Lightweight defense method oriented to malicious client attack resistance in federated learning

Abstract

The invention discloses an anti-attack lightweight defense method for a malicious client in federated learning, and the method comprises the steps: calculating a gradient parameter # imgabs0 # of a local model after a client i completes the local training of a current round, and uploading the gradient parameter # imgabs0 # to a server; the server extracts a gradient parameter # imgabs2 # of an output layer from the gradient parameter # imgabs1 #, calculates a gradient parameter change amplitude # imgabs3 #, updates a gradient parameter change matrix M, finds out an outlier client with inconsistent gradient parameter update, and determines the outlier client as a malicious client; and aggregating the gradient parameter # imgabs4 # uploaded by the benign client, updating global model parameters based on the aggregated gradient parameter Gt, issuing the global model parameters to all clients, updating local model parameters by the clients, adding 1 to the number of iterations, and starting t + 1 turns of iterations. By introducing a reputation point mechanism, different weights are distributed during client gradient aggregation according to historical manifestation of each client, and the method reduces model performance loss caused by misjudgment of benign clients while punishing malicious clients.

Description

Technical Field

[0001] The present invention belongs to the technical field of federated learning, and more specifically, the present invention relates to a lightweight defense method for resisting attacks from malicious clients in federated learning. Background Art

[0002] Federated learning is an emerging distributed machine learning framework. In traditional centralized machine learning environments, data and training processes are controlled by a single device, which may lead to serious privacy leakage risks. Federated learning combines multiple clients with a central server, so that each client retains its own local data set without sharing data with other clients or servers. The server is responsible for coordinating and aggregating model parameters from each client, thereby achieving joint training of the global model.

[0003] The iterative process of federated learning can be simplified into several steps: first, the server broadcasts the parameters of the current global model to all clients (or their subsets) participating in the training; then, the client uses the local data set to perform local training based on the global model and uploads the updated model parameters to the server; finally, the server uses an aggregation algorithm to integrate the received local model parameters and update the global model. Because federated learning can effectively protect user privacy, it has been widely used in many fields, such as prediction of the next word on the smart keyboard, medical imaging, digital health, etc.

[0004] Due to the privacy protection mechanism of federated learning and its distributed nature, the server cannot directly analyze the client's original data, which means that the server cannot determine whether the data of the edge devices participating in the training is wrong. More seriously, there may be malicious clients that directly upload incorrect model parameters to disrupt the training of the global model. This malicious behavior is called a poisoning attack. Depending on the attacker's target, poisoning attacks can be divided into untargeted attacks and targeted attacks. In an untargeted attack, the attacker attempts to make the global model make incorrect predictions for all inputs; while in a targeted attack, the attacker hopes that the model will only make incorrect predictions for specific inputs and maintain a high prediction accuracy for other inputs. The common aggregation algorithm of federated learning, the Federated Average Algorithm (FedAvg), participates in the aggregation of poisonous model gradient parameters or poisonous model parameters uploaded by malicious clients, thereby affecting the learning of the global model. Summary of the invention

[0005] The present invention provides a lightweight defense method for resisting attacks from malicious clients in federated learning, aiming to improve the above-mentioned problems.

[0006] The present invention is implemented as follows: a lightweight defense method for resisting attacks from malicious clients in federated learning, the method comprising the following steps:

[0007] (1) During the tth iteration, after client i completes the local training of the current round, it calculates the gradient parameters of the local model The gradient parameter Upload to the server;

[0008] (2) Gradient parameters uploaded by the server from each client Extract the gradient parameters of the output layer And calculate the amplitude of gradient parameter change Based on the parameter change amplitude Update the gradient parameter change matrix M, and then find out the outlier clients with inconsistent gradient parameter updates based on the gradient parameter change matrix M, and identify the outlier clients as malicious clients;

[0009] (3) Gradient parameters uploaded by benign clients Aggregation is performed based on the gradient parameter G after aggregation t To update the global model parameters, the updated global model parameters are sent to all clients. The clients update the local model parameters to the global model parameters sent by the server, increase the number of iterations by 1, and start the t+1 round of iterations.

