Performance evaluation method for defense mechanism of federal learning model under optimized backdoor attack

Abstract

The invention discloses a federal learning model defense mechanism performance evaluation method under optimized backdoor attack, and belongs to the field of network security. The method comprises the following steps: an attacker normally participates in training in the early stage of federal learning training; in the middle stage of training, an attacker obtains the global model; when an attacker normally participates in pre-training, the obtained global model is utilized in advance, normal training and backdoor model training are simulated, and a trigger is optimized in advance by updating differences; in the later stage of training, performing backdoor attack by using the optimized trigger, and continuously optimizing the trigger by using the global model obtained again by using the same method, so as to improve the attack effect and efficiency; and performing backdoor attack test based on the finally optimized trigger, and evaluating the performance of the federal learning model defense mechanism. According to the federal learning model vulnerability evaluation method under the optimized backdoor attack, a set of new attack thought and an effective evaluation method are provided for existing defense, and vulnerabilities of the existing defense are revealed.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for evaluating the performance of a federated learning model defense mechanism under optimized backdoor attacks. Background Art

[0002] In today's digital age, federated learning, as an emerging distributed machine learning technology, is gradually showing great potential in various fields. It allows multiple parties to jointly train models without sharing original data, thereby protecting data privacy.

[0003] However, this technology also faces security threats, among which federated learning backdoor attacks have become a highly concerned issue. Federated learning backdoor attacks are attacks in which the attacker implants a specific "backdoor" in the model by tampering with data, optimizing triggers, or destroying the model update process in the federated learning system, so as to manipulate the model output under specific conditions to achieve malicious purposes. At present, there are some adaptive attack methods. In the federated learning environment, backdoor attack methods are constantly evolving and extremely concealed. The attacker can cleverly mix malicious samples with specific trigger patterns into the local training data. To deal with backdoor attacks, researchers have proposed a large number of defense mechanisms. These include methods based on robust aggregation algorithms, which aim to identify and filter out abnormal model updates; improved solutions based on differential privacy technology, which enhance resistance to malicious data injection while ensuring the model training effect; and solutions based on trusted execution environments, which ensure the security of the model training process from the hardware level. However, there is currently a lack of a systematic, comprehensive and effective method to evaluate the performance of these defense mechanisms. Different evaluation indicators have their own advantages and disadvantages in different scenarios. Some focus on detection accuracy, while others focus on the degree of impact on normal model training. Without a unified evaluation method, it is difficult to accurately compare the advantages and disadvantages of different defense mechanisms, and it is also impossible to determine the applicability of a certain defense mechanism in an actual complex environment, which hinders the further optimization and promotion of defense technology. In summary, in view of the current lack of unified evaluation methods and indicators, a method that can optimize the evaluation of the performance of the federated learning model's defense against backdoor attacks is proposed, which can fill the gap in this field. Summary of the invention

[0004] In order to overcome the problems in the prior art, the purpose of the present invention is to provide a method for evaluating the performance of a federated learning model defense mechanism under optimized backdoor attacks to evaluate the performance of a defense mechanism based on a detection algorithm.

[0005] The performance evaluation method of the federated learning model defense mechanism under optimized backdoor attack of the present invention. First, after understanding the mechanism of the detection method, the difference between normal updates and malicious updates is reduced by optimizing the triggers to reduce the distribution difference between the poisoned data set and the original data set to evade the defense. In addition, the attack adopts the strategy of early optimization, and uses the global model in the middle of training to optimize the trigger in advance. The attacker chooses to carry out the backdoor attack in the late stage of training, and at the same time, in order to adapt to the dynamic changes of the global model, the triggers are optimized alternately. Through repetitive experiments, the performance of the defense method can be more accurately evaluated.

