A robustness detection method, device, equipment and medium based on federated learning

Abstract

The present invention relates to the field of robustness detection technology, and relates to a robustness detection method, device, equipment and medium based on federated learning. The method includes obtaining a first global model, which is a model trained on a server side; sending the first global model to a local side, and using a data set on the local side to update and train the global model to obtain at least one local model; generating a first malicious model based on at least one local model; sending the first malicious model to a server side for aggregation and performing robustness detection based on the aggregated global model. The present invention generates a first malicious model locally and then uploads the first malicious model to the server side to interfere with the update of the global model, and then judges the robustness of the federated learning system by observing the performance of the global model before and after the test, thereby effectively improving the robustness detection efficiency and speed of the federated learning system.

Description

Technical Field

[0001] The present invention relates to the field of robustness detection technology, and in particular to a robustness detection method, apparatus, device and medium based on federated learning. Background Art

[0002] Federated learning is an emerging machine learning method that aims to enable model training and collaboration among multiple participants while protecting the privacy and security of user data. Current federated learning robustness detection technologies mainly focus on anomaly detection and security aggregation algorithms. However, existing detection technologies mainly adopt passive defense methods and rely too much on prior knowledge and rules, which easily leads to high false alarm rates. Summary of the Invention

[0003] The purpose of the present invention is to provide a robustness detection method, device, equipment and medium based on federated learning to improve the above-mentioned problems.

[0004] In order to achieve the above objectives, the embodiments of the present application provide the following technical solutions:

[0005] In one aspect, an embodiment of the present application provides a robustness detection method based on federated learning, the method comprising:

[0006] Obtain a first global model, where the first global model is a model trained on the server side;

[0007] Sending the first global model to the local end, and using the local end data set to update and train the global model to obtain at least one local model;

[0008] generating a first malicious model based on at least one of the local models;

[0009] The first malicious model is sent to the server for aggregation and robustness detection is performed based on the aggregated global model.

[0010] In a second aspect, an embodiment of the present application provides a robustness detection device based on federated learning, the device comprising:

[0011] An acquisition module, configured to acquire a first global model, where the first global model is a model trained on the server side;

[0012] A first processing module is configured to send the first global model to a local end, and update and train the global model using a data set on the local end to obtain at least one local model;

[0013] A second processing module, configured to generate a first malicious model based on at least one of the local models;

[0014] A detection module is used to send the first malicious model to the server for aggregation and perform robustness detection based on the aggregated global model.

[0015] In a third aspect, embodiments of the present application provide a robustness detection device based on federated learning, comprising a memory and a processor. The memory is configured to store a computer program; the processor is configured to implement the steps of the robustness detection method based on federated learning when executing the computer program.

[0016] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned robustness detection method based on federated learning are implemented.

[0017] The beneficial effects of the present invention are:

[0018] The present invention generates a first malicious model locally and then uploads the first malicious model to the server to interfere with the global model update. Then, the robustness of the federated learning system is judged by observing the performance of the global model before and after the test, thereby effectively improving the robustness detection efficiency and speed of the federated learning system.

[0019] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the embodiments of the present invention. The purposes and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 Schematic diagram of the robustness detection method based on federated learning described in an embodiment of the present invention.

[0022] Figure 2 Schematic diagram of the structure of the robustness detection device based on federated learning described in an embodiment of the present invention.

[0023] Figure 3 Schematic diagram of the structure of a robustness detection device based on federated learning described in an embodiment of the present invention.

[0024] Figure 4 This is the first curve graph described in an embodiment of the present invention.

[0025] Figure 5 This is the second curve graph described in the embodiment of the present invention.

[0026] Figure 6 This is the third curve diagram described in the embodiment of the present invention.

[0027] In the figure, the following are marked: 901, acquisition module; 902, first processing module; 903, second processing module; 904, detection module; 9031, first acquisition unit; 9032, first processing unit; 9033, second processing unit; 9041, third processing unit; 9042, fourth processing unit; 9043, fifth processing unit; 9044, sixth processing unit; 9045, seventh processing unit; 90331, second acquisition unit; 90332, eighth processing unit; 90333, ninth processing unit ; 903331, screening unit; 903332, tenth processing unit; 903333, eleventh processing unit; 903311, third acquisition unit; 903312, twelfth processing unit; 903313, thirteenth processing unit; 903314, fourteenth processing unit; 903315, fifteenth processing unit; 800, robustness detection device based on federated learning; 801, processor; 802, memory; 803, multimedia component; 804, I / O interface; 805, communication component. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0029] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are used only to distinguish the description and should not be understood as indicating or implying relative importance.

