Poison defense method, device and equipment for federal learning, medium and product

Abstract

The embodiment of the invention provides a poisoning defense method, device and equipment for federal learning, a medium and a product, and relates to the technical field of network security. The method comprises the following steps: combining model update data uploaded by each client with client behavior data to obtain a multi-modal feature corresponding to each client; performing anomaly detection on the multi-modal features of each client to obtain an anomaly detection result; adjusting the trust score of each client based on the anomaly detection result to obtain an adjusted trust score; injecting adaptive noise into the target client with the adjusted trust score lower than a preset score to obtain a malicious client; and performing weighted aggregation on each client based on the adjusted trust score to obtain a global model. According to the invention, the security of the global model is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology. More specifically, the embodiments of the present invention relate to a poisoning defense method, device, equipment, medium and product for federated learning. Background Art

[0002] This section is intended to provide a background or context to embodiments of the invention that are recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] With the rapid development of information technology and the improvement of data privacy awareness, Federated Learning (FL), as a distributed machine learning framework, has attracted widespread attention and application because it can achieve multi-party collaborative training without sharing original data.

[0004] However, the decentralized nature of federated learning makes it vulnerable to malicious attacks, especially poisoning attacks, in which malicious clients upload forged model updates in an attempt to undermine the performance of the global model or even cause the model to make incorrect decisions, thereby threatening the security of the global model. Summary of the invention

[0005] In this context, embodiments of the present invention are intended to provide a poisoning defense method, apparatus, device, medium, and product for federated learning.

[0006] In a first aspect of an embodiment of the present invention, a poisoning defense method for federated learning is provided, the method comprising:

[0007] Combine the model update data uploaded by each client with the client behavior data to obtain the multimodal features corresponding to each client;

[0008] Perform anomaly detection on the multimodal features of each client to obtain anomaly detection results;

[0009] Adjusting the trust score of each client based on the anomaly detection result to obtain an adjusted trust score;

[0010] Injecting adaptive noise into the target client whose adjusted trust score is lower than the preset score to obtain a malicious client; wherein the adaptive noise is generated based on the anomaly detection result;

[0011] Based on the adjusted trust score, each client is weightedly aggregated to obtain a global model; wherein the each client includes the malicious client.

[0012] In an example of the present implementation, the model update data is update data after client training, and the client behavior data at least includes upload frequency and data sparsity information.

[0013] In one embodiment of this implementation, the multimodal feature is formed by:

[0014] v i (t) = [g i (t),b i (t)]

[0015] Among them, v i (t) represents the multimodal feature, g i (t) represents the model update data of client i at time t, b i (t) represents the client behavior data of client i at time t.

[0016] In one example of this implementation, the calculation formula for the adjusted trust score is:

[0017] T i (t+1)=T i (t)×(1-λ×α i (t))

[0018] Among them, T i (t+1) represents the adjusted trust score of client i, T i (t) represents the trust score of client i before adjustment, λ represents the adjustment coefficient, α i (t) represents the abnormality degree of client i at time t.

[0019] In one embodiment of this implementation, the formula for injecting adaptive noise into the target client is:

[0020] g noisy (t) = g test (t)+∈(t)×n(t);

[0021] Among them, g test (t) represents the malicious client, g test (t) represents the target client, ∈(t) represents the noise intensity coefficient of the adaptive noise, and n(t) represents the adaptive noise at time t.

[0022] In one embodiment of this implementation, performing weighted aggregation on each client based on the adjusted trust score to obtain a global model includes:

[0023] Determining a weight of each client based on the adjusted trust score;

[0024] The clients are weightedly aggregated based on the weights to obtain a global model.

[0025] In a second aspect of an embodiment of the present invention, a poisoning defense device for federated learning is provided, the device comprising:

[0026] A combining unit, used to combine the model update data uploaded by each client with the client behavior data to obtain multimodal features corresponding to each client;

[0027] A detection unit, used to perform anomaly detection on the multimodal features of each client to obtain anomaly detection results;

[0028] An adjustment unit, configured to adjust the trust score of each client based on the anomaly detection result to obtain an adjusted trust score;

[0029] An injection unit, configured to inject adaptive noise into a target client whose adjusted trust score is lower than a preset score, to obtain a malicious client; wherein the adaptive noise is generated based on the anomaly detection result;

[0030] An aggregation unit is used to perform weighted aggregation on each client based on the adjusted trust score to obtain a global model; wherein the each client includes the malicious client.