[0006] In order to achieve the above object, the specific technical solution adopted by the present invention is as follows:

[0007] On the one hand, the present invention proposes a method for evaluating the performance of a federated learning model defense mechanism under optimized backdoor attacks, comprising:

[0008] S1: Establish a federated learning evaluation system including an initiator and multiple participants, the initiator has a global model to be evaluated, the participants have their own local training data sets for global model training, one of the participants is defined as the attacker, and the total training rounds, initial training rounds and mid-term training rounds are preset; during the federated learning training process between the initiator and the participants, a defense mechanism to be evaluated for resisting backdoor attacks is set;

[0009] S2: Each participant performs initial federated learning training on the initiator's global model based on the local training data set until the initial training round is reached to obtain the initial global model;

[0010] S3: Each participant conducts mid-term federated learning training on the initial global model based on the local training data set until the mid-term training round is reached to obtain a mid-term global model; during the mid-term federated learning training, the attacker initializes the trigger and adds the trigger to the local training data set, uses the training data set without the trigger to participate in the federated learning training, and backs up the global model of each round of federated learning training, and uses the training data set with the trigger added to perform parallel training on the backup model. Based on the difference in the model parameter update between the two trainings, the trigger parameters are optimized and updated using an adaptive optimization method;

[0011] S4: Each participant conducts a later period of federated learning training on the mid-term global model based on the local training data set until the total number of training rounds is reached; during the later period of federated learning training, the attacker adds the current trigger to the local training data set, uses the training data set with the added trigger to participate in the federated learning training, and backs up the global model of each round of federated learning training, and uses the training data set without the added trigger to perform parallel training on the backup model. Based on the difference in model parameter updates between the two trainings, the trigger parameters are optimized and updated using an adaptive optimization method;

[0012] S5: Build a test dataset based on the final trigger, test the trained global model, calculate the accuracy of the model output, and evaluate the performance of the defense mechanism based on the accuracy.

[0013] Furthermore, the global model to be trained is an image recognition model, and the training data set includes image samples and their labels; adding a trigger to the local training data set refers to modifying the image samples in the training data set according to the trigger parameters.

[0014] Furthermore, each round of federated learning training includes: sending the global model to each participant, each participant performs local training on the global model on a local training data set, uploading the updated model parameters after the local training is completed to the initiator, and the initiator updates the global model based on all uploaded model parameters;

[0015] Furthermore, the defense mechanism includes: during each round of federated learning training, the initiator detects and filters the model parameters uploaded by each participant before comprehensively updating the global model with all uploaded model parameters, and updates the global model with the comprehensively filtered model parameters. The updated model is the trained global model.

[0016] Furthermore, the federated learning training specifically includes: the attacker uses the training data set participating in the federated learning training to perform local training on the currently received global model, and uploads the updated model parameters to the initiator after each round of local training; the parallel training specifically includes: in each round of local training, the attacker uses the training data set participating in the federated learning training to perform local training on the backup global model, and the updated model parameters are not uploaded to the initiator; the rounds of parallel training are synchronized with the rounds of federated learning training.

[0017] Furthermore, in step S6, the backdoor attack test is performed on the federated learning model based on the final trigger, specifically: a test data set is obtained, the final trigger is added to the test data set, and the federated learning model is tested using the test data set with the added trigger.

[0018] On the other hand, the present invention also proposes a performance evaluation system for optimizing the federated learning model defense mechanism under backdoor attacks, which is used to implement the above method.

[0019] Compared with the prior art, the beneficial effects of the present invention include at least:

[0020] (1) By optimizing the triggers and understanding the detection mechanism, the distribution difference between the poisoned data set and the original data set is reduced, thereby reducing the difference between normal updates and malicious updates, thereby successfully evading the defense. This creates conditions for more accurate analysis of the defense mechanism's response to attacks.

