A federated learning optimization method of a trusted sandbox extension

Abstract

The application provides a trusted sandbox extension federated learning optimization method, which comprises the following steps: training a global model in a sandbox to obtain local model update parameters; the global model is used for power business prediction; the local model update parameters are sent to an aggregation node; and the aggregation node is used for determining an updated global model based on the local model update parameters. The method of the application embodiment effectively ensures the security of the federated learning related to the power business prediction.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a trusted sandbox-extended federated learning optimization method. Background Technology

[0002] Federated learning, as a new branch of machine learning technology, enables efficient joint modeling and training among multiple users while ensuring that privacy data does not leave the local machine, thus fully releasing the potential value of the data. Therefore, it has brought new impetus to various industries in recent years, with broad application prospects in fields such as the Industrial Internet, smart cities, power, and retail.

[0003] In related technologies, traditional federated learning for power business forecasting ignores the security issues of data and models during training and transmission. Therefore, how to prevent malicious programs from damaging the data and leaking the data, and improve the security of federated learning for power business forecasting, is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] This invention provides a trusted sandbox-based optimized federated learning method. By placing the model training and parameter transfer processes for federated learning tasks related to power business forecasting within a computation sandbox, the client can send local model update parameters to an aggregation node while ensuring the reliability of the computation and transmission process. The aggregation node then aggregates the local model update parameters sent by multiple clients, thereby accurately obtaining the updated global model and effectively guaranteeing the security of federated learning related to power business forecasting.

[0005] In a first aspect, the present invention provides a trusted sandbox-extended federated learning optimization method, applied to clients participating in federated learning tasks, comprising:

[0006] The global model is trained in a sandbox to obtain local model update parameters; the global model is used for power business prediction.

[0007] The local model update parameters are sent to the aggregation node; the aggregation node is used to determine the updated global model based on the local model update parameters.

[0008] According to the trusted sandbox extended federated learning optimization method provided by the present invention, after sending the local model update parameters to the aggregation node, the method further includes:

[0009] The local model update parameters are hashed to obtain a first hash result, which is then uploaded to the blockchain. The first hash result on the blockchain is used by the aggregation node to determine whether to discard the received local model update parameters.

[0010] According to the trusted sandbox extended federated learning optimization method provided by the present invention, after sending the local model update parameters to the aggregation node, the method further includes:

[0011] Receive the test gradient sent by the aggregation node; the test gradient is constructed based on a deep deterministic strategy;

[0012] Based on the test gradient, a response gradient is determined and sent to the aggregation node; the directional and magnitude deviations between the test gradient and the response gradient are used by the aggregation node to identify whether the client is a malicious node.

[0013] Secondly, this invention provides a trusted sandbox-extended federated learning optimization method, applied to aggregation nodes participating in federated learning tasks, comprising:

[0014] The system receives local model update parameters sent by multiple clients; these local model update parameters are obtained by the clients training a global model in a sandbox; the global model is used for power business prediction.

[0015] The local model update parameters sent by the multiple clients are aggregated to determine the updated global model.

[0016] According to a trusted sandbox-extended federated learning optimization method provided by the present invention, before aggregating the local model update parameters sent by the plurality of clients, the method further includes:

[0017] Obtain the first hash result uploaded by the client from the blockchain; the first hash result is obtained by the client through hash processing of the local model update parameters;

[0018] The local model update parameters sent by the client are hashed to obtain a second hash result;

[0019] Based on the first hash result and the second hash result, determine whether to discard the local model update parameters sent by the client.

[0020] According to a trusted sandbox-extended federated learning optimization method provided by the present invention, before aggregating the local model update parameters sent by the plurality of clients, the method further includes:

[0021] The test gradient is sent to the client; the test gradient is constructed based on a deep deterministic strategy.

[0022] The client is identified as a malicious node based on the directional and magnitude deviations between the test gradient and the response gradient; the response gradient is determined by the client based on the test gradient.

[0023] The present invention also provides a client comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements a federated learning optimization method for trusted sandbox extension as described in any of the first aspects above.

[0024] The present invention also provides an aggregation node, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a federated learning optimization method for trusted sandbox extension as described in any of the second aspects above.

[0025] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a federated learning optimization method for trusted sandbox extension as described above.

[0026] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a federated learning optimization method for trusted sandbox extension as described above.