[0010] Furthermore, the gradient parameter change matrix M is composed of the gradient parameter change amplitude sequences of all clients, and the gradient parameter change amplitude sequence TS of client i is i , calculate the gradient parameter change amplitude sequence TS i Discrete factor LOF k (TS i ) If the discrete factor LOF k (TS i ) is higher than the threshold ε, then the client i is considered to be a malicious client. k (TS i ) is lower than the threshold ε, the client is considered to be a benign client.

[0011] Furthermore, the method for determining the threshold ε of the current round t is as follows:

[0012] Calculate the mean (LOF) of the discrete factors of the current series of all gradient parameter change amplitudes k ) and standard deviation std(LOF k ), threshold ε=mean(LOF k )+std(LOF k ).

[0013] Furthermore, the gradient parameter change amplitude sequence TS i Discrete factor LOF k (TS i ) is calculated as follows:

[0014]

[0015] Among them, lrd k (TS j ), lrd k (TS i ) are the gradient parameter change amplitude sequence TS j , gradient parameter change amplitude sequence TS i The local reachable density, N k (TS i ) is the gradient parameter change amplitude sequence TS i The set of gradient parameter change amplitude sequences of the k nearest neighbors.

[0016] Furthermore, the local reachable density lrd k (TS i ) is calculated as follows:

[0017]

[0018] Among them, |N k (TS i )| is the set N k (TS i ), the number of time series in |N k (TS i )|=k,RD k (TS i ,TS j ) is the gradient parameter change amplitude sequence TS i To the gradient parameter change amplitude sequence TS j The reachable distance.

[0019] Furthermore, the gradient parameter change amplitude sequence TS i To the gradient parameter change amplitude sequence TS j The reachable distance RD k (TS i ,TS j ) is calculated as follows:

[0020] RD k (TS i ,TS j )=max(dist(TS i ,TS j ),k_dist(TS j ))

[0021] Among them, dist(TS i ,TS j) is the gradient parameter change amplitude sequence TS i and gradient parameter change amplitude sequence TS j The Euclidean distance between j ) is the gradient parameter change amplitude sequence TS j The distance to the gradient parameter change amplitude sequence of its kth nearest neighbor.

[0022] Furthermore, the reputation points of benign clients are used as weights to aggregate the gradient parameters uploaded by benign clients. The aggregated gradient parameters G t The calculation formula is as follows:

[0023]

[0024] Among them, r i t represents the reputation score of client i in round t, represents the gradient parameter uploaded by client i in round t, s i is the identity of client i. If client i is identified as a malicious client in the tth iteration, the identity Set to 0, otherwise, the identity Set to 1.

[0025] Furthermore, reputation points i t The update formula is as follows:

[0026]

[0027] Among them, r i t 、r i t-1 Respectively represent the reputation points of client i in round t and round t-1; LOF k (TS i ) is the current gradient parameter change amplitude sequence TS i The corresponding discrete factor, α is the reward factor, r i 0 Represents the initial reputation score of client i.

[0028] Furthermore, the initial credit score Among them, |D i | and |D| represent the number of samples of client i and the total number of samples of all clients, respectively.

[0029] The lightweight defense method for resisting attacks from malicious clients in federated learning proposed by the present invention has the following beneficial technical effects:

[0030] (1) A new defense method against federated learning poisoning attacks is proposed. This defense method introduces a reputation points mechanism to assign different weights to client gradient aggregation based on each client's historical performance. This method punishes malicious clients while reducing the model performance loss caused by misjudgment of benign clients.

[0031] (2) The gradient parameter change amplitude sequence of the client model output layer gradient update is used as the feature vector for anomaly detection of each client, and then an improved local anomaly factor detection algorithm is used to perform anomaly detection on the gradient parameter change matrix. This method greatly reduces the computational overhead of the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flow chart of a federated learning method for model gradient update consistency provided by an embodiment of the present invention;

[0033] Figure 2 A comparison diagram of the difference in the second norm of the benign and malicious model parameters at the output layer provided by the embodiment of the present invention;

[0034] Figure 3 A comparison chart of the variation range of benign and malicious model parameters at the output layer provided by an embodiment of the present invention;

[0035] Figure 4 A comparison chart of the prediction accuracy of various labels of CIFAR-10 under label flipping attack provided by an embodiment of the present invention;

