Artificial intelligence aggregation method with robustness for resisting malicious nodes

Abstract

The invention relates to an artificial intelligence aggregation method resistant to malicious nodes and having robustness, and belongs to the technical field of mobile communication. According to the method, a traditional federal learning aggregation mode is changed, a geometric median algorithm is adopted for global model aggregation, meanwhile, an asynchronous time weighting mechanism is designed, old global model parameters of a user are utilized, and the probability of breakdown of the geometric median aggregation algorithm due to the excessive number of malicious nodes in certain aggregation is reduced. The designed algorithm can reduce the influence on the global model when the global model is attacked by malicious nodes, and has important practical application value.

Description

Technical Field

[0001] The present invention belongs to the technical field of mobile communications and relates to an artificial intelligence aggregation method which is robust against malicious nodes. Background Art

[0002] With the development of machine learning technology, federated learning, as a distributed learning method, has been widely used in various scenarios involving privacy data, such as personalized recommendations on mobile devices, analysis of medical and health data, etc. In the practical application of federated learning, asynchronous federated learning overcomes the problems of slow convergence and low time efficiency in synchronous federated learning, and significantly improves the efficiency of federated learning. However, asynchronous federated learning also faces some challenges, one of the most important of which is the problem of malicious node attacks. In asynchronous federated learning, each participant can destroy the global model local aggregation update by sending damaged global model parameters or tampering with communication data, thereby affecting the performance of the model. Although there are many malicious node detection schemes in current federated learning, malicious node detection schemes still have limitations and cannot detect all malicious nodes. Therefore, it is of great theoretical significance and practical application value to study the user participation mechanism in asynchronous federated learning, design an asynchronous federated learning user participation mechanism that is robust to attacks by malicious nodes, and reduce the impact of the global model when attacked by malicious nodes.

[0003] Malicious node detection in federated learning is a critical task that aims to identify participating nodes that intentionally tamper with, interfere with, or disrupt the federated learning process. However, the current detection mechanism for malicious nodes in federated learning has limitations. First, malicious node detection requires a lot of computing resources and communication overhead, which reduces the efficiency of the system and increases the cost and complexity of federated learning. Second, malicious nodes will adopt adversarial strategies to circumvent the detection mechanism, such as forging legitimate gradient information or attacking the verification mechanism. Finally, when the detection algorithm is not accurate enough, false positives will be generated, and ordinary nodes will be mistakenly identified as malicious nodes, thus affecting the performance of federated learning. Malicious node detection schemes cannot detect all malicious nodes, so it is crucial to improve the robustness of asynchronous federated learning against malicious node attacks. Summary of the invention

[0004] In view of this, an object of the present invention is to provide an artificial intelligence aggregation method that is robust against malicious nodes.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] An artificial intelligence aggregation method that is robust against malicious nodes. Let the total number of users be N, and the data uploaded by user n to the central server be k nis the k value of user n, that is It is obtained by local training based on the global model of the kth round. The method includes the following steps:

[0007] Step 101: The server initiates a learning task to the client, sends the initial global model parameters to all users, and creates a collection for storing data uploaded by all users;

[0008] Step 102: Check the k value of all user data in the set and decide whether to delete the user's data;

[0009] Step 103: Execute the adaptive waiting asynchronous federated learning algorithm to receive user data; when the central server collects the latest model parameters uploaded by the user, it searches whether the user's historical data exists in the collection, and if so, replaces the historical data; if not, adds the data uploaded by the user to the collection;

[0010] Step 104: End the adaptive waiting phase of collecting user data; perform global model aggregation on the data in the collection;

[0011] Step 105: Check whether the global model has reached the task termination condition. If so, stop the federated learning task; otherwise, return to step 102.

