Lightweight, safe and robust federated learning system suitable for field of Internet of Vehicles

Abstract

The invention relates to the technical field of federated learning, and discloses a lightweight, safe and robust federated learning system suitable for the field of Internet of Vehicles, and the system comprises a CKKS homomorphic encryption module which is used for carrying out the selective encryption of a local model parameter part; the double-server structure comprises a first server and a second server; the cosine similarity judgment module is used for calculating the cosine similarity between the client upload model update and the global model at the cloud server side, and identifying and eliminating malicious clients; and the key generation center is used for generating and distributing a public and private key pair for the client so as to support homomorphic encryption. According to the method, the CKKS homomorphic encryption technology is adopted, safe calculation of the data in the encryption state is achieved, excessive interaction does not need to be conducted between the client side and the server, meanwhile, the last layer weight of the model is selectively encrypted, sensitive information is protected, calculation expenditure is reduced, and the calculation efficiency is improved. The problem of balancing between privacy protection and calculation efficiency is solved.

Description

Technical Field

[0001] The present invention relates to the field of federated learning technology, and in particular to a lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles. Background Art

[0002] In the field of Internet of Vehicles, vehicles interact with other vehicles, infrastructure, pedestrians and the cloud through networking, forming a complex intelligent transportation system. With the development of autonomous driving technology and the increasing demand for intelligent transportation, more and more vehicles are able to collect a large amount of data through devices such as on-board sensors and cameras. These data are of great value for improving traffic efficiency and driving safety, but they also face huge challenges in data security and privacy protection. Federated learning is an emerging distributed machine learning technology that can complete model training without sharing original data, thereby achieving the goal of multi-party collaborative modeling. In the Internet of Vehicles environment, each vehicle can use federated learning to use its own collected local data for local model training, and then aggregate the model parameters with the server by uploading them to finally form a shared global model. This not only achieves data privacy protection, but also reduces the amount of data transmission.

[0003] Traditional privacy protection methods, such as differential privacy and multi-party secure computing, have their own shortcomings. Although differential privacy can increase noise to protect data privacy, it usually leads to a loss of model accuracy; while multi-party secure computing requires participants to stay online, and the communication overhead is large, making it difficult to adapt to the scenario where clients frequently go online and offline in the Internet of Vehicles. Summary of the invention

[0004] In order to make up for the above shortcomings, the present invention provides a lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles, which aims to improve differential privacy. Although it can increase noise to protect data privacy, it usually leads to a loss of model accuracy; while multi-party secure computing requires the participants to stay online, and the communication overhead is large, and it is difficult to adapt to the problem of frequent online and offline scenarios of clients in the Internet of Vehicles.

[0005] In a first aspect, the present invention provides the following technical solution: a lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles, comprising:

[0006] CKKS homomorphic encryption module, used to selectively encrypt part of the local model parameters to protect sensitive information;

[0007] A dual-server structure includes a first server and a second server, wherein the first server is used to calculate cosine similarity, and the second server is used to aggregate model updates of benign clients to form a new global model;

[0008] The cosine similarity discrimination module is used to calculate the cosine similarity between the model update uploaded by the client and the global model on the cloud server side to identify and exclude malicious clients;

[0009] The key generation center is used to generate and distribute public-private key pairs to clients to support homomorphic encryption.

[0010] Preferably, the CKKS homomorphic encryption module only encrypts the last layer of weights of the model.

[0011] Preferably, the cosine similarity determination module compares the cosine similarity between the update of each client and the global model with a preset threshold to determine whether it is a malicious client.

[0012] Preferably, the first server in the dual-server structure is used to receive the encrypted model parameters from the client and calculate the cosine similarity, and the second server is used to aggregate the model updates of benign clients to prevent malicious clients from affecting the training of the global model.

[0013] Preferably, the key generation center generates a public-private key pair for the client and distributes the public key to each client for encryption of model parameters.

