Privacy-preserving and robust personalized image recognition method based on federated learning

Abstract

The application provides a privacy-protected and robust personalized image recognition method based on federated learning. First, the differential privacy mechanism is used to protect user privacy. Compared with homomorphic encryption, secure multi-party computation and other cryptographic means, the method does not need to distribute keys or consider the access mechanism of users, improves the operation efficiency of the system and reduces the maintenance cost of the system. Second, compared with the existing framework which only focuses on privacy or poisoning attack, the training framework considering both is not realized. The application can protect user privacy and defend against potential attacks in personalized federated learning. In summary, the application is a personalized image recognition method based on average regularization multi-task learning. The method can protect the privacy of training data and defend against various attacks such as data poisoning and model poisoning. The central server applies the rule, and potential attackers with a proportion of less than 50% can be effectively filtered out.

Description

Technical Field

[0001] This invention belongs to the field of federated learning technology in privacy computing, and particularly relates to a privacy-preserving and robust personalized image recognition method based on federated learning. Background Technology

[0002] In recent years, with improvements in hardware performance and rapid growth in data volume, machine learning performance has continuously improved, and its application scenarios have become increasingly diverse. In traditional centralized machine learning, massive amounts of data need to be centralized on a single machine for training; however, such unregulated transfer is extremely dangerous for sensitive data. With increasing emphasis on data privacy and the introduction of relevant protection regulations, federated learning, as one of the paradigms of distributed machine learning, has gradually attracted widespread attention. In federated learning, data does not need to be transferred; participants train their models locally and send the training results to the server, which aggregates the results submitted by all participants as a global model. Federated learning can achieve training results similar to centralized learning while protecting the data privacy of participants, solving the problem of data silos between different institutions. Since the concept of federated learning was first proposed in 2016, related research and applications have developed rapidly. Currently, mature federated learning systems have been applied in fields such as government affairs, healthcare, and finance.

[0003] While keeping training data locally protects participant privacy to some extent, numerous studies have shown that servers can launch inference attacks, recovering valid information from the data based on the models or gradients submitted by participants. Therefore, relying solely on the federated learning mechanism itself to protect sensitive data is insufficient. Currently, participants can choose cryptographically-based secure aggregation methods or differential privacy mechanisms to prevent the server from directly observing the initial values ​​of the submitted models or gradients. Furthermore, the federated learning system environment is complex, with a large number of participants and no identity authentication. Malicious attackers may attempt to disrupt the global model's convergence process, degrade its performance, or insert backdoors, performing data poisoning, model poisoning, or backdoor attacks. Currently, servers can employ anomaly detection techniques to remove updates submitted by potential attackers, aggregating only updates deemed non-malicious.

[0004] Typical federated learning scenarios aim to train a single overall model. However, when data is not independently and identically distributed, participants apply the model in different ways, and a single model cannot meet the individual needs of each participant. Therefore, personalized federated learning methods, designed to train different models for different participants, have been proposed, with multi-task learning being one representative approach. In personalized federated learning based on multi-task learning, each type of participant generates a model suitable for its local data distribution during training, with varying degrees of difference between models from different participant types. However, existing multi-task learning frameworks cannot effectively defend against attacks such as model poisoning and backdoor attacks while protecting the privacy of training data. Therefore, it is crucial to introduce privacy protection measures into multi-task learning and combine them with defenses suitable for personalized scenarios.

[0005] IV. Disadvantages of the prior art and the technical problem to be solved by the present invention

[0006] Existing personalized federated learning methods based on multi-task learning cannot simultaneously protect privacy and defend against attacks. Some studies have incorporated differential privacy mechanisms into participant training to address gradient leakage, but simply adding noise is insufficient to effectively defend against multiple attacks; the training process or the final model obtained by the participants remains vulnerable to attacker influence. Furthermore, some studies focus on the defensive effects of the personalized framework itself, or simply combine it with defensive measures in general federated learning scenarios, without considering the protection of training data privacy or the applicability of these defensive measures in multi-task learning. Summary of the Invention

[0007] To address the aforementioned issues, this invention provides a privacy-preserving and robust personalized image recognition method based on federated learning. This method protects the privacy of training data while defending against various attacks such as data poisoning and model poisoning, thereby improving system operating efficiency and reducing system maintenance costs.