[0027] The trusted sandbox-extended federated learning optimization method provided by this invention places the model training and parameter transfer process of federated learning tasks related to power business forecasting in a computation sandbox. In other words, while ensuring the trustworthiness of the computation and transmission process, the client can send local model update parameters to the aggregation node, and the aggregation node aggregates the local model update parameters sent by multiple clients, thereby accurately obtaining the updated global model and effectively ensuring the security of federated learning related to power business forecasting. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0029] Figure 1 This is one of the schematic diagrams of the trusted sandbox extension federated learning optimization method provided by the present invention.

[0030] Figure 2 This is the second schematic diagram of the trusted sandbox extension federated learning optimization method provided by the present invention.

[0031] Figure 3 This is the third schematic diagram of the trusted sandbox extended federated learning optimization method provided by the present invention.

[0032] Figure 4 This is the fourth schematic diagram of the trusted sandbox extension federated learning optimization method provided by the present invention.

[0033] Figure 5 This is the fifth schematic diagram of the trusted sandbox extended federated learning optimization method provided by the present invention.

[0034] Figure 6 This is one of the schematic diagrams of the experimental comparison results provided by the present invention.

[0035] Figure 7 This is the second schematic diagram of the experimental comparison results provided by the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0037] The following is combined with Figures 1-7 This invention describes a federated learning optimization method for a trusted sandbox extension.

[0038] To facilitate a clearer understanding of the technical solutions of the various embodiments of this application, some technical content related to the various embodiments of this application will be introduced first.

[0039] Federated learning, as a new branch of machine learning technology, enables efficient joint modeling and training among multiple users while ensuring privacy data remains within the user's local environment, fully unlocking the potential value of data. Therefore, it has brought new impetus to various industries in recent years, with broad application prospects in fields such as the Industrial Internet, smart cities, power, and retail. However, traditional federated learning neglects the security issues of data, models, and results during training and transmission. A significant security threat to federated learning is poisoning attacks. Poisoning attacks can be categorized into data poisoning attacks and model poisoning attacks. Data poisoning attacks involve attackers contaminating the training dataset, causing the model to learn incorrect correspondences during training, thus reducing model accuracy. Model poisoning attacks, on the other hand, manipulate the global model by controlling the client's training phase, replacing or tampering with the uploaded local model or gradients. During federated learning computation, malicious clients may attack legitimate clients, tampering with their gradients or impersonating legitimate clients to submit custom gradients, causing errors and rendering the final model invalid.

[0040] Figure 1 This is one of the flowcharts illustrating the trusted sandbox-extended federated learning optimization method provided by this invention, such as... Figure 1 As shown, the method includes the following:

[0041] Step 101: Train the global model in the sandbox to obtain the local model update parameters; the global model is used for power business prediction.

[0042] Specifically, in this embodiment, the client can create a trusted computing sandbox to perform the model training and parameter transfer processes for federated learning tasks related to power business forecasting within the sandbox. This means training the global model related to power business forecasting within the sandbox to obtain local model update parameters, thereby ensuring the trustworthiness of the computation and transmission process. Optionally, the global model is used for power business forecasting, such as load forecasting, credit assessment, power consumption forecasting, and query retrieval.

[0043] For example, the technical solutions in the embodiments of this application are as follows: Figure 2 As shown, the system consists of multiple Internet of Things (IoT) devices participating in federated learning. These IoT devices have limited computing and communication resources. Assuming there are M IoT devices, denoted by M = {1, ..., m, ..., M}, and the IoT device requesting the task is defined as m'. Assuming the IoT device set M has a corresponding training dataset D = {D1, ..., Dm, ..., DM}, the computational task is to train a task model based on dataset D and return the target model requested by the task requester. Optionally, in this architecture, the trusted computing sandbox aims to create an encrypted space as a secure area for model training and aggregation, protecting the code and data within from tampering or leakage by other processes. Optionally, Intel SGX technology can be used to create a protected memory region, called an Enclave, isolated from any other code in the system, based on a series of instructions. Strict access control and encryption operations are implemented in this protected space to provide protection for the confidentiality of program data and the integrity of code, thereby ensuring the trustworthiness of the computation and transmission process.

[0044] Step 102: Send the local model update parameters to the aggregation node; the aggregation node is used to determine the updated global model based on the local model update parameters.

[0045] Specifically, by placing the model training and parameter transfer processes for federated learning tasks related to power business forecasting within a computation sandbox, clients can send local model update parameters to the aggregation node while ensuring the reliability of the computation and transmission processes. The aggregation node then aggregates the local model update parameters sent by multiple clients, thereby accurately obtaining the updated global model and effectively guaranteeing the security of federated learning related to power business forecasting.

