Federal learning malicious participant detection method and system based on statistical control

Abstract

The invention discloses a method and a system for detecting a federal learning malicious participant based on statistical control. The method comprises the following steps: S1, a server sends a training task and an initialization model parameter to the participant; s2, a participant downloads the current global model, carries out local training, obtains a local model and uploads the local model; s3, the server receives the local models and aggregates the local models to obtain a new global model; s4, when the federal learning round is smaller than Tg, the server calculates the Euclidean distance square from the parameter vector of the uploaded model to the global model, models all distance values, and selects honest participants to perform model aggregation; s5, when the round is equal to Tg, the server constructs a control limit; s6, when the round is larger than Tg, the server calculates the distance between the model uploaded by the participants and the global model, and the malicious participants and honest participants are distinguished through the control limit; s7, the server aggregates the models of honest participants to obtain a new global model, and sends the new global model to all participants; and S8, returning to S2 until a preset target is reached.

Description

Technical Field

[0001] The present invention belongs to the technical field of federated learning and distributed machine learning security, and specifically relates to a method and system for detecting malicious participants in federated learning based on statistical control. Background Art

[0002] Machine learning technology plays an increasingly important role in digital transformation and is widely used in all aspects of production and life. However, the traditional machine learning paradigm represented by deep learning is highly dependent on large-scale, centralized data sets for model training, which is in sharp contrast to the current status of data distribution in the real world. At present, data is fragmented and small-scale, especially in data-intensive industries such as banks and governments. Due to the particularity of their business, user data often contains highly sensitive personal information. For the sake of data security and privacy protection, these data are strictly restricted within the institution and are difficult to share and aggregate across institutions. This data barrier leads to a limited amount of data available to a single institution, which directly restricts the training effect of machine learning models and hinders the further development of related technologies. At the same time, with the increasing attention paid by society to data privacy and personal information security, and the introduction of a series of data regulatory laws and regulations such as the General Data Protection Regulations (GDPR), the threshold for data collection, storage and use has been continuously raised, further exacerbating the difficulty of data acquisition and utilization, and ultimately forming the so-called "data island" phenomenon. The existence of data islands has seriously restricted the application potential of machine learning and artificial intelligence technologies and has become a major challenge on their development path.

[0003] As a distributed machine learning framework, federated learning allows multiple participants to collaboratively train a global model without sharing local data. The core idea is that each participant uses local data to train a local model and uploads the model parameters to a central server for aggregation. The server integrates the parameters of all parties to update the global model, and iterates until the model converges. This "data available but invisible" model can not only make full use of decentralized data resources to improve model performance, but also effectively protect the data security and privacy of each participant. However, the distributed characteristics and data isolation mechanism of the federated learning system also expose it to potential security risks, such as poisoning attacks by malicious participants. Since the server cannot directly access the local data of the participants, it is difficult to effectively judge the reliability of the uploaded parameters. Once the attacker maliciously manipulates the local model training process or uploads incorrect parameters, the performance of the global model will be seriously affected, and even the model will fail. Therefore, how to effectively resist poisoning attacks and improve the robustness of the federated learning system under the premise of ensuring data privacy and security has become a key issue to be solved in this field.

[0004] The poisoning attacks faced by federated learning systems are mainly divided into two categories: model poisoning attacks and data poisoning attacks. Model poisoning attacks refer to malicious participants tampering with local model parameters, such as injecting random noise or carefully designed deviations, and uploading incorrect model updates to the server, thereby polluting global model parameters and causing them to deviate from the normal training track. This type of attack is relatively direct, with obvious traces of attack and easy to be identified by detection algorithms. Data poisoning attacks are more covert. The attacker does not directly modify the model parameters, but indirectly affects the update of local model parameters by polluting local training data, such as injecting wrong labels or adding abnormal samples. Since the changes in model parameters caused by data poisoning attacks are relatively small and lack obvious attack patterns, they are more difficult to detect and defend. Whether it is model poisoning or data poisoning, the ultimate goal is to destroy the performance of the global model, causing it to make incorrect predictions for a large number of samples during the testing phase, or even cause model training failure. However, the decentralized nature of federated learning and the data privacy protection mechanism make it impossible for the server to directly verify the quality of the data of the participants, which brings great challenges to identifying and screening malicious participants. Therefore, how to effectively identify and eliminate low-quality or malicious participants while ensuring data privacy has become a key issue in ensuring the security and reliability of the federated learning system. Summary of the invention