[0036] Figure 5 A comparison chart of the prediction accuracy of various labels of MNIST under label flipping attack provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The specific implementation modes of the present invention are further explained in detail below by describing the embodiments with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0038] The method proposed in this invention is to find malicious values ​​in all model gradients in each iteration process, and redistribute the weights of aggregation according to the historical behaviors of all clients. The defense against poisoning attacks proposed in this invention is mainly divided into two stages: anomaly detection and weighted aggregation. Figure 1The framework of the lightweight defense method for anti-attack against malicious clients in federated learning proposed by the present invention is described. The server is responsible for detecting malicious clients and updating client weights. Unlike most existing defense methods, the defense method proposed by the present invention does not require an assumption of the exact number of attackers, and does not rely on a verification data set to detect the model gradient of malicious clients. Because the present invention detects malicious clients by calculating the consistency of the update amplitude of the client model gradient in historical information. Specifically, the server calculates the update amplitude of each client model gradient and its past model gradient in each round of iteration, constructs a gradient parameter change amplitude sequence based on multiple rounds of update amplitude information, and takes the latest several pieces of information of each gradient parameter change amplitude sequence to construct a gradient parameter change matrix. The gradient parameter change matrix is ​​detected for anomalies using an anomaly detection algorithm, wherein the client corresponding to the abnormal time series is identified as a malicious client. The detected malicious model gradient is in the form of soft filtering, rather than permanently excluding the malicious client from the system. Because, on the one hand, in each round of iteration, benign clients may be identified as malicious clients due to reasons such as device performance and network, and on the other hand, malicious clients may be identified as benign clients due to false detection and small-amplitude poisoning attacks. Specifically, the server discards the local model updates identified as malicious model gradients in the current iteration during aggregation, updates the credibility metric of each client based on its historical performance, and uses this metric as the weight of the benign client during aggregation.

[0039] Figure 1 A flowchart of a federated learning method based on model gradient parameter updating provided in an embodiment of the present invention, the method is specifically as follows:

[0040] (1) During the tth iteration, after each client completes the local training of the current round, the gradient parameters of the local model are calculated The gradient parameter Upload to the server;

[0041] Each client has a model. Only the model output layer gradient parameters can reflect the difference between the benign model gradient and the malicious model gradient. At the same time, the local dataset of each client is independent and identically distributed and has the same model structure and the same initialization conditions in the training phase. After training with the same optimization algorithm (such as SGD), the update amplitude of the obtained gradient is consistent in the iteration round. Assume that there are n clients in total, and the local dataset D of each client i is i Independent and identically distributed in the entire data set D, and the local loss function is f i (w), that is:

[0042]

[0043] Where L(w;x) is the loss of model parameter w on data sample x. In each round of training, the gradient calculated by each client is Since the data is independent and identically distributed, the expected gradient of all clients The same, so the amplitude of its gradient update is also consistent. According to the above derivation, the update amplitude of the gradient parameter of the model output layer is also consistent. Therefore, by comparing the consistency of the update amplitude of the gradient parameter of each client model output layer in multiple iterations, malicious clients can be detected.

[0044] In the classification model, the layer most relevant to the accuracy of the classification results is the output layer (that is, the last layer of the model parameters). The output layer uses an activation function to convert the internal representation of the model into an interpretable category probability. The prediction result of the model depends on the output of the output layer. Only the parameters of the output layer can reveal the benign and malicious clients in the client. To verify this point of view, the following experiment was conducted. In a round of training of the global model of federated learning, malicious clients (Client IDs are 1 and 2) uploaded parameter information generated by using a label flipping attack (changing label 0 to label 5) to observe the difference in the second norm between the output layer parameters of all clients, such as Figure 2 and 3 As shown. Figure 2 and Figure 3 It can be seen that the two-norm values ​​of the malicious model parameters generated by the label flipping attack and the benign model parameters on the output layer are significantly different, and as the training progresses, the difference in the two-norm values ​​of the malicious model parameters and the benign model parameters on the output layer becomes larger and larger.

[0045] (2) Gradient parameters uploaded by the server from each client Extract the gradient parameters of the output layer And calculate the amplitude of gradient parameter change Based on the parameter change amplitude Update the gradient parameter change matrix M, find out the outlier clients with inconsistent gradient parameter updates based on the updated gradient parameter change matrix M, and identify the outlier clients as malicious clients;

[0046] In the embodiment of the present invention, the gradient parameter variation amplitude The calculation formula is as follows:

[0047]

[0048] in, They represent the gradient parameters of the model output layer of client i after completing t and t-1 rounds of training respectively.