[0031] In a third aspect of an embodiment of the present invention, a computing device is provided, comprising: at least one processor, a memory, and an input-output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute any one of the methods described in the first aspect.

[0032] In a fourth aspect of the embodiments of the present invention, a computer-readable storage medium is provided, which includes instructions, and when the instructions are executed on a computer, the computer executes the method described in any one of the first aspects.

[0033] In a fifth aspect of the embodiments of the present invention, a computer program product is provided, comprising a computer program, which implements any one of the methods in the first aspect when executed by a processor.

[0034] According to the poisoning defense method, device, equipment, medium and product for federated learning of the embodiment of the present invention, the model update data uploaded by each client and the client behavior data are combined to obtain the multimodal features corresponding to each client; the multimodal features of each client are detected for anomalies to obtain anomaly detection results; the trust scores of each client are adjusted based on the anomaly detection results to obtain adjusted trust scores; adaptive noise is injected into the target client whose adjusted trust score is lower than the preset score to obtain a malicious client; weighted aggregation is performed on each client based on the adjusted trust score to obtain a global model; through multi-level defense mechanisms such as multimodal anomaly detection, adaptive trust management and noise injection, the present invention effectively improves the ability of the federated learning system to cope with complex poisoning attacks. Compared with the traditional single-dimensional anomaly detection method, the present invention can accurately detect malicious clients in more complex and data-sparse scenarios, and flexibly adjust the trust score and noise intensity, thereby improving the adaptability and robustness of the defense, and thus improving the security of the global model. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:

[0036] Figure 1 A flowchart of a poisoning defense method for federated learning provided by an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the structure of a poisoning defense device for federated learning provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of the structure of a medium according to an embodiment of the present invention is schematically shown;

[0039] Figure 4 A schematic diagram schematically shows the structure of a computing device according to an embodiment of the present invention;

[0040] Figure 5 The schematic diagram schematically shows the defense effect comparison between the poisoning defense method for federated learning of the embodiment of the present invention and the FLDetector method on ER@5 on the ML-100k dataset;

[0041] Figure 6 The figure schematically shows a comparison of the defense effects of the poisoning defense method for federated learning according to an embodiment of the present invention and the FLDetector method on ER@5 on the ML-1M dataset.

[0042] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0043] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0044] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0045] According to an embodiment of the present invention, a poisoning defense method, apparatus, device, medium and product for federated learning are proposed.

[0046] It should be noted that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any limiting meaning.

[0047] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0048] Exemplary Methods

[0049] Reference below Figure 1 , Figure 1 A flowchart of a poisoning defense method for federated learning provided by an embodiment of the present invention. It should be noted that the embodiments of the present invention can be applied to any applicable scenario.

[0050] Figure 1 The process of the poisoning defense method for federated learning provided by an embodiment of the present invention shown includes:

[0051] Step S101, combining the model update data and the client behavior data uploaded by each client to obtain the multimodal features corresponding to each client.

[0052] In an embodiment of the present invention, after the model is trained locally on the client, the client uploads the model update data to the central server and uploads the client behavior data at the same time. These uploaded client behavior data are combined with the model update data for subsequent detection of whether the client has abnormal behavior. The model update data is the updated data after the client is trained, and the client behavior data at least includes the upload frequency and data sparsity information. The client behavior data is used to represent the behavioral characteristics of the client user.

[0053] In addition, the model update data can be model gradient information, such as mean, variance, etc. Client behavior data can also include frequency, stability, etc. Model update data and client behavior data will be used as input basic data for subsequent anomaly detection to more comprehensively identify potential malicious behaviors.

[0054] In the embodiment of the present invention, the multimodal feature composition formula is:

[0055] v i (t) = [g i (t),b i (t)];

[0056] Among them, v i (t) represents the multimodal feature, g i (t) represents the model update data of client i at time t, such as gradient and other model update parameters, b i (t) represents the client behavior data (such as behavior characteristics, including data upload frequency or data sparsity) of client i at time t.