[0008] A privacy-preserving and robust personalized image recognition method based on federated learning is proposed, in which each participant uses a local image recognition model to perform personalized recognition on images; wherein the training method of each participant's local image recognition model includes the following steps:

[0009] S1: The central server sends the initialized global image recognition model to each participant; wherein, each participant's local training set contains the same number of image samples, and each image sample corresponds to a label. The number of label categories corresponding to the image samples contained by all participants is N. The label categories corresponding to the image samples contained by each participant are not completely the same, and the number of label categories corresponding to the image samples contained by each participant does not exceed N / 2.

[0010] S2: Determine if this is the first iteration. If yes, calculate the average gradient of each participant based on their local training set. If not, each participant updates its local image recognition model using a stochastic gradient descent algorithm with differential privacy; otherwise, each participant updates its model based on the average gradient of its local training set. The model parameters θ of the global model for image recognition g The fused gradient is obtained, and then a stochastic gradient descent algorithm with differential privacy is executed based on the fused gradient to update the local image recognition model; wherein, the local image recognition model has the same structure as the global image recognition model;

[0011] S3: Each participant obtains its own updated local image recognition model parameters θ. l The model parameters θ of the global model for image recognition g The difference M between k =θ l -θ g Where k = 1, 2, ..., K, and K is the number of participants;

[0012] S4: The difference M between each participant on the central server. k Calculate a score k The K-means clustering algorithm was used to analyze all scores. k Perform binary classification;

[0013] S5: Get all differences M in categories that contain more scores k average and average With model parameters θ g The sum of these values ​​serves as the model parameters for the global image recognition model in the next round.

[0014] S6: Determine whether the current iteration count has reached the upper limit. If yes, obtain the final local image recognition model for each participant. If no, send the global image recognition model obtained in step S5 to each participant, and then re-execute steps S2 to S6.

[0015] Furthermore, the average gradient of the local training set of any participant in step S2 The specific calculation method is as follows:

[0016] S21: For each image sample x i The resulting gradient g(x) i Perform clipping to obtain the clipped gradient.

[0017]

[0018] Where C is the maximum 2 norm of the gradient of a single image sample, and ||·||2 represents the calculation of the 2 norm;

[0019] S22: From Gaussian distribution The noise is sampled and summed with the cropped gradient to obtain the average gradient of the image samples contained in the local training set.

[0020]

[0021] Where L is the number of image samples contained in the local training set, and σ is the expression that satisfies the inequality The auxiliary variables are δ, which is the probability of differential privacy, ε, which is the privacy budget of differential privacy, and I, which is the identity matrix.

[0022] Furthermore, in step S4, the difference M for any participant k k The corresponding score k The calculation method is as follows:

[0023] S41: Assume the difference M corresponding to participant k. k =[m k,1 ,m k,2 ,…,m k,n ], where m k,1 ~m k,n Let θ be the difference between the parameters in the model parameters corresponding to participant k, and n be the model parameter θ. l The number of parameters included;

[0024] S42: Obtain the Euclidean distance dis between participant k and the other participants. k,j :

[0025]

[0026] Wherein, the difference M corresponding to participant j j =[m j,1 ,m j,2 ,…,m j,n ], m j,1 ~m j,n The difference between the parameters in the model parameters corresponding to participant k;

[0027] S43: Distance the Euclidean distance between participant k and all participants. k,j The sum of the values ​​is used as the difference M between participants k. k The corresponding score k .

[0028] Furthermore, the method for calculating the fusion gradient of any participant in step S2 is as follows:

[0029]

[0030] in, For participant k, the fusion gradient is... Let λ be the average gradient corresponding to participant k, λ be the weight, and θ be the average gradient. l [k] represents the model parameters of the local image recognition model corresponding to participant k.