[0021] (2) The attack adopts an advance optimization strategy, using the global model in the middle of training to optimize the trigger in advance. At the same time, the attacker chooses to carry out backdoor attacks in the late stage of training. In order to adapt to the dynamic changes of the global model, the triggers are optimized alternately. This innovation of attack strategy makes the evaluation process more in line with the actual complex attack scenarios. In addition, through repetitive experiments, the performance of the defense method can be evaluated more accurately, thereby providing more reliable data support for improving and optimizing the defense mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of the performance evaluation method of the federated learning model defense mechanism provided in this embodiment;

[0024] Figure 2 It is a schematic diagram of the trigger optimization process based on model update difference provided in this embodiment. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention and the reverse operation are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0026] In view of the current situation in which academia and industry are insufficient in evaluating the performance of federated learning backdoor attack defense, this embodiment provides an evaluation method based on advance optimization of triggers. This method is committed to accurately evaluating the performance of defense mechanisms in responding to backdoor attacks, thereby providing a reliable basis for measuring the effectiveness of existing defense mechanisms. Specifically, by carefully optimizing the triggers and taking full account of the model structure and data characteristics of federated learning, more complex triggers that are difficult to be identified by existing defense mechanisms are designed. During the federated learning process, observe whether the defense mechanism can effectively detect when the attack is launched using this optimized trigger. At the same time, combined with adaptive attack strategies, dynamic changes in real scenarios are simulated, and the attack method is adjusted according to the changes to test the performance of the defense mechanism in complex attack situations. In addition, by deeply analyzing the backdoor attack defense mechanism, it is evaluated whether the defense mechanism can accurately identify and defend against attack methods that specifically reduce detection risks, so as to determine whether it can effectively respond to backdoor attacks during training, thereby completing a comprehensive evaluation of defense performance. Figure 1 As shown, the flowchart of the method for evaluating the performance of the federated learning model defense mechanism under the optimized backdoor attack provided in this embodiment includes the following steps:

[0027] Step 1: Establish a performance evaluation system for the federated learning model defense mechanism, including an initiator and multiple participants, one of which is an attacker. The initiator has a global model to be trained, and the participants have their own training data sets. In this embodiment, the global model to be trained is an image recognition model, and the training data set includes image samples and their labels. The total training rounds, initial training rounds, and mid-term training rounds are preset, and the federated learning training process is divided into the early, mid-term, and late stages. The rounds are specifically the rounds in which the participants exchange model parameters with the initiator.

[0028] In this embodiment, the central server is the initiator, and the training data set of the participants is obtained by splitting and distributing a large data set. The splitting is performed according to Dirichlet sampling Dir(α) to simulate the situation that the distribution of the data sets of each participant is not independent and different in actual situations. Suppose N:{P1,P2,…P N} participants, the server initializes the global model parameters θ 0 , and sent to the participants.

[0029] Step 2: The attacker participates in the initial federated learning training as normal, exposing the model to data.

[0030] In the initial stage of federated learning, the attacker joins the training process as a normal participant. This step is crucial because it lays the foundation for subsequent attack actions. Through training, the model can fully access the data and begin to understand the characteristics and distribution of the data. In this embodiment, the process of federated learning includes: the server sends the current global model, the participants upload the model update for local training, the server updates the model according to the aggregation rules, and sends the updated model to each participant. This is a normal round of federated learning training. In this embodiment, each participant performs two rounds of local training in each round of federated learning training.

[0031] Participants in the local dataset D i Training is performed on the i (θ) Update local model parameters:

[0032]

[0033] Where η is the learning rate, and The local model parameters before and after the update of the ith participant in the t+1th round of training, Represents the loss function of the model. After completing the initial federated learning training, each participant uploads the locally trained model parameters (or model updates) to the central server, and the server updates the new global model parameters according to the aggregation rule, such as FedAvg:

[0034]

[0035] where θ t+1 The server uses the parameters of the global model updated after t+1 rounds of training by each participant.

[0036] Step 3: In the middle of training, the attacker obtains the global model and optimizes the triggers while continuing to participate in training normally, thereby preparing for subsequent attacks.

[0037] Step 3-1: After the server updates the global model parameters, the attacker obtains the global model for parallel training. This global model is the result of the initial training of all participants. It contains important information about the data and the structure of the model. For example, when the total number of global training rounds is set to 220, the initial federated learning training ends at round 100, the server updates the global model parameters, and the attacker obtains the global model parameters θ of the 100th round. 100 .