[0005] In order to solve the security problems faced by existing federated learning technologies, the present invention provides a method and system for detecting malicious participants in federated learning based on statistical control. The present invention solves the problem of poisoning by malicious participants encountered in federated learning through statistical inspection and control methods, and realizes high-quality model training.

[0006] In order to achieve the above purpose, the present invention adopts the following technical solutions: A method for detecting malicious participants in federated learning based on statistical control, characterized by comprising the following steps: S1: The server sends training tasks and initialized model parameters to all participants, including honest participants and malicious participants; S2: Each participant downloads the global model of the current round from the server, and uses the local data set for local training to obtain the local model, and then uploads the local model parameters to the server; S3: The server receives the local models uploaded by the participants and aggregates the models through the federated averaging algorithm to obtain a new round of initial global models; S4: When the number of federated learning rounds is less than When , the server calculates the square of the Euclidean distance between the parameter vector of the model uploaded by each participant and the global model, and uses the Gaussian mixture model to model all distance values. It distinguishes honest participants from malicious participants based on the posterior probability of the distance value corresponding to each participant and the characteristics of different Gaussian distributions, and selects honest participants for model aggregation; among them, Indicates the set communication round; S5: When the federated learning round is equal to When , the server constructs control limits based on the historical standard distance data of all parties previously judged to be honest; S6: When the number of federated learning rounds is greater than When , the server calculates the distance between the model uploaded by the participant and the global model, and judges the anomaly through the control limit to distinguish malicious participants from honest participants; S7: The server executes the federated average algorithm to aggregate the models uploaded by honest participants to obtain a new round of global models, and sends the global model to all participants; S8: Repeat steps S2 to S7 until the global model reaches a preset target or the federated learning reaches a predetermined round.

[0007] Furthermore, in step S2, the participants perform local training, and the training algorithm of the local model is: ; in, For the Participants of Federated Learning The local model parameters, For the The global model parameters of the wheel, For participants The learning rate, For participants The local dataset, is the gradient formula of the loss function.

[0008] Furthermore, in step S3, the server receives the models uploaded by the participants and aggregates the models through the federated average algorithm to obtain a new round of initial global models. The federated average algorithm used for global model aggregation is: ; in, For the The global model parameters of the wheel, For participants The amount of data you have, is the total amount of data owned by all participants, is the total number of participants.

[0009] Further, step S4 includes the following steps: S41: The server calculates the square of the Euclidean distance between each local model and the global model. The calculation formula is: ; in, For the participants The local model parameters, are global model parameters, For the participants The distance between the uploaded model and the global model, For the participants Upload the model parameter vector The difference between the dimension element and the corresponding global model parameter, is the total number of dimensions of model parameters; S42: The server uses a Gaussian mixture model to model all distance values, and the joint probability density of each distance value is: ; in, is the distance value, is the ratio of honest participants to malicious participants to be estimated, is the participant category, are the two types of Gaussian distribution parameters to be estimated, represents the probability density function of the distance value for a given mean and variance, For all parameters to be estimated , , A collection of; gather The maximum likelihood method is used to estimate The log-likelihood function of is expressed as: ; in, Indicates distance value The probability density value in the entire Gaussian mixture model, Indicates distance value In the The probability density value in the Gaussian sub-model; Introducing representative participants Distance value Belongs to a type of distribution Hidden variables of probability , then formula (5) can be written as: ; S43: The server executes the EM algorithm to solve the optimal parameters , according to the Bayesian formula, It is expressed as: ; The expected function of the log-likelihood function is: ; By solving The optimal solution , the update formula of Gaussian mixture model parameters is obtained as: ; ; ; The server sets a threshold greater than 0 And initialize the posterior probability In each iteration, firstly according to the parameters of the previous round , calculate the posterior probability of the current round through formula (9) , and then update the weights, means and variances of each sub-model of the Gaussian mixture model according to formula (10) and formula (11) to obtain , iterate the parameter update process until the convergence condition is met ;in, Indicates the number of EM algorithm iterations; S44: The server calculates the probability that each distance value belongs to a Gaussian distribution. , classify the distance values. Assume that the number of malicious participants is always less than that of honest participants. Therefore, the server marks the participants with a small number of samples in the Gaussian distribution as potential malicious participants, and the participants with a large number of samples as honest participants: ; in, is the set of honest participants, and are sample sets belonging to two types of Gaussian distributions, represents the sample size of the set; S45: The server standardizes the distance values ​​corresponding to the honest parties and saves them as historical data.