[0031] Furthermore, in step S4, the K-means clustering algorithm is used to analyze all scores. k The specific method for binary classification is as follows:

[0032] S4a: Randomly select two scores as the initial centroids c1 and c2 of the two clusters;

[0033] S4b: Calculate each score individually. k Distance d between the initial centroid c1 and the initial centroid c1 k,1 The distance d between the initial centroid c2 and the initial centroid c2 k,2 :

[0034] d k,1 =score k -c1|

[0035] d k,2 =|score k -c2|

[0036] S4c: For each score k Compare its corresponding d k,1 and d k,2 and score each k Assign them to clusters with smaller distances to complete the current binary classification;

[0037] S4d: Determine whether the current binary classification result is the same as the binary classification result obtained in the previous iteration. If yes, complete the binary classification; otherwise, proceed to step S4e.

[0038] S4e: Get the average score of the two clusters in the current binary classification, and use the two average scores as the centroids of the two clusters;

[0039] S4f: Repeat steps S4b to S4d based on the new centroids of the two clusters until the binary classification is completed.

[0040] Beneficial effects:

[0041] This invention provides a privacy-preserving and robust personalized image recognition method based on federated learning. First, it employs a differential privacy mechanism to protect user privacy. Compared to homomorphic encryption and secure multi-party computation, this method eliminates the need for key distribution or user access control, improving system efficiency and reducing maintenance costs. Second, unlike existing frameworks that only focus on privacy or poisoning attacks without simultaneously considering both, this invention protects user privacy and defends against potential attacks in personalized federated learning. In summary, this invention is a personalized image recognition method based on average regularized multi-task learning. It protects training data privacy while defending against various attacks such as data poisoning and model poisoning. The central server applying this rule can effectively filter out potential attackers who make up less than 50% of the total. Attached Figure Description

[0042] Figure 1 This is a framework diagram of a privacy-preserving and robust personalized image recognition method based on federated learning, which is provided by the present invention. Detailed Implementation

[0043] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0044] To protect the privacy of participants' training data and prevent attackers from influencing the training process in personalized federated learning of image recognition network models, this invention proposes a privacy-preserving and robust personalized image recognition method based on average regularized multi-task learning. The framework consists of two roles: learning participants and servers. To avoid leakage of image privacy information, participants execute a stochastic gradient descent algorithm with differential privacy during training. After local training is complete, they submit model parameters to a semi-honest server. The server executes a robust aggregation method, filters out potential malicious updates according to specific criteria, calculates a new global model, and sends the results to all participants.

[0045] like Figure 1 As shown, a privacy-preserving and robust personalized image recognition method based on federated learning is characterized in that each participant uses a local image recognition model to perform personalized recognition of images; wherein, the training method of each participant's local image recognition model includes the following steps:

[0046] S1: The central server sends the initialized global image recognition model to each participant; wherein, each participant's local training set contains the same number of image samples, and each image sample corresponds to a label. The number of label categories corresponding to the image samples contained by all participants is N. The label categories corresponding to the image samples contained by each participant are not completely the same, and the number of label categories corresponding to the image samples contained by each participant does not exceed N / 2.

[0047] It should be noted that the federated learning system of the present invention includes multiple participants and a central server; during initialization, it is necessary to negotiate the specific image recognition task for this training, the image recognition model used, the criteria for stopping training, the differential privacy parameters ε and δ of the participants, the maximum 2 norm C of the gradient of a single sample, the personalization parameter λ, the learning rate η, and other hyperparameters.

[0048] S2: Determine if this is the first iteration. If yes, calculate the average gradient of each participant based on their local training set. If not, each participant updates its local image recognition model using a stochastic gradient descent algorithm with differential privacy; otherwise, each participant updates its model based on the average gradient of its local training set. The model parameters θ of the global model for image recognition g The fused gradient is obtained, and then a stochastic gradient descent algorithm with differential privacy is executed based on the fused gradient to update the local image recognition model; wherein, the local image recognition model has the same structure as the global image recognition model;

[0049] Specifically, the average gradient of any participant's local training set. The specific calculation method is as follows:

[0050] S21: For each image sample x i The resulting gradient g(x) i Perform clipping to obtain the clipped gradient.

[0051]

[0052] Where C is the maximum 2 norm of the gradient of a single image sample, and ||·||2 represents the calculation of the 2 norm;

[0053] S22: From Gaussian distribution The noise is sampled and summed with the cropped gradient to obtain the average gradient of the image samples contained in the local training set.