[0046] Optionally, such as Figure 3 As shown, the technical solution of this application is applicable to power services in new power systems, such as load forecasting, credit assessment, power consumption forecasting, and query retrieval tasks in demand-side response, source-grid interaction, and intelligent dispatching. By building a trusted sandbox-extended federated learning architecture for these services, it solves the problem of secure data sharing between different entity systems and provides a solution for privacy and security issues in large-scale data aggregation scenarios. Its architecture can be divided into a perception layer, a network layer, a platform layer, and an application layer. The perception layer includes various edge intelligent devices in the smart grid, used to acquire power service data. Through resource sharing such as communication and computing, it realizes notification perception access and edge intelligent processing at the source end, mainly referring to charging piles, meters, and electric vehicles. The network layer refers to various network devices, such as routers and base stations. The platform layer refers to system platforms for different users regarding different services, mainly referring to vehicle networking platforms, charging station platforms, power grid systems, and regulatory agencies. The trusted sandbox-extended federated learning architecture realizes trusted data interaction between various platforms at this layer and uses deep learning models to implement various services. The application layer includes various new power services, mainly referring to load forecasting, credit assessment, power consumption forecasting, and query retrieval.

[0047] For example, the trusted sandbox-extended federated learning architecture in this application embodiment can be used for load forecasting tasks at electric vehicle charging stations. The surge in electric vehicles has led to a surge in energy demand in the electricity market. When a large number of electric vehicles charge simultaneously, energy transmission congestion can occur. To address this issue, energy can be pre-reserved at charging stations to meet the real-time demand of electric vehicles. Optionally, historical records of energy consumption and charging duration of connected electric vehicles can be captured as a dataset and then stored on the charging station's power supplier (remote server) for training. However, this method requires electric vehicles connected to the charging station and the power supplier to share charging data, which may encounter privacy and security issues. The method in this application embodiment can effectively solve these problems. It predicts the energy demand of charging stations based on federated learning within a sandbox. The charging station records relevant information about locally charging vehicles but does not share the real dataset with the central server; it only shares the model trained on the local dataset at the charging station. The central server executes a model aggregation algorithm, training a prediction model through several iterations. The prediction model predicts the energy demand of the charging station, and based on the prediction results, a decision is made on whether to pre-store energy at the charging station and how much energy to store.

[0048] The method described above places the model training and parameter transfer process of the federated learning task related to power business forecasting in a computing sandbox. In other words, while ensuring the reliability of the computing and transmission process, the client can send local model update parameters to the aggregation node, and the aggregation node aggregates the local model update parameters sent by multiple clients, thereby accurately obtaining the updated global model and effectively ensuring the security of federated learning related to power business forecasting.

[0049] In one embodiment, after sending the local model update parameters to the aggregation node, the method further includes:

[0050] The local model update parameters are hashed to obtain the first hash result, which is then uploaded to the blockchain. The first hash result on the blockchain is used by the aggregation node to determine whether to discard the received local model update parameters.

[0051] Specifically, in this embodiment, after the client sends the local model update parameters to the aggregation node, it further hashes the local model update parameters to obtain a first hash result, which is then uploaded to the blockchain. Upon receiving the local model update parameters from the client, the aggregation node hashes the parameters to obtain a second hash result and compares the first and second hash results. Optionally, if the first hash result on the blockchain and the second hash result calculated by the aggregation node are inconsistent, indicating that the federated learning related to power business forecasting has been attacked, the local model update parameters sent by the client should be discarded to improve the security of the federated learning related to power business forecasting.

[0052] For example, such as Figure 4 As shown, it is first assumed that in the t-th round of federated learning training related to power business forecasting, the i-th training node performs local training and obtains local model updates in a trusted computing sandbox. Then the training nodes obtain local model updates. Then, immediately perform hash processing on it and obtain its hash value. Uploaded to the blockchain. Training nodes will then update the local model. The data is transmitted to the aggregation node via a secure channel between sandboxes. Finally, the aggregation node receives the local model updates from all training nodes. Then, the aggregation node downloads the hash values ​​of the local model updates from all training nodes on the blockchain. Furthermore, the aggregation node hashes the local model updates it receives and compares the hash value calculated by each training node with the downloaded hash value. If the comparison matches, the next aggregation operation proceeds normally. If the comparison does not match, it indicates that the local model update has been tampered with by an attacker, and the local model update result of that training node in this round must be discarded. In other words, by combining sandboxing and blockchain in this embodiment, the integrity and authenticity of data during transmission are effectively guaranteed, preventing malicious tampering by attackers, achieving reliable verification of model updates, and improving the security of federated learning related to power business forecasting.