[0010] Furthermore, in step S5, when the federated learning round is equal to When the server constructs the participant's selection control limit , specifically: ; in, For historical distance data The mean of For historical distance data The standard deviation of .

[0011] Further, in step S6, when the number of federated learning training rounds is greater than In each round, the server calculates the distance between the model uploaded by the participant and the global model, and uses the control limit to determine anomalies and distinguish malicious participants from honest participants: ; in, Number the participants. is a collection of participants, Control limits constructed for step S5.

[0012] The present invention also discloses a federated learning malicious participant detection system based on statistical control, which is used to execute the above method and includes the following modules: Training task sending module: The server sends training tasks and initialized model parameters to all participants, including honest participants and malicious participants; Local training module: Each participant downloads the global model of the current round from the server, and uses the local data set for local training to obtain the local model, and then uploads the local model parameters to the server; Model aggregation module: The server receives the local models uploaded by the participants and aggregates the models through the federated averaging algorithm to obtain a new round of initial global models; Discriminant module: When the number of federated learning rounds is less than When , the server calculates the square of the Euclidean distance between the parameter vector of the model uploaded by each participant and the global model, and uses the Gaussian mixture model to model all distance values. It distinguishes honest participants from malicious participants based on the posterior probability of the distance value corresponding to each participant and the characteristics of different Gaussian distributions, and selects honest participants for model aggregation; among them, Indicates the set communication round; When the federated learning round is equal to When , the server constructs control limits based on the historical standard distance data of all parties previously judged to be honest; When the number of federated learning rounds is greater than When , the server calculates the distance between the model uploaded by the participant and the global model, and judges the anomaly through the control limit to distinguish malicious participants from honest participants; Honest Participant Model Aggregation Module: The server executes the federated average algorithm to aggregate the models uploaded by the honest participants to obtain a new round of global models, and sends the global model to all participants; Iteration module: The local training module, model aggregation module, discrimination module and honest participation model aggregation module are executed in sequence and repeated several times until the global model reaches the preset goal or the federated learning reaches the predetermined round.

[0013] Compared with the prior art, the present invention has the following beneficial effects: The present invention uses a Gaussian mixture model to statistically model the distance distribution between the participant model and the global model, and uses the idea of ​​a control chart to ensure the accuracy of identifying malicious participants (after testing, the identification accuracy is not less than 99.865%). The present invention can make full use of the historical training data of federated learning to construct control limits, avoid the honest participants being mistakenly identified as malicious participants due to data heterogeneity and other reasons, and ensure the integrity of the federated learning process while ensuring the accuracy of malicious participant identification. Therefore, the use of the present invention can effectively solve the problem of malicious participants in federated learning, which has very important practical significance for the deployment and implementation of federated learning in actual scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flowchart of a method for detecting malicious participants in federated learning based on statistical control in a preferred embodiment of the present invention; Figure 2 It is a schematic diagram of the present invention applying the statistical control principle; Figure 3 It is a block diagram of a federated learning malicious participant detection system based on statistical control according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0015] The present invention will be further described below in conjunction with the accompanying drawings and preferred embodiments. The specific embodiments and data described herein are only used to explain the present invention and are not used to limit the present invention.