[0049] In the embodiment of the present invention, the gradient parameter change matrix M records the gradient parameter change amplitudes of all clients in the current round and the previous k-1 rounds of iterations. A row in the gradient parameter change matrix M corresponds to a gradient parameter change amplitude sequence of a client. The gradient parameter change amplitude sequence of client i is The gradient parameter change matrix M is expressed as follows:

[0050]

[0051] Where n is the number of clients participating in the federation aggregation.

[0052] In order to reduce the computational overhead of the server during anomaly detection, a KD-tree is used to accelerate the nearest neighbor search of the gradient parameter change amplitude sequence. First, a KD-tree structure is constructed based on the gradient parameter change matrix M, and the number of neighbors is set to k, which is half or slightly less than half of the total number of clients. All the gradient parameter change amplitude sequences in the gradient parameter change matrix M are traversed, and the gradient parameter change amplitude sequence TS corresponding to the i-th row in the gradient parameter change matrix M is searched. i , use KD-tree to find the gradient parameter change amplitude sequence of its k nearest neighbors and put it into the set N k (TS i ), and then calculate the gradient parameter change amplitude sequence TS i The reachable distance to the gradient parameter change amplitude sequence of its k nearest neighbors, the gradient parameter change amplitude sequence TS j , TS j ∈N k (TS i ), then the gradient parameter change amplitude sequence TS i To the gradient parameter change amplitude sequence TS j The reachable distance RD k (TS i ,TS j ) is calculated as follows:

[0053] RD k (TS i ,TS j )=max(dist(TS i ,TS j ),k_dist(TS j ))(2)

[0054] Among them, dist(TS i ,TS j ) is the gradient parameter change amplitude sequence TS i and gradient parameter change amplitude sequence TS j The Euclidean distance between j) is the numerical gradient change amplitude sequence TS j The distance to the gradient parameter change amplitude sequence of its kth nearest neighbor.

[0055] Based on the gradient parameter change amplitude sequence TS i The reachable distance to the gradient parameter change amplitude sequence of its k nearest neighbors is used to calculate the gradient parameter change amplitude sequence TS i The local reachability density lrd k (TS i ), local reachability density lrd k (TS i ) is calculated as follows:

[0056]

[0057] Among them, |N k (TS i )| is the set N k (TS i ), the number of time series in |N k (TS i )|=k.

[0058] Gradient parameter change amplitude sequence TS i The local reachability density lrd k (TS i ) is lower, it means that the gradient parameter change amplitude sequence TS i Finally, the discrete factor of each gradient parameter change amplitude sequence is calculated to determine whether the gradient parameter change amplitude sequence is abnormal. i Discrete factor LOF k (TS i ) is calculated as follows:

[0059]

[0060] When LOF k (TS i ) is larger, the gradient parameter change amplitude sequence TS i The more likely it is to be abnormal, the server determines the abnormal limit by setting a threshold ε. And in each iteration, the discrete factor mean (LOF k ) and standard deviation std(LOF k ), based on the mean of discrete factors (LOF k ) and standard deviation std(LOF k ) to dynamically determine the threshold ε, threshold ε = mean (LOF k)+std(LOF k ), if the discrete factor LOF k (TS i ) is higher than the threshold ε, then the gradient parameter change amplitude sequence TS is considered i is the abnormal gradient parameter change amplitude sequence, and the corresponding client is currently identified as a malicious client. If the discrete factor LOF k (TS i ) is lower than the threshold ε, then the gradient parameter change amplitude sequence TS is considered i It is a non-abnormal gradient parameter change amplitude sequence, and the corresponding client is currently identified as a benign client.

[0061] (3) Gradient parameters uploaded by benign clients Perform aggregation and convert the aggregated gradient parameter G t To update the global model parameters, the updated global model parameters are sent to all clients. The clients update the local model parameters to the global model parameters sent by the server, increase the number of iterations by 1, and start the t+1 round of iterations.

[0062] Since there is a possibility that a benign client is misjudged as a malicious client, or a malicious client is not detected, the present invention does not directly exclude the malicious clients corresponding to the abnormal gradient parameter change amplitude sequence, but reallocates the weights of each client during aggregation according to its historical performance.