[0054]

[0055] Where L is the number of image samples contained in the local training set, and σ is the expression that satisfies the inequality The auxiliary variables are δ, which is the probability of differential privacy, ε, which is the privacy budget of differential privacy, and I, which is the identity matrix.

[0056] Furthermore, the fusion gradient of any participant is calculated as follows:

[0057]

[0058] in, For participant k, the fusion gradient is... Let λ be the average gradient corresponding to participant k, λ be the weight, and θ be the average gradient. l [k] represents the model parameters of the local image recognition model corresponding to participant k.

[0059] In other words, based on the definition of differential privacy, this invention assumes that there are L image samples in a training batch, and for each image sample x in a batch... i The resulting gradient g(x) i The gradients of individual samples are cropped and noise-added. To protect information regarding whether a sample participated in training, noise is added to the gradients of each sample to blur the difference between that gradient and those generated by samples close to it. Participants crop the gradients of a batch of samples according to a specified maximum gradient norm C. The cropped gradients are... From Gaussian distribution The sampled noise is summed with the clipped gradient, and then the average gradient of the batch of samples is calculated. By definition, a differential privacy mechanism based on a Gaussian distribution, if applicable to a function with sensitivity C, then when... At that time, the mechanism satisfies (ε,δ)-differential privacy.

[0060] If this is the first round of federated learning, then completely local training will be conducted, with participants averaging gradients. Perform stochastic gradient descent to update the model parameters θ of the local model. l If it's not the first round, then the global model is meaningful at this point, and the model parameters θ of the local model need to be adjusted. l To the model parameters θ of the global model g Approximately; specifically, in the obtained image sample x i gradient In this case, we add the product of λ and the difference between this parameter and the corresponding parameter in the global model, i.e. Participants receive new gradients Then, perform stochastic gradient descent, i.e.

[0061] S3: Each participant obtains its own updated local image recognition model parameters θ. l The model parameters θ of the global model for image recognition g The difference M between k =θ l -θ g Where k = 1, 2, ..., K, and K is the number of participants;

[0062] S4: The difference M between each participant on the central server. k Calculate a score k The K-means clustering algorithm was used to analyze all scores. k Perform binary classification;

[0063] Furthermore, the difference M for any participant k k The corresponding score k The sum of the Euclidean distances between participant k and all other participants is calculated as follows:

[0064] S41: Assume the difference M corresponding to participant k. k =[m k,1 ,m k,2 ,...,m k,n ], where m k,1 ~m k,n Let θ be the difference between the parameters in the model parameters corresponding to participant k, and n be the model parameter θ. l The number of parameters included;

[0065] S42: Obtain the Euclidean distance dis between participant k and the other participants. k,j :

[0066]

[0067] Wherein, the difference M corresponding to participant j j =[m j,1 ,m j,2 ,…,m j,n ], m j,1 ~m j,n The difference between the parameters in the model parameters corresponding to participant k;

[0068] S43: Distance the Euclidean distance between participant k and all participants. k,j The sum of the values ​​is used as the difference M between participants k. k The corresponding score k =∑ j∈ Ndis k,j .

[0069] Furthermore, the K-means clustering algorithm was used to analyze all scores. k The specific method for binary classification is as follows:

[0070] S4a: Randomly select two scores as the initial centroids c1 and c2 of the two clusters;

[0071] S4b: Calculate each score separately. k Distance d between the initial centroid c1 and the initial centroid c1 k,1 The distance d between the initial centroid c2 and the initial centroid c2 k,2 :

[0072] d k,1 =|score k -c1|

[0073] d k,2 =|score k -c2|

[0074] S4c: For each score k Compare its corresponding d k,1 and d k,2 and score each k Assign them to clusters with smaller distances to complete the current binary classification;

[0075] In other words, for each score k Calculate the distance between it and the two centroids respectively, and assign the score to the cluster with the smaller distance from the centroid.

[0076] S4d: Determine whether the current binary classification result is the same as the binary classification result obtained in the previous iteration. If yes, complete the binary classification; otherwise, proceed to step S4e.

