A heterogeneous federated training and inference method against backdoor attacks

Abstract

The application discloses a heterogeneous federated training and reasoning method resisting backdoor attacks, and comprises cloud services. The method embeds a BN layer to record the variance and mean of neuron activation data in training when a global model is generated, then selects a benign client by measuring the neuron activation distribution through KL divergence and Bottom-K voting in the training stage, finally inputs a task data set into the trained global model in the reasoning stage, so as to obtain the probability distribution of each category, and then aggregates all probability distributions by using the maximum value or the mean value to obtain a reasoning result. The application solves the problems that the existing defense methods have poor defense effect against backdoor attacks under data heterogeneity, most backdoor attack detection methods need an additional data set, and heterogeneous federated learning does not study the inhibition of backdoor attacks in the reasoning stage.

Description

Technical Field

[0001] The present invention relates to the technical field of information security, and in particular to a heterogeneous federated training and reasoning method for resisting backdoor attacks. Background Art

[0002] With the widespread adoption of mobile internet and smart devices, more and more data is being generated and distributed across various devices and terminals. This poses challenges for traditional centralized machine learning approaches, such as data centralization and privacy leakage. Consequently, distributed machine learning technologies have gradually replaced centralized machine learning. Federated learning, a common distributed machine learning technique, enables distributed model training across multiple data sources with local data. This approach, without exchanging individual or sample data, builds a global model based on virtually fused data by exchanging model parameters or intermediate results. This balances data privacy protection with shared computation. With the rapid development of big data and AI, the demand for more efficient and faster machine learning methods is growing. Federated learning, with its advantages of being distributed, parallel, and real-time, can effectively address these needs and has broad application prospects. Addressing the heterogeneity of client-side local data and models, heterogeneous federated learning expands its applicability by effectively managing and integrating this heterogeneity. However, since the central server cannot directly control client behavior or access local training data, federated learning is inherently vulnerable to backdoor attacks. Heterogeneous federated learning offers advantages in protecting data privacy, processing heterogeneous data, and meeting high-performance computing requirements. However, its vulnerability to backdoor attacks requires effective detection and defense mechanisms. To address this challenge, it is crucial to introduce backdoor attack detection and defense mechanisms into heterogeneous federated learning. These mechanisms can detect and mitigate backdoor attacks, ensuring the robustness and reliability of heterogeneous federated learning models. However, existing federated learning backdoor attack defense methods have the following problems: 1) Federated learning is ineffective in defending against backdoor attacks in heterogeneous data; 2) Heterogeneous federated learning only studies the management mechanisms and training processes for heterogeneous data and models, without considering mechanisms for defending against backdoor attacks; and 3) Existing research methods do not consider suppressing backdoor attacks during the inference phase of federated learning. Summary of the Invention

[0003] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a safe and reliable heterogeneous federated training and inference method for resisting backdoor attacks. It can effectively solve the problems that the existing defense methods are poor in defending against backdoor attacks in the case of data heterogeneity, most backdoor attack detection methods require additional data sets, heterogeneous federated learning does not consider the defense mechanism of backdoor attacks, and existing research does not have a method to suppress backdoor attacks in the inference stage of federated learning.

[0004] To achieve the above objectives, the present invention provides a technical solution: a heterogeneous federated training and inference method that resists backdoor attacks. The heterogeneous federation includes data heterogeneity and model heterogeneity. The data heterogeneity refers to the distribution of local client data being non-independent and identically distributed. The model heterogeneity refers to a cloud server containing multiple client clusters, and the model structure in each client cluster is not necessarily the same. The method comprises the following steps:

[0005] Step 1: The cloud server initializes the tasks and client clusters, and randomly initializes the global model {ω1,ω2,…,ω q}, q is the number of client clusters, ω q Represents the qth global model, each global model ω1,ω2,…,ω q There is a heterogeneous relationship between them; when the global model is initialized, a batch normalization layer, namely a BN layer, is embedded after the first convolutional layer of each global model. The BN layer uses the statistics of a small batch to standardize the data in each layer of each neuron;

