed, the client uses the model to locally calculate the gradient on the data ξ l,i ξ l,i represents the l-th iteration, and i represents the client number;

[0023] S12. The client uploads the gradient and the width ability d i .

[0024] Furthermore, the step S2 specifically includes the following steps:

[0025] S20. At the iteration l, the server receives the stale updates uploaded by the client and the width ability d i .

[0026] S21. The server predicts the expected model update of each client The calculation formula is as follows:

[0027]

[0028] where represents the expected model update of the client i with the width ability q at the l-th iteration, represents the padded and cropped model update of the client i with the width ability q at the t-th iteration, where t < l and t represents the last round when the client participated in the aggregation. is the Hessian matrix estimated using the L-BFGS algorithm at the l-th iteration. respectively represent the global models at the l-th round and the l - 1-th round.

[0029] Furthermore, the estimated Hessian matrix at the l-th round has the following calculation formula:

[0030]

[0031] where represents the global model gradient difference in the past N iterations, represents the global model gradient difference at the l - N-th iteration. ΔW l = represents the global model difference in the past N iterations, Represents the global model difference at the lNth iteration. Represents the projection direction of the Hessian matrix.

[0032] S22, the server first determines the size of the untrained portion of the client update

[0033] S23, the server uses the corresponding size in the expected model gradient Populate Client Updates The specific formula is as follows:

[0034]

[0035] in, is the client update after filling, Is a stale update uploaded by a customer It means that the size is qd at the jth iteration i The expected stale update section.

[0036] S24. The server will perform gradient clipping based on the obsolescence and size of the sub-model after gradient filling. The specific formula is as follows:

[0037]

[0038] where clip(·) is the clipping function, c is a variable related to the staleness of the gradient and the size of the submodel, It is the client-side update that is pruned for aggregation.

[0039] S25. In iteration j, the server evaluates the suspicious score s of each client. l,i and unify their age and width, then collect them into S j In,s l,i The calculation formula is as follows:

[0040]

[0041] Among them, ||·||2 represents the l2 norm, represents the expected model update for client i with width capability q at iteration l, Represents the padded and cropped model update for client i with width capacity q at iteration l.

[0042] S26. During detection, the server uses the Canopy method to determine the number of clusters, which is called pre-detection. If the client can be divided into multiple clusters based on the pre-detection, the k-means algorithm is used to sort the client's malicious score S jThe clients are divided into two clusters. Finally, the clients of the cluster with the higher average maliciousness score are designated as malicious clients and are subsequently deleted in this round.

[0043] Furthermore, the semi-asynchronous aggregation performed by the server in step S3 specifically includes the following steps:

[0044] S30. The server executes the aggregation and distribution model. The aggregation formula is as follows:

[0045]

[0046] in, is the global model at the j+1th iteration, is the global model at the jth iteration, η represents the learning rate, K represents the number of gradients to wait for in each iteration, Represents client updates after pruning for aggregation.

[0047] S31. The server records the model differences at the first iteration and update diff

[0048] The present invention adopts the above technical solutions to build a trusted SAFL framework in the context of resource-constrained cross-device FL. The present invention enables each client to run a sub-model to train the global model and complete aggregation in asynchronous communication, while also demonstrating robustness against malicious attackers. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments;

[0050] Figure 1 This is an overall flow chart of a trusted semi-asynchronous federated learning method with heterogeneous clients according to an embodiment of the present invention;

[0051] Figure 2 Schematic diagram of a framework of a trusted semi-asynchronous federated learning method with heterogeneous clients according to an embodiment of the present invention;

[0052] Figure 3 This is a specific flow chart of a trusted semi-asynchronous federated learning method with heterogeneous clients according to an embodiment of the present invention. Implementation Method

[0053] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0054] The mainstream approach to defending against poisoning attacks is malicious client detection, which aims to distinguish malicious clients from benign clients. Roughly speaking, the key idea is to exploit some statistical differences between the features of malicious and benign clients. Different detection methods use different features and binary classifiers for detection. Specifically, for each client, these detection methods first extract features from its model updates in one or more rounds, and then use a classifier to predict whether it is malicious. Z. Zhang et al. (FL Detector: Defending federated learning against model poisoning attacks via detecting malicious clients, 2022, 2545-2555) proposed to detect malicious clients by checking the consistency of the client's model updates; S. Li et al. (Learning to Detect Malicious Clients for Robust Federated Learning, 2020) proposed a robust FL framework based on spectral anomaly detection, where spectral anomaly detection is performed on the server side to detect and remove malicious model updates from hostile clients.

