A federated learning approach for malicious client identification and poisoning attack recovery

Abstract

The present invention discloses a federated learning method for malicious client identification and poisoning attack recovery, comprising the steps of: preprocessing global model update data in federated learning, predicting model updates of each client using the Cauchy mean theorem, filling missing channels in heterogeneous models, and calculating suspicious scores of each client, using multiple indicators to collaboratively identify malicious clients; after detecting malicious clients, determining appropriate model rollback points through selectively stored historical information and adaptive model rollback strategies; the server calibrates client updates and recovers an accurate global model from the contaminated model. The present invention reduces the demand for storage and computing resources while protecting data privacy and enhancing model security.

Description

Technical Field

[0001] The present invention relates to the fields of network security technology and artificial intelligence technology, and in particular to a federated learning method for malicious client identification and poisoning attack recovery. Background Art

[0002] With the rapid development of information technology and the Internet, the advent of the big data era has greatly promoted the progress in the field of artificial intelligence, especially in the distributed machine learning paradigm of federated learning (FL). As data privacy protection is increasingly valued, federated learning has received widespread attention as a technology that enables data sharing and model training while protecting user privacy. However, in actual federated learning scenarios, mobile devices are usually equipped with limited computing and communication resources, which seriously restricts the convergence performance of federated learning algorithms. Due to the distributed characteristics of federated learning, the model is vulnerable to poisoning attacks by malicious clients during training. These attacks destroy the integrity and performance of the global model by sending tampered model updates, posing severe challenges to the security of federated learning.

[0003] According to the investigation, malicious clients can target the global model with untargeted and targeted attacks. Untargeted attacks are designed to slow down the learning process or reduce the overall performance of the global model, such as trim attacks; targeted attacks (also known as backdoor attacks) introduce a backdoor into the model, such as a small patch. Although the model behaves normally under standard input, it responds maliciously to input with this hidden trigger. Many poisoning attacks can quickly affect the performance of the global model or inject a backdoor in a few FL rounds, and persist for multiple rounds, causing major security issues.

[0004] However, most existing methods are not suitable for scenarios with heterogeneous models and are not combined with matching detection algorithms. Therefore, combining the characteristics of detection and recovery in scenarios with heterogeneous models, designing an integrated defense algorithm that supports malicious client detection and model recovery in scenarios with heterogeneous models has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of the present invention is to provide a federated learning method for malicious client identification and poisoning attack recovery, which can identify malicious clients and effectively recover the global model from model poisoning attacks to enhance the security and stability of the federated learning environment.

[0006] The technical solution adopted by the present invention is:

[0007] A federated learning method for malicious client identification and poisoning attack recovery includes the steps of:

[0008] S1. Preprocess the global model update data in federated learning, use the Cauchy mean theorem to predict the model update of each client, fill in the missing channels in the heterogeneous model, calculate the suspicious score of each client, and use multiple indicators to collaboratively identify malicious clients;

[0009] S2, after detecting a malicious client, determine the appropriate model rollback point through selectively stored historical information and adaptive model rollback strategy;

[0010] S3, the server calibrates the client update to recover an accurate global model from the contaminated model.

[0011] Furthermore, step S1 specifically includes the following steps:

[0012] S1-1. Calculate the approximate integral Hessian matrix of the global model difference using the L-BFGS algorithm ;

[0013] S1-2. For each client c, use the L-BFGS algorithm to calculate the approximate integral Hessian matrix corresponding to client c. ;

[0014] S1-3. After receiving the local gradient from a benign client with t local rounds, the server predicts the model update of each client using the Cauchy mean theorem, calculated as follows:

[0015] (1);

[0016] in, is the expected model update of client c in round t; is the actual model update of client c in round t-1; is the approximate integrated Hessian matrix, which is used to estimate the changes in model updates; and are the global models of rounds t and t-1 respectively;

[0017] S1-4. The server uses the predicted update to fill the missing channels in the heterogeneous model and calculates the model update after filling. The specific calculation expression is:

[0018] (2);

[0019] in, is the update of client c in round t after filling; is the update sent by client c after training with local samples; is the mask used to fill in the missing channels, It is the part of the passage that is taken;