[0006] Step 2: The cloud server selects a set of clients W that participate in this round of training for each client cluster according to a fixed ratio α. q , and the global model ω corresponding to the client cluster q Send to the selected client set W q As a local model;

[0007] Step 3: Client i uses local dataset D i Train until the local model converges and obtain the trained local model ω q,i , and upload the local model q,i To the cloud server;

[0008] Step 4: The cloud server generates local models for each client cluster {ω q,1 ,ω q,2 ,…,ω q,i Perform backdoor attack detection, calculate the KL divergence of each client's BN layer with the BN layers of other clients, and use the Bottom-K algorithm based on the KL divergence to select clients similar to each client for voting. The client with a number of votes greater than the preset value is selected as a benign client, and the local model of the benign client is considered a benign model;

[0009] Step 5: Aggregate the good models of each client cluster and reselect the client set for each client cluster to participate in this round of training Then send the new global model to the client collection

[0010] Step 6: Repeat steps 2 to 5 until all global models {ω1,ω2,...,ω q}convergence;

[0011] Step 7: The cloud server initializes the federated inference task T, including the task dataset D. t and all trained global models {ω1,ω2,...,ω q};

[0012] Step 8: Set the task dataset D t Input to the trained global model {ω1,ω2,…,ω q}, the probability distribution of each category is obtained, and the cloud server inputs all probability distributions into the aggregation function Agg, thereby obtaining the predicted category label y that is not affected by backdoor attacks and heterogeneity as the final inference result.

[0013] Furthermore, in step 1, the initialization of the client cluster and the global model are measured by the computing power and communication capabilities provided by the clients, clients with similar capabilities are grouped together, and global models with more complex model structures are assigned to client clusters with stronger computing capabilities.

[0014] Furthermore, in step 3, the training process is expressed as: in, is the local model of client i belonging to the qth client cluster during round t of local training, is the local model of client i belonging to the qth client cluster during the t+1th round of local training, represents the local training objective function, η represents the learning rate, D i is the local dataset of client i.

[0015] Furthermore, in step 4, the cloud server trains the local model {ω q,1 ,ω q,2 ,…,ω q,i The specific steps for backdoor attack detection are as follows:

[0016] Step 4-1, the cloud server obtains the BN layer neuron distribution {N 1,q ,N 2,q ,…,N i,q ,…,N n,q}, where n is the number of clients participating in the training in the qth client cluster, i.e. |W q |, is the statistics of the BN layer of client i, k is the number of neurons in the BN layer, N(·) is the normal distribution, μ kis the mean value of the kth neuron in the BN layer of client i, σ k is the variance of the kth neuron in the BN layer of client i;

[0017] Step 4-2: The cloud server calculates the KL divergence of each client's BN layer with the BN layers of other clients, and calculates the KL divergence of other clients based on the neurons in each client's BN layer. The specific calculation formula is: Among them, D KL (N i,q ,N j,q ) is the KL divergence of the BN layer of client i to client j, N j,q is the statistics of the BN layer of client j, D KL (N i,q ,N j,q ) k It is the KL divergence of the kth neuron in the BN layer of client i to client j, that is, the KL metric formula between neurons in the BN layer is: in, is the mean value of the kth neuron in the BN layer of client j, is the variance of the kth neuron in the BN layer of client j;

[0018] Step 4-3: The cloud server uses the Bottom-K algorithm to select clients close to each client for voting and generates a voting list, which is specifically expressed as follows: Among them, Vote i is the voting result of the i-th client. It is assumed that the proportion of malicious clients is no more than 50%, so we set

[0019] Step 4-4: The cloud server counts all voting lists in each client cluster and selects clients with more than k votes, which is specifically expressed as: Among them, G q The set of clients selected for the qth client cluster.

[0020] Furthermore, in step 5, the aggregation method of the benign model is expressed as Where Agg is the federated learning aggregation function, is the new model after aggregation.