[0053] In the method described above, after the client sends the local model update parameters to the aggregation node, the local model update parameters are further hashed to obtain a first hash result, which is then uploaded to the blockchain. Upon receiving the local model update parameters from the client, the aggregation node can hash the parameters to obtain a second hash result; and compare the first and second hash results to determine whether the local model update parameters sent by the client need to be discarded. In other words, by combining sandboxing and blockchain in this embodiment, the integrity and authenticity of data during transmission are effectively ensured, preventing malicious tampering by attackers, achieving reliable verification of model updates, and improving the security of federated learning related to power business forecasting.

[0054] In one embodiment, after sending the local model update parameters to the aggregation node, the method further includes:

[0055] Receive test gradients sent by the aggregation node; the test gradients are constructed based on a deep deterministic strategy.

[0056] Based on the test gradient, the response gradient is determined and sent to the aggregation node; the directional and magnitude deviations between the test gradient and the response gradient are used by the aggregation node to identify whether the client is a malicious node.

[0057] Specifically, to defend against poisoning attacks, this application implements periodic detection and identification of training nodes, removing malicious nodes to improve the security of the federated learning platform related to power business forecasting. Assuming a trusted sandbox-extended federated learning framework, there are n training nodes, represented as follows: This includes x malicious nodes and y normal nodes, and The aggregation rules based on federated learning perform a weighted average of the training results uploaded by the training nodes. Optionally, it is necessary to maintain a weight list for each training node. This is then used as the aggregation rule to aggregate the global model. During federated learning initialization, the initial weight of each training node is set to 1.

[0058] Optionally, to avoid excessively affecting the federated learning process and causing an excessive increase in training latency, the training mode is divided into two modes: detection mode and normal mode. Assuming that in a certain iteration f of the federated learning, in normal mode, the gradients of each training node are aggregated using formula (1) according to the maintained aggregation rules:

[0059] (1)

[0060] in, For global model updates in the f-th iteration of federated learning, This involves updating the local model of the i-th training node in the f-th iteration of the federated learning process. Then, the global model of the federated learning process is updated, resulting in the following global model:

[0061] (2)

[0062] in, For global model updates in the f-th iteration of federated learning, To federate the global model in the f-th iteration, For federated learning of the global model in the (f-1)th iteration, The learning rate for federal learning.

[0063] Assuming the federated learning system is in detection mode during a certain iteration t, the DDPG agent first learns the rules for the test gradient based on the current environment of the system. This rule, along with the local model updates of the training nodes from the previous iteration, is then used to construct the corresponding test gradient. The constructed test gradient is then used as the global model update for the new iteration and distributed to the corresponding training nodes for local training. By observing the reactions of the training nodes—specifically, the difference between their returned local model updates and the test gradient—poisoning detection is performed to determine if a node is malicious. Finally, based on the determination, the weight list of the aggregation rules for the federated learning system is adjusted. The process involves optimization and updates. Its workflow mainly consists of the following four steps: constructing test gradients, obtaining training node responses, poisoning detection, constructing new aggregation strategies, and updating the agent.

[0064] Optionally, such as Figure 5 As shown, the first step is to construct the test gradient, setting the state space in reinforcement learning as... ,in This represents the weight values ​​of the i-th training node in the t-th round of federated learning. The DDPG agent outputs the action space based on the state space. The actions output by the DDPG agent are defined as the rules for constructing the test gradient, where Indicates the change in magnitude. Indicates the change in direction, where Therefore, the test gradient constructed for the i-th training node is: , The test gradient construction formula (3) is satisfied.

[0065] (3)

[0066] in, For the first The training node at the _th ... Local model updates for wheels. For intermediate quantities generated during the construction of test gradients, Representing vectors Norm.

[0067] Then, the test gradient constructed in the action space. As the global model update in the t-th round of federated learning The data is then distributed to the corresponding training nodes for detection, and the response gradients of the training nodes are obtained. For the i-th training node, the local model is updated as follows:

[0068] (4)

[0069] in, Represents training nodes The learning rate. Indicates the training node at the th The local model for each round. Optionally, the training nodes train the model on the local dataset. And obtain local model update This means obtaining the response gradient of the training node.