[0012] Furthermore, in the adaptive waiting asynchronous federated learning algorithm, the difference between the accuracy of the final result with and without the participation of malicious nodes is reduced as follows:

[0013] When malicious nodes participate in asynchronous federated learning, the impact of malicious node attacks on the global model is weakened and reduced, which is mainly reflected in reducing the difference Δθ between the accuracy of the final results with and without malicious nodes in asynchronous federated learning. RB , the optimization objectives are as follows:

[0014]

[0015] In the formula, θ null is the accuracy of the global model without malicious nodes; θ evil is the global model accuracy with malicious nodes involved; N evil is the number of malicious nodes; N is the total number of all nodes; M evil is the number of malicious nodes participating in training; M null For those who participate in training; L M() is the loss function of the global model parameters after M rounds of training; σ and σ' are the thresholds of the average accuracy growth rate, respectively; C1 is the limit on the number of malicious nodes, C2 is the communication cost limit, and C3 and C4 are the convergence conditions of federated learning with and without the participation of malicious nodes, respectively.

[0016] Further, in step 102, the k value represents the round of model parameters obtained by the user through local training based on the global model of the ǐth round.

[0017] Furthermore, in step 102, a threshold K is set; the k value of all user data in the set is checked, and if |k-(m-1)|≤K, the user's data is retained; otherwise, the user's data is deleted. m is the round of the current federated learning.

[0018] Furthermore, in step 104, the global model aggregation adopts a geometric median algorithm to obtain the current latest round of global model parameters by solving the geometric median of all parameters in the set.

[0019] Furthermore, in step 104, the time weight of each user is calculated and applied to the geometric median calculation. The calculation formula of the time weight is:

[0020] Among them, ω n,T is the time weight of user n; k n is the k value of user n.

[0021] Furthermore, in step 104, the Weiszfeld algorithm is used to solve the geometric median of the parameters in the set.

[0022] Further, in step 103, the adaptive waiting asynchronous federated learning algorithm includes:

[0023] Receive model parameters uploaded by users;

[0024] Check whether the user's historical data exists in the collection;

[0025] If it exists, replace the historical data;

[0026] If it does not exist, add the data uploaded by the user to the collection.

[0027] Further, in step 105, the task termination condition includes:

[0028] The global model reaches the preset accuracy;

[0029] Federated learning reaches the preset rounds;

[0030] Other preset conditions.

[0031] Furthermore, the server is a cloud server, and the client is a mobile terminal device.

[0032] The beneficial effect of the present invention is that the method changes the traditional federated learning aggregation mode, adopts the geometric median algorithm for global model aggregation, and designs an asynchronous time weighted mechanism to utilize the user's outdated global model parameters, thereby reducing the probability of malicious nodes breaking through the geometric median aggregation algorithm due to excessive number during a certain aggregation.

[0033] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0035] Figure 1 This is the adaptive weighted federated learning model diagram of the present invention;

[0036] Figure 2 This is a model diagram of the robust weighted aggregation asynchronous federated learning method in the solution of the present invention;

[0037] Figure 3 This is an example diagram of the RWAFL algorithm of the solution of the present invention. DETAILED DESCRIPTION

[0038] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0039] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0040] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0041] like Figure 1 As shown, in order to improve the robustness of asynchronous federated learning, the difference Δθ between the global model accuracy with malicious nodes and the global model accuracy without malicious nodes is reduced. RB Based on the robustness of geometric median to outliers, a robust weighted aggregation asynchronous federated learning (RWAFL) algorithm is designed, which includes the following steps:

[0042] Let the total number of users be N, and the data uploaded by user n to the central server be k n is the k value of user n, that is It is obtained by local training based on the global model of the kth round. Figure 2 As shown, the algorithm flow is as follows:

[0043] 101: The central server initiates a federated learning task, sends the initial global model parameter w0 to all users; creates a set κ for storing data uploaded by all users; and sets a threshold K.

[0044] 102: Check the k value of all user data in the set κ. If |k-(m-1)|≤K, the user's data is retained; otherwise, the user's data is deleted. m is the round of the current federated learning.

[0045] 103: Execute adaptive waiting asynchronous federated learning algorithm to receive user data. When the central server collects the latest model parameters uploaded by the user, it searches whether the user's historical data exists in the set. If so, the historical data is replaced; if not, the data uploaded by the user is added to the set κ.