[0055] like Figures 1 to 3 As shown in Figure 1, the present invention discloses a trusted semi-asynchronous federated learning method with heterogeneous clients. Based on the context of the artificial intelligence internet of things, clients upload sub-model updates and outdated information at the beginning of each communication round. The server then predicts each client's expected model update based on the uploaded parameters, uses the expected model update to fill and trim sub-model updates, detects and eliminates malicious clients, and finally performs semi-asynchronous aggregation. The method includes the following steps:

[0056] S1, client uploads sub-model updates and outdated status;

[0057] S2, the server predicts the expected model update for each client, fills and trims the sub-model updates with the expected model update, and finally detects and eliminates malicious clients;

[0058] S3, the server performs semi-asynchronous aggregation.

[0059] From the above description, we can see that in the context of resource-constrained cross-device FL, the server is able to build a trusted SAFL framework in the context of resource-constrained cross-device FL. This framework enables each client to run a sub-model to train the global model and complete aggregation in asynchronous communication, while also showing robustness against malicious attackers.

[0060] Furthermore, the client uploading the sub-model update and outdated status in step S1 specifically includes the following steps:

[0061] S10, the client receives the model from the server at iteration l The calculation formula is as follows:

[0062]

[0063] in, represents the global model, where q = 1, l represents the number of iterations, represents the model of client i in the first iteration, d i Indicates the width capability of client i, d i ∈(0,1], defined by the ratio to the original model. is the width capacity d i The corresponding global model shape. ⊙ Operation is defined as the custom global model Specifically, for q, we also have:

[0064] w q =w q ☉m q (2);

[0065] Among them, m q is the model shape of the global model.

[0066] The gradient can also be customized in the same way, and the calculation formula is as follows:

[0067]

[0068] in, g(w q ) represent the models and w q gradient.

[0069] S11, the client according to the sample l,i Perform gradient descent to get in Indicates that after training is completed, the client uses the model In the data l,i The locally computed gradient, ξ l,i represents the lth iteration, i represents the client number;

[0070] S12, client uploads gradient and width capacity d i .

[0071] From the above description, we can see that the client model uses the width capability d i Define the size of the submodel using Define width capability di The model shape of the corresponding global model, so as to achieve splicing with the global model, and further achieve the aggregation of heterogeneous network models.

[0072] Further, the step S2 specifically includes the following steps:

[0073] S20. At iteration l, the server receives the stale updates uploaded by the client and the width capacity d i .

[0074] S21. The server predicts the expected model updates of each client The calculation formula is as follows:

[0075]

[0076] Among them, represents the expected model update with width capacity q of client i at the l-th iteration, represents the padded and cropped model update with width capacity q of client i at the t-th iteration, where t < l and t represents the last round when the client participated in aggregation. is the Hessian matrix estimated using the L-BFGS algorithm at the l-th iteration. respectively represent the global models at the l-th round and the l - 1-th round.

[0077] Further, the estimated Hessian matrix at the l-th round has the following calculation formula:

[0078]

[0079] Among them, represents the global model gradient difference in the past N iterations, represents the global model gradient difference at the l - N-th iteration. represents the global model difference in the past N iterations, represents the global model difference at the l - N-th iteration. represents the projection direction of the Hessian matrix.

[0080] S22. The server first determines the size of the untrained part of the client update

[0081] S23. The server fills the client update with the corresponding size in the expected model gradient Specific formula is as follows:

[0082] ​

[0083] in, is the client update after filling, Is a stale update uploaded by a customer It means that the size is qd at the jth iteration i The expected stale update section.

[0084] S24. The server will perform gradient clipping based on the obsolescence and size of the sub-model after gradient filling. The specific formula is as follows:

[0085]

[0086] where clip(·) is the clipping function, c is a variable related to the staleness of the gradient and the size of the submodel, It is the client-side update that is pruned for aggregation.

[0087] S25. In iteration j, the server evaluates the suspicious score s of each client. l,i and unify their age and width, then collect them into S j In,s l,i The calculation formula is as follows:

[0088]

[0089] Among them, ‖·‖2 represents the l2 norm, represents the expected model update for client i with width capability q at iteration l, Represents the padded and cropped model update for client i with width capacity q at iteration l.

[0090] S26. During detection, the server uses the Canopy method to determine the number of clusters, which is called pre-detection. If the client can be divided into multiple clusters based on the pre-detection, the k-means algorithm is used to sort the client's malicious score S j The clients are divided into two clusters. Finally, the clients of the cluster with the higher average maliciousness score are designated as malicious clients and are subsequently deleted in this round.

[0091] As can be seen from the above description, the server uses the prediction model update to supplement the sub-model, uses the pruning algorithm to prune the supplemented model, and finally uses the pruning model gradient and the prediction model gradient to detect malicious clients. This not only solves the problem of standardization of heterogeneous models, but also increases the norm of the gradient after supplementation and demonstrates robustness against malicious attackers.