[0030] Example 1:

[0031] This embodiment provides a robustness detection method based on federated learning. It is understandable that a scenario can be laid out in this embodiment, for example:

[0032] See also Figure 1 , the figure shows that the method includes steps S1, S2, S3 and S4, which specifically include:

[0033] Step S1: Obtain a first global model, where the first global model is a model trained on the server side;

[0034] Step S2: sending the first global model to the local end, and using the local end data set to update and train the global model to obtain at least one local model;

[0035] In this step, after receiving the global model, the local client participating in federated learning loads its locally stored dataset. This dataset is unique to the local client and is not shared with other clients to maintain data privacy. The client then performs normal training using its local dataset to obtain a local model.

[0036] Step S3: generating a first malicious model based on at least one of the local models;

[0037] Step S3 further includes steps S31, S32, and S33, which specifically include:

[0038] Step S31: Acquire parameter information, where the parameter information includes weight parameters of each layer in the neural network included in each local model;

[0039] In this step, the parameter information includes the weight parameters of each layer in the neural network but is not limited to the weight parameters of each layer in the neural network, and may specifically be bias parameters.

[0040] Step S32: sorting each layer in the neural network according to the parameter information to obtain a sorted neural network;

[0041] In this step, the local models need to be sorted to ensure that the parameter information of each layer can be processed and compared separately, so as to find the parameter information with the most significant changes in each layer and prepare for subsequent interference operations.

[0042] Step S33: Generate a first malicious model based on the sorted neural network.

[0043] The step S33 further includes steps S331, S332 and S333, which specifically include:

[0044] Step S331, obtaining a disturbance coefficient;

[0045] In this step, a too large λ may cause the attack to be detected, while a too small λ may not achieve the expected attack effect. Therefore, the selection of the perturbation coefficient is particularly important.

[0046] Step S331 also includes steps S3311, S3312, S3313, S3314, and S3315, which specifically include:

[0047] Step S3311: Acquire at least one data set, at least one second global model, and a preset perturbation coefficient, wherein the second global models have different network architectures;

[0048] In this step, three different data sets are used to test the second global model for image classification tasks, including the first data set, the second data set and the third data set. For the first and second data sets, the second global model adopts the LeNet network architecture for training and evaluation, and for the third data set, the second global model adopts the VGG-11 network architecture for training and evaluation. It should be noted that the first data set includes MN I ST, the second data set includes FMN IST, and the third data set includes CI FAR-10.

[0049] Step S3312: training each of the second global models using at least one of the data sets to obtain at least one trained second global model;

[0050] Step S3313: Send at least one of the trained second global models to the local end and perform update training using the preset perturbation coefficient to generate at least one second malicious model;

[0051] Step S3314: Send at least one of the second malicious models to the local end for aggregation, test the impact of the poisoning attack, and generate a curve graph, which is used to represent the impact of malicious models generated with different perturbation coefficients on model performance;

[0052] In this step, the curve graph includes a first curve graph Figure 4 , the second graph Figure 5 and the third graph Figure 6 As shown, Figure 4 This is a performance impact diagram of the image classification task using the federated averaging algorithm on the first, second, and third datasets; Figure 5 Performance impact diagram for image classification task using minimum distance sum based aggregation algorithm on the first dataset, the second dataset and the third dataset; Figure 6 This is a performance impact diagram of the image classification task using the trimmed mean algorithm on the first data set, the second data set, and the third data set.

[0053] Step S3315: Determine the disturbance coefficient according to the curve graph.

[0054] In this step, Figure 4 It can be seen that as the perturbation coefficient increases, the accuracy of the model decreases. However, when the perturbation coefficient is 0.9 and 1.0, the model still maintains a high accuracy. This is because slight perturbations are not enough to significantly reduce the accuracy of the model, so the robustness of the model cannot be effectively tested. Figure 5 It can be seen that when the perturbation coefficient is 1.5, the accuracy of the model does not decrease with the increase of the perturbation coefficient. On the contrary, compared with the perturbation coefficient of 1.1, the accuracy of the model increases significantly. Because excessive perturbation to the model will cause the aggregation algorithm based on the minimum distance sum to easily filter and exclude malicious updates by selecting updates with the minimum total distance. Therefore, considering the attack effect and the risk of being detected, the perturbation coefficient in this application is selected as 1.1.