[0046] 104: End the adaptive waiting phase of collecting user data. Perform global model aggregation on the data in the set κ to obtain w mThe following introduces the global model aggregation update process of the RWAFL algorithm.

[0047] In the mth round, there are N' in the set κ m For all the parameters in the set, the time weight ω of each user is calculated according to the k value corresponding to each parameter using the following formula n,T , and its weight calculation formula is:

[0048]

[0049] Where ω n,T is the time weight of user n. In the mth round, there are N' m The central server obtains the latest global model parameter w by solving the geometric median of all parameters in the set. m The geometric median w of all user parameters in the set m Parameters to the user The Euclidean distance of After that, the sum is the smallest, that is:

[0050]

[0051] In the formula, ||·|| is the Euclidean norm. The present invention uses the Weiszfeld algorithm to solve the geometric median of the parameters in the set κ.

[0052] 105: Check whether the global model has reached the task termination condition. If so, stop the federated learning task; otherwise, return to step 102.

[0053] When malicious nodes participate in asynchronous federated learning, the impact of malicious node attacks on the global model is weakened and reduced, which is mainly reflected in reducing the difference Δθ between the accuracy of the final results with and without malicious nodes in asynchronous federated learning. RB , the optimization objectives are as follows:

[0054]

[0055] In the formula, θ null is the accuracy of the global model without malicious nodes; θ evil is the global model accuracy with malicious nodes; C1 is the number limit of malicious nodes. In the research on the robustness of asynchronous federated learning of the present invention, the number of malicious nodes is limited to no more than half of the number of users participating in the overall federated learning; N evil is the number of malicious nodes; C2 is the communication cost limit; m evil The number of rounds required to complete the federated learning task with the participation of malicious nodes; m nullIt is the number of rounds required to complete the federated learning task without the participation of malicious nodes; C3 and C4 are the convergence conditions of federated learning with and without the participation of malicious nodes, respectively.

[0056] Let the total number of users be N, and the data uploaded by user n to the central server be k n is the k value of user n, that is It is obtained by local training based on the global model of the kth round. Figure 2 As shown, the algorithm flow is as follows:

[0057] 101: The central server initiates a federated learning task and sends the initial global model parameter w0 to all users; creates a set k for storing data uploaded by all users; and sets a threshold K.

[0058] 102: Check the k value of all user data in the set κ. If |k-(m-1)|≤K, the user's data is retained; otherwise, the user's data is deleted. m is the round of the current federated learning.

[0059] 103: Execute adaptive waiting asynchronous federated learning algorithm to receive user data. When the central server collects the latest model parameters uploaded by the user, it searches whether the user's historical data exists in the set. If so, the historical data is replaced; if not, the data uploaded by the user is added to the set κ.

[0060] 104: End the adaptive waiting phase of collecting user data. Perform global model aggregation on the data in the set κ to obtain w m The following will introduce the global model aggregation update process of the RWAFL algorithm in detail.

[0061] In the mth round, there are N' in the set κ m For all the parameters in the set, the time weight ω of each user is calculated according to the k value corresponding to each parameter using the following formula n,T , and its weight calculation formula is:

[0062]

[0063] Where ω n,T is the time weight of user n. In the mth round, there are N' m The central server obtains the latest global model parameter w by solving the geometric median of all parameters in the set. m The geometric median w of all user parameters in the set m Parameters to the user The Euclidean distance of After that, the sum is g(wm ), minimize g(w m ),Right now:

[0064]

[0065] Where ||·|| is the Euclidean norm; the Weiszfeld algorithm is used to solve the geometric median of the parameters in the set κ.

[0066] The Weiszfeld algorithm is an iterative algorithm for solving weighted average positions. It finds the position that minimizes the weighted average of the distances from each position to a given point through iteration. The Weiszfeld algorithm is often used to solve position estimation, weighted average, and some optimization problems. The iterative process of the algorithm includes calculating the distance between each position and the target point, and updating the position according to the distance and weight until it converges to a solution. The present invention uses ∈-approximate as the Weiszfeld algorithm for g(w m ) is based on the convergence of the solution when it satisfies the following:

[0067]

[0068] The Weiszfeld algorithm stops iterating. is the global model parameter after the aggregation update of the mth round, ∈ is an arbitrary small value set.