[0020] S1-5. Based on the approximate integral Hessian matrix Predict the model update of client c at iteration t, and compare the predicted value with the actual update to determine whether the client's update deviates from the expected behavior. The expression for predicting the model update is as follows:

[0021] (3);

[0022] in, Model update for predicted client c at iteration t;

[0023] S1-6. Calculate the suspicious score of each client c in round t. The calculation expression of the suspicious score is as follows:

[0024] (4);

[0025] in, represents the suspicious score of client c in round t; is the Manhattan distance of client c in round t; is the Euclidean distance of client c in round t; is the cosine similarity of client c in round t;

[0026] S1-7. Normalize the suspicious score of each client c in round t. The calculation formula of the standardized suspicious score is as follows:

[0027] (5);

[0028] in, Normalized suspicious score of client c in round t;

[0029] S1-8. All clients The value combination uses the DBSCAN algorithm to cluster the consistency scores and separate normal and abnormal clients;

[0030] S1-9. Mark the malicious client according to the clustering result and add it to the malicious client set.

[0031] Furthermore, S1-6 also includes the following steps:

[0032] S1-6-1, calculate the Manhattan distance between the padded model update and the predicted model update. The specific calculation expression is as follows:

[0033] (6);

[0034] in, is the Manhattan distance of client c in round t, is the model update after filling, is the predicted model update, represents the L1 norm.

[0035] S1-6-2, calculate the Euclidean distance between the padded model update and the predicted model update:

[0036] (7);

[0037] in, is the Euclidean distance of client c in round t, represents the L2 norm;

[0038] S1-6-3, calculate the cosine similarity between the padded model update and the predicted model update:

[0039] (8);

[0040] in, is the cosine similarity of client c in round t, Represents the Euclidean norm of a vector.

[0041] Furthermore, the selective information storage and model rollback in S2 specifically include the following steps:

[0042] S2-1, loop through each global model in the buffer and calculate the difference between adjacent models as follows:

[0043] (9);

[0044] in, represents the difference between two global models;

[0045] S2-2. Select the model with the highest difference value according to the preset selection ratio A global model is shown below:

[0046] (10);

[0047] in, The function is used to select the model update round with the largest difference value from the difference set D. and is to select the scaling factor, which is related to the buffer size Multiply them to determine the number of rounds to keep;

[0048] S2-3. Based on the stored historical information and the suspicious score calculated in real time, detect malicious clients and trigger model rollback, rolling back the current global model to the selected historical checkpoint model. .

[0049] Furthermore, in step S2-1, the KL divergence metric is used to calculate , the calculation formula is as follows:

[0050] (11);

[0051] in, represents the difference measure between the i-th and i+1-th global models in round b, and Represent the global model and The probability distribution of .

[0052] Furthermore, in step S2-2, the global model corresponding to the selected model round and its tags Add to output collection In order to quickly find the key update rounds that have a significant impact on model changes when rollback is needed, the recovery process is accelerated and the recovery accuracy is improved.

[0053] Furthermore, the model recovery in step S3 specifically includes the steps of model filling, updating calibration, updating aggregation and model updating:

[0054] Step S3-1: Calculate the contribution score of each client c in the selected round as follows:

[0055] (11);

[0056] Step S3-2: Select the client with the highest contribution score according to formula (12):

[0057] (12);

[0058] in, represents the update vector of client c in round b and layer i, is the selected threshold, only contributions that reach or exceed The client update vector will be selected;

[0059] Step S3-3, model filling: Generate predicted updates for each client, calculate the difference between the actual update and the predicted update, and fill in the missing channels;

[0060] Step S3-4, update calibration: standardize each selected client update vector according to formula (13):

[0061] (13);

[0062] in, Represents the client The update vector at layer j is, Represents the reference vector of this layer;

[0063] Step S3-5, update aggregation: Aggregate updates from high-contributing clients to form a new global model update, as shown below:

[0064] (14);

[0065] Where A is the aggregation function. In the FedHIR solution, the aggregation adopts the FedAvg algorithm. is the calibrated global gradient, Indicates Roundly select and remove a set of malicious clients, Represents a client collection Datasets;

[0066] Step S3-6, model update: Update the global model for the next round of calibration based on the aggregate update and the calibrated global model obtained from the previous round of recovery, as shown below:

[0067] (15);

[0068] in, is the updated global model, is the current global model;

[0069] Step S3-7: The server and the benign client repeat steps S3-3 to S3-6 until all historical gradients are is calibrated.