[0014] In a second aspect, the present invention provides the following technical solution, a lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles, comprising the following steps:

[0015] S1. Client model training: Each client trains the model using local data and selectively encrypts the last layer of weights of the trained model;

[0016] S2. Upload encrypted parameters: upload the encrypted model parameters to the first server;

[0017] S3, Malicious Client Detection: The first server calculates the cosine similarity of client updates and compares it with the similarity threshold of the global model to identify and exclude malicious clients; the second server aggregates the model updates of benign clients to generate a new global model;

[0018] S4. Sending the global model: The second server sends the newly generated global model to each client for the next round of training.

[0019] Preferably, the calculation of the cosine similarity is based on the last layer weights of the client model update and the last layer weights of the global model.

[0020] Preferably, the updates whose cosine similarity is lower than a threshold are regarded as malicious updates and excluded during the aggregation process.

[0021] In the third aspect, the invention provides the following technical solution: a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor; when the processor executes the computer program, the processor implements the above-mentioned lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles.

[0022] In a fourth aspect, the present invention provides the following technical solution: a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the above-mentioned lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles is implemented.

[0023] The present invention has the following beneficial effects:

[0024] 1. In the present invention, by adopting CKKS homomorphic encryption technology, secure calculation of data in an encrypted state is achieved without excessive interaction between the client and the server. At the same time, by selectively encrypting the last layer of weights of the model, sensitive information is protected and computing overhead is reduced, solving the trade-off problem between privacy protection and computing efficiency.

[0025] 2. In the present invention, the cosine similarity between each client model update and the global model is calculated to determine whether the client is a malicious node, without relying on the server-side verification data set. This mechanism ensures that the system can effectively exclude malicious clients without verification data, while reducing the demand for server data storage and simplifying the server's burden.

[0026] 3. In the present invention, through the dual-server structure, the system separates the malicious node detection and model aggregation tasks, and processes them by different servers. The first server is responsible for calculating the cosine similarity and identifying malicious clients, and the second server is responsible for aggregating benign client updates. This architecture improves the overall efficiency of the system and reduces the load pressure of a single server. It is particularly suitable for application scenarios such as the Internet of Vehicles that require high real-time performance.

[0027] 4. In the present invention, the last layer of weights of the selective encryption model is used to reduce unnecessary full model encryption and noise addition processes, significantly reducing computing and communication overhead. The CKKS homomorphic encryption module allows the server to perform computing operations while maintaining data encryption, without the need for additional data exchange and interaction, which greatly reduces the occupancy of communication bandwidth. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of a model defense against poisoning attacks of a lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles proposed by the present invention;

[0029] Figure 2A schematic diagram of data defense against poisoning attacks for a lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles proposed by the present invention;

[0030] Figure 3 A schematic diagram of the time cost of different security measures for a lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles proposed by the present invention;

[0031] Figure 4 A schematic diagram showing the effect of homomorphic encryption on model accuracy and loss of a lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles proposed by the present invention;

[0032] Figure 5 A schematic diagram showing the impact of different numbers of attackers on a lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles proposed by the present invention;

[0033] Figure 6 A schematic diagram of the impact of different non-independent and identically distributed levels of data on a lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles proposed by the present invention;

[0034] Figure 7 This is a schematic diagram of the impact of different label flipping rates on a lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles proposed by the present invention. DETAILED DESCRIPTION

[0035] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Embodiment 1

[0037] Reference Figure 1-Figure 7 In a first embodiment of the present invention, the present invention provides a lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles, including:

[0038] CKKS homomorphic encryption module, used to selectively encrypt part of the local model parameters to protect sensitive information;

[0039] A dual-server structure includes a first server and a second server, wherein the first server is used to calculate cosine similarity, and the second server is used to aggregate model updates of benign clients to form a new global model;

[0040] The cosine similarity discrimination module is used to calculate the cosine similarity between the model update uploaded by the client and the global model on the cloud server side to identify and exclude malicious clients;

[0041] The key generation center is used to generate and distribute public-private key pairs to clients to support homomorphic encryption.