[0016] This paper implements a method for detecting malicious participants in federated learning based on statistical control, such as Figure 1 As shown, compared with the traditional federated learning method, the present invention uses statistical testing and statistical control methods to select dynamic participants in each round. The specific steps are as follows: 1. The federated server sends training tasks and initialized model parameters to all participants, including honest and malicious participants; 2. Each participant downloads the global model of the current round from the server, and uses the local data set for local training to obtain the local model, and uploads the local model parameters to the server. The local model training algorithm is: ; in, For the Participants of Federated Learning The local model parameters, For the The global model parameters of the wheel, For participants The learning rate, For participants The local dataset, is the gradient formula of the loss function; 3. The server receives the local models uploaded by the participants and aggregates the models through the federated average algorithm to obtain a new round of initial global models. The federated average algorithm used for global model aggregation is: ; in, For the The global model parameters of the wheel, For the participants The amount of data you have, is the total amount of data owned by all participants, is the total number of participants; 4. When the number of federated learning rounds is less than When , the server calculates the square of the Euclidean distance between the parameter vector of the model uploaded by each participant and the global model, and uses the Gaussian mixture model to model all distance values. It distinguishes honest participants from malicious participants based on the posterior probability of the distance value corresponding to each participant and the characteristics of different Gaussian distributions, and selects honest participants for model aggregation; among them, It represents the set communication round, which can be regarded as a hyperparameter. The value is 50 in the experiment. This step is described in more detail as follows: 4-1. The server calculates the square of the Euclidean distance between each local model and the global model. The calculation formula is: ; in, For the participants The local model parameters, are global model parameters, For the participants The distance between the uploaded model and the global model, For the participants Upload the model parameter vector The difference between the dimension element and the corresponding global model parameter, is the total number of dimensions of model parameters; 4-2. The server uses a Gaussian mixture model to model all distance values, and the joint probability density of each distance value is: ; in, is the distance value, is the ratio of honest participants to malicious participants to be estimated, is the participant category, are the two types of Gaussian distribution parameters to be estimated, represents the probability density function of the distance value for a given mean and variance, For all parameters to be estimated , , A collection of; gather The maximum likelihood method is used to estimate The log-likelihood function of is expressed as: ; in, Indicates distance value The probability density value in the entire Gaussian mixture model, Indicates distance value In the The probability density value in the Gaussian sub-model; Introducing representative participants Distance value Belongs to a type of distribution Hidden variables of probability , then formula (5) can be written as: ; 4-3. The server executes the EM algorithm to solve the optimal parameters , according to the Bayesian formula, It is expressed as: ; The expected function of the log-likelihood function is: ; By solving The optimal solution , the update formula of Gaussian mixture model parameters is obtained as: ; ; ; The server sets a threshold greater than 0 And initialize the posterior probability In each iteration, firstly according to the parameters of the previous round , calculate the posterior probability of the current round through formula (9) , and then update the weights, means and variances of each sub-model of the Gaussian mixture model according to formula (10) and formula (11) to obtain , iterate the parameter update process until the convergence condition is met ;in, Indicates the number of EM algorithm iterations; 4-4. The server calculates the probability that each sample belongs to a certain Gaussian distribution Classify them, assuming that malicious participants are always in the minority, so the server marks the participants belonging to the Gaussian distribution with a small sample size as potential malicious participants, and the participants with a large sample size as honest participants: ; in, is the set of honest participants, and are sample sets belonging to two types of Gaussian distributions, represents the sample size of the set; 4-5. The server uses the z-score method to standardize the distance values ​​corresponding to the honest parties and saves them as historical data.

[0017] 5. When the number of federated learning rounds is equal to When the server constructs the participant's selection control limit , specifically: ; in, For historical distance data The mean of For historical distance data The standard deviation of .