[0070] Furthermore, in step S3-1, cosine similarity is used to measure the similarity between the client's update direction and the aggregation direction, which is calculated as follows:

[0071] (16);

[0072] in, represents the contribution score of client c in round t, represents the local update of client c at layer j in round t, represents the global model update of layer j for all clients in round t, represents the Euclidean norm.

[0073] From the above description, it can be seen that through the above methods, the FedHIR algorithm can provide an effective solution for model poisoning attacks in federated learning, while protecting data privacy and enhancing model security while reducing the demand for storage and computing resources.

[0074] The present invention adopts the above technical scheme to identify malicious clients and recover the global model from model poisoning attacks in a federated learning environment. The present invention adopts anomaly detection and selective historical information storage technology, which can adapt to the computing power of different clients and process heterogeneous models. The method of the present invention is called FedHIR. The present invention introduces predictions based on the Cauchy mean theorem to fill the missing channels in heterogeneous models, and identifies malicious clients through multiple indicators. After detecting the malicious client, an accurate global model is restored from the contaminated model through selectively stored historical information and adaptive model rollback strategies. In this way, the FedHIR method of the present invention provides an effective solution to model poisoning attacks in federated learning, reducing the demand for storage and computing resources while protecting data privacy and enhancing model security. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments;

[0076] Figure 1 This is an overall flow chart of a federated learning method for malicious client identification and poisoning attack recovery according to an embodiment of the present invention;

[0077] Figure 2 A schematic diagram of a framework of a federated learning method for malicious client identification and poisoning attack recovery according to an embodiment of the present invention;

[0078] Figure 3 The present invention is a specific flow chart of a federated learning method for malicious client identification and poisoning attack recovery according to an embodiment of the present invention. DETAILED DESCRIPTION

[0079] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0080] like Figures 1 to 3 As shown in one, the present invention discloses a federated learning method for malicious client identification and poisoning attack recovery, comprising the steps of:

[0081] S1. Preprocess the global model update data in federated learning, use the Cauchy mean theorem to predict the model update of each client, fill in the missing channels in the heterogeneous model, calculate the suspicious score of each client, and use multiple indicators to collaboratively identify malicious clients.

[0082] S2. After detecting a malicious client, determine the appropriate model rollback point through selectively stored historical information and adaptive model rollback strategy.

[0083] S3, the server calibrates the client update to recover an accurate global model from the contaminated model.

[0084] Please refer to Figures 1 to 3 In a federated learning algorithm for malicious client identification and poisoning attack recovery in embodiment 1 of the present invention, anomaly detection and malicious client detection include using the Cauchy mean theorem to predict the model update of each client, filling in the missing channels in the heterogeneous model, and using multiple indicators to collaboratively identify malicious clients.

[0085] In order to perform anomaly detection and malicious client detection, step S1 in the above embodiment 1 specifically includes the following steps:

[0086] S1-1. Calculate the approximate integral Hessian matrix of the global model difference using the L-BFGS algorithm .

[0087] S1-2. For each client c, use the L-BFGS algorithm to calculate its approximate integral Hessian matrix .

[0088] S1-3. After receiving the local gradient from a benign client with t local rounds, the server uses the Cauchy mean theorem to predict the model update for each client, calculated as follows:

[0089] (1);

[0090] in, is the expected model update of client c in round t, is the actual model update of client c in round t-1, is the approximate integral Hessian matrix used to estimate the change in model update, and are the global models of rounds t and t-1 respectively.

[0091] S1-4. The server uses the predicted update to fill in the missing channels in the heterogeneous model and obtains the model update after filling according to formula (2):

[0092] (2);

[0093] in, is the update of client c in round t after filling, is the update sent by client c after training with local samples, is the mask used to fill in the missing channels, is the portion of the channel that is taken.