[0042] Specifically, the CKKS homomorphic encryption module is used to selectively encrypt some of the local model parameters to protect sensitive information. Based on the CKKS homomorphic encryption algorithm, this module can perform calculations in an encrypted data state, ensuring that data privacy is not leaked while supporting efficient encrypted model training. This module chooses to encrypt the last layer of weights of the model because the last layer of weights is most sensitive to the input data, which helps to effectively prevent the adversary from reconstructing the original data.

[0043] Cosine similarity discrimination module: used to calculate the cosine similarity between the model update uploaded by the client and the global model on the cloud server side to identify and exclude malicious clients. By calculating the cosine similarity between the uploaded model gradient and the global model gradient, it can be determined whether the client intentionally deviates from the correct direction of the global model. This module filters malicious client updates by setting thresholds to ensure the stability and correctness of the global model.

[0044] Dual-server structure: It includes computing servers and aggregation servers. The computing servers are used to calculate cosine similarity, and the aggregation servers are used to aggregate model updates from benign clients to form a new global model. The dual-server structure helps to disperse the workload and improve the overall efficiency of the system while reducing security risks introduced by malicious nodes. The computing servers are responsible for malicious client detection, while the aggregation servers centrally process benign updates to ensure the security of the model aggregation process.

[0045] Key Generation Center (KGC): used to generate and distribute public-private key pairs for clients to support homomorphic encryption. The key generation center is the root of trust in the system. By generating public-private keys for each client, it ensures the security of the data encryption and decryption process and prevents security issues caused by key leakage.

[0046] The present invention implements data privacy protection by introducing the CKKS homomorphic encryption module, ensuring that data can be operated without decryption, especially protecting sensitive information such as the vehicle's driving trajectory and location. The cosine similarity discrimination module enables the system to effectively identify and exclude malicious clients, ensuring the stability of the global model. The dual-server structure separates computing tasks from aggregation tasks, improves the robustness and fault tolerance of the system, and is suitable for dynamically changing Internet of Vehicles scenarios. At the same time, the last layer of weights in the selective encryption model reduces the computing overhead, enabling the system to run efficiently in the Internet of Vehicles. As the root of trust, the key generation center simplifies key management and ensures the security of data encryption and communication.

[0047] The CKKS homomorphic encryption module only encrypts the last layer of weights of the model.

[0048] Specifically, the CKKS homomorphic encryption module only encrypts the last layer of weights of the model, where the last layer of weights of the model usually contains the most sensitive features of the input data and is the most direct connection between the data label and the input features. By encrypting only the last layer of weights, the system can effectively protect the most important and sensitive data features while reducing the huge computational overhead caused by full encryption of the entire model.

[0049] The cosine similarity discrimination module compares the cosine similarity of each client's update with the global model and a preset threshold to determine whether it is a malicious client.

[0050] Specifically, the cosine similarity discrimination module calculates the model update uploaded by each client and the gradient of the global model to obtain the cosine similarity value, and compares the value with the preset similarity threshold to determine whether the client's behavior conforms to the normal model training process. Cosine similarity refers to the cosine value of the angle between two vectors, which is used to measure their similarity. If the direction of the gradient update uploaded by a client deviates significantly from the direction of the global model gradient (that is, the cosine similarity value is lower than the set threshold), it may indicate that the client has malicious behavior, such as attempting to interfere with the overall training results of the model through bad updates. The discrimination process of this module is as follows:

[0051] Upload model updates: After each client completes model training locally, it uploads the updated model parameters to the server.

[0052] Cosine similarity calculation: The server calculates the cosine similarity value between each client's updated gradient and the current global model gradient through the cosine similarity discrimination module.

[0053] Compare with threshold: Compare the calculated cosine similarity value with the preset threshold. If the cosine similarity is lower than the threshold, the update of the client is considered malicious.

[0054] Excluding malicious updates: If a client is identified as a malicious client, its updates will not be aggregated into the global model, thus avoiding deviations from the global model.

[0055] The first server in the dual-server structure is used to receive the encrypted model parameters from the client and calculate the cosine similarity, and the second server is used to aggregate the model updates of benign clients to prevent malicious clients from affecting the training of the global model.