[0070] Optionally, upon receiving the response gradient from the training node, i.e., the local model update... Subsequently, the direction and magnitude of gradient changes before and after training are detected to determine whether a node is malicious. Malicious nodes typically manipulate the uploaded gradients of the node, causing the global gradient to deviate from its original direction. The gradient direction of benign nodes usually points to the distribution of their local dataset, while the gradient direction of malicious nodes is usually random or contrary to the global gradient direction. Therefore, it is necessary to measure the change in gradient direction before and after testing. Optionally, cosine similarity is used in this implementation. The formula for measuring the degree of change in direction is shown in (5):

[0071] (5)

[0072] Optionally, the magnitude of the gradient of a malicious node also governs the poisoning effect. To make the poisoning effect appear as quickly as possible, malicious nodes often drastically change the gradient, especially when the gradient is greater than the benign gradient. Therefore, it is necessary to measure the magnitude of the gradient change. The embodiments of this application use gradient... The norm is used to measure the magnitude of the gradient, and the ratio of the gradient magnitude before and after the test is used. The magnitude of its change is measured by the formula shown in (6).

[0073] (6)

[0074] in, For the first The training node at the _th ... The local model update of the cycle is the response gradient. The test gradient is constructed for the i-th training node in round t.

[0075] Optionally, in this embodiment, the anomaly of a training node is redefined by the degree of deviation in direction and magnitude. Discriminant function The definition is shown in formula (7):

[0076] (7)

[0077] in, Controlling the anomaly The positive and negative, when When the value is negative, it means that the test gradient and response gradient of the training node are in opposite directions, and the change is huge. =1. When When the value is positive, The larger, The closer the value is to 1, The smaller. When When = 1, it means that the difference in gradient magnitude before and after the test is almost negligible. =0. Similarly, where and To control the impact of directional and magnitude deviations on outliers, adjustments should be made to ensure that both are of similar magnitude and have an equal impact. Size, Then, some appropriate adjustments are made to outliers. In summary, the definition of outliers encourages gradient updates within a small range, thereby avoiding the impact of malicious updates with large changes on federated learning.

[0078] Finally, after each round of detection, those identified as potentially poisoned during the poisoning detection will have a constant baseline value deducted. Specifically, for the i-th training node, the updated weights are... for:

[0079] (8)

[0080] in, This is the weight value updated for the i-th training node after the t-th round of detection. Let be the weight value of the i-th training node before the t-th round of detection. This indicates an outlier value in the training node of this detection round. This represents the set constant baseline value. When the weight value of a training node is reduced to less than or equal to 0, it is marked as a malicious node, and its gradients are no longer included in the aggregation process, effectively forcing it out of the federated learning process. The updated weight values... After normalization, a new list of model weights is generated. .

[0081] Alternatively, it can be based on a new list of model weights. The training nodes are aggregated again to obtain a new global model, and the reward settings for reinforcement learning are applied. , The calculation is as shown in formula (9):

[0082] (9)

[0083] in This represents the accuracy of the new global model on a clean validation dataset. 'a' and 'c' adjust for the order of magnitude and the impact of outliers. After obtaining the reward value, the DDPG agent is updated, and the above process is repeated until the reinforcement learning algorithm reaches the iteration termination condition. Afterwards, the new model weight list obtained when the iteration termination condition is reached is used. The current list of model weights is updated as a result of the reinforcement learning-based model security aggregation strategy.

[0084] In the method described above, the aggregation node constructs a test gradient and sends it to the client. Based on the directional and amplitude deviations between the test gradient and the response gradient sent by the client, the weights of each client can be updated and the client can be accurately identified as a malicious node. This effectively ensures the integrity and authenticity of the data during transmission, achieves reliable verification of model updates, and effectively improves the security of federated learning related to power business forecasting.

[0085] This application also provides a trusted sandbox-extended federated learning optimization method, applied to aggregation nodes participating in federated learning tasks, including:

[0086] Step 201: Receive local model update parameters sent by multiple clients; the local model update parameters are obtained by the clients training the global model in the sandbox; the global model is used for power business prediction.

[0087] Specifically, in this embodiment, the aggregation node first receives local model update parameters sent by multiple clients. These local model update parameters are obtained by the clients training the global model in a sandbox. In other words, the clients obtain the local model update parameters after training the global model related to power business forecasting in the sandbox, which effectively ensures the reliability of the calculation and transmission process. Optionally, the global model is used for power business forecasting, such as load forecasting, credit assessment, power consumption forecasting, and query retrieval.

[0088] Step 202: Aggregate the local model update parameters sent by multiple clients to determine the updated global model.

[0089] Specifically, after receiving local model update parameters from multiple clients, the aggregation node can aggregate the local model update parameters sent by multiple clients, thereby accurately obtaining the updated global model while ensuring the reliability of the calculation and transmission process, and effectively guaranteeing the security of federated learning related to power business forecasting.

[0090] The method described above places the model training and parameter transfer process of the federated learning task related to power business forecasting in a computing sandbox. In other words, while ensuring the reliability of the computing and transmission process, the aggregation node can accurately obtain the updated global model by aggregating the local model update parameters sent by multiple clients, thus effectively guaranteeing the security of federated learning related to power business forecasting.