[0055] Step S332: Calculate the absolute value of the parameter information of each layer in the sorted neural network to obtain a first calculation result;

[0056] In this step, since the parameter information to be found is a parameter with significant changes, which may be negative or positive, it is necessary to obtain the absolute value of each layer of parameter information.

[0057] Step S333: Calculate according to the first calculation result and the disturbance coefficient to generate a first malicious model.

[0058] The step S333 also includes step S3331, step S3332 and step S3333, which specifically include:

[0059] Step S3331: Filter the neural network layer of each local model according to the first calculation result to obtain a filtered neural network layer, wherein the weight coefficient of each layer in the filtered neural network layer is the maximum value of the corresponding number of layers in the local model;

[0060] In this step, the most influential parameter changes in each layer are selected from the sorted neural network. By selecting the maximum value, it is ensured that the interference effect of each layer is maximized when generating the malicious model.

[0061] Step S3332: Calculate the disturbance coefficient and the weight coefficient corresponding to each layer in the filtered neural network layer to obtain a second calculation result;

[0062] In this step, the perturbation coefficient is multiplied by the weight coefficient of each layer in the neural network to obtain a second calculation result.

[0063] Step S3333: Modify the weight coefficient of each layer in the filtered neural network layer based on the second calculation result to obtain a first malicious model.

[0064] Step S4: Send the first malicious model to the server for aggregation and perform robustness detection based on the aggregated global model.

[0065] In this step, after the first malicious model is generated, it is sent to the server to interfere with the global model. Since federated learning updates the global model by aggregating model updates from various local terminals, the introduction of the malicious model will have a significant impact on the global model. By observing and analyzing the performance of the global model on the test dataset, the specific impact of the attack on the performance of the global model can be evaluated, and the robustness of the federated learning system can be judged.

[0066] Step S4 further includes steps S41, S42, S43, S44, and S45, which specifically include:

[0067] Step S41: Aggregate the first malicious model using at least one aggregation algorithm to obtain an aggregated global model;

[0068] In this step, three aggregation algorithms are selected to aggregate the first malicious model, specifically including FedAVG, Krum, and Trimmed-mean.

[0069] Step S42: performing an image classification task using the aggregated global model to obtain a first classification result;

[0070] In this step, using the aggregated global model to perform image classification tasks is a technical solution well known to those skilled in the art, so it will not be described here in detail.

[0071] Step S43: using the first global model to perform an image classification task to obtain a second classification result;

[0072] Step S44: determining first accuracy information based on the first classification result, and determining second accuracy information based on the second classification result;

[0073] In this step, the robustness is tested based on the accuracy of the image classification task of the global model before and after aggregation as the evaluation indicator.

[0074] Step S45: Determine the robustness of the first global model according to the first accuracy information and the second accuracy information.

[0075] In this step, the accuracy changes of the global model before and after the poisoning attack are observed. It is generally believed that if the model accuracy drops by more than 15%, the attack is considered successful, which indicates that the robustness of the federated learning system is poor.

[0076] Example 2:

[0077] like Figure 2 As shown, this embodiment provides a robustness detection device based on federated learning, which includes an acquisition module 901, a first processing module 902, a second processing module 903 and a detection module 904, which specifically includes:

[0078] An acquisition module 901 is configured to acquire a first global model, where the first global model is a model trained on a server side;

[0079] A first processing module 902 is configured to send the first global model to a local terminal and update and train the global model using a data set on the local terminal to obtain at least one local model;

[0080] A second processing module 903 is configured to generate a first malicious model based on at least one of the local models;

[0081] The detection module 904 is used to send the first malicious model to the server for aggregation and perform robustness detection based on the aggregated global model.

[0082] In a specific embodiment of the present disclosure, the second processing module 903 further includes a first acquiring unit 9031, a first processing unit 9032, and a second processing unit 9033, which specifically include:

[0083] A first acquiring unit 9031 is configured to acquire parameter information, where the parameter information includes weight parameters of each layer in the neural network included in each local model;

[0084] A first processing unit 9032 is configured to sort each layer in the neural network according to the parameter information to obtain a sorted neural network;

[0085] The second processing unit 9033 is used to generate a first malicious model according to the sorted neural network.