[0056] Specifically, the dual-server structure includes two independent servers, each responsible for different tasks, to improve the efficiency and security of the entire system. Among them:

[0057] First server (computing server):

[0058] Receive encrypted model parameters from the client: After each client completes training locally, it uses the CKKS homomorphic encryption module to encrypt some parameters of the model (such as the last layer weights), and then uploads the encrypted parameters to the first server.

[0059] Calculate cosine similarity: After receiving the encrypted model parameters of each client, the first server uses the cosine similarity discrimination module to calculate the cosine similarity between each client model update and the global model. This similarity is used to determine whether the client's behavior is abnormal and identify potential malicious clients.

[0060] Exclude malicious clients: Compare the calculated cosine similarity with the preset threshold. If the similarity is lower than the threshold, the client may have malicious behavior and its model update will not be included in the global model aggregation process.

[0061] Second server (aggregation server):

[0062] Aggregate model updates of benign clients: After the first server completes malicious client detection, the second server receives the screening results from the first server and aggregates the model parameters of all verified benign clients. This aggregation process only includes updates of benign clients, ensuring the quality and accuracy of the global model.

[0063] Generate a new global model: The second server performs weighted aggregation on the updates of the benign clients, generates new global model parameters, and sends them to each client for the next round of model training.

[0064] The key generation center generates a public-private key pair for the client and distributes the public key to each client for encryption of model parameters.

[0065] Specifically, the Key Generation Center (KGC) is responsible for generating a public-private key pair for each client and distributing the public key to each client to support the encryption process of the model parameters. The specific workflow is as follows:

[0066] Key generation: The key generation center selects appropriate security parameters based on the security requirements of system initialization and uses the CKKS homomorphic encryption algorithm to generate the public-private key pair required by each client. The public key is used to encrypt data, while the private key is used to decrypt the encrypted data.

[0067] Public key distribution: The key generation center distributes the public key to each client through a secure communication channel. After receiving the public key, each client uses it to selectively encrypt the locally trained model parameters, thereby ensuring that the data will not be leaked to the server or intercepted by eavesdroppers during the upload process.

[0068] Private key protection: The private key is only stored locally on the client and will not be shared with the server or other nodes. This design ensures that even if the server is attacked or the data is leaked, only the encrypted data is exposed and cannot be directly decrypted to the original content, thus protecting the client's sensitive data.

[0069] Client-side encryption of model parameters: The client uses the public key provided by the key generation center to selectively encrypt the last layer of weights of the locally trained model, and then uploads the encrypted parameters to the server. Due to the characteristics of homomorphic encryption, the server can directly perform calculations while keeping the data encrypted.

[0070] Embodiment 2:

[0071] In a second embodiment of the present invention, the present invention provides a lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles, comprising the following steps:

[0072] S1. Client model training: Each client trains the model using local data and selectively encrypts the last layer of weights of the trained model;

[0073] S2. Upload encrypted parameters: upload the encrypted model parameters to the first server;

[0074] S3, Malicious Client Detection: The first server calculates the cosine similarity of client updates and compares it with the similarity threshold of the global model to identify and exclude malicious clients; the second server aggregates the model updates of benign clients to generate a new global model;

[0075] S4. Sending the global model: The second server sends the newly generated global model to each client for the next round of training.

[0076] The cosine similarity is calculated based on the last layer weights updated by the client model and the last layer weights of the global model.

[0077] Updates with cosine similarity below the threshold are considered malicious updates and excluded from the aggregation process.

[0078] Specifically, client model training:

[0079] Each client trains the model using locally collected data. The training process is performed locally on the client device to ensure that sensitive data (such as the vehicle's location, driving route, etc.) does not leave the client device, thereby protecting privacy.

[0080] After training is completed, the client uses the CKKS homomorphic encryption module to encrypt the last layer of weights of the model. Since the last layer of weights has the most direct relationship with the input data, encrypting this part can effectively prevent the data from being reconstructed.

[0081] Upload encryption parameters:

[0082] The encrypted model parameters are uploaded to the first server (computing server) through a secure communication channel. The data is encrypted using a public key to ensure that even if the data is intercepted during transmission, it cannot be decrypted, further ensuring the security of the data.