[0063] At the beginning of the federated learning task, the server assigns an initial reputation score to each client participating in the training. The initial reputation score of client i is r i 0 , the reputation score is used to record the credibility of the client, the initial reputation score Among them, |D i | and |D| represent the number of samples of client i and the total number of samples of all clients, respectively.

[0064] The server will update the reputation score of the corresponding client based on the discrete factor calculated by each client. The reputation score update formula is as follows:

[0065]

[0066] Among them, r i t 、r i t-1 Respectively represent the reputation points of client i in round t and round t-1; LOF k (TS i ) is the current gradient parameter change amplitude sequence TS i The corresponding discrete factor, α is the reward and punishment factor.

[0067] From formula (5), we can see that when the discrete factor LOF k (TS i ) is lower than the set threshold ε, the current reputation score of client i increases, and the discrete factor LOF k (TS i ) is higher than the set threshold ε, the current credit score of client i will be reduced. k (TS i )LOF k (TS i )The degree of distance from the threshold ε varies, and the degree of reward and punishment received is also different.

[0068] In the aggregation phase, the server sets an identity s for each client i i , if client i is identified as a malicious client in the tth iteration, then the identity s of client i in the tth iteration i t Set to 0. If client i is identified as a benign client in the tth iteration, the identity of client i in the tth iteration Set to 1.

[0069] The server uses the reputation points of each client as a weight and evaluates the gradient parameters uploaded by the benign client. Aggregation is performed, and the server is based on the aggregated gradient parameter G t To update the parameters W of the global model t , parameter W t =W t-1 +G t , W t-1 is the global model parameter after the t-1th round of aggregation, and the global model parameter W t Send it to all clients, and the clients update the local model parameters to parameter W t , where the aggregated gradient parameter G t The calculation formula is as follows:

[0070]

[0071] The pseudo code of the gradient parameter-based federated learning method provided by the present invention is as follows:

[0072]

[0073]

[0074] The time complexity of the proposed algorithm is analyzed. The time complexity of the algorithm consists of multiple parts. First, assume that there are n clients, the dimension of the complete model gradient of each client is d, and the dimension of the output layer gradient is d′. It takes O(d′) time to calculate the update amplitude of the output layer gradient of each client in the current round and the output layer gradient of the previous round. Therefore, the time complexity of calculating the update amplitude of the output layer gradient of all clients in each round is O(n·d′). The update amplitude time series of each client stores the latest k data. The operations of adding or deleting data in the sequence are O(1). Therefore, the time complexity of updating the time series of all clients is O(n), and the time complexity of constructing the time series matrix is ​​O(n·k). The time complexity of the local anomaly factor algorithm using KD-tree for neighbor search is O(nlogn). The time complexity of updating the reputation points of all clients is O(n). Assuming that the number of benign clients is m, the time complexity of weighted aggregation of benign client model gradients is O(n·d). Therefore, the overall time complexity of the algorithm is O(n·d+n·k+nlogn).

[0075] Dataset settings: Experiments are conducted on two common public datasets, CIFAR-10 and MNIST. CIFAR-10 is a dataset widely used in computer vision research, usually for image classification tasks. The CIFAR-10 dataset contains a total of 60,000 32x32 pixel color images from 10 different categories, with 6,000 images in each category, including airplanes, cars, birds, cats, deer, dogs, frogs, horses, ships, and cars. The MNIST dataset is a classic machine learning and computer vision dataset for handwritten digit recognition tasks. The MNIST dataset contains approximately 70,000 28x28 pixel grayscale images.

[0076] For the CIFAR-10 dataset, a deep learning model with 121,182 trainable parameters was used. The front layer of the model contains a convolution layer with a convolution kernel size of 5×5, a pooling layer with a window size of 2×2, and a convolution layer with a convolution kernel size of 5×5 for feature extraction and passed to the following three fully connected layers: fc1, fc2, and fc3. Fc1 contains 120 neurons, fc2 contains 84 neurons, and fc3 contains 10 neurons. Each neuron has a bias of 1. The outputs of fc1 and fc2 are passed through the relu function and then through fc3 to finally obtain the predicted probabilities of 10 classes. For the MNIST dataset, a deep learning model with 21,840 trainable parameters was used. The model contains 2 convolution layers with a convolution kernel size of 5×5, a dropout layer, and 2 fully connected layers. The two fully connected layers contain 50 and 10 neurons respectively. The output of the last fully connected layer is processed by the softmax function to obtain the final predicted probability.