[0021] Furthermore, the specific steps of step 8 are as follows:

[0022] Step 8-1: Set the task dataset D t Input to each global model {ω1,ω2,…,ω q}, and obtain the score vectors of each category of the global model. The specific formula is: {s1,s2,...,sq}=f({ω1,ω2,...,ω q},D t ), where s q is the score vector output by the qth global model, f(·) is the inference function of the global model, which includes a multi-layer neural network;

[0023] Step 8-2: The cloud server inputs the score vector into the softmax function to obtain the probability distribution of all categories of the global model. The specific formula is: {P1,P2,...,P i ,...,P q}=softmax(s1,s2,...,s q ),in, is the probability distribution of the i-th global model, p i,k is the probability value of category k. The softmax function converts the scores of multiple categories into a probability distribution, ensuring that the sum of these probabilities is equal to 1;

[0024] Step 8-3: The cloud server inputs the probability distribution of all global models into the aggregation function Agg to obtain the aggregated probability distribution, and then obtains the final predicted category label y as the final inference result. The specific steps are as follows:

[0025] Step 8-3-1. The cloud server uses the MaxAgg aggregation function to take the maximum value corresponding to each category in the probability distribution as the final aggregation result to obtain the maximum probability distribution P max , the specific formula is: Among them, p q,k is the probability value of category k of the qth global model;

[0026] Step 8-3-2: The cloud server uses the AvgAgg aggregation function to take the average value of each category in the probability distribution as the final aggregation result to obtain the average probability distribution P avg , the specific formula is:

[0027] Step 8-3-3, the cloud server considers the impact of all clients and distributes the maximum probability P max and the mean probability distribution P add As the input of the argmax function, the final inference result is obtained. The specific formula is: y = argmax (P avg +P max ).

[0028] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0029] 1. It can defend against existing federated learning backdoor attacks when data is heterogeneous, that is, when client data is not independent and identically distributed.

[0030] 2. Without the need for auxiliary datasets on the server, malicious clients with a client ratio of <50% can be detected for each client cluster.

[0031] 3. The first study on the effective suppression method for federated learning backdoor attacks by using the predicted label distribution of model output during the federated learning inference phase. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a framework diagram of the method of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be described in further detail below with reference to the embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0034] See also Figure 1 As shown, this embodiment discloses a heterogeneous federated training and inference method for resisting backdoor attacks. The heterogeneous federation includes data heterogeneity and model heterogeneity. The data heterogeneity refers to the distribution of local data on the client being non-independent and identically distributed. The model heterogeneity refers to a cloud server containing multiple client clusters, and the model structure in each client cluster is not necessarily the same. The method includes the following steps:

[0035] Step 1: The cloud server initializes the tasks and client clusters, and randomly initializes the global model {ω1,ω2,…,ω q}, q is the number of client clusters, ω q Represents the qth global model, each global model ω1,ω2,…,ω q There is a heterogeneous relationship between them; in this embodiment, the global model {ω1,ω2} is initialized, and the specific situation is as follows;

[0036] ω1 is composed of a convolutional (3,64) conv layer, a normalized bn layer, and a fully connected fc layer. Some of its parameters are ['conv.weight',[3.1183e-04,2.4394e-02,9.2062e-03,...,1.5298e-02,6.8450e-03,1.7653e-02],'bn.weight',[1.,1.,1.,...,1.,1.,1],'fc.weight',[-0.0105,0.0225,-0.0353]];

[0037] ω2 consists of a convolutional (3,32) conv layer, a normalized bn layer, and a fully connected fc layer, some of whose parameters are ['conv.weight',[-0.1399,0.0456,-0.0735,...,0.1881,-0.0699,0.0262],'bn.weight',[1.,1.,1.,...,1.,1.,1],'fc.weight',[-0.0332,0.0341,-0.0088]].

[0038] Step 2: The cloud server selects a set of clients W that participate in this round of training for each client cluster according to a fixed ratio α. q , and the global model ω corresponding to the client cluster q Send to the selected client set W q As the local model; in this embodiment, W1 = {0, 1, 2}, W2 = {3, 4, 5} are selected.