[0083] Encrypting uploaded model parameters not only protects privacy, but also enables the server to operate on the parameters without decryption, thanks to the characteristics of CKKS homomorphic encryption.

[0084] Malicious Client Detection:

[0085] The first server is responsible for calculating the cosine similarity between the model update uploaded by each client and the global model to determine whether the client has malicious behavior. By calculating the cosine similarity, the difference between the client update and the global model can be evaluated.

[0086] The cosine similarity of each client is compared with the preset threshold. If the similarity is lower than the threshold, it means that the update of the client deviates from the normal training direction and is judged as a malicious client. Its update will be excluded from the subsequent aggregation process. This detection step effectively prevents malicious nodes from submitting abnormal data to the system.

[0087] Model aggregation:

[0088] The second server (aggregation server) receives the benign client updates from the first server and aggregates them. The aggregation method usually adopts a weighted average method, so that the contribution of each client can affect the global model, while preventing the negative impact of individual abnormal updates on the model.

[0089] By only aggregating updates that pass screening, the security and accuracy of the global model are ensured, preventing malicious nodes from interfering with model training results.

[0090] Send the global model:

[0091] The aggregated global model is sent from the second server to each client. The client can use the private key to decrypt the global model and use it as the initial model for the next round of training.

[0092] Through multiple rounds of training and aggregation, the performance of the global model is gradually improved, and the global model shared by all clients becomes more and more accurate and adapts to more scenarios and data distributions.

[0093] Embodiment 3

[0094] The third embodiment of the present invention is based on the same inventive concept. The present invention proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles of the above embodiment.

[0095] Embodiment 4

[0096] The fourth embodiment of the present invention is based on the same inventive concept. A computer device proposed by the present invention comprises: a processor and a memory; the processor and the memory communicate with each other; the memory is used to store instructions; the processor is used to execute the instructions in the memory, and execute the lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles of the above embodiment.

[0097] Implementation settings: Experiments are conducted on four datasets, including mnist, fmnist, cifar10, and GTSRB, as well as 4-layer CNN, 6-layer CNN, and RestNat18 models. The experimental results show that compared with other defense strategies, the proposed method has a better defense effect. For the inner product flipping attack (IPM), the proposed method performs significantly better than the classic methods krum and clipping_median. In the implementation case, the implementation platform is Ubuntu20.04, 3090GPU. We default to 100 clients, of which 30 are malicious clients, and the non-independent and identically distributed indicator q is set to 0.5 (0~1), following the settings of predecessors. In the label flipping attack, the default wrong label ratio is 40%. In each round of the experiment, 10 clients are randomly selected and 1000 rounds are executed by default.