[0018] 6. When the number of federated learning training rounds is greater than In each round, the server calculates the distance between the model uploaded by the participant and the global model, and uses the control limit to judge the anomaly and distinguish malicious participants from honest participants, such as Figure 2 As shown: ; in, Number the participants. is a collection of participants, The control limits constructed in step 5; specifically, the server identifies the participants corresponding to the distance values ​​greater than as malicious participants according to the control limit rules, and retains the participants within the control limit as honest participants for further model aggregation.

[0019] 7. The server executes the federated average algorithm to aggregate the models uploaded by honest participants to obtain a new round of global models, and sends the global model to all participants; 8. Repeat steps 2 to 7 until the global model achieves the expected effect or the federated learning reaches the predetermined number of rounds.

[0020] In order to facilitate the understanding and implementation of the present invention by those skilled in the art, the following is an illustration of the comparative experiment of the existing federated defense algorithm. In this example, federated learning under four attack scenarios is simulated, namely label flipping, sample poisoning, parameter noise (Gaussian-noise) and random parameters (random-weights). Label flipping is when the malicious party modifies the original label of the local data randomly or in a certain way, causing the training results to be abnormal; sample poisoning is when the malicious party adds noise to part of the local data set, and uses the contaminated data set for training and model upload; parameter noise is when the malicious party adds Gaussian noise to the local model parameters of each round of training, and uploads the damaged model for aggregation; random parameters are when the malicious party uploads randomly generated model parameters in each round to replace the real training model.

[0021] This example uses three datasets: MNIST, Fashion-MNIST (FMNIST), and CIFAR10 for experiments. MNIST is a dataset consisting of 1-10 grayscale images of handwritten digits, including 60,000 training samples and 10,000 test samples; FMNIST is a 10-category clothing grayscale image classification dataset, including 60,000 training samples and 10,000 test samples, using a convolutional neural network with 2 convolutional layers and one fully connected layer as the global model; CIFAR10 is a 10-category color image classification dataset, including 50,000 training samples and 10,000 test samples, using a convolutional neural network with 2 convolutional layers, 1 pooling layer, and 3 fully connected layers as the global model. Each dataset will be evenly divided among the participants, the number of participants is 100, of which the number of malicious participants is 20. Some parameter settings in the present invention are as follows: In step 4, ; In step 4-3, .

[0022] The model performance metric used in this example is global accuracy (ACC * ), ACC * It is the average accuracy of the global model on all labeled samples in the test set. FLGMM represents the method of the present invention. FedAvg, Multi-Krum, Median, TMean and RFA are all existing traditional federated learning algorithms or defense algorithms, and are presented as comparative methods. The performance comparison of the algorithms in the simulated attack scenario is shown in Table 1: Table 1 Algorithm performance comparison data table under simulated attack scenarios

[0023] It can be seen from Table 1 that under three data sets and four attack scenarios, the present invention realizes the selection of participants with high-quality data or models through statistical control, and effectively defends against various poisoning attacks by malicious participants. The accuracy of the global model is significantly higher than that of the existing algorithms.

[0024] like Figure 3 As described above, this embodiment discloses that the present invention also discloses a federated learning malicious participant detection system based on statistical control, which is used to execute the above method embodiment, including the following modules: Training task sending module: The server sends training tasks and initialized model parameters to all participants, including honest participants and malicious participants; Local training module: Each participant downloads the global model of the current round from the server, and uses the local data set for local training to obtain the local model, and then uploads the local model parameters to the server; Model aggregation module: The server receives the local models uploaded by the participants and aggregates the models through the federated averaging algorithm to obtain a new round of initial global models; Discriminant module: When the number of federated learning rounds is less than When , the server calculates the square of the Euclidean distance between the parameter vector of the model uploaded by each participant and the global model, and uses the Gaussian mixture model to model all distance values. It distinguishes honest participants from malicious participants based on the posterior probability of the distance value corresponding to each participant and the characteristics of different Gaussian distributions, and selects honest participants for model aggregation; among them, Indicates the set communication round; When the federated learning round is equal to When , the server constructs control limits based on the historical standard distance data of all parties previously judged to be honest; When the number of federated learning rounds is greater than When , the server calculates the distance between the model uploaded by the participant and the global model, and judges the anomaly through the control limit to distinguish malicious participants from honest participants; Honest Participant Model Aggregation Module: The server executes the federated average algorithm to aggregate the models uploaded by the honest participants to obtain a new round of global models, and sends the global model to all participants; Iteration module: The local training module, model aggregation module, discrimination module and honest participation model aggregation module are executed in sequence and repeated several times until the global model reaches the preset goal or the federated learning reaches the predetermined round.