[0094] S1-5. Based on the approximate integral Hessian matrix , predict the model update of client c at iteration t according to formula (3), and compare the predicted value with the actual update to determine whether the client's update deviates from the expected behavior:

[0095] (3).

[0096] S1-6. Calculate the suspicious score of each client c in round t according to formula (4):

[0097] (4).

[0098] In this example, the Manhattan distance between the padded model update and the predicted model update is calculated as follows:

[0099] (6);

[0100] in, is the Manhattan distance of client c in round t, is the model update after filling, is the predicted model update, represents the L1 norm.

[0101] The Euclidean distance between the padded model update and the predicted model update is calculated as follows:

[0102] (7);

[0103] in, is the Euclidean distance of client c in round t, represents the L2 norm.

[0104] The cosine similarity between the padded model update and the predicted model update is calculated as follows:

[0105] (8);

[0106] in, is the cosine similarity of client c in round t, Represents the Euclidean norm of a vector.

[0107] S1-7. Standardize the suspicious score of each client c in round t according to formula (5):

[0108] (5).

[0109] S1-8. All clients The DBSCAN algorithm is used to cluster the consistency scores and separate normal and abnormal clients.

[0110] S1-9. According to the clustering results, malicious clients are marked and added to the malicious client set.

[0111] That is, in this embodiment, prediction based on the Cauchy mean theorem is used to fill the missing channels in the heterogeneous model, and malicious clients are identified through the cooperation of multiple indicators, thereby effectively processing the heterogeneous model.

[0112] In this embodiment, step S2 also includes:

[0113] Determine appropriate model rollback points through selectively stored historical information.

[0114] That is, in this embodiment, after a malicious client is detected, a suitable model rollback point is determined through selectively stored historical information and an adaptive model rollback strategy.

[0115] The selective information storage and model rollback in step S2 of the first embodiment specifically include the following steps:

[0116] S2-1, loop through each global model in the buffer and calculate the difference between adjacent models as follows:

[0117] (9);

[0118] in, Represents the difference between two global models.

[0119] In this embodiment, Using the KL divergence measure, it is calculated as follows:

[0120] (11);

[0121] in, represents the difference measure between the i-th and i+1-th global models in round b, and Represent the global model and The probability distribution of .

[0122] S2-2. Select the model with the highest difference value according to the preset selection ratio A global model is shown below:

[0123] (10);

[0124] in, The function is used to select the model update round with the largest difference value from the difference set D. and is to select the scaling factor, which is related to the buffer size Multiply them together to determine the number of rounds to keep.

[0125] In this embodiment, the global model corresponding to the selected model round is and its tags Add to output collection In order to quickly find the key update rounds that have a significant impact on model changes when rollback is needed, the recovery process is accelerated and the recovery accuracy is improved.

[0126] S2-3. Based on the stored historical information and the suspicious score calculated in real time, detect malicious clients and trigger model rollback, rolling back the current global model to the selected historical checkpoint model. .

[0127] Wherein, step S3 also includes:

[0128] There are several steps: model filling, update calibration, update aggregation and model update.

[0129] That is, in this embodiment, after the server calibrates and the client updates, an accurate global model is restored from the contaminated model, which includes model recovery, which specifically includes the steps of model filling, updating calibration, updating aggregation and model updating.

[0130] Then step S3 of the above embodiment 1 is specifically as follows:

[0131] S3-1. Calculate the contribution score of each client c in the selected round as follows:

[0132] (11).

[0133] In this embodiment, cosine similarity is used to measure the similarity between the update direction of the client and the aggregation direction, and is calculated as follows:

[0134] (16);

[0135] in, represents the contribution score of client c in round t, represents the local update of client c at layer j in round t, represents the global model update of layer j for all clients in round t, represents the Euclidean norm.

[0136] S3-2. Select the client with the highest contribution score according to formula (12):

[0137] (12);

[0138] in, represents the update vector of client c in round b and layer i, is the selected threshold, only contributions that reach or exceed The client update vector will be selected.

[0139] S3-3, Model filling: Generate predicted updates for each client, calculate the difference between the actual update and the predicted update, and fill in the missing channels.

[0140] S3-4, Update calibration: Normalize each client update vector after selection according to formula (13):

[0141] (13);

[0142] in, Represents the client The update vector at layer j is, Represents the reference vector of this layer.