[0086] In a specific embodiment of the present disclosure, the detection module 904 further includes a third processing unit 9041, a fourth processing unit 9042, a fifth processing unit 9043, a sixth processing unit 9044, and a seventh processing unit 9045, which specifically include:

[0087] The third processing unit 9041 is configured to aggregate the first malicious model using at least one aggregation algorithm to obtain an aggregated global model;

[0088] A fourth processing unit 9042 is configured to perform an image classification task using the aggregated global model to obtain a first classification result;

[0089] A fifth processing unit 9043 is configured to perform an image classification task using the first global model to obtain a second classification result;

[0090] A sixth processing unit 9044 is configured to determine first accuracy information based on the first classification result, and determine second accuracy information based on the second classification result;

[0091] The seventh processing unit 9045 is used to determine the robustness of the first global model according to the first accuracy information and the second accuracy information.

[0092] In a specific embodiment of the present disclosure, the second processing unit 9033 further includes a second acquiring unit 90331, an eighth processing unit 90332, and a ninth processing unit 90333, which specifically include:

[0093] A second acquisition unit 90331 is used to acquire a disturbance coefficient;

[0094] an eighth processing unit 90332, configured to obtain an absolute value of parameter information of each layer in the sorted neural network to obtain a first calculation result;

[0095] The ninth processing unit 90333 is configured to perform calculation based on the first calculation result and the disturbance coefficient to generate a first malicious model.

[0096] In a specific embodiment of the present disclosure, the ninth processing unit 90333 further includes a screening unit 903331, a tenth processing unit 903332, and an eleventh processing unit 903333, which specifically include:

[0097] a screening unit 903331, configured to screen the neural network layers of each local model according to the first calculation result to obtain screened neural network layers, wherein the weight coefficient of each layer in the screened neural network layers is the maximum value of the corresponding number of layers in the local model;

[0098] a tenth processing unit 903332, configured to calculate the disturbance coefficient and the weight coefficient corresponding to each layer in the filtered neural network layer to obtain a second calculation result;

[0099] The eleventh processing unit 903333 is used to modify the weight coefficient of each layer in the filtered neural network layer based on the second calculation result to obtain a first malicious model.

[0100] In a specific embodiment of the present disclosure, the second acquiring unit 90331 further includes a third acquiring unit 903311, a twelfth processing unit 903312, a thirteenth processing unit 903313, a fourteenth processing unit 903314, and a fifteenth processing unit 903315, which specifically include:

[0101] The third acquisition unit 903311 is configured to acquire at least one data set, at least one second global model, and a preset perturbation coefficient, wherein the second global models have different network architectures.

[0102] A twelfth processing unit 903312 is configured to train each of the second global models using at least one of the data sets to obtain at least one trained second global model;

[0103] The thirteenth processing unit 903313 is configured to send at least one of the trained second global models to the local end and perform update training using the preset perturbation coefficient to generate at least one second malicious model;

[0104] A fourteenth processing unit 903314 is configured to send at least one of the second malicious models to a local terminal for aggregation, test the impact of the poisoning attack, and generate a curve graph for representing the impact of malicious models generated with different perturbation coefficients on model performance;

[0105] The fifteenth processing unit 903315 is configured to determine a disturbance coefficient according to the curve graph.

[0106] It should be noted that, regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated on here.

[0107] Example 3:

[0108] Corresponding to the above method embodiment, this embodiment also provides a robustness detection device based on federated learning. The robustness detection device based on federated learning described below and the robustness detection method based on federated learning described above can refer to each other.

[0109] Figure 3 FIG is a block diagram of a robustness detection device 800 based on federated learning according to an exemplary embodiment. Figure 3As shown, the robustness detection device 800 based on federated learning may include: a processor 801 and a memory 802. The robustness detection device 800 based on federated learning may also include one or more of a multimedia component 803, an I / O interface 804, and a communication component 805.

[0110] The processor 801 is used to control the overall operation of the federated learning-based robustness detection device 800 to complete all or part of the steps in the above-mentioned federated learning-based robustness detection method. The memory 802 is used to store various types of data to support the operation of the federated learning-based robustness detection device 800. Such data may include, for example, instructions for any application or method operating on the federated learning-based robustness detection device 800, as well as application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 802 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The multimedia component 803 can include a screen and an audio component. The screen can be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component can include a microphone for receiving external audio signals. The received audio signals can be further stored in the memory 802 or sent via the communication component 805. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 804 provides an interface between the processor 801 and other interface modules, and the above-mentioned other interface modules can be a keyboard, a mouse, buttons, etc. These buttons can be virtual buttons or physical buttons. The communication component 805 is used for wired or wireless communication between the robustness detection device 800 based on federated learning and other devices. Wireless communication, such as Wi-Fi, Bluetooth, near field communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 805 can include: Wi-Fi module, Bluetooth module, NFC module.