[0025] For other contents of this embodiment, please refer to the above method embodiment.

[0026] In summary, in view of the shortcomings of the existing detection methods for malicious participants in federated learning, the present invention proposes a detection method and system based on statistical control. The core idea of ​​the present invention is to use the distance between the local model parameter vector of the participant and the global model parameter vector as an abnormal monitoring statistic. The model parameter update uploaded by the honest participant should be consistent with the change trend of the global model, while the parameter update uploaded by the malicious participant will deviate from the evolution direction of the global model. Therefore, the statistical control model can be used to characterize the distribution difference of the statistics of the honest participants and the malicious participants, and the control chart method can be used to identify abnormal behaviors. Specifically, the present invention first establishes a baseline distribution of the statistics of the honest participants based on historical training data, and sets reasonable control limits. In each round of federated learning training, the server calculates the distance from the model parameter vector of each participant to the global model parameter vector, and compares it with the control limit. If the statistics of a participant continue to exceed the control limit, it is considered that the participant has a malicious attack or low data quality problem, and it can be removed from the federated learning system, thereby ensuring the identification accuracy of the malicious participant. At the same time, the present invention can also ensure the integrity of the federated learning process.

[0027] The above description is only the specific implementation mode and effect of the present invention, but the protection scope of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for detecting malicious participants in federated learning based on statistical control, characterized in that: The steps include: S1: The server sends training tasks and initialized model parameters to all participants, including honest participants and malicious participants; S2: Each participant downloads the global model of the current round from the server, and uses the local data set for local training to obtain the local model, and then uploads the local model parameters to the server; S3: The server receives the local models uploaded by the participants and aggregates the models through the federated averaging algorithm to obtain a new round of initial global models; S4: When the federated learning round is less than When , the server calculates the square of the Euclidean distance between the parameter vector of the model uploaded by each participant and the global model, and uses the Gaussian mixture model to model all distance values. It distinguishes honest participants from malicious participants based on the posterior probability of the distance value corresponding to each participant and the characteristics of different Gaussian distributions, and selects honest participants for model aggregation; among them, Indicates the set communication round; S5: When the federated learning round is equal to When , the server constructs control limits based on the historical standard distance data of all parties previously judged to be honest; S6: When the number of federated learning rounds is greater than When , the server calculates the distance between the model uploaded by the participant and the global model, and judges the anomaly through the control limit to distinguish malicious participants from honest participants; S7: The server executes the federated average algorithm to aggregate the models uploaded by honest participants to obtain a new round of global models, and sends the global model to all participants; S8: Repeat steps S2 to S7 until the global model reaches a preset target or the federated learning reaches a predetermined round.

2. According to claim 1, a method for detecting malicious participants in federated learning based on statistical control is characterized in that: In step S2, the participants perform local training, and the training algorithm of the local model is: ； in, For the Participants of Federated Learning The local model parameters, For the The global model parameters of the wheel, For the participants The learning rate, For the participants The local dataset, is the gradient formula of the loss function.

3. According to claim 2, a method for detecting malicious participants in federated learning based on statistical control is characterized in that: In step S3, the federated average algorithm is specifically: ； in, For the The global model parameters of the wheel, For the participants The amount of data you have, is the total amount of data owned by all participants, is the total number of participants.

