Security federal learning method based on cosine similarity and lightweight privacy protection

Abstract

The invention discloses a security federal learning method based on cosine similarity and lightweight privacy protection. The method comprises the following steps: S1, presetting global model convergence precision; s2, the central server issues the global model to a plurality of clients; s3, training a local model by the client, and training a central server model by the central server; s4, randomly generating random factors greater than 0 by the clients, multiplying each random factor by the local model of the corresponding client and updating the quantity, and then uploading the random factors to the central server; s5, retaining the model update of the non-malicious client; s6, performing aggregation global model updating on the non-malicious client model according to the reserved initial weight updated by the non-malicious client model, and judging whether the global model at the moment reaches preset global model convergence precision or not; if yes, terminating; and if not, carrying out aggregation again and updating the global model until the updated global model reaches the preset precision, and outputting a final updated global model.

Description

Technical Field

[0001] The present invention relates to technical fields such as Byzantine robust federated learning, and in particular to a secure federated learning method based on cosine similarity and lightweight privacy protection. Background Art

[0002] Federated learning (FL) is an emerging distributed machine learning that is performed on decentralized data. In FL, there are multiple clients (e.g., smartphones, IoT devices, and edge devices) and a service provider (e.g., Google, Apple, and IBM). Each client holds a local training dataset; the service provider enables clients to jointly learn a model (called the global model) without sharing their original local training data with the service provider. FL has been widely used due to its potential promise in protecting private / proprietary client data, especially in the era of emerging privacy regulations such as the General Data Protection Regulation (GDPR). For example, Google has deployed FL for next word prediction on Android Gboard; WeBank uses FL for credit risk prediction; and more than 10 leading pharmaceutical companies use FL for drug discovery in the MELLODDY project. Roughly speaking, FL iteratively performs the following three steps: the server provided by the service provider sends the current global model to the client or a selected subset; each selected client trains a model (called the local model) by fine-tuning the global model with its own local training data and sends the local model update back to the server; the server aggregates the local model update according to the aggregation rule, takes it as the global model update, and uses it to update the global model. For example, FedAvg, a popular FL method in non-adversarial settings developed by Google, computes a weighted average of local model updates as a global model update. However, due to its distributed nature, FL is vulnerable to adversarial manipulation by malicious clients, which could be fake clients injected by an attacker or real clients compromised by an attacker. For example, malicious clients can corrupt the global model by contaminating their local training data (known as data poisoning attacks) or the local model updates they send to the server (known as local model poisoning attacks). The corrupted global model either randomly makes incorrect predictions for a large number of test examples (known as untargeted attacks), or it predicts the attacker-selected target label for the attacker-selected target test examples, while the predicted labels for other non-target test examples remain unaffected (known as targeted attacks).

[0003] Byzantine-robust federated learning (FL) methods aim to address the malicious client problem. Their goal is to learn an accurate global model when a limited number of clients are malicious. Their key idea is to leverage Byzantine-robust aggregation rules, which essentially compare clients' local model updates and remove statistical outliers before using them to update the global model. However, recent studies have shown that existing FL methods are still vulnerable to local model poisoning attacks by malicious clients. The root cause is that they have no trust foundation. Specifically, from the server's perspective, each client may be malicious, which provides no trust foundation for the server to decide which local model updates are suspicious. FLTrust, which is more robust among existing methods, is different from relying entirely on client local model updates. Specifically, the server manually collects a small clean training dataset (called the root dataset). The server maintains a model (called the server model) for the root dataset, just like the client maintains a local model. In each iteration, the server updates the global model by considering its server model update and the client's local model update.

[0004] However, it still has the problem of inaccurate screening and identification of clients, so the proportion of malicious clients resisted is not high enough; and when the data distribution of the server model and the client model is quite different, the trust score that the server gives to the client as the aggregation weight is unreasonable, resulting in a client that should have made a great contribution to receive a lower aggregation weight. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a secure federated learning method based on cosine similarity and lightweight privacy protection, which is used to solve the technical problems that the prior art is not sufficiently resistant to malicious clients and the trust score given by the server to the client as an aggregation weight is unreasonable.

[0006] To achieve the above object, the present invention provides a secure federated learning method based on cosine similarity and lightweight privacy protection, comprising the following steps: S1: preset global model convergence accuracy; S2: The central server initializes the global model for this round , the global model Send to several clients; S3: The client trains the local model, and the central server trains the central server model; S4: Each client randomly generates a random factor greater than 0, and each random factor is multiplied by the local model update amount of the corresponding client, which is recorded as the model update of each client , and then upload it to the central server; S5: The central server calculates the central server model update separately and model updates for each client The cosine similarity between them is used to retain non-malicious clients based on the cosine similarity results; S6: Normalize the updates of the retained non-malicious client models, and then aggregate the global model updates according to the weights of the updates of each retained non-malicious client model to determine whether the global model at this time reaches the preset global model convergence accuracy; Yes, directly output the final global model update ; No, proceed to the next round, the global model in the next round S2 Updated by the global model aggregated in this round The global model of this round Replace until the preset global model convergence accuracy is reached.