[0069] 105: Check whether the global model has reached the task termination condition. If so, stop the federated learning task; otherwise, return to step 102.

[0070] The following example illustrates the algorithm execution process. Figure 3 As shown in the figure, the horizontal axis is the time axis, the vertical line is the central server aggregation time, the solid rectangular box is the time taken for user local training and data transmission, the dotted rectangular box is the offline time of the user device, and the threshold K is set to 2. The user's device may be offline due to other computing tasks, insufficient energy, or unwillingness to participate in federated learning. At the same time, the user's local training and data transmission time in each round is different due to the user's remaining energy, the presence of other computing tasks, location changes, and changes in channel status.

[0071] At the beginning, users A, B, C, D, and E obtain the global model parameter w0. At this time, there is no user parameter in the set κ. In the first round, after user D's data arrives at the central server, the central server waits for time τ1 and no other user data arrives. The set κ is updated, and the global model parameter w0 uploaded by users A and D in the first round is A,0 and w D,0 Stored in set κ, now set k={w A,0,w D,0 The central server uses the parameters of user A and user D in the set κ to perform the first round of global model aggregation to obtain the global model w1, and sends w1 to user A and user D. In the first round, user C's device is offline, and user E and user B time out.

[0072] In the second round, the central server first checks whether there are parameters to be deleted in the set κ. The k value in the parameters of user D and user A is 0, and the difference between the current aggregation round number minus 1 does not exceed the threshold 2, so the parameter w D,0 The central server receives the parameter w from user A. A,1 , parameter w of user B B,0 , parameter w of user E E,0 . Update the set κ and set w A,0 Replace with w A,1 , w B,0 、w E,0 Add to the set κ. Now κ={w A,1 ,w B,0 ,w D,0 ,w E,0 The central server aggregates the parameters in the set κ to obtain the global model parameter w2 and sends w2 to user A, user B, and user E.

[0073] In the third round, the set κ is retrieved, and the k values ​​of the parameters of users A, B, D, and E are within the threshold range and do not need to be deleted. The central server receives the parameter w of user A. A,2 , parameter w of user C C,0 , parameter w of user D D,1 . Update the set k and set w C,0 Add to the set κ, and change w D,0 Replace with w D,1 , w A,1 Replace with w A,2 , then the set κ={w A,2 ,w B,0 ,w c,0 ,w D,1 ,w E,0}. The global model is aggregated using the parameters in the set κ to obtain w3, and then the global model w3 is sent to users A, C, and D.

[0074] Similarly, in the fourth round, the parameters of users B, C, D, and E in the set κ are retrieved, where w B,0 、w C,0 、w E,0 The difference between the k value of the current round minus 1 is 3, which exceeds the threshold and is therefore unavailable. B,0 、w C,0 、w E,0 Delete, parameter w of user DD,1 Available, so no need to delete. In the fourth round, we receive the parameter w from user A. A,3 . Update the set κ, w A,2 Replace with w A,3 , then the set κ={w A,3 ,w D,1}. Therefore, the fourth round uses w A,3 , w D,1 Perform global model aggregation update to get w4, and send w4 to user A. The RWAFL algorithm is shown in Table 1.