[0077] S4e: Obtain the average score of the two clusters in the current binary classification, and use the two averages as the centroids of the two clusters; assuming the number of scores in the two clusters are n1 and n2 respectively, then the new centroids...

[0078] S4f: Repeat steps S4b to S4d based on the new centroids of the two clusters until the binary classification is completed.

[0079] S5: Get all differences M in categories that contain more scores k average and average With model parameters θ g The sum of As the model parameters for the global image recognition model in the next round;

[0080] It should be noted that, considering that the proportion of attackers is generally no more than half of the total number of participants, the category with the larger number is selected for aggregation, and all updates of that category are averaged.

[0081] S6: Determine whether the current iteration count has reached the upper limit. If yes, obtain the final local image recognition model for each participant. If no, send the global image recognition model obtained in step S5 to each participant, and then re-execute steps S2 to S6.

[0082] The following example illustrates a privacy-preserving and robust personalized image recognition method based on federated learning, provided by this invention.

[0083] In this federation, participating parties can use devices such as mobile phones, tablets, and laptops. Ideally, both types of members are honest and curious (i.e., each party honestly adheres to the agreement but also attempts to glean additional information from the received data). Each participating party possesses a local training dataset for image recognition, which is part of the CIFAR-10 dataset. The CIFAR-10 dataset contains 50,000 training samples and 10,000 test samples. The samples consist of color images and labels; the images are 32×32 pixel matrices, and the labels represent 10 common object classes. To simulate a non-independent and identically distributed data distribution among participants, each participant is randomly assigned labels from 4 out of the 10 classes.

[0084] Furthermore, the system contains two types of attackers: passive attackers and active attackers. Passive attackers eavesdrop on the image recognition models sent to the server by federated participants, attempting to obtain useful information contained in other participants' images. Active attackers poison the image set or tamper with upcoming updates, attempting to disrupt the training process or insert backdoors into the global model to compromise other participants' local image recognition models. The number of active attackers generally does not exceed half of the federated participants.

[0085] If the privacy-preserving and robust personalized image recognition method based on average regularized multi-task learning proposed in this invention is implemented, it can simultaneously protect the data privacy of the participants and defend against potential attacks. Specifically, it includes the following sub-steps:

[0086] Step 1: Initialize the federated learning training system.

[0087] Step 1.1: Determine the training task as CIFAR10 image classification, the model used as a simple neural network ConvNet, and the criterion for stopping training as the number of federated learning rounds reaches 200, the participants' differential privacy parameters ε = 15, δ = 0.001, the maximum 2 norm of the gradient of a single sample C = 2, the personalization parameter λ = 0.25, the learning rate η = 0.1, and other hyperparameters.

[0088] Step 1.2: Import and distribute the dataset using the PyTorch machine learning library, and build a federated learning system with 50 participants and 1 server. All participants and the server initialize local or global neural network models.

[0089] Step 1.3: The server sends the initialized global model to all participants.

[0090] Step 2: Participants conduct local training.

[0091] Step 2.1: According to the definition of differential privacy, a training batch contains L = 16 samples. For each sample x in a batch... i The resulting gradient g(x) i The participants performed cropping and noise addition. They cropped the gradients generated from a batch of samples according to the maximum norm C = 2 specified in step 1. The cropped gradients were then... From Gaussian distribution The sampled noise is summed with the clipped gradient, and then the average gradient of the batch of samples is calculated. This mechanism satisfies (15, 0.001)-differential privacy. To accelerate the gradient clipping and noise addition process for each sample, the Opacus library is used to process a single batch of samples. The Opacus library utilizes tensor hooks provided by the PyTorch library to vectorize the clipping and noise addition process, thereby improving the speed of DP-SGD.

[0092] Step 2.2: If it is the first round of federated learning, perform fully local training, and participants use the average gradient obtained in Step 2.1 to execute the stochastic gradient descent algorithm; if it is not the first round, adjust the local parameter θ. l To the global model θ g Approximately. Specifically, the gradient of a certain parameter i obtained in step 2.1. In this case, we add the product of λ and the difference between this parameter and the corresponding parameter in the global model, i.e. After the participants obtain the new gradient, they perform stochastic gradient descent, i.e.