[0039] Step 3: Client i uses local dataset D i Train until the local model converges and obtain the trained local model ω q,i , and upload the local model q,i To the cloud server, the training process can be expressed as: in, is the local model of client i belonging to the qth client cluster during round t of local training, is the local model of client i belonging to the qth client cluster during the t+1th round of local training, represents the local training objective function, η represents the learning rate, D i is the local dataset of client i; in this embodiment, the specific situation is as follows:

[0040] ω 1,0 Some parameters are ['conv.weight',[7.3097e-02,-1.5932e-02,3.5207e-02,...,2.4506e-02,1.9172e-02,1.1879e-02],'bn.weight',[0.9883,0.9830,1.0107,...,1.0052,0.9950,0.9941],'fc.weight',[-2.2697e-02,1.3333e-02,-6.3632e-03]];

[0041] ω 1,1Some parameters are ['conv.weight',[7.9383e-02,-2.2168e-02,2.1530e-02,...,4.7697e-03,8.7841e-03,1.1062e-02],'bn.weight',[0.9989,0.9989,0.9989,...,0.9989,0.9989,0.9989],'fc.weight',[-0.0158,-0.0027,0.0060]];

[0042] ω 1,2 Some parameters are ['conv.weight',[1.1447e-01,1.1075e-02,4.3884e-02,...,7.9306e-03,2.0986e-02,2.4765e-02],'bn.weight',[0.9989,0.9989,0.9989,...,0.9989,0.9989,0.9989],'fc.weight',[-0.0158,-0.0027,0.0060]];

[0043] ω 2,3 Some parameters are ['conv.weight',[1.1595e-01,-1.8794e-02,1.3230e-01,...,1.2467e-01,4.6098e-02,-6.0035e-02],'bn.weight',[1.0000,1.0144,0.9895,...,0.9839,1.0004,1.0115],'fc.weight',[-0.0359,-0.0109,-0.0466]];

[0044] ω 2,4 Some parameters are ['conv.weight',[0.1220,-0.0253,0.1282,...,-0.1241,0.0333,-0.0691],'bn.weight',[1.0240,0.9921,1.0110,...,0.9987,0.9711,1.0111],'fc.weight',[-0.0037,-0.0066,0.0095]];

[0045] ω 2,5Some parameters are ['conv.weight',[1.1929e-01,-3.2499e-02,1.1677e-01,...,-1.2501e-01,3.2158e-02,-7.1353e-02],'bn.weight',[1.0019,1.0029,0.9972,...,0.9979,0.9974,0.9978],'fc.weight',[-0.0415,-0.0169,-0.0444]].

[0046] Step 4: The cloud server generates local models for each client cluster {ω q,1 ,ω q,2 ,…,ω q,i} To perform backdoor attack detection, the specific steps are as follows:

[0047] Step 4-1, the cloud server obtains the BN layer neuron distribution {N 1,q ,N 2,q ,…,N i,q ,…,N n,q}, where n is the number of clients participating in the training in the qth client cluster, i.e. |W q |, is the statistics of the BN layer of client i, k is the number of neurons in the BN layer, N(·) is the normal distribution, μ k is the mean value of the kth neuron in the BN layer of client i, σ k is the variance of the kth neuron in the BN layer of client i; in this embodiment, the specific situation is as follows:

[0048] W1=ω in {0,1,2} 1,0 The BN layer distribution is: ['running_var',[1.5406,0.5934,1.2107,...,2.5785,2.1956,1.5306],'running_mean',[-2.7534e-01,4.6078e-02,2.3322e-01,...,3.7388e-01,-2.8517e-01,1.1889e-01]]; ω 1,1 The BN layer distribution is: ['running_var',[0.6445,0.1243,0.1654,...,0.0494,0.0535,0.0798],'running_mean',[-0.2070,0.0007,0.1020,...,0.0123,-0.0088,0.0355]]; ω 1,2The BN layer distribution is: ['running_var',[0.7063,1.1832,0.2172,...,2.4871,1.7644,0.8425],'running_mean',[-0.0084,0.2933,-0.0479,...,0.4852,-0.2775,-0.0636]];

[0049] W2=ω in {3,4,5} 2,3 The BN layer distribution is: ['running_var',[0.1819,0.2719,0.5573,...,0.6796,0.6493,0.3924],'running_mean',[-0.0505,-0.0505,-0.0715,...,0.0135,0.2355,-0.2521]]; ω 2,4 The BN layer distribution is: ['running_var',[0.2328,0.1668,0.6365,...,0.2476,0.5554,0.4479],'running_mean',[-0.1146,-0.0292,-0.1481,...,-0.0604,0.3045,-0.2627]]; ω 2,5 The BN layer distribution is: ['running_var',[0.3038,0.3330,0.3089,...,0.8955,0.6333,0.2284],'running_mean',[-0.0742,-0.0194,-0.1468,...,0.0315,0.4156,-0.1569]];