[0057] Step S102, performing anomaly detection on the multimodal features of each client to obtain anomaly detection results.

[0058] In the embodiment of the present invention, anomaly detection methods such as the Isolation Forest algorithm and the Local Outlier Factor (LOF) algorithm can be used to analyze multimodal features and identify potential malicious client behaviors. After constructing the comprehensive feature vector, a comprehensive anomaly degree calculation formula based on anomaly detection is designed to combine global and local anomaly detection results. The anomaly degree formula is:

[0059] α i (t) = ω1·f global (v i (t))+ω2·f local (v i (t))

[0060] Where: α i (t) is the abnormality of client i at time t, fglobal (v i (t)) represents the scoring result based on global anomaly detection (e.g., Isolation Forest), which identifies the degree of deviation of the client in the global data distribution, f local (v i (t)) represents the scoring result based on local anomaly detection (e.g., LOF), which is used to detect the abnormality of the client in the neighborhood. ω1 and ω2 are weight parameters that can be adjusted according to the historical behavior of the client to adapt to the dynamic attack environment.

[0061] This design specifically introduces an adaptive adjustment mechanism to dynamically adjust the values ​​of ω1 and ω2. According to the behavioral characteristics of the client, the system can adjust the weight in real time to prioritize the detection of global or local anomalies. For example, when the client upload frequency increases abnormally or the model update changes dramatically, the ω1 weight can be increased to make the global anomaly have a higher impact; when the data sparsity is high, more emphasis is placed on local anomaly detection.

[0062] At the same time, in order to ensure the comparability of the abnormality of different clients, we normalize the abnormality. The calculation formula is as follows:

[0063]

[0064] Among them, min(α) and max(α) represent the minimum and maximum values ​​of the abnormality of all clients, respectively. The normalized abnormality is used for trust score adjustment and subsequent noise injection to ensure the consistency and fairness of the score.

[0065] This anomaly calculation design effectively improves the recognition rate of malicious clients in a complex federated learning environment and provides strong support for the defense system.

[0066] Step S103: adjusting the trust score of each client based on the anomaly detection result to obtain an adjusted trust score.

[0067] In the embodiment of the present invention, if the anomaly detection result indicates that the client is abnormal, the client will be assigned a lower trust score, that is, the client is confirmed to be a malicious client, thereby weakening its influence on the global model. Correspondingly, the system will increase the trust score of normal clients whose anomaly detection results indicate that the client is not abnormal, so as to increase the weight ratio when the global model is updated, and ensure that the influence of malicious clients is minimized when the global model is updated.

[0068] In the embodiment of the present invention, the calculation formula of the adjusted trust score is:

[0069] T i (t+1)=T i (t)×(1-λ×αi (t));

[0070] Among them, T i (t+1) represents the adjusted trust score of client i, T i (t) represents the trust score of client i before adjustment, λ represents the adjustment coefficient, which controls the degree of change of the trust score, and α i (t) represents the degree of abnormality of client i at time t, which is usually determined based on the anomaly detection results.

[0071] Step S104, injecting adaptive noise into the target client whose adjusted trust score is lower than the preset score to obtain a malicious client.

[0072] In the embodiment of the present invention, the adaptive noise is generated based on the abnormality detection result.

[0073] In the embodiment of the present invention, in order to further weaken the damage of malicious clients to the global model, the system will introduce adaptive noise according to the detected malicious clients. During the model aggregation process, the system will dynamically inject disruptive adaptive noise for the detected abnormal behavior, and the noise intensity will be dynamically adjusted according to the trust score and the abnormal detection results. This measure can effectively disrupt the impact of malicious updates and protect the security and stability of the global model.

[0074] In the embodiment of the present invention, the formula for injecting adaptive noise into the target client is:

[0075] g noisy (t) = g test (t)+∈(t)×n(t)

[0076] Among them, g test (t) represents a malicious client (i.e., a noisy model update), g test (t) represents the target client (i.e., the model update without noise), ∈(t) represents the noise intensity coefficient of the adaptive noise, and n(t) represents the adaptive noise at time t.