[0091] In one embodiment, before aggregating the local model update parameters sent by multiple clients, the method further includes:

[0092] Retrieve the first hash result uploaded by the client from the blockchain; the first hash result is obtained by the client through hash processing of the local model update parameters;

[0093] The local model update parameters sent by the client are hashed to obtain a second hash result;

[0094] Based on the first hash result and the second hash result, determine whether to discard the local model update parameters sent by the client.

[0095] Specifically, in this embodiment, after receiving the local model update parameters sent by the client, the aggregation node can hash the local model update parameters sent by the client to obtain a second hash result, and compare the first hash result and the second hash result. Optionally, the first hash result is obtained by the client after hashing the local model update parameters, and the first hash result is uploaded to the blockchain to improve the security of federated learning. Optionally, if the first hash result on the blockchain and the second hash result calculated by the aggregation node are inconsistent, it indicates that the federated learning related to power business forecasting has been attacked. In this case, the aggregation node needs to discard the local model update parameters sent by the client, thereby improving the security of the federated learning related to power business forecasting.

[0096] In the method described above, after receiving the local model update parameters sent by the client, the aggregation node can hash the parameters to obtain a second hash result. It then compares the first hash result obtained from the blockchain with the calculated second hash result to determine whether the local model update parameters sent by the client need to be discarded. In other words, by combining a sandbox and blockchain in this embodiment, the integrity and authenticity of data during transmission are effectively guaranteed, preventing malicious tampering by attackers. This achieves reliable verification of model updates and improves the security of federated learning related to power business forecasting.

[0097] In one embodiment, test gradients are sent to the client; the test gradients are constructed based on a deep deterministic strategy.

[0098] The client is identified as a malicious node based on the directional and magnitude deviations between the test gradient and the response gradient; the response gradient is determined by the client based on the test gradient.

[0099] Specifically, in order to resist poisoning attacks, this embodiment of the application periodically detects and identifies training nodes, removes malicious nodes, and improves the security of the federated learning platform related to power business forecasting.

[0100] Optionally, the test gradient is first constructed, setting the state space in reinforcement learning as follows: ,in This represents the weight values ​​of the i-th training node in the t-th round of federated learning. The DDPG agent outputs the action space based on the state space. The actions output by the DDPG agent are defined as the rules for constructing the test gradient, where Indicates the change in magnitude. Indicates the change in direction, where Therefore, the test gradient constructed for the i-th training node is: , It satisfies the formula for constructing the test gradient.

[0101]

[0102] in, For the first The training node at the _th ... Local model updates for wheels. For intermediate quantities generated during the construction of test gradients, Representing vectors Norm.

[0103] Then, the test gradient constructed in the action space. As the global model update in the t-th round of federated learning The data is then distributed to the corresponding training nodes for detection, and the response gradients of the training nodes are obtained. For the i-th training node, the local model is updated as follows:

[0104]

[0105] in, Represents training nodes The learning rate. Indicates the training node at the th The local model for each round. Optionally, the training nodes train the model on the local dataset. And obtain local model update This means obtaining the response gradient of the training node.

[0106] Optionally, upon receiving the response gradient from the training node, i.e., the local model update... Subsequently, the direction and magnitude of gradient changes before and after training are detected to determine whether a node is malicious. Malicious nodes typically manipulate the uploaded gradients of the node, causing the global gradient to deviate from its original direction. The gradient direction of benign nodes usually points to the distribution of their local dataset, while the gradient direction of malicious nodes is usually random or contrary to the global gradient direction. Therefore, it is necessary to measure the change in gradient direction before and after testing. Optionally, cosine similarity is used in this implementation. To measure the degree of change in its direction.

[0107] Optionally, the magnitude of the gradient of a malicious node also governs the poisoning effect. To make the poisoning effect appear as quickly as possible, malicious nodes often drastically change the gradient, especially when the gradient is greater than the benign gradient. Therefore, it is necessary to measure the magnitude of the gradient change. The embodiments of this application use gradient... The norm is used to measure the magnitude of the gradient, and the ratio of the gradient magnitude before and after the test is used. To measure the magnitude of its change.

[0108] Optionally, the direction and magnitude deviations between the test gradient and the response gradient, as well as a preset threshold, can be used to determine whether a training node is a malicious node. This can effectively ensure the integrity and authenticity of the data during transmission and improve the security of federated learning related to power business forecasting.