[0050] Step 4-2: The cloud server calculates the KL divergence of each client's BN layer with the BN layers of other clients, and calculates the KL divergence of other clients based on the neurons in each client's BN layer. The specific calculation formula is: Among them, D KL (N i,q ,N j,q ) is the KL divergence of the BN layer of client i to client j, N j,q is the statistics of the BN layer of client j, D KL (N i,q ,N j,q ) k It is the KL divergence of the kth neuron in the BN layer of client i to client j, that is, the KL metric formula between neurons in the BN layer is: in, is the mean value of the kth neuron in the BN layer of client j, is the variance of the kth neuron in the BN layer of client j; in this embodiment, the specific situation is as follows:

[0051] W1={0,1,2}:['0',[0.0000,384.6130,12.1951],'1',[4.7576e+01,0.0000,4.3693e+01],'2',[10.0945,350.1348,0.0000]];

[0052] W2={3,4,5}:['0',[0.0000,4.7836,1.1501],'1',[4.0233,0.0000,4.5300],'2',[1.2438,7.0808,0.0000]];

[0053] Step 4-3: The cloud server uses the Bottom-K algorithm to select clients close to each client for voting and generates a voting list, which is specifically expressed as: Among them, Vote i is the voting result of the i-th client. It is assumed that the proportion of malicious clients is no more than 50%, so we set In this embodiment, the specific situation is as follows:

[0054] Where k = 2, the voting results in W1 = {0,1,2} are: ['vote0',[0,2],'vote1',[1,2],'vote2',[0,2]], and the voting results in W2 = {3,4,5} are: ['vote0',[0,2],'vote1',[0,1],'vote2',[0,2]];

[0055] Step 4-4 Among them, G q The client set selected by the qth client cluster; in this embodiment, the specific situation is as follows:

[0056] The screening result in W1={0,1,2} is [0,2], and the screening result in W2={3,4,5} is [0,2].

[0057] Step 5: Aggregate the good models of each client cluster and reselect the client set for each client cluster to participate in this round of training Then send the new global model to the client collection Among them, the aggregation method of the benign model is expressed as Agg is the federated learning aggregation function, is the new model after aggregation.

[0058] Step 6: Repeat steps 2 to 5 until all global models {ω1,ω2,…,ω q}convergence; in this embodiment, the specific situation is as follows:

[0059] The parameters of ω1 are ['conv.weight',[3.1314e-02,2.8765e-03,-9.7534e-04,...,-1.2840e-02,-5.7452e-02,-4.6772e-03],'bn.weight',[0.9520,0.9944,0.9803,...,1.0048,1.2923,0.9457],'fc.weight',[0.0124,-0.0022,0.0105]];

[0060] The parameters of ω2 are ['conv.weight',[2.0195e-02,-1.3231e-01,6.3728e-03,...,5.9733e-02,7.1137e-02,1.5157e-01],'bn.weight',[1.0051,1.0457,0.9332,...,1.0530,0.9933,0.9801],'fc.weight',[0.0542,-0.0054,-0.0485]].

[0061] Step 7: The cloud server initializes the federated inference task T, including the task dataset D. t and two trained global models {ω1,ω2}.

[0062] Step 8: Set the task dataset D t The data is input into the trained global model {ω1,ω2} to obtain the probability distribution of each category. The cloud server inputs all probability distributions into the aggregation function Agg to obtain the predicted category label y as the final inference result, which is not affected by backdoor attacks and heterogeneity. The specific steps are as follows:

[0063] Step 8-1: Set the task dataset D t Input into the two global models {ω1,ω2}, and obtain the score vectors of each category of the two global models, {s1,s2}={[2.14,3.68,1.43],[1.35,4.68,0.68]}, where s1,s2 are the score vectors corresponding to each category of the global models ω1,ω2;

[0064] Step 8-2: The cloud server inputs the score vector into the softmax function to obtain the probability distribution of all categories of the two global models: {P1, P2} = softmax{[2.14, 3.68, 1.43], [1.35, 4.68, 0.68]} = {[0.162, 0.749, 0.089], [0.043, 0.946, 0.011]}, where P1 and P2 are the probability distributions of the global models ω1 and ω2. The softmax function converts the scores of multiple categories into probability distributions, ensuring that the sum of these probabilities is equal to 1.