[0007] Further: In said S5: The cosine similarity is detected by the activation function ReLU; The specific rule for retaining non-malicious clients is: remove the clients and client model updates corresponding to the cosine similarity results of 0, and the remaining clients are non-malicious clients.

[0008] Further: There are m non-malicious clients in S6, and the model update of the jth client among the m non-malicious clients is recorded as .

[0009] Further: the normalization process of the non-malicious client in S6 is shown in the following formula: ; in, The model update of the jth client among the m non-malicious clients retained in the current tth round; The normalized processing object here is the model updates corresponding to all non-malicious clients retained in S5; since the model update can be regarded as a vector, whose characteristics are direction and size, the essence of normalization is to scale the local model update size to the same scale as the server model update, further limiting the impact of the contaminated local model update size, which can enhance its robustness and make the model more stable.

[0010] Further: the judgment process of S6 includes a first round and two rounds or more, and in each round, the client model corresponding to the reserved non-malicious client needs to be updated and assigned weights before the judgment can be made.

[0011] Further: in the first round, the method of assigning weights to the client model updates corresponding to the non-malicious clients is: directly calculated from the client model updates corresponding to the non-malicious clients retained in the first round and the global model of the central server in the first round, including the following steps: Step 1: Calculate each normalized result corresponding to the first round of retained client model updates , t represents the round, at this time t=1; Step 2: According to Assign the corresponding weight to the jth client among the m non-malicious clients retained in the first round , which is calculated directly through the ReLU function.

[0012] Further: in the rounds greater than or equal to two, t≥2, the method for updating and allocating weights for the client model corresponding to the non-malicious client is: ; in, Update the weight assigned to the client model corresponding to the j-th non-malicious client retained in round t; The maximum angle between the normalized result of the client model update of all non-malicious clients retained in round t and the global model update aggregated in round t-1 The corresponding , denoted as ; j is the jth client among the m non-malicious clients retained in round t.

[0013] Further: the global model updates represents the global model update aggregated at the tth round, which is specifically shown by the following formula: ; Where t is the count of aggregation rounds; m is the total number of non-malicious client models retained in the tth round, ; represents the weight assigned to the jth client among the non-malicious clients retained in the tth round; It represents the normalized result of the client model update of the jth client among the non-malicious clients retained in the tth round.

[0014] Further: Specifically: , The value range is set to any value between 0.01 and 0.2.

[0015] The beneficial effects of the present invention are: different from the traditional method which is still vulnerable to local model poisoning attacks by malicious clients, the present invention introduces malicious client screening (based on cosine similarity) and weight scoring for malicious clients, and then performs indefinite rounds of aggregation, so that the trust score given by the server to the client as the aggregation weight is more reasonable, and the final aggregation model obtained is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention and the technical solutions in the prior art, the drawings required for use in the embodiments and the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a schematic diagram of the method flow of the present invention; Figure 2 A schematic diagram of model update vectorization according to a specific embodiment of the present invention; Figure 3 A schematic diagram of lightweight encryption for updating a client model according to a specific embodiment of the present invention; Figure 4 A schematic diagram of client screening according to a specific embodiment of the present invention; Figure 5 A schematic diagram of normalization of client model update according to a specific embodiment of the present invention; Figure 6 A schematic diagram of client weight allocation according to a specific embodiment of the present invention; Figure 7 This is a graph showing the relationship between the proportion of malicious clients and the error rate that can be sustained when being attacked by model poisoning using a commonly used robust aggregation algorithm; Figure 8 The present invention provides a method for Figure 7 The relationship between the training rounds and accuracy obtained under the same experimental conditions; Fig. 9 This is a graph showing the relationship between the proportion of malicious clients and the error rate that can be sustained when being attacked by model poisoning using a commonly used robust aggregation algorithm; Fig.10 The present invention provides a method for Fig. 9 A graph showing the relationship between training rounds and accuracy obtained under the same experimental conditions. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments provided by the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0019] Obviously, the drawings described below are only some examples or embodiments of the present invention. For ordinary technicians in this field, the present invention can be applied to other similar scenarios based on these drawings without any creative work.