[0109] In the method described above, the aggregation node constructs a test gradient and sends it to the client. Based on the directional and amplitude deviations between the test gradient and the response gradient sent by the client, the weights of each client can be updated and the client can be accurately identified as a malicious node. This effectively ensures the integrity and authenticity of the data during transmission, achieves reliable verification of model updates, and effectively improves the security of federated learning related to power business forecasting.

[0110] For example, this application provides a federated learning optimization method with trusted sandbox extension, the specific process of which is as follows:

[0111] (1) First, clients participating in federated learning tasks related to power business forecasting must first register as training nodes on the blockchain system. Participants submit identity information, descriptions of their data digests, dataset hashes, and computing resource information, including dataset size, computing unit speed, and storage space size, to facilitate blockchain scheduling and authentication.

[0112] (2) The blockchain system authenticates the client, integrates the resources provided by the client, and establishes a resource pool. The blockchain system maintains a virtual resource status table for all nodes, recording the allocation and usage of resources, which facilitates the instantiation of subsequent federated learning tasks.

[0113] (3) A training node initiates a federated learning task request and uploads the relevant federated learning parameters to the blockchain. The blockchain instantiates the federated learning task based on the relevant parameters of the federated learning task and the resource information of the node, and distributes the global model to the training nodes and broadcasts the training request.

[0114] (4) The training node creates a trusted computing sandbox locally, loads the data and training program code into the trusted computing sandbox for training, obtains the local model update of the federated learning task, and transmits it to the aggregation node through the secure channel between sandboxes.

[0115] (5) After all training nodes have completed training, the aggregation node aggregates the local models of the training nodes to obtain a new global model. Steps 4-5 above are repeated to continuously perform federated learning training and parameter transfer within the trusted computing sandbox until the iterative conditions for the federated learning task are met. Finally, the blockchain issues an iteration termination command, and the nodes destroy the trusted computing sandbox and release resources.

[0116] The method described above, by combining blockchain technology and a sandbox mechanism, ensures the trustworthiness of the federated learning training process related to power business forecasting, while reducing the risk of model poisoning attacks. Furthermore, by constructing appropriate test gradients, malicious nodes in the federated learning system can be detected and promptly removed, effectively mitigating the impact of data poisoning attacks.

[0117] For example, in a federated learning system related to power business forecasting, the deep convolutional neural network model ResNet18 is used to implement the image classification task on the CIFAR10 dataset. For each training node in the system, the ratio of the training set to the test set is 9:1.

[0118] Dataset: CIFAR-10 is a small dataset for recognizing common objects. It contains RGB color images for 10 categories: airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck. Each image in the CIFAR-10 dataset is 32 × 32 pixels, with 6000 images per category. The dataset contains a total of 50,000 training images and 10,000 test images.

[0119] Experimental Environment: In this embodiment, a federated learning framework based on a trusted computing sandbox was used to model the environment for resisting poisoning attacks. The open-source framework PyTorch was used for federated learning experiments, and the security aggregation strategy in this embodiment was simulated. Additionally, a Docker container was used to simulate the trusted computing sandbox. All experiments were performed on an Ubuntu 20.04.6 LTS 64-bit server with a 128 AMD EPYC 776364-Core Processor CPU, 52GB of memory, and 64 cores.

[0120] During the experiment, to simulate a real-world environment, unless otherwise specified, it was assumed that 20% of the nodes were malicious. The hyperparameter of the Dirichlet distribution was set to 0.5 when partitioning the dataset. To simulate a poisoning attack environment, a poisoning attack was performed every 10 rounds during the training of the federated learning system.

[0121] Optionally, the proposed method is compared with two existing defense measures, Fltrust and RECESS. To better observe the impact of poisoning attacks, federated learning experiments are conducted using common FedAvg aggregation rules, with and without poisoning, and these results are used as benchmarks to observe the effectiveness of different defense measures. During the experiments, the initial action space of the DDPG agent is set to... Regarding the implementation of constructing the test gradient, for the magnitude change, the gradient is directly scaled; for the direction change, noise is added to the gradient elements, and iterative adjustments are made until the cosine similarity before and after the change reaches the direction change. The training hyperparameter settings in the experiment are shown in Table 1.

[0122] Table 1

[0123]

[0124] Accuracy can be used to measure the performance of model training. Higher accuracy indicates better defenses. Furthermore, the effectiveness of an attack can also be measured by the degree of accuracy degradation. For two classic poisoning methods, label flipping attack (FLIP) and model replacement attack (MR), we evaluated the changes in average accuracy of the global model obtained in different iterations of federated learning on the test dataset using several different defense measures. The experimental results are as follows: Figure 6 , Figure 7 As shown.