[0038] Step 3-2: The attacker continues to participate in the training as normal. The attacker continues to participate in the federated learning training as a normal participant. This can reduce the impact on the normal federated learning training.

[0039] Step 3-3: While the attacker continues training, use the acquired global model to start optimizing the trigger. Adding the trigger to the local training dataset means modifying the image samples in the training dataset according to the trigger parameters. The trigger is the core component of the backdoor attack, which determines the conditions for triggering the backdoor and the concealment of the backdoor attack. Through parallel training, the attacker can give the trigger a good parameter value, making it more concealed and effective in subsequent simulated attacks.

[0040] Specifically, the attacker simulates normal training and parallel training, and fine-tunes the trigger parameters based on the differences in model parameters obtained from the two trainings. The parallel training in step 3 is backdoor training, which requires data contamination before local training using the contaminated dataset.

[0041] Data contamination means that the attacker modifies some data in the local data set to inject a backdoor. For example, a normal local data set is The attacker will select some data samples, such as k samples {x j1 ,y j1}, {x j2 ,y j2}, …, {x jk ,y jk}, and modify its label to the attack target label. The modified local dataset is the contaminated dataset. For example, in an image classification task, if the normal label is "cat", the attacker may modify some selected labels to "dog". At the same time, some subtle and imperceptible disturbances are added to these images through triggers. In this embodiment, the trigger parameter is defined as trigger, and the original image pixel value is image. Then the image pixel value after adding the disturbance is 0.9*image+0.1*trigger. The specific way to add a trigger can also be to inject a pixel block into the image sample or add an image filter. At this time, the trigger parameters include the injection position, pixel block size, etc. The attacker then backs up the global model obtained during the current round of federated learning training, uses the dataset for local training, and updates the model parameters of the backup model:

[0042]

[0043] in, is the backup model parameter updated during the t+1th round of training, θ t are the global model parameters obtained by the parameterizer during the t+1th round of training, is the gradient, L poison (θ t ) is the loss function.

[0044] The optimization process for triggers is as follows Figure 2As shown, the received global model is used to perform normal federated local training and backdoor training on the clean dataset and the contaminated dataset respectively. After each round of federated local training and backdoor training updates the model parameters, the trigger is optimized based on the difference between the two updates:

[0045]

[0046] in is the gradient of the optimization method, The difference in updating parameters for normal training and backdoor training models, and is the trigger value, α is the learning rate, and cosine similarity is used here to measure the update difference

[0047]

[0048] Where cosine_similarity(·) represents cosine similarity.

[0049] Step 4: The attacker alternates between backdoor attacks and trigger optimization in the later stages of training. When training reaches the later stages, such as the 200th round (the total number of training rounds is 220), the attacker begins to conduct backdoor attacks. This stage is a critical period for the attack, and the attacker needs to make full use of the previous preparations to carry out effective backdoor attacks. During the backdoor attack, the attacker will continue to optimize the trigger according to the progress of federated learning and the changes in the model to keep it powerful at all times.

[0050] The backdoor attack is that the attacker does not use a clean dataset (a dataset without triggers) when performing federated local training, but adds triggers to its own training dataset to obtain a polluted dataset, and uses the polluted dataset with triggers to participate in training. While performing the backdoor attack, the attacker continues to use the clean dataset for parallel training, and the parallel training is synchronized with the federated local training to optimize and update the trigger.

[0051] When performing normal training and backdoor attack on clean and contaminated datasets, the model parameters are updated in each round as follows:

[0052]

[0053]

[0054] in are the model parameters after the tth round of training on the poisoned dataset, is the gradient, L poison (.) is the loss function.

[0055]

[0056]

[0057] where y i is the true label, is the model prediction value, n is the number of training samples in this round of training; L poison (θ t ) has the same form, where y i ′ is the target label. The method of optimizing the trigger parameters in this step is the same as that described in step 3, which is to optimize the trigger parameters based on the difference in the model parameter updates of the two trainings.