[0092] Furthermore, the semi-asynchronous aggregation performed by the server in step S3 specifically includes the following steps:

[0093] S30. The server executes the aggregation and distribution model. The aggregation formula is as follows:

[0094]

[0095] in, is the global model at the j+1th iteration, is the global model at the jth iteration, η represents the learning rate, K represents the number of gradients to wait for in each iteration, Represents client updates after pruning for aggregation.

[0096] S31. The server records the model differences at the first iteration and update diff

[0097] From the above description, we can see that using pruned client updates for aggregation helps prevent the increase of gradient norm and ensure the stability and correct convergence of the training process.

[0098] The present invention has the following beneficial effects: From the perspective of asynchronous heterogeneity, the present invention outperforms existing representative heterogeneous FL methods in terms of global model performance, enabling each client to run a sub-model to train the global model and complete aggregation in asynchronous communication. From the perspective of attack resistance, the detection method in the present invention has the ability to accurately detect malicious clients in semi-asynchronous environments and resource-constrained scenarios.

[0099] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

Claims

1. A trusted semi-asynchronous federated learning method with heterogeneous clients, characterized by: It includes the steps of: S1. The client uploads the sub-model update and outdated status; specifically, the following steps are included: S10, the client receives the model from the server at iteration l The calculation formula is as follows: in, represents the global model, q represents the width capability of the global model, q=1; l represents the number of iterations; represents the model of client i in the first iteration, d i Indicates the width capability of client i, d i ∈(0,1]; is the width capacity d i The corresponding global model shape; ⊙ operation is defined as the shape of the global model in the custom global model. The part corresponding to the shape; S11, the client according to the sample l,i Perform gradient descent to get in, Indicates that the client uses the model after training is completed In the data l,i The locally computed gradient, ξ l,i represents the lth iteration, i represents the client number; S12, client uploads gradient and width capacity d i ; S2. The server predicts the expected model update for each client, uses the expected model update to fill and trim the sub-model updates, and finally detects and eliminates malicious clients. This specifically includes the following steps: S20, at iteration 1, the server receives the old update uploaded by the client and width capacity d i ; S21. The server predicts the expected model update for each client The calculation formula is as follows: where, represents the expected model update of client i with width capacity q at the l-th iteration; represents the padded and cropped model update of client i with width capacity q at the t-th iteration, where t < l and t represents the last round when the client participated in aggregation; is the Hessian matrix estimated using the L-BFGS algorithm at the l-th iteration; represent the global models at the l-th and (l - 1)-th rounds respectively; S22, the server first determines the size of the untrained portion of the client update S23, the server uses the corresponding size in the expected model gradient Populate Client Updates The specific formula is as follows: in, is the client update after filling, It is an old update uploaded by the customer; It means that the size is qd at the jth iteration i The expected obsolete update part of ; S24. The server will perform gradient clipping based on the obsolescence and size of the sub-model after gradient filling. The specific formula is as follows: Where clip(·) is the clipping function and c is a variable related to the staleness of the gradient and the size of the sub-model; It is the client update that is pruned for aggregation; S25. In iteration j, the server evaluates the suspicious score s of each client. l,i And unify the staleness and width, then collect to S j In, s l,i The calculation formula is as follows: Among them, ‖·‖2 represents the l2 norm, represents the expected model update for client i with width capability q at iteration l, represents the padded and cropped model update of client i with width capacity q at iteration l; S26. During detection, the server uses the Canopy method to determine the number of clusters, which is called pre-detection. When the client can be divided into multiple clusters based on the pre-detection, the k-means algorithm is used to sort the malicious scores S of the client. j Divide the clients into two clusters; finally, designate the clients in the cluster with the larger average malicious score as malicious clients and subsequently delete them in this round; S3. The server performs semi-asynchronous aggregation, which specifically includes the following steps: S30. The server executes the aggregation and distribution model. The aggregation formula is as follows: in, is the global model at the j+1th iteration, is the global model at the jth iteration, η represents the learning rate, K represents the number of gradients to wait for in each iteration, Represents client updates for aggregation after pruning; S31. The server records the model differences at the first iteration and update diff 2. A trusted semi-asynchronous federated learning method with heterogeneous clients according to claim 1, characterized in that: In S10, q satisfies the following relationship: In q =in q ⊙m q (2); Among them, m q is the model shape of the global model; And the gradient is calculated as follows: in, g(w q ) represent the models and w q gradient.

3. The trusted semi-asynchronous federated learning method with heterogeneous clients according to claim 1, characterized in that: The estimated Hessian matrix of the lth round The calculation formula is as follows: in, Represents the global model gradient difference in the past N iterations; Represents the global model gradient difference at the lNth iteration; represents the global model difference over the past N iterations, Represents the global model difference at the lNth iteration; Represents the projection direction of the Hessian matrix.

Images