[0125] It should be noted that the no-attack curve represents the federated learning experiment using FedAvg without poisoning attacks. Observing the above figure, it can be seen that, overall, the proposed solution has high model accuracy and is superior in reducing accuracy loss caused by poisoning attacks. Furthermore, it is closer to the case without poisoning attacks, indicating that the proposed solution has better defense. Additionally, since the proposed solution sets up a poisoning attack every 10 rounds, it can be seen from the figure that the model's accuracy decreases significantly every 10 rounds. However, the curve in the figure shows that the curve of the proposed solution changes more gently, indicating that the accuracy drop before and after the poisoning attack is less, demonstrating its advantage in reducing accuracy loss caused by poisoning attacks.

[0126] This application also provides a client, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a federated learning optimization method for trusted sandbox extension.

[0127] This application also provides an aggregation node, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a federated learning optimization method for trusted sandbox expansion.

[0128] This application also provides a federated learning system, including a client and an aggregation node.

[0129] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the trusted sandbox extended federated learning optimization method provided by the above methods. The method includes: training a global model in a sandbox to obtain local model update parameters; using the global model for power business prediction; sending the local model update parameters to an aggregation node; the aggregation node determining the updated global model based on the local model update parameters; or receiving local model update parameters sent by multiple clients; the local model update parameters are obtained by the clients training the global model in the sandbox; the global model is used for power business prediction; and aggregating the local model update parameters sent by multiple clients to determine the updated global model.

[0130] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a federated learning optimization method for trusted sandbox extension provided by the methods described above. This method includes: training a global model in a sandbox to obtain local model update parameters; using the global model for power business prediction; sending the local model update parameters to an aggregation node; the aggregation node determining the updated global model based on the local model update parameters; or, receiving local model update parameters sent by multiple clients; the local model update parameters are obtained by the clients training the global model in the sandbox; the global model is used for power business prediction; and aggregating the local model update parameters sent by multiple clients to determine the updated global model.

[0131] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A federated learning optimization method with trusted sandbox extension, characterized in that, Clients used in federated learning tasks include: The global model is trained in a sandbox to obtain local model update parameters; the global model is used for power business prediction. The local model update parameters are sent to the aggregation node; the aggregation node is used to determine the updated global model based on the local model update parameters. After sending the local model update parameters to the aggregation node, the process further includes: Receive the test gradient sent by the aggregation node; the test gradient is constructed based on a deep deterministic strategy; Based on the test gradient, a response gradient is determined and sent to the aggregation node; the directional and magnitude deviations between the test gradient and the response gradient are used by the aggregation node to identify whether the client is a malicious node.

2. The trusted sandbox-extended federated learning optimization method according to claim 1, characterized in that, After sending the local model update parameters to the aggregation node, the process further includes: The local model update parameters are hashed to obtain a first hash result, which is then uploaded to the blockchain. The first hash result on the blockchain is used by the aggregation node to determine whether to discard the received local model update parameters.

3. A federated learning optimization method with trusted sandbox extension, characterized in that, The aggregation nodes used in federated learning tasks include: The system receives local model update parameters sent by multiple clients; these local model update parameters are obtained by the clients training a global model in a sandbox; the global model is used for power business prediction. The local model update parameters sent by the multiple clients are aggregated to determine the updated global model; Before aggregating the local model update parameters sent by the multiple clients, the method further includes: The test gradient is sent to the client; the test gradient is constructed based on a deep deterministic strategy. The client is identified as a malicious node based on the directional and magnitude deviations between the test gradient and the response gradient; the response gradient is determined by the client based on the test gradient.

4. The trusted sandbox-extended federated learning optimization method according to claim 3, characterized in that, Before aggregating the local model update parameters sent by the multiple clients, the method further includes: Obtain the first hash result uploaded by the client from the blockchain; the first hash result is obtained by the client through hash processing of the local model update parameters; The local model update parameters sent by the client are hashed to obtain a second hash result; Based on the first hash result and the second hash result, determine whether to discard the local model update parameters sent by the client.

5. A client application, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the trusted sandbox extension federated learning optimization method as described in claim 1 or 2.

6. An aggregation node, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the trusted sandbox extension federated learning optimization method as described in claim 3 or 4.

7. A federated learning system, characterized in that, This includes the client as described in claim 5 and the aggregation node as described in claim 6.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the Federated Learning Optimization Method with Trusted Sandbox Extension as described in claim 1 or 2, or the Federated Learning Optimization Method with Trusted Sandbox Extension as described in claim 3 or 4.

Images