[0077] The training dataset is divided into 10 subsets of equal size and assigned to 10 local clients. Considering the different convergence difficulties of different datasets, we set different global model iteration rounds for different datasets and models. For the CIFAR-10 dataset, the global model will perform 100 iterations and each client will perform 5 local iterations per round, while for the MNIST dataset, the global model will perform 100 iterations and each client will perform only 1 local iteration per round.

[0078] Three untargeted poisoning attacks and one targeted poisoning attack are considered to simulate the attack methods launched by malicious clients. Among them, the three untargeted poisoning attacks include sign flipping attack (SF) and inner product manipulation attack (IPM). The inner product manipulation attack can be divided into two attacks with different attack amplitudes according to different parameters. For the targeted attack, we choose to use label flipping attack (LF). The attacker modifies the sample label with label 0 in the dataset to label 5, and then uses the poisoned dataset to calculate the model parameters. The accuracy of the global model trained by the federated average algorithm (FedAvg) in the absence of an attacker is used as the baseline. Four other classic defense algorithms for federated learning poisoning attacks (Krum, Median, GeoMed, TrimmedMean) and the recently proposed federated learning defense method (FedDet) are also considered.

[0079] In order to verify the defense capability of the defense method proposed in the present invention, the present invention uses CIFAR-10 and MNIST data sets for experiments. Tables 1 and 2 show the experimental results of the defense method proposed in this article and other defense algorithms under different poisoning attacks launched by 30% malicious clients. As shown in the results in the table, it can be clearly seen from the data in the table that the defense method proposed in the present invention has a better defense effect than other defense methods under different poisoning attacks. At the same time, when there is no malicious client in the federated learning system, the defense method (FedShield) in the present invention hardly damages the performance of the global model. It is worth noting that in the experimental results of the label flipping attack (LF), almost all defense methods have good defense performance, and the performance of the global model is only 0.64% to 4.04% lower than that of the baseline federated learning, but on the attacker's target class, the test accuracy of the target class under the existing defense method is significantly reduced. This is because the existing defense method only constrains the parameters according to the complete two norms of the model parameters. In the case of untargeted constraints, the reduction is limited or cannot reduce the influence of the weight vector related to the target class. The defense method in the present invention further considers the weight vector of a single category and completely excludes malicious parameters in each round of iteration to ensure that malicious parameters cannot affect the global model update.

[0080] Table 1 Experimental results of different defense methods on CIFAR-10 under different attacks

[0081]

[0082] Table 2 Experimental results of different defense methods on MNIST under different attacks

[0083]

[0084] It is worth noting that under the label flipping attack (LF), the performance gap between the global model obtained by applying different defense algorithms and the global model obtained by the FedCCD algorithm is only 1.5%~4.7% (CIFAR-10) and 0.4%~1.1% (MNIST), but the prediction accuracy gap on the attacker’s target class is obvious, as shown in Table 3.

[0085] Table 3 Performance of different defense methods on LF attack target classes

[0086]

[0087] In order to demonstrate the robustness of the defense algorithm of the present invention to the proportion of malicious clients, the proportion of malicious clients was gradually increased from 10% to 40% in the experiment. The experimental results are shown in Tables 4 and 5.

[0088] Table 4 Experimental results on CIFAR-10 with different proportions of malicious clients

[0089]

[0090] Table 5 Experimental results on MNIST with different proportions of malicious clients

[0091]

[0092] In order to verify the effectiveness and necessity of the defense method of the present invention using the category weight vector instead of the complete model parameters, the present invention designs a simple experiment. The server trains a classification model, and the attacker controls 40% of the malicious clients to attack the federated learning system using a label flipping attack (flipping labels 0 and 3 to labels 5 and 4). The server uses a variant algorithm with complete model parameter information for defense. Experiments are conducted on the CIFAR-10 and MNIST datasets, respectively. The experimental results are shown in Figure 2. Figure 4 , Figure 5 shown.

[0093] from Figure 5 It can be clearly observed that using complete model parameter information for anomaly detection cannot accurately identify malicious model parameters, resulting in poor model accuracy of the global model on the attacker's target class. This is because for targeted attacks such as label flipping, the attacker will not affect the accuracy of the global model on non-target classes, making the difference between malicious model parameters and benign model parameters unclear, which in turn leads to false detection in the anomaly detection process.