[0143] S3-5, Update aggregation: Aggregate updates from high-contribution clients to form a new global model update, as shown below:

[0144] (14);

[0145] Where A is the aggregation function. In the FedHIR solution, the aggregation adopts the FedAvg algorithm. is the calibrated global gradient, Indicates Roundly select and remove a set of malicious clients, Represents a client collection of the dataset.

[0146] S3-6, Model Update: Update the global model for the next round of calibration based on the aggregated update and the calibrated global model obtained from the previous round of recovery, as follows:

[0147] (15);

[0148] in, is the updated global model, is the current global model.

[0149] Step S3-7: The server and the benign client repeat steps S3-3 to S3-6 until all historical gradients are is calibrated.

[0150] That is, in this embodiment, an effective solution is provided for model poisoning attacks in federated learning, which reduces the demand for storage and computing resources while protecting data privacy and enhancing model security.

[0151] The present invention adopts the above technical solution and has the following beneficial effects: (1) From the perspective of privacy protection: The present invention is based on the distributed architecture of federated learning. The client trains on local data and only uploads model updates to the server instead of original data. This avoids direct sharing of personal data and fundamentally reduces the risk of privacy leakage. The model updates uploaded by the client are monitored by the anomaly detection module, and the update consistency of each client is predicted using the Cauchy mean theorem. The malicious client is identified by detecting updates that do not match the prediction. This mechanism can effectively protect data from malicious tampering when an attack occurs. By selectively restoring important historical updates, the integrity and security of private data are guaranteed while improving security and accuracy; (2) From the perspective of system performance: The present invention stores historical model updates and gradients with high contribution instead of all updates. The server only stores the rounds in which the model changes significantly, thereby saving memory resources and significantly speeding up the recovery speed. This method reduces the demand for computing resources, reduces the memory burden and computing overhead, and makes the system more efficient. (3) From the perspective of security: The anomaly detection module of the present invention identifies malicious clients by the difference between predicted and actual updates, and can accurately detect malicious behavior when facing clients with different computing capabilities. Once a malicious client is detected, the recovery model will selectively roll back to a historical global model that is less affected by the attack, thereby restoring the model accuracy after the attack with higher security.

[0152] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

Claims

1. A federated learning method for malicious client identification and poisoning attack recovery, characterized by: It includes the steps of: S1. Preprocess the global model update data in federated learning, use the Cauchy mean theorem to predict the model update of each client, fill in the missing channels in the heterogeneous model, calculate the suspicious score of each client, and use multiple indicators to collaboratively identify malicious clients; S2, after detecting a malicious client, determine the appropriate model rollback point through selectively stored historical information and adaptive model rollback strategy; S3, the server calibrates the client update and recovers an accurate global model from the contaminated model; the specific steps of step S3 are as follows: Step S3-1: Calculate the contribution score of each client c in the selected round as follows: （17）； Step S3-2: Select the client with the highest contribution score: （12）； in, represents the update vector of client c in round b and layer i, The contribution score reaches or exceeds the selected threshold. The client update vector of is selected; Step S3-3, model filling: Generate predicted updates for each client, calculate the difference between the actual update and the predicted update, and fill in the missing channels; Step S3-4, update calibration: standardize each selected client update vector: （13）； in, Represents the client The update vector at layer j is, Represents the client The reference vector at layer j; Step S3-5, update aggregation: Aggregate updates from high-contribution clients to form a new global model update. The specific expression is as follows: （14）； Where A is an aggregate function, is the calibrated global gradient, Indicates Roundly select and remove a set of malicious clients, Represents a client collection Datasets; Step S3-6, model update: Update the global model for the next round of calibration based on the aggregate update and the calibrated global model obtained from the previous round of recovery, as shown below: （15）； in, is the updated global model, is the current global model; Step S3-7: The server and the benign client repeat steps S3-3 to S3-6 until all historical gradients are is calibrated.