[0065] Step 8-3: The cloud server inputs the probability distributions of the two global models into the aggregation function Agg to obtain the aggregated probability distribution, and then obtains the final predicted category label y as the final inference result. The specific steps are as follows:

[0066] Step 8-3-1. The cloud server uses the MaxAgg aggregation function to take the maximum value corresponding to each category in the probability distribution as the final aggregation result to obtain the maximum probability distribution: P max ={0.162,0.946,0.089};

[0067] Step 8-3-2, the cloud server uses the AvgAgg aggregation function to take the average value of each category in the probability distribution as the final aggregation result, and obtains the average probability distribution: P avg ={0.103,0.848,0.05};

[0068] Step 8-3-3, the cloud server fairly considers the impact of all clients and distributes the maximum probability P max and the mean probability distribution P add As the input of the argmax function, the final inference result y=1 is obtained. The specific formula is: y=argmax(P avg +P max ).

[0069] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A heterogeneous federated training and inference method to resist backdoor attacks. The heterogeneous federation includes data heterogeneity and model heterogeneity. The data heterogeneity refers to the distribution of local client data being non-independent and identically distributed. The model heterogeneity refers to a cloud server containing multiple client clusters, and the model structure in each client cluster is not necessarily the same. The method is characterized by: The following steps are involved: Step 1: The cloud server initializes the tasks and client clusters, and randomly initializes the global model {ω1,ω2,…,ω q }, q is the number of client clusters, ω q Represents the qth global model, each global model ω1,ω2,…,ω q There is a heterogeneous relationship between them; when the global model is initialized, a batch normalization layer, namely a BN layer, is embedded after the first convolutional layer of each global model. The BN layer uses the statistics of a small batch to standardize the data in each layer of each neuron; Step 2: The cloud server selects a set of clients W that participate in this round of training for each client cluster according to a fixed ratio α. q , and the global model ω corresponding to the client cluster q Send to the selected client set W q As a local model; Step 3: Client i uses local dataset D i Train until the local model converges and obtain the trained local model ω q,i , and upload the local model q,i To the cloud server; Step 4: The cloud server generates local models for each client cluster {ω q,1 ,ω q,2 ,…,ω q,i Perform backdoor attack detection, calculate the KL divergence of each client's BN layer with the BN layers of other clients, and use the Bottom-K algorithm based on the KL divergence to select clients similar to each client for voting. The client with a number of votes greater than the preset value is selected as a benign client, and the local model of the benign client is considered a benign model; Step 5: Aggregate the good models of each client cluster and reselect the client set for each client cluster to participate in this round of training Then send the new global model to the client collection Step 6: Repeat steps 2 to 5 until all global models {ω1,ω2,…,ω q }convergence; Step 7: The cloud server initializes the federated inference task T, including the task dataset D. t and all trained global models {ω1,ω2,…,ω q }; Step 8: Set the task dataset D t Input to the trained global model {ω1,ω2,…,ω q }, the probability distribution of each category is obtained, and the cloud server inputs all probability distributions into the aggregation function Agg, thereby obtaining the predicted category label y that is not affected by backdoor attacks and heterogeneity as the final inference result.

2. A heterogeneous federated training and inference method for resisting backdoor attacks according to claim 1, characterized in that: In step 1, the initialization of the client cluster and the global model are measured by the computing power and communication capabilities provided by the clients. Clients with similar capabilities are grouped together, and global models with more complex model structures are assigned to client clusters with stronger computing capabilities.