[0075] Table 1

[0076]

[0077]

[0078] The geometric median is robust to the number of malicious nodes not exceeding 50%. In the RWAFL algorithm, even if the number of malicious nodes in the data received by the central server exceeds 50% of the number of users currently received in a certain round of aggregation update, the parameters of the historical models of other users are used to participate in the aggregation when the global model is aggregated. Although most users did not upload their updated model parameters in this round or the central server did not receive the model parameters of most users in this round, the central server uses the historical parameters of these users to participate in the latest round of global aggregation, which can effectively avoid the damage of the geometric median aggregation caused by the excessive proportion of malicious nodes. At the same time, weighting these parameters with corresponding time weights can not only balance the delayed effect of the old parameters on the global model aggregation, but also promote the aggregation of the global model after the old parameters are given time weights.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. An artificial intelligence aggregation method that is robust against malicious nodes. Let the total number of users be N, and the data uploaded by user n to the central server be k n is the k value of user n, that is It is obtained by local training based on the global model of the kth round, and its characteristics are: The method comprises the following steps: Step 101: The server initiates a learning task to the client, sends the initial global model parameters to all users, and creates a collection for storing data uploaded by all users; Step 102: Check the k value of all user data in the set and decide whether to delete the user's data; Step 103: Execute the adaptive waiting asynchronous federated learning algorithm to receive user data; when the central server collects the latest model parameters uploaded by the user, it searches whether the user's historical data exists in the collection, and if so, replaces the historical data; if not, adds the data uploaded by the user to the collection; Step 104: End the adaptive waiting phase of collecting user data; perform global model aggregation on the data in the collection; Step 105: Check whether the global model has reached the task termination condition. If so, stop the federated learning task; otherwise, return to step 102.

2. The artificial intelligence aggregation algorithm according to claim 1 that is robust against malicious nodes, characterized in that: In the adaptive waiting asynchronous federated learning algorithm, the difference Δθ between the accuracy of the final result with and without the participation of malicious nodes is reduced. RB , the optimization objectives are as follows: In the formula, θ null is the accuracy of the global model without malicious nodes; θ evil is the global model accuracy with malicious nodes involved; N evil is the number of malicious nodes; N is the total number of all nodes; M evil is the number of malicious nodes participating in training; M null For those who participate in training; L M () is the loss function of the global model parameters after M rounds of training; σ and σ' are the thresholds of the average accuracy growth rate, respectively; C1 is the limit on the number of malicious nodes, C2 is the communication cost limit, and C3 and C4 are the convergence conditions of federated learning with and without the participation of malicious nodes, respectively.

3. The artificial intelligence aggregation method according to claim 1, which is robust against malicious nodes, is characterized in that: In step 102, the k value represents the round number of model parameters obtained by the user through local training based on the global model of the ǐth round.

4. The artificial intelligence aggregation method according to claim 1, which is robust against malicious nodes, is characterized in that: In step 102, a threshold K is set; the k values ​​of all user data in the set are checked, and if |k-(m-1)|≤K is satisfied, the data of the user is retained; otherwise, the data of the user is deleted; m is the round of the current federated learning.

5. The artificial intelligence aggregation method with robustness against malicious nodes according to claim 1, characterized in that: In step 104, the global model aggregation adopts a geometric median algorithm to obtain the latest round of global model parameters by solving the geometric median of all parameters in the set.

6. The artificial intelligence aggregation method according to claim 5, which is robust against malicious nodes, is characterized in that: In step 104, the time weight of each user is calculated and applied to the geometric median calculation. The calculation formula of the time weight is: Among them, ω n,T is the time weight of user n; k n is the k value of user n.

7. The method of artificial intelligence aggregation with robustness against malicious nodes according to claim 5, characterized in that: In step 104, the Weiszfeld algorithm is used to solve the geometric median of the parameters in the set.

8. The artificial intelligence aggregation method with robustness against malicious nodes according to claim 1, characterized in that: In step 103, the adaptive waiting asynchronous federated learning algorithm includes: Receive model parameters uploaded by users; Check whether the user's historical data exists in the collection; If it exists, replace the historical data; If it does not exist, add the data uploaded by the user to the collection.

9. The artificial intelligence aggregation method with robustness against malicious nodes according to claim 1, characterized in that: In step 105, the task termination condition includes: The global model reaches the preset accuracy; Federated learning reaches the preset rounds; Other preset conditions.

10. The artificial intelligence aggregation method according to claim 1, which is robust against malicious nodes, is characterized by: The server is a cloud server, and the client is a mobile terminal device.

Images