[0020] In addition, it can be understood that although the efforts made in this development process may be complex and lengthy, for ordinary technicians in the field related to the contents disclosed in the present invention, some design, manufacturing or production changes based on the technical contents disclosed in the present invention are just conventional technical means and should not be understood as the contents disclosed in the present invention are insufficient.

[0021] If not otherwise specified, all embodiments and optional embodiments of the present invention can be combined with each other to form a new technical solution.

[0022] See also Figure 1 , the method flow chart of the present invention comprises the following steps: S1: preset global model convergence accuracy; S2: The central server initializes the global model for this round , the global model Send to several clients; S3: The client trains the local model, and the central server trains the central server model; S4: Each client randomly generates a random factor greater than 0, and each random factor is multiplied by the local model update amount of the corresponding client, which is recorded as the model update of each client , and then upload it to the central server; S5: The central server calculates the central server model update separately and model updates for each client The cosine similarity between them is used to retain non-malicious clients based on the cosine similarity results; S6: Normalize the updates of the retained non-malicious client models, and then aggregate the global model updates according to the weights of the updates of each retained non-malicious client model to determine whether the global model at this time reaches the preset global model convergence accuracy; Yes, directly output the final global model update ; No, proceed to the next round, the global model in the next round S2 Updated by the global model aggregated in this round The global model of this round Replace until the preset global model convergence accuracy is reached Specifically: In S3, clients use local datasets to train local models, and the central server uses the root dataset to train the central server model.

[0023] In S4, in order to protect the privacy of the client, the present invention introduces a lightweight privacy protection mechanism. Specifically, the client randomly generates a random factor greater than 0 after calculating the local model update. , n is the total number of clients, each random factor Multiply them by the local model update amount of the corresponding client, and record them as the model update of each client , and then uploaded to the central server. Multiplying the random factor can mask the original model update. When the attacker formulates an attack strategy based on the model update, the update obtained is not the original model, which weakens the attack and improves the robustness. In addition, the subsequent server does not need to decrypt, which will not increase the computing overhead.

[0024] The specific method of S5 is as follows: The central server calculates the central server model update separately And every client model update The cosine similarity is shown in the following formula: ; in, Initialize the global model corresponding to the current tth round Central server model update after that; The model update of each client in the current tth round (client local model update). Since all clients’ local models are multiplied by their own generated random factors, the number of each round is The quantity is the same, but the value is not the same; The cosine similarity is then detected by the activation function ReLU , when the cosine similarity When is 0, the corresponding i-th client is considered to be a malicious client and is removed; the rest are all non-malicious clients, a total of m, and the model updates of non-malicious clients and non-malicious clients are retained. The model update of the j-th client among the m non-malicious clients is recorded as .

[0025] In S6, the object of normalization processing is the model update corresponding to all non-malicious clients retained in the current t-th round S5; the model update of the j-th client among all the retained non-malicious clients is normalized as shown in the following formula: ; In S6, Specifically: , The value range is set to any value between 0.01 and 0.2.

[0026] Federated learning is generally multi-round, but due to the design of the present invention, in the first round (t=1) of the present invention, when the central server aggregates the models of the clients retained in this round, the weight (initial weight) of each client model is somewhat different from the weights of other rounds, which is obtained specifically according to the following method: The client multiplies the model update by the random factor and sends it to the server; Server computes client model updates and The cosine similarity of Use the ReLU function to test the cosine similarity. Clients with a test result of 0 are considered malicious clients and removed. The remaining m non-malicious clients and the corresponding client model updates are retained. Calculate the normalized results of the client model updates corresponding to the m non-malicious clients retained in the first round , at this time t=1; Directly based on Assign the corresponding weight to the jth client among the m non-malicious clients retained in the first round , which can be obtained directly through the ReLU function distribution, the formula is as follows: ; At this point, the first round (t=1) of non-malicious client weight distribution is completed.

[0027] In other rounds (t≥2), that is, in S6, the decision is made to “no”. For this, starting from the second round, the weight of the client reserved in the current round is updated in each round and obtained by the following method: After retaining the non-malicious clients; Then calculate the normalized results of the client model update corresponding to the m non-malicious clients retained in the current round t, that is, the normalized results of the client model update of all non-malicious clients corresponding to j=1 to j=m ; Since t≥2 at this time; determine the angle between the normalized results of the client model update of all non-malicious clients and the global model update aggregated in round t-1, that is, , j takes all angles from 1 to m; select the one with the largest angle among all the angles ,Right now The corresponding , denoted as ;according to Assign corresponding weights to the m non-malicious clients retained in the current round t , the formula is as follows: ; Among them, j is the j-th client among the m non-malicious clients retained in round t. At this point, the weight allocation in the case of round t≥2 is also completed.