3. The heterogeneous federated training and inference method for resisting backdoor attacks according to claim 1 is characterized in that: In step 3, the training process is expressed as: in, is the local model of client i belonging to the qth client cluster during round t of local training, is the local model of client i belonging to the qth client cluster during the t+1th round of local training, represents the local training objective function, η represents the learning rate, D i is the local dataset of client i.

4. The heterogeneous federated training and inference method for resisting backdoor attacks according to claim 1 is characterized in that: In step 4, the cloud server trains the local model {ω q,1 ,ω q,2 ,…,ω q,i The specific steps for backdoor attack detection are as follows: Step 4-1, the cloud server obtains the BN layer neuron distribution {N 1,q ,N 2,q ,…,N i,q ,…,N n,q }, where n is the number of clients participating in the training in the qth client cluster, i.e. |W q |, is the statistics of the BN layer of client i, k is the number of neurons in the BN layer, N(·) is the normal distribution, μ k is the mean value of the kth neuron in the BN layer of client i, σ k is the variance of the kth neuron in the BN layer of client i; Step 4-2: The cloud server calculates the KL divergence of each client's BN layer and the BN layers of other clients, and calculates the KL divergence of other clients based on the neurons in each client's BN layer. The specific calculation formula is: D KL (N i,q ,N j,q )=∑ k D KL (N i,q ,N j,q ) k , Among them, D KL (N i,q ,N j,q ) is the KL divergence of the BN layer of client i to client j, N j,q is the statistics of the BN layer of client j, D KL (N i,q ,N j,q ) k It is the KL divergence of the kth neuron in the BN layer of client i to client j, that is, the KL metric formula between neurons in the BN layer is: in, is the mean value of the kth neuron in the BN layer of client j, is the variance of the kth neuron in the BN layer of client j; Step 4-3: The cloud server uses the Bottom-K algorithm to select clients close to each client to vote and generate a voting list, which is specifically expressed as: Vote i =Bottom-k([D KL (N i,q ,N j,q )]), Among them, Vote i is the voting result of the i-th client. It is assumed that the proportion of malicious clients is no more than 50%, so we set Step 4-4: The cloud server counts all voting lists in each client cluster and selects clients with more than k votes, which is specifically expressed as: Among them, G q The set of clients selected for the qth client cluster.

5. The heterogeneous federated training and inference method for resisting backdoor attacks according to claim 1 is characterized in that: In step 5, the aggregation method of the benign model is expressed as Where Agg is the federated learning aggregation function, is the new model after aggregation.

6. The heterogeneous federated training and inference method for resisting backdoor attacks according to claim 1 is characterized in that: The specific steps of step 8 are as follows: Step 8-1: Set the task dataset D t Input to each global model {ω1,ω2,…,ω q }, and obtain the score vectors of each category of the global model. The specific formula is: {s1,s2,...,s q }=f({ω1,ω2,...,ω q },D t ), where s q is the score vector output by the qth global model, f(·) is the inference function of the global model, which includes a multi-layer neural network; Step 8-2: The cloud server inputs the score vector into the softmax function to obtain the probability distribution of all categories of the global model. The specific formula is: {P1,P2,...,P i ,...,P q }=softmax(s1,s2,...,s q ),in is the probability distribution of the i-th global model, p i,k is the probability value of category k. The softmax function converts the scores of multiple categories into a probability distribution, ensuring that the sum of these probabilities is equal to 1; Step 8-3: The cloud server inputs the probability distribution of all global models into the aggregation function Agg to obtain the aggregated probability distribution, and then obtains the final predicted category label y as the final inference result. The specific steps are as follows: Step 8-3-1. The cloud server uses the MaxAgg aggregation function to take the maximum value corresponding to each category in the probability distribution as the final aggregation result to obtain the maximum probability distribution P max , the specific formula is: Among them, p q,k is the probability value of category k of the qth global model; Step 8-3-2: The cloud server uses the AvgAgg aggregation function to take the average value of each category in the probability distribution as the final aggregation result to obtain the average probability distribution P avg , the specific formula is: Step 8-3-3, the cloud server considers the impact of all clients and distributes the maximum probability P max and the mean probability distribution P add As the input of the argmax function, the final inference result is obtained. The specific formula is: y = argmax (P avg +P max ).

Images