[0058] Step 5: In the last round of federated learning training, the initiator uses an anomaly detection algorithm to detect and filter the model parameters uploaded by each participant, and updates the parameters of the global model based on the filtered model parameters. The updated model is the trained global model.

[0059] The anomaly detection algorithm includes clustering methods such as HDBACN and PCA.

[0060] Step 6: Perform a backdoor attack test on the trained global model based on the final trigger, and evaluate the performance of the defense mechanism based on the test results.

[0061] In this embodiment, a test data set is first obtained, and the finally optimized trigger is added to the test data set. The federated learning model is tested using the test data set with the added trigger, and the number of normal and abnormal model outputs is recorded. The percentage of normal times is calculated as the attack success rate, and the preset threshold ε=50%. If the attack success rate is greater than 50%, it is determined that the defense mechanism of the model has good performance and is not easily affected by backdoor attacks. Otherwise, it is determined that the defense mechanism of the model has poor performance and is easily affected by backdoor attacks.

[0062] This method is designed based on an in-depth analysis of existing defense methods. The server detects anomalies in uploaded model updates. In essence, the differences between updates come from differences in data set distributions. For example, when the poisoning rate increases, malicious updates are easier to detect. Due to the high-dimensional continuity of the data itself and the low-dimensional discrete characteristics of the data labels, the dimensionality difference is large, making it difficult to directly and accurately establish their joint distribution.

[0063] However, during the training process, the model itself is also a joint distribution of learning data. Even when it is in a convergent state, its model update can capture the differences between data distributions. In particular, when the data distribution tends to be consistent, the model update difference also tends to 0. Based on this, the attacker can directly use the received global model to simulate normal training and backdoor training, so as to calculate the difference to optimize the trigger. And use the gap in training to optimize the trigger in advance, give the trigger a good initial value, so as to improve the efficiency of the subsequent backdoor attack. Taking into account this backdoor attack method, the present invention proposes the above-mentioned evaluation method to achieve a more targeted vulnerability assessment, which helps relevant researchers to take effective defense measures to ensure the safe and reliable operation of the federated learning system, and provide a solid guarantee for the safe use and innovative development of data.

[0064] In summary, this method provides new ideas and methods for solving the detection and defense of backdoor attacks in federated learning, and is expected to play an important role in practical applications.

[0065] In this embodiment, a system for evaluating the performance of a federated learning model defense mechanism under optimized backdoor attacks is also provided, which is used to implement the above embodiments. The terms "module", "unit", etc. used below can implement a combination of software and / or hardware for a predetermined function. Although the system described in the following embodiments is preferably implemented in software, it is also possible to implement hardware, or a combination of software and hardware. The system includes:

[0066] A federated learning training module, including an initiator and multiple participants, is used to conduct federated learning training, wherein one of the participants uses a trigger to implement a backdoor attack in the later stage of the federated learning training;

[0067] The trigger optimization module is used to initialize and optimize triggers during the federated learning training process;

[0068] The defense module is used to detect and filter the model parameters obtained after local training of each participant;

[0069] The test and evaluation module builds a test dataset based on the final trigger, and uses the test dataset to test the trained global model and evaluate the performance of the defense mechanism.