[0077] Step S105 , performing weighted aggregation on each client based on the adjusted trust score to obtain a global model.

[0078] Implementation process of weighted aggregation: In each round of federated learning training, the system dynamically calculates the weight of each client in the model aggregation based on the updated trust score. The weight calculation formula is as follows:

[0079]

[0080] Among them, w i (t) is the weight of client i at time t.i (t) represents the trust score of client i at time t. N is the total number of clients. This process normalizes the trust score so that the sum of the weights is equal to 1. The client with a higher trust score has a larger weight, which ensures that high-trust clients contribute more to the global model, while the impact of malicious clients is effectively limited.

[0081] After obtaining the weight of each client, the system performs weighted aggregation on the model updates of all clients to generate a new global model. The specific formula is as follows:

[0082]

[0083] Among them, G(t+1) is the global model at time t+1. i (t) is the model update uploaded by client i at time t. i (t) is the weight of client i.

[0084] Through this weighted aggregation process, the proportion of the client's contribution to the global model can be flexibly adjusted according to the client's trust score, thereby effectively reducing the impact of malicious clients in model updates. This weighted aggregation mechanism ensures the robustness and stability of the system under different attack scenarios.

[0085] In the embodiment of the present invention, the various clients include the malicious client.

[0086] As an optional implementation, step S105 performs weighted aggregation on each client based on the adjusted trust score to obtain a global model, which may include:

[0087] Determining a weight of each client based on the adjusted trust score;

[0088] The clients are weightedly aggregated based on the weights to obtain a global model.

[0089] Please also read Figure 5 and Figure 6 , Figure 5 The schematic diagram schematically shows the defense effect comparison between the poisoning defense method for federated learning of the embodiment of the present invention and the FLDetector method on ER@5 on the ML-100k dataset; Figure 6 The figure schematically shows a comparison of the defense effects of the poisoning defense method for federated learning according to an embodiment of the present invention and the FLDetector method on ER@5 on the ML-1M dataset.

[0090] like Figure 5As shown, on the ML-100k dataset, the method of the present invention is used to detect model poisoning attacks by malicious clients. In the experiment, the effect of using the defense strategy of the present invention and the existing FLDetector defense mechanism are compared. It can be observed through the ER@5 indicator in the iterative training process that after using the defense strategy of the present invention, the proportion of malicious recommendations in the top 5 items in the recommendation list has dropped significantly. In the first 25 iterations, the proportion of malicious recommendations quickly dropped from close to 1.0 to about 0.1, and remained at a low level in subsequent iterations until it fluctuated slightly after the 150th iteration. In contrast, the proportion of malicious recommendations of FLDetector remained at a high level close to 1.0 throughout the iteration process. The experimental results show that the method of the present invention can effectively suppress malicious updates and prevent malicious recommendations from appearing on a large scale in the recommendation list, significantly improving the defense effect and system robustness.

[0091] like Figure 6 As shown, on the ML-1M dataset, the effectiveness of the method of the present invention is further verified for more complex and sparse data. The experimental results are shown in the figure, which shows the performance of the defense strategy in a sparse data environment. In the first 50 iterations, the defense strategy of the present invention successfully reduced the proportion of malicious recommendations from 1.0 to about 0.2. Although the proportion rebounded in subsequent iterations, it was always lower than 0.8, while FLDetector maintained the proportion of malicious recommendations close to 1.0 during the entire iteration process. This result shows that in scenarios with high data complexity and sparsity, the method of the present invention can still effectively suppress malicious updates and significantly reduce the proportion of malicious recommendations. The defense effect is better than that of traditional methods, which proves the robustness and flexibility of the method in complex scenarios.

[0092] It can be seen that on the recommendation system datasets such as ML-100k and ML-1M, the embodiments of the present invention have shown significant defense effects in experiments. Compared with traditional defense methods, the frequency of malicious recommendation items in the Top-N recommendation list has been significantly reduced, and the overall robustness and security of the system have been improved by more than 30%, proving the effectiveness of this method.