[0111] In an exemplary embodiment, the robustness detection device 800 based on federated learning can be implemented by one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned robustness detection method based on federated learning.

[0112] In another exemplary embodiment, a computer-readable storage medium including program instructions is further provided. When executed by a processor, the program instructions implement the steps of the aforementioned robustness detection method based on federated learning. For example, the computer-readable storage medium may be the aforementioned memory 802 including the program instructions. The program instructions may be executed by the processor 801 of the robustness detection device 800 based on federated learning to implement the aforementioned robustness detection method based on federated learning.

[0113] Example 4:

[0114] Corresponding to the above method embodiment, this embodiment further provides a readable storage medium. The readable storage medium described below and the robustness detection method based on federated learning described above can refer to each other.

[0115] A readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the robustness detection method based on federated learning in the above method embodiment.

[0116] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0117] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

[0118] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A robustness detection method based on federated learning, characterized in that: include: Obtain a first global model, where the first global model is a model trained on the server side; Sending the first global model to the local end, and using the local end data set to update and train the global model to obtain at least one local model; generating a first malicious model based on at least one of the local models; Sending the first malicious model to the server for aggregation and performing robustness detection based on the aggregated global model; Generating a first malicious model according to at least one of the local models includes: Obtaining parameter information, the parameter information including weight parameters of each layer in the neural network included in each local model; Sorting each layer in the neural network according to the parameter information to obtain a sorted neural network; generating a first malicious model according to the sorted neural network; Generating a first malicious model according to the sorted neural network includes: Obtaining a disturbance coefficient, wherein the disturbance coefficient is 1.1; Calculate the absolute value of the parameter information of each layer in the sorted neural network to obtain a first calculation result; Performing calculation based on the first calculation result and the disturbance coefficient to generate a first malicious model; The first malicious model is sent to the server for aggregation and robustness detection is performed based on the aggregated global model, including: Aggregating the first malicious model using at least one aggregation algorithm to obtain an aggregated global model; Performing an image classification task using the aggregated global model to obtain a first classification result; Performing an image classification task using the first global model to obtain a second classification result; Determine first accuracy information based on the first classification result, and determine second accuracy information based on the second classification result; The robustness of the first global model is determined according to the first accuracy information and the second accuracy information.

2. A robustness detection device based on federated learning, characterized in that: include: An acquisition module, configured to acquire a first global model, where the first global model is a model trained on the server side; A first processing module is configured to send the first global model to a local end, and update and train the global model using a data set on the local end to obtain at least one local model; A second processing module, configured to generate a first malicious model based on at least one of the local models; A detection module, configured to send the first malicious model to a server for aggregation and perform robustness detection based on the aggregated global model; Wherein, the second processing module includes: A first acquisition unit is configured to acquire parameter information, wherein the parameter information includes weight parameters of each layer in the neural network included in each local model; A first processing unit is configured to sort each layer in the neural network according to the parameter information to obtain a sorted neural network; a second processing unit, configured to generate a first malicious model based on the sorted neural network; Wherein, the second processing unit includes: A second acquiring unit is used to acquire a disturbance coefficient, wherein the disturbance coefficient is 1.1; an eighth processing unit, configured to obtain an absolute value of parameter information of each layer in the sorted neural network to obtain a first calculation result; a ninth processing unit, configured to perform calculation based on the first calculation result and the disturbance coefficient to generate a first malicious model; Wherein, the detection module includes: a third processing unit, configured to aggregate the first malicious model using at least one aggregation algorithm to obtain an aggregated global model; a fourth processing unit, configured to perform an image classification task using the aggregated global model to obtain a first classification result; a fifth processing unit, configured to perform an image classification task using the first global model to obtain a second classification result; a sixth processing unit, configured to determine first accuracy information according to the first classification result, and determine second accuracy information according to the second classification result; A seventh processing unit is used to determine the robustness of the first global model based on the first accuracy information and the second accuracy information.

3. A robustness detection device based on federated learning, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the robustness detection method based on federated learning as claimed in any one of claims 1 when executing the computer program.

4. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the robustness detection method based on federated learning as claimed in any one of claim 1 are implemented.

Images