4. According to claim 3, a method for detecting malicious participants in federated learning based on statistical control is characterized in that: Step S4 includes the following steps: S41: The server calculates the square of the Euclidean distance between each local model and the global model. The calculation formula is: ； in, For the participants The local model parameters, is the global model parameter, For the participants The distance between the uploaded model and the global model, For the participants Upload the model parameter vector The difference between the dimension element and the corresponding global model parameter, is the total number of dimensions of model parameters; S42: The server uses a Gaussian mixture model to model all distance values, and the joint probability density of each distance value is: ； in, is the distance value, is the ratio of honest participants to malicious participants to be estimated, is the participant category, are the two types of Gaussian distribution parameters to be estimated, represents the probability density function of the distance value for a given mean and variance, For all parameters to be estimated , , A collection of; gather The maximum likelihood method is used to estimate The log-likelihood function of is expressed as: ； in, Indicates distance value The probability density value in the entire Gaussian mixture model, Indicates distance value In the The probability density value in the Gaussian sub-model; Introducing representative participants Distance value Belongs to a type of distribution Hidden variables of probability , then formula (5) can be written as: ； S43: The server executes the EM algorithm to solve the optimal parameters , according to the Bayesian formula, It is expressed as: ； The expected function of the log-likelihood function is: ； By solving The optimal solution , the update formula of Gaussian mixture model parameters is obtained as: ； ； ； The server sets a threshold greater than 0 And initialize the posterior probability In each iteration, firstly according to the parameters of the previous round , calculate the posterior probability of the current round through formula (9) , and then update the weights, means and variances of each sub-model of the Gaussian mixture model according to formula (10) and formula (11) to obtain , iterate the parameter update process until the convergence condition is met ;in, Indicates the number of EM algorithm iterations; S44: The server calculates the probability that each distance value belongs to a Gaussian distribution. , classify the distance values. Assume that the number of malicious participants is always less than that of honest participants. Therefore, the server marks the participants with a small number of samples in the Gaussian distribution as potential malicious participants, and the participants with a large number of samples as honest participants: ； in, is the set of honest participants, and are sample sets belonging to two types of Gaussian distributions, represents the sample size of the set; S45: The server standardizes the distance values ​​corresponding to the honest parties and saves them as historical data.

5. According to claim 4, a method for detecting malicious participants in federated learning based on statistical control is characterized in that: In step S5, when the federated learning round is equal to When the server constructs the participant's selection control limit , specifically: ； in, For historical distance data The mean of For historical distance data The standard deviation of .

6. A method for detecting malicious participants in federated learning based on statistical control according to claim 5, characterized in that: In step S6, when the number of federated learning training rounds is greater than When the service provider uses control limits to identify anomalies, specifically: ； in, Number the participants. is a collection of participants, Control limits constructed for step S5.

7. A federated learning malicious participant detection system based on statistical control, used to execute the method as claimed in any one of claims 1 to 6, characterized in that: Includes the following modules: Training task sending module: The server sends training tasks and initialized model parameters to all participants, including honest participants and malicious participants; Local training module: Each participant downloads the global model of the current round from the server, and uses the local data set for local training to obtain the local model, and then uploads the local model parameters to the server; Model aggregation module: The server receives the local models uploaded by the participants and aggregates the models through the federated averaging algorithm to obtain a new round of initial global models; Discriminant module: When the number of federated learning rounds is less than When , the server calculates the square of the Euclidean distance between the parameter vector of the model uploaded by each participant and the global model, and uses the Gaussian mixture model to model all distance values. It distinguishes honest participants from malicious participants based on the posterior probability of the distance value corresponding to each participant and the characteristics of different Gaussian distributions, and selects honest participants for model aggregation; among them, Indicates the set communication round; When the federated learning round is equal to When , the server constructs control limits based on the historical standard distance data of all parties previously judged to be honest; When the number of federated learning rounds is greater than When , the server calculates the distance between the model uploaded by the participant and the global model, and judges the anomaly through the control limit to distinguish malicious participants from honest participants; Honest Participant Model Aggregation Module: The server executes the federated average algorithm to aggregate the models uploaded by the honest participants to obtain a new round of global models, and sends the global model to all participants; Iteration module: The local training module, model aggregation module, discrimination module and honest participation model aggregation module are executed in sequence and repeated several times until the global model reaches the preset goal or the federated learning reaches the predetermined round.

Images