[0093] The embodiments of the present invention can enhance the ability to identify malicious clients: by introducing multimodal anomaly detection technology, the system can conduct a comprehensive analysis of the model updates and behavior data uploaded by the client, no longer relying on a single feature dimension, thereby greatly improving the accuracy of identifying malicious clients. Compared with traditional methods, the present invention can significantly reduce the risk of false positives and false negatives when dealing with scenarios with high data sparsity or complex client behavior, enabling the system to more accurately identify potential malicious clients.

[0094] The embodiment of the present invention uses a dynamic trust management mechanism: the adaptive trust management system in the present invention can dynamically adjust the trust score of the client according to its historical performance and current anomaly detection results. When faced with complex attack scenarios, the system can respond flexibly, weaken the impact of malicious clients on the global model, and enhance the flexibility and effectiveness of defense. By continuously adjusting the weight ratio of the client, the system can effectively suppress the impact of malicious clients and maintain the stability of the global model.

[0095] The embodiment of the present invention uses a flexible noise injection mechanism: During the global model aggregation process, the dynamic noise injection mechanism proposed by the present invention can flexibly adjust the noise injection intensity according to the attack intensity and model stability. This can effectively disrupt the forged model updates uploaded by malicious clients and ensure the security and robustness of the global model. Compared with the fixed noise injection method, the dynamic noise injection mechanism is more flexible and can adapt to attacks of different types and intensities, ensuring that the defense effect does not affect the model performance.

[0096] The embodiment of the present invention uses a multi-level defense framework: The present invention combines multimodal anomaly detection, adaptive trust management and dynamic noise injection technology to build a multi-level defense framework that can cope with various complex attack modes. Especially when dealing with high-sparse data scenarios and complex client behavior patterns, the framework can provide a stable defense effect and prevent malicious behavior from negatively affecting the global model.

[0097] The embodiments of the present invention can be adapted to multi-field applications: The multi-level poisoning defense method proposed in the present invention is particularly suitable for federated learning application scenarios in the fields of recommendation systems, finance, and medical care. In these fields, the sparsity and complexity of data are high, and traditional defense methods are difficult to deal with. The multi-level defense mechanism of the present invention can not only improve the security of the system, but also effectively reduce the damage to the system by malicious clients, and ensure the performance and stability of the global model.

[0098] The embodiments of the present invention can improve the security and robustness of the global model: through multi-modal anomaly detection, adaptive trust management and dynamic noise injection of the multi-level defense strategy, the present invention significantly enhances the robustness and security of the global model. In complex attack scenarios, the system can quickly identify and respond to forged updates uploaded by malicious clients, ensuring that the global model is not disturbed and maintaining the high accuracy and stability of the model.

[0099] The present invention can effectively improve the ability of the federated learning system to deal with complex poisoning attacks through multi-level defense mechanisms such as multimodal anomaly detection, adaptive trust management, and noise injection. Compared with the traditional single-dimensional anomaly detection method, the present invention can accurately detect malicious clients in more complex and data-sparse scenarios, and flexibly adjust the trust score and noise intensity, thereby improving the adaptability and robustness of the defense, and further improving the security of the global model.

[0100] Exemplary Devices

[0101] After introducing the method of the exemplary embodiment of the present invention, next, refer to Figure 2 A poisoning defense device for federated learning according to an exemplary embodiment of the present invention is described, and the device includes:

[0102] A combining unit 201 is used to combine the model update data uploaded by each client with the client behavior data to obtain multimodal features corresponding to each client;

[0103] In an embodiment of the present invention, the model update data is update data after client training, and the client behavior data at least includes upload frequency and data sparsity information.

[0104] In the embodiment of the present invention, the multimodal feature composition formula is:

[0105] v i (t) = [g i (t),b i (t)];

[0106] Among them, v i (t) represents the multimodal feature, g i (t) represents the model update data of client i at time t, b i (t) represents the client behavior data of client i at time t.