2. A federated learning method for malicious client identification and poisoning attack recovery according to claim 1, characterized in that: Step S1 specifically includes the following steps: S1-1. Calculate the approximate integral Hessian matrix of the global model difference using the L-BFGS algorithm ; S1-2. For each client c, use the L-BFGS algorithm to calculate the approximate integral Hessian matrix corresponding to client c. ; S1-3. After receiving the local gradient from a benign client with t local rounds, the server predicts the model update of each client using the Cauchy mean theorem, calculated as follows: （1）； in, is the expected model update of client c in round t; is the actual model update of client c in round t-1; is the approximate integrated Hessian matrix, which is used to estimate the changes in model updates; and are the global models of rounds t and t-1 respectively; S1-4. The server uses the predicted update to fill the missing channels in the heterogeneous model and calculates the model update after filling. The specific calculation expression is: （2）； in, is the update of client c in round t after filling; is the update sent by client c after training with local samples; is the mask used to fill in the missing channels, It is the part of the passage that is taken; S1-5. Based on the approximate integral Hessian matrix Predict the model update of client c at iteration t, and compare the predicted value with the actual update to determine whether the client's update deviates from the expected behavior. The expression for predicting the model update is as follows: （3）； in, Model update for predicted client c at iteration t; S1-6. Calculate the suspicious score of each client c in round t. The calculation expression of the suspicious score is as follows: （4）； in, represents the suspicious score of client c in round t; is the Manhattan distance of client c in round t; is the Euclidean distance of client c in round t; is the cosine similarity of client c in round t; S1-7. Normalize the suspicious score of each client c in round t. The calculation formula of the standardized suspicious score is as follows: （5）； in, Normalized suspicious score of client c in round t; S1-8. All clients The value combination uses the DBSCAN algorithm to cluster the consistency scores and separate normal and abnormal clients; S1-9. Mark the malicious client according to the clustering result and add it to the malicious client set.

3. A federated learning method for malicious client identification and poisoning attack recovery according to claim 2, characterized in that: S1-6 also includes the following steps: S1-6-1, calculate the Manhattan distance between the padded model update and the predicted model update. The specific calculation expression is as follows: （6）； in, is the Manhattan distance of client c in round t, is the model update after filling, is the predicted model update, represents the L1 norm; S1-6-2, calculate the Euclidean distance between the padded model update and the predicted model update: （7）； in, is the Euclidean distance of client c in round t, represents the L2 norm; S1-6-3, calculate the cosine similarity between the padded model update and the predicted model update: （8）； in, is the cosine similarity of client c in round t, Represents the Euclidean norm of a vector.

4. A federated learning method for malicious client identification and poisoning attack recovery according to claim 1, characterized in that: The selective information storage and model rollback in S2 specifically include the following steps: S2-1, loop through each global model in the buffer and calculate the difference between adjacent models as follows: （9）； in, represents the difference between the two global models; S2-2. Select the model with the highest difference value according to the preset selection ratio A global model, the specific expression is as follows: （10）； in, Represents the set of selected models; Indicates the selected client tag set. The function is used to select the model update round with the largest difference value from the difference set D. and is the selected proportionality factor, is the buffer size, and Respectively Multiply to determine the number of rounds to keep; S2-3. Based on the stored historical information and the suspicious score calculated in real time, detect malicious clients and trigger model rollback, rolling back the current global model to the selected historical checkpoint model. .

5. A federated learning method for malicious client identification and poisoning attack recovery according to claim 4, characterized in that: In step S2-1, the KL divergence metric is used to calculate , the calculation formula is as follows: （11）； in, represents the difference measure between the i-th and i+1-th global models in round b, and Represent the global model and The probability distribution of .

6. A federated learning method for malicious client identification and poisoning attack recovery according to claim 4, characterized in that: In step S2-2, the global model corresponding to the selected model round and its tags Add to output collection In order to quickly find the key update rounds that have a significant impact on model changes when rollback is needed, the recovery process is accelerated and the recovery accuracy is improved.

7. A federated learning method for malicious client identification and poisoning attack recovery according to claim 1, characterized in that: In step S3-1, cosine similarity is used to measure the similarity between the client's update direction and the aggregation direction, which is calculated as follows: （16）； in, represents the contribution score of client c in round t, represents the local update of client c at layer j in round t, represents the global model update of layer j for all clients in round t, represents the Euclidean norm.

Images