[0070] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0071] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0072] The above-mentioned embodiments only express several implementation methods of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for evaluating the performance of a federated learning model defense mechanism under optimized backdoor attacks, characterized in that: include: S1: Establish a federated learning evaluation system including an initiator and multiple participants, the initiator has a global model to be evaluated, the participants have their own local training data sets for global model training, one of the participants is defined as the attacker, and the total training rounds, initial training rounds and mid-term training rounds are preset; during the federated learning training process between the initiator and the participants, a defense mechanism to be evaluated for resisting backdoor attacks is set; S2: Each participant performs initial federated learning training on the initiator's global model based on the local training data set until the initial training round is reached to obtain the initial global model; S3: Each participant conducts mid-term federated learning training on the initial global model based on the local training data set until the mid-term training round is reached to obtain a mid-term global model; during the mid-term federated learning training, the attacker initializes the trigger and adds the trigger to the local training data set, uses the training data set without the trigger to participate in the federated learning training, and backs up the global model of each round of federated learning training, and uses the training data set with the trigger added to perform parallel training on the backup model. Based on the difference in the model parameter update between the two trainings, the trigger parameters are optimized and updated using an adaptive optimization method; S4: Each participant conducts a later period of federated learning training on the mid-term global model based on the local training data set until the total number of training rounds is reached; during the later period of federated learning training, the attacker adds the current trigger to the local training data set, uses the training data set with the added trigger to participate in the federated learning training, and backs up the global model of each round of federated learning training, and uses the training data set without the added trigger to perform parallel training on the backup model. Based on the difference in model parameter updates between the two trainings, the trigger parameters are optimized and updated using an adaptive optimization method; S5: Build a test dataset based on the final trigger, test the trained global model, calculate the accuracy of the model output, and evaluate the performance of the defense mechanism based on the accuracy.

2. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 1, characterized in that: The global model is an image recognition model, and the training data set includes image samples and their labels; adding a trigger to the local training data set refers to modifying the image samples in the training data set according to the trigger parameters.

3. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 1, characterized in that: Each round of federated learning training includes: sending the global model to each participant, each participant performs local training on the global model on the local training data set, uploading the updated model parameters after the local training is completed to the initiator, and the initiator updates the global model based on all the uploaded model parameters.

4. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 3 is characterized in that: The method of updating the global model by comprehensively uploading all model parameters is as follows: calculating the average value of the model parameters uploaded by each participant as the parameter of the updated global model.

5. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 3, characterized in that: The defense mechanism includes: during each round of federated learning training, the initiator detects and filters the model parameters uploaded by each participant before comprehensively updating the global model with all the uploaded model parameters, and updates the global model with the comprehensively filtered model parameters. The updated model is the trained global model.

6. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 1, characterized in that: The federated learning training specifically includes: the attacker uses the training data set participating in the federated learning training to perform local training on the currently received global model, and uploads the training updated model parameters to the initiator after each round of local training; The parallel training specifically includes: in each round of local training, the attacker uses the training data set participating in the federated learning training to perform local training on the backed-up global model, and the model parameters updated by the training are not uploaded to the initiator; the rounds of parallel training are synchronized with the rounds of federated learning training.

7. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 1, characterized in that: The adaptive optimization method is specifically as follows: in is the gradient of the optimization method, is the difference in model parameter updates between the two trainings, and is the trigger parameter after the k+1th optimization update and before the optimization update, α is the learning rate, and cosine_similarity(·) represents the cosine similarity.

8. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 5, characterized in that: In step S5, the detection and filtering is performed using an anomaly detection algorithm, which includes a HDBSCAN algorithm and a PCA algorithm.

9. The method for evaluating the performance of a federated learning model defense mechanism under an optimized backdoor attack according to claim 1, characterized in that: In step S6, the backdoor attack test is performed on the federated learning model based on the final trigger, specifically: obtaining a test data set, adding the final trigger to the test data set, and using the test data set with the added trigger to test the federated learning model.

10. A performance evaluation system for optimizing the federated learning model defense mechanism under backdoor attacks, used to implement the method described in claim 1, characterized in that: The system comprises: A federated learning training module, including an initiator and multiple participants, is used to conduct federated learning training, wherein one of the participants uses a trigger to implement a backdoor attack in the later stage of the federated learning training; The trigger optimization module is used to initialize and optimize triggers during the federated learning training process; The defense module is used to detect and filter the model parameters obtained after local training of each participant; The test and evaluation module builds a test dataset based on the final trigger, and uses the test dataset to test the trained global model and evaluate the performance of the defense mechanism.

Images