[0107] The detection unit 202 is used to perform anomaly detection on the multimodal features of each client to obtain anomaly detection results;

[0108] An adjusting unit 203, configured to adjust the trust score of each client based on the abnormality detection result to obtain an adjusted trust score;

[0109] In the embodiment of the present invention, the calculation formula of the adjusted trust score is:

[0110] T i (t+1)=T i (t)×(1-λ×α i (t));

[0111] Among them, T i (t+1) represents the adjusted trust score of client i, T i (t) represents the trust score of client i before adjustment, λ represents the adjustment coefficient, α i (t) represents the abnormality degree of client i at time t.

[0112] An injection unit 204 is used to inject adaptive noise into the target client whose adjusted trust score is lower than a preset score to obtain a malicious client; wherein the adaptive noise is generated based on the anomaly detection result;

[0113] In the embodiment of the present invention, the formula for injecting adaptive noise into the target client is:

[0114] g noisy (t) = g test (t)+∈(t)×n(t);

[0115] Among them, g test (t) represents the malicious client, g test (t) represents the target client, ∈(t) represents the noise intensity coefficient of the adaptive noise, and n(t) represents the adaptive noise at time t.

[0116] The aggregation unit 205 is used to perform weighted aggregation on each client based on the adjusted trust score to obtain a global model; wherein the clients include the malicious client.

[0117] As an optional implementation, the aggregation unit 205 performs weighted aggregation on each client based on the adjusted trust score to obtain the global model in the following manner:

[0118] Determining a weight of each client based on the adjusted trust score;

[0119] The clients are weightedly aggregated based on the weights to obtain a global model.

[0120] The present invention can effectively improve the ability of the federated learning system to deal with complex poisoning attacks through multi-level defense mechanisms such as multimodal anomaly detection, adaptive trust management, and noise injection. Compared with the traditional single-dimensional anomaly detection method, the present invention can accurately detect malicious clients in more complex and data-sparse scenarios, and flexibly adjust the trust score and noise intensity, thereby improving the adaptability and robustness of the defense, and further improving the security of the global model.

[0121] Exemplary Media

[0122] After introducing the method and apparatus of the exemplary embodiment of the present invention, next, reference is made to Figure 3 For a description of a computer-readable storage medium according to an exemplary embodiment of the present invention, please refer to Figure 3 , the computer-readable storage medium shown is a CD 30, on which a computer program (i.e., a program product) is stored. When the computer program is executed by the processor, the steps recorded in the above method implementation are implemented, for example, the model update data uploaded by each client and the client behavior data are combined to obtain the multimodal features corresponding to each client; anomaly detection is performed on the multimodal features of each client to obtain anomaly detection results; the trust score of each client is adjusted based on the anomaly detection results to obtain an adjusted trust score; adaptive noise is injected into the target client whose adjusted trust score is lower than the preset score to obtain a malicious client; weighted aggregation is performed on each client based on the adjusted trust score to obtain a global model; the specific implementation method of each step is not repeated here.

[0123] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0124] Exemplary Computing Devices

[0125] After introducing the method, apparatus and medium of the exemplary embodiments of the present invention, next, reference is made to Figure 4 A computing device for poisoning defense of federated learning according to an exemplary embodiment of the present invention.

[0126] Figure 4 A block diagram of an exemplary computing device 40 suitable for implementing embodiments of the present invention is shown, and the computing device 40 may be a computer system or a server. Figure 4 The computing device 40 shown is only an example and should not bring any limitation to the functionality and scope of use of the embodiments of the present invention.

[0127] like Figure 4 As shown, the components of the computing device 40 may include, but are not limited to: one or more processors or processing units 401, a system memory 402, and a bus 403 connecting different system components (including the system memory 402 and the processing unit 401).

[0128] The computing device 40 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computing device 40, including volatile and non-volatile media, removable and non-removable media.

[0129] System memory 402 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 4021 and / or cache memory 4022. Computing device 40 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, ROM 4023 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 is not shown in the Figure 4 As shown in FIG. 4 , a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 403 via one or more data medium interfaces. System memory 402 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of various embodiments of the present invention.

[0130] A program / utility 4025 having a set (at least one) of program modules 4024 may be stored, for example, in system memory 402, and such program modules 4024 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 4024 generally perform the functions and / or methods of the embodiments described herein.