[0094] The present invention has conducted extensive experiments on two public data sets, and the results show that the method proposed in the present invention has good defense effects under several classic attacks and has low computational overhead for defense.

[0095] The present invention has been described exemplarily. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A lightweight defense method for resisting attacks from malicious clients in federated learning, characterized in that: The method comprises the following steps: (1) During the tth iteration, when client i completes the local training of the current round, it calculates the gradient parameters of the local model The gradient parameter Upload to the server; (2) Gradient parameters uploaded by the server from each client Extract the gradient parameters of the output layer And calculate the amplitude of gradient parameter change Based on the parameter change amplitude Update the gradient parameter change matrix M, and then find out the outlier clients with inconsistent gradient parameter updates based on the gradient parameter change matrix M, and identify the outlier clients as malicious clients; (3) Gradient parameters uploaded by benign clients Aggregation is performed based on the gradient parameter G after aggregation t To update the global model parameters, the updated global model parameters are sent to all clients. The clients update the local model parameters to the global model parameters sent by the server, increase the number of iterations by 1, and start the t+1 round of iterations.

2. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 1, characterized in that: The gradient parameter change matrix M is composed of the gradient parameter change amplitude sequence of all clients, and the gradient parameter change amplitude sequence TS of client i is i , calculate the gradient parameter change amplitude sequence TS i Discrete factor LOF k (TS i ) If the discrete factor LOF k (TS i ) is higher than the threshold ε, then the client i is considered to be a malicious client. k (TS i ) is lower than the threshold ε, the client is considered to be a benign client.

3. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 2, characterized in that: The method for determining the threshold ε of the current round t is as follows: Calculate the mean (LOF) of the discrete factors of the current series of all gradient parameter change amplitudes k ) and standard deviation std(LOF k ), threshold ε=mean(LOF k )+std(LOF k ).

4. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 2, characterized in that: Gradient parameter change amplitude sequence TS i Discrete factor LOF k (TS i ) is calculated as follows: Among them, lrd k (TS j ), lrd k (TS i ) are the gradient parameter change amplitude sequence TS j , gradient parameter change amplitude sequence TS i The local reachable density, N k (TS i ) is the gradient parameter change amplitude sequence TS i The set of gradient parameter change amplitude sequences of the k nearest neighbors.

5. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 4, characterized in that: Local reachability density lrd k (TS i ) is calculated as follows: Among them, |N k (TS i )| is the set N k (TS i ), the number of time series in |N k (TS i )|=k,RD k (TS i ,TS j ) is the gradient parameter change amplitude sequence TS i To the gradient parameter change amplitude sequence TS j The reachable distance.

6. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 5, characterized in that: Gradient parameter change amplitude sequence TS i To the gradient parameter change amplitude sequence TS j The reachable distance RD k (TS i ,TS j ) is calculated as follows: RD k (TS i ,TS j )=max(dist(TS i ,TS j ),k_dist(TS j )) Among them, dist(TS i ,TS j ) is the gradient parameter change amplitude sequence TS i and gradient parameter change amplitude sequence TS j The Euclidean distance between j ) is the gradient parameter change amplitude sequence TS j The distance to the gradient parameter change amplitude sequence of its kth nearest neighbor.

7. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 1, characterized in that: The reputation points of benign clients are used as weights to aggregate the gradient parameters uploaded by benign clients. The aggregated gradient parameters G t The calculation formula is as follows: in, represents the reputation score of client i in round t, represents the gradient parameter uploaded by client i in round t, s i is the identity of client i. If client i is identified as a malicious client in the tth iteration, the identity Set to 0, otherwise, the identity Set to 1.

8. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 7, characterized in that: Credit Points The update formula is as follows: in, Respectively represent the reputation points of client i in round t and round t-1; LOF k (TS i ) is the current gradient parameter change amplitude sequence TS i The corresponding discrete factor, α is the reward factor, Represents the initial reputation score of client i.

9. The lightweight defense method for resisting attacks from malicious clients in federated learning as claimed in claim 8, characterized in that: Initial credit score Among them, |D i | and |D| represent the number of samples of client i and the total number of samples of all clients, respectively.

Images