[0098] Effects of implementation cases: (1) After the IPM attack begins, all defense methods will significantly reduce the accuracy of the datasets MNIST and FMNIST. However, the LSFL method converges much faster than krum and clipping_median, and guarantees a shorter recovery time for learning. For the CIFAR10 and GTSRB datasets, our method not only recovers higher accuracy, but also shows an upward trend on the curve. (2) After the label flipping attack begins, we can observe that our method still performs well on the MNIST and FMNIST datasets. Although the performance is not good on the CIFAR10 and GTSRB datasets, our method is at least comparable to no_defense compared to other methods. (3) We chose CKKS as the encryption measure and compared it with the classic algorithm Paillier scheme. The results show that on the MNIST, FMNIST and GTSRB datasets, the time overhead of Paillier encryption is generally 3 to 4 times that of CKKS. We found that ResNet18 does not seem to have this phenomenon compared to other models. This is actually because the time overhead of different aggregation functions on the ResNet18 model fluctuates greatly. The encryption time of Paillier is 1.7 seconds, and that of CKKS is 0.45 seconds. However, since the time overhead of Paillier to execute the encryption aggregation function on RestNet18 is about 27 seconds, while that of CKKS is about 20 seconds. This makes the time overhead of the two similar. However, in actual deployment, as the computing power of the server increases, the aggregation time overhead will inevitably be greatly reduced. In addition, the experimental results also show that the use of the LSFL-cos method does not increase the model overhead. (4) The present invention also explores the impact of encryption measures on the accuracy of the training model. On the MNIST dataset, the accuracy and loss degree of the encryption measures have almost no effect on the accuracy of the model training, which proves the feasibility of the implementation of the CKKS scheme. (5) The impact of different numbers of attackers, the number of attackers is set to 10, 20, 30, and 40, and experiments are conducted on the GTSDRB dataset. The others are default conditions. We can observe that krum still has defense against attacks when the number of attackers is 10, that is, 10%. However, as the number of attackers increases, krum no longer has defensive capabilities, while LSFL and clipping_median still have defensive capabilities. The model basically remains robust and converges with acceptable accuracy. Experimental results show that LSFL is robust and reliable under different attacker ratios. (6) The impact of different non-independent and identically distributed levels of data. In order to explore the impact of data heterogeneity, we conducted experiments with different q values ​​(the q value represents the heterogeneity of the model. The higher the q value, the higher the heterogeneity). The experimental results show that compared with other methods, LSFL can maintain a stable accuracy rate under the influence of data heterogeneity.(7) The impact of different label flipping rates, and the impact of different label flipping rates on model accuracy under labelflip (label flipping attack) attacks are studied. When other conditions are default conditions, different label flipping rates are set to 10%, 20%, 30%, and 40%. As the label flipping rate increases, the accuracy of the model continues to decrease. The experimental results show that the LSFL scheme has the same ability to resist label flipping attacks as krum and clippingmedian.

[0099] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0100] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A lightweight, secure and robust federated learning system suitable for the field of Internet of Vehicles, characterized by: include: CKKS homomorphic encryption module, used to selectively encrypt part of the local model parameters to protect sensitive information; A dual-server structure includes a first server and a second server, wherein the first server is used to calculate cosine similarity, and the second server is used to aggregate model updates of benign clients to form a new global model; The cosine similarity discrimination module is used to calculate the cosine similarity between the model update uploaded by the client and the global model on the cloud server side to identify and exclude malicious clients; The key generation center is used to generate and distribute public-private key pairs to clients to support homomorphic encryption.

2. The lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles according to claim 1 is characterized in that: The CKKS homomorphic encryption module only encrypts the last layer of weights of the model.

3. The lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles according to claim 1 is characterized in that: The cosine similarity determination module compares the cosine similarity between the update of each client and the global model with a preset threshold to determine whether it is a malicious client.

4. The lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles according to claim 1 is characterized in that: The first server in the dual-server structure is used to receive the encrypted model parameters of the client and calculate the cosine similarity, and the second server is used to aggregate the model updates of benign clients to prevent malicious clients from affecting the training of the global model.

5. The lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles according to claim 1 is characterized in that: The key generation center generates a public-private key pair for the client and distributes the public key to each client for encryption of model parameters.

6. A lightweight, secure and robust federated learning method suitable for the field of Internet of Vehicles, characterized in that: The lightweight, secure and robust federated learning system applicable to the field of Internet of Vehicles as claimed in any one of claims 1 to 5 comprises the following steps: S1. Client model training: Each client trains the model using local data and selectively encrypts the last layer of weights of the trained model; S2. Upload encrypted parameters: upload the encrypted model parameters to the first server; S3, Malicious Client Detection: The first server calculates the cosine similarity of client updates and compares it with the similarity threshold of the global model to identify and exclude malicious clients; the second server aggregates the model updates of benign clients to generate a new global model; S4. Sending the global model: The second server sends the newly generated global model to each client for the next round of training.

7. The lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles according to claim 6, characterized in that: The cosine similarity is calculated based on the last layer weights updated by the client model and the last layer weights of the global model.

8. The lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles according to claim 6, characterized in that: Updates with cosine similarity lower than the threshold are considered malicious updates and excluded during the aggregation process.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles as described in claim 6 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the lightweight, secure and robust federated learning method applicable to the field of Internet of Vehicles as described in claim 6.

Images