[0131] The computing device 40 may also communicate with one or more external devices 404 (e.g., a keyboard, a pointing device, a display, etc.). Such communication may be performed via an input / output (I / O) interface 405. Furthermore, the computing device 40 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 406. Figure 4 As shown, the network adapter 406 communicates with other modules (such as the processing unit 401, etc.) of the computing device 40 via the bus 403. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with computing device 40 .

[0132] The processing unit 401 executes various functional applications and data processing by running the program stored in the system memory 402, for example, combining the model update data uploaded by each client with the client behavior data to obtain the multimodal features corresponding to each client; performing anomaly detection on the multimodal features of each client to obtain anomaly detection results; adjusting the trust score of each client based on the anomaly detection results to obtain an adjusted trust score; injecting adaptive noise into the target client whose adjusted trust score is lower than the preset score to obtain a malicious client; performing weighted aggregation on each client based on the adjusted trust score to obtain a global model. The specific implementation of each step is not repeated here. It should be noted that although several units / modules or sub-units / sub-modules of the poisoning defense device for federated learning are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units / modules described above can be concretized in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be concretized.

[0133] In the description of the present invention, it should be noted that the terms “first”, “second” and “third” are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0134] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0135] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0138] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0139] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

[0140] In addition, although the operations of the method of the present invention are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0141] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

Claims

1. A poisoning defense method for federated learning, characterized in that: The method comprises: Combine the model update data uploaded by each client with the client behavior data to obtain the multimodal features corresponding to each client; Perform anomaly detection on the multimodal features of each client to obtain anomaly detection results; Adjusting the trust score of each client based on the anomaly detection result to obtain an adjusted trust score; Injecting adaptive noise into the target client whose adjusted trust score is lower than the preset score to obtain a malicious client; wherein the adaptive noise is generated based on the anomaly detection result; Based on the adjusted trust score, each client is weightedly aggregated to obtain a global model; wherein the each client includes the malicious client.

2. The poisoning defense method for federated learning according to claim 1, characterized in that: The model update data is update data after client training, and the client behavior data at least includes upload frequency and data sparsity information.

3. The poisoning defense method for federated learning according to claim 1, characterized in that: The multimodal feature composition formula is: v i (t)=[g i (t),b i (t); Among them, v i (t) represents the multimodal feature, g i (t) represents the model update data of client i at time t, b i (t) represents the client behavior data of client i at time t.

4. The poisoning defense method for federated learning according to claim 1, characterized in that: The calculation formula of the adjusted trust score is: T i (t+1)=T i (t)×(1-λ×α i (t)); Among them, T i (t+1) represents the adjusted trust score of client i, T i (t) represents the trust score of client i before adjustment, λ represents the adjustment coefficient, α i (t) represents the abnormality degree of client i at time t.

5. The poisoning defense method for federated learning according to claim 1, characterized in that: The formula for injecting adaptive noise into the target client is: g noisy (t)=g test (t)+∈(t)×n(t); Among them, g test (t) represents the malicious client, g test (t) represents the target client, ∈(t) represents the noise intensity coefficient of the adaptive noise, and n(t) represents the adaptive noise at time t.

6. The poisoning defense method for federated learning according to any one of claims 1 to 5, characterized in that: The weighted aggregation of each client based on the adjusted trust score to obtain a global model includes: Determining a weight of each client based on the adjusted trust score; The clients are weightedly aggregated based on the weights to obtain a global model.

7. A poisoning defense device for federated learning, characterized in that: The device comprises: A combining unit, used to combine the model update data uploaded by each client with the client behavior data to obtain multimodal features corresponding to each client; A detection unit, used to perform anomaly detection on the multimodal features of each client to obtain anomaly detection results; An adjustment unit, configured to adjust the trust score of each client based on the anomaly detection result to obtain an adjusted trust score; An injection unit, configured to inject adaptive noise into a target client whose adjusted trust score is lower than a preset score, to obtain a malicious client; wherein the adaptive noise is generated based on the anomaly detection result; An aggregation unit is used to perform weighted aggregation on each client based on the adjusted trust score to obtain a global model; wherein the each client includes the malicious client.

8. A computing device, comprising: at least one processor, memory, and input-output unit; The memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium comprising instructions, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images