[0093] Step 2.3: Repeat steps 2.1-2.2 until all samples have been trained once, then local training is complete.

[0094] Step 2.4: Participants calculate the difference M = θ between the parameters of the local model and the global model. l -θ g The value is then sent to the server.

[0095] Step 3: The server performs robust aggregation to filter out model updates submitted by potential attackers.

[0096] Potential attackers may attempt data poisoning or model poisoning attacks. In random update attacks, attackers submit random numbers with the same dimensions as the model, attempting to reduce the accuracy of other participants' local models or disrupt their model convergence process. In update boosting attacks, attackers amplify the differences between the calculated models by a factor of several, such as 6, causing the overall model to shift towards the local model. In grid backdoor attacks, attackers change the bottom right 3×3 pixel grid of samples to a fixed black and white mode during training and set the labels of such samples to fixed values. The aim is to insert a backdoor into the local models of other participants, hoping that when images containing this mode are input into their local models, the models will also classify them as the target label. In edge backdoor attacks, attackers insert samples that are few or zero in number from other participants' training data into their local training set and assign them fixed labels. The aim is to insert a backdoor into the local models of other participants, hoping that when such rare images are input into their local models, the models will also classify them as the target label.

[0097] Step 3.1: The server receives all updates M uploaded by N=50 participants. i Then, a score is calculated for each participant. i Specifically, the local model parameters M trained by participant i i =[m i,1 ,m i,2 ,...,m i,n The local model parameters M trained by participant j j =[m j,1 ,m j,2 ,…,m j,n ], all have n dimensions. M i and M j The formula for calculating the Euclidean distance is: Then the score of participant i i =∑j∈{1…50} dis i,j .

[0098] Step 3.2: The server filters out and aggregates updates that are not malicious. Specifically, the server performs unsupervised K-means binary classification on all scores, using the K-means class from the cluster package in the scikit-learn library. Considering that the proportion of attackers generally does not exceed half of the total number of participants, the class with the larger number of participants is selected for aggregation, and all updates from that class are averaged.

[0099] Step 3.3: The server updates the average obtained in step 3.2. Adding the global model from the previous round to obtain the new global model, i.e. The results are sent to all participants.

[0100] Step 4: Repeat steps 2-3 until the number of training rounds reaches 200.

[0101] Since the applicable scenario is personalized federated learning, the data distribution of each participant's test set is similar to that of the training set, but the test sets differ among participants. Therefore, during testing, the average test accuracy of all participants is used as the standard for measuring the framework's performance. Furthermore, in the two backdoor attacks, a backdoor attack test set is assigned to non-attacker participants. The samples in the test set contain backdoors that trigger the attack, and the average test accuracy of all participants' backdoor attack test sets is used as the standard for measuring the backdoor attack success rate. Specific experimental results are shown in Tables 1 and 2. When testing the effectiveness of backdoor attacks, existing work is followed, and the more complex model structure ResNet18 is used. Note that in the grid backdoor attack, introducing differential privacy mechanisms only during training is sufficient to reduce the attack success rate to an ideal range.

[0102] Table 1. Defense effect of the proposed method against model poisoning attacks.

[0103]

[0104] Table 2. Defense effectiveness of the proposed method against backdoor attacks.

[0105]

[0106] Therefore, this invention provides a privacy-preserving and robust personalized image recognition method based on federated learning. It is a personalized image recognition method based on average regularized multi-task learning. While introducing differential privacy to protect data in a type of multi-task learning, it adopts defense methods suitable for this scenario to effectively resist various attacks. It can improve the robustness of personalized image recognition while protecting the privacy of federated learning participants.

[0107] Of course, the present invention may have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.

Claims

1. A privacy-preserving and robust personalized image recognition method based on federated learning, characterized in that, Each participant adopts an image recognition local model to perform personalized recognition on images; wherein the training method of the image recognition local model of each participant comprises the following steps: S1: the center server sends the initialized image recognition global model to each participant; wherein the image sample number contained in the local training set of each participant is the same, each image sample corresponds to a label, the label category number corresponding to all image samples contained by the participants is N, the label category corresponding to the image samples contained by each participant is not completely the same, and the label category number corresponding to the image samples contained by each participant does not exceed N / 2; S2: judging whether it is the first round iteration, if yes, each participant updates the image recognition local model based on the average gradient of the local training set executes the random gradient descent algorithm with differential privacy to update the image recognition local model of itself; if no, each participant updates the image recognition local model based on the average gradient of the local training set the model parameters θ of the image recognition global model g obtains the fusion gradient, and then executes the random gradient descent algorithm with differential privacy based on the fusion gradient to update the image recognition local model of itself; wherein the image recognition local model has the same structure as the image recognition global model; S3: Each participant respectively acquires the model parameters θ of the updated image recognition local model of itself l and the model parameters θ of the image recognition global model g between them M k = θ l - θ g , wherein k = 1, 2, …, K, and K is the number of participants. S4: the center server calculates the difference M of each participant k Calculate a score score k And use the K-means clustering algorithm to classify all scores score k into two categories; S5: Obtain all the differences M in the category containing more scores k of the average value and the sum value of the average value and the model parameters θ g as the model parameters of the image recognition global model in the next round; S6: whether the current iteration number reaches the upper limit is judged, if yes, the final image recognition local model of each participant is obtained, if no, the image recognition global model obtained in step S5 is sent to each participant, and then steps S2-S6 are executed again.

2. The federated learning based privacy-preserving and robust personalized image recognition method of claim 1, wherein, the average gradient of the local training set of any one participant in step S2 The calculation method is specifically: S21 : clipping the generated gradient g(x i i ​​ Wherein, C is the maximum two-norm of a single image sample gradient, ||·||2 represents calculating two-norm; S22: Sample noise from a Gaussian distribution S22: Sample noise from a Gaussian distribution Wherein, L is the number of image samples contained in the local training set, σ is the auxiliary variable satisfying the inequality , δ is the probability of differential privacy, ε is the privacy budget of differential privacy, and I is the unit matrix.

3. The federated learning based privacy-preserving and robust personalized image recognition method of claim 1, wherein, The difference M of any one participant k in step S4 k The corresponding score score k The calculation method is: S41: Assuming that the difference value M corresponding to the participant k k = [m k,1 ,m k,2 ,...,m k,n ], wherein m k,1 ~m k,n is the difference value of each parameter contained in the model parameter corresponding to the participant k, and n is the number of parameters contained in the model parameter θ l . S42: Obtain the Euclidean distance dis of participant k with the rest of the participants k,j : wherein the difference value M corresponding to the participant j j = [m j,1 ,m j,2 ,…,m j,n ], m j,1 ~ m j,n is the difference value of each parameter contained in the model parameter corresponding to the participant k; S43: Calculate the Euclidean distance dis of participant k with all participants k,j the sum of the values as the difference M of participant k k the corresponding score score k .

4. The federated learning based privacy-preserving and robust personalized image recognition method of claim 1, wherein, The calculation method of the fusion gradient of any one participant in step S2 is: wherein, is the fusion gradient corresponding to participant k, is the average gradient corresponding to participant k, λ is a set weight, θ l [k] is the model parameter of the image recognition local model corresponding to participant k.

5. The federated learning based privacy-preserving and robust personalized image recognition method of claim 1, wherein, In step S4, the K-means clustering algorithm is used to classify all scores score k The method of binary classification is specifically: S4a: randomly selecting two scores as the starting centroids c1 and c2 of two clusters; S4b: Calculate each score scorei separately k distance d between the start centroid c1 k,1 distance d between the start centroid c2 k,2 : d k,1 = | score k - cl | d k,2 = | score k - c2| S4c: For each score score k , compare it to its corresponding d k,1 , and d k,2 , and divide each score score k into a cluster with a smaller distance, complete the current binary classification; S4d: whether the current obtained two-classification result is the same as the two-classification result obtained in the last iteration is judged, if yes, the two-classification is completed, if no, step S4e is entered; S4e: the average values of the scores contained in the two clusters of the current two-classification are obtained, and the two average values are taken as the centroids of the two clusters; S4f: steps S4b-S4d are repeatedly executed based on the new centroids of the two clusters until the two-classification is completed.

Images