[0028] Finally, the global model of round t aggregation is updated The details are as follows: ; Where t is the count of aggregation rounds; m is the total number of non-malicious client models retained in the tth round, ; represents the weight assigned to the jth client among the non-malicious clients retained in the tth round; It represents the normalized result of the client model update of the jth client among the non-malicious clients retained in the tth round.

[0029] See also Figures 2 to 6 , is a specific embodiment of the present invention; In this embodiment, the round t≥2, that is, the situation shown in this embodiment starts from the second round. It represents the aggregation result of the previous round of round t; This embodiment uses four clients for demonstration; Figure 2 This is a schematic diagram of model update vectorization in a specific embodiment of the present invention, showing that the current round aggregates the results of the previous round (For the global model update of this round) Perform steps S2-S3 to obtain the model update of the central server and client model updates ; Figure 3 A schematic diagram of lightweight encryption for updating a client model according to a specific embodiment of the present invention is shown. Then multiply it by the corresponding random factor The encrypted model obtained , i.e. part of step S4; Figure 4This is a schematic diagram of client screening in a specific embodiment of the present invention. In the part corresponding to step S5, the central server calculates and The cosine similarity between is as follows: ; ; ; ; Here, the ReLU function detects each cosine similarity separately. As can be seen from the figure, Corresponding to client 4 After detection, the value is 0, and client 4 is considered a malicious client and is excluded; Figure 5 This is a schematic diagram of client model update normalization in a specific embodiment of the present invention, in which the retained clients 1, 2, and 3 are normalized: , , .

[0030] Figure 6 This is a schematic diagram of client weight allocation in a specific embodiment of the present invention, where the normalized clients 1, 2, 3 and the global model of the previous round are updated. Calculate separately and find the global model update that is aggregated with the previous round The client model with the largest angle indicates that this client deviates from the global model update of the previous round of aggregation Farthest, as can be seen from the figure, the related term with the largest angle is The corresponding angle, so choose ; Then calculate the weights of clients 1, 2, and 3 respectively, which are: ; ; .

[0031] The final aggregation is: ; from Figures 2 to 6 It can be seen in The corresponding update direction of each parameter changes as follows: Generally speaking, parameters have an update direction, where It is completely reliable, so it can be used as a judgment. If the update of the client is less than 90° from its update, it can be considered that the direction is roughly consistent, and the client is considered good; Although the directions of the two most marginal parameters are somewhat similar to the directions (update directions) of any other parameters, one of the parameters and The angle of the components tends to be larger than 90°, so its actual pointing direction is rather vague.

[0032] In actual situations, the present invention adopts the following two means to solve this problem: 1. By judging any parameter and Is the angle greater than 90 degrees? Remove the parameters that are obviously out of place. Second, attackers will change the updates of malicious clients by formulating attack strategies to allow them to mix in and bypass the first step of screening. Therefore, when malicious clients mix in, they are given very low weights so that they will not have any impact. After processing, Figure 5 and Figure 6 It can be clearly seen that the remaining The corresponding parameter update direction is The angles between them all meet the condition of being less than 90°, so that malicious clients can be effectively screened out.

[0033] The experimental data of a specific embodiment provided by the present invention are as follows: These are the experimental results for the MNIST dataset and the Fashion-MNIST dataset respectively; Among them, the specific parameters of the MNIST data set (MNIST-0.1, MNIST-0.5) are: Number of images: 60,000 training images and 10,000 test images; Image size: Each image is 28×28 pixels in size and is a grayscale image, meaning that each pixel has only one color channel. Category: The images in the dataset are divided into 10 categories, corresponding to handwritten digits 0 to 9.

[0034] The specific parameters of the Fashion-MNIST dataset are: Number of images: 60,000 training images and 10,000 test images; Image size: Each image is 28×28 pixels in size and is a grayscale image, meaning that each pixel has only one color channel. Category: The data set is divided into 10 categories, namely: T-shirt / top (T-shirt / top), Trouser (pants), Pullover (pullover), Dress (dress), Coat (jacket), Sandal (sandals), Shirt (shirt); Sneaker (sports shoes), Bag (bag), Ankle boot (ankle boot).

[0035] The experimental results of the MNIST dataset (MNIST-0.1, MNIST-0.5) and Fashion-MNIST dataset are shown in Table 1, Table 2 and Table 3 respectively:

[0036] In the table, each item is represented as follows: No attack: No attack; LF attack: data poisoning attack, label flipping attack, for example, if the number of label categories in a dataset is 10, label x is flipped to 10-x-1; Krum attack: model poisoning attack (Krum class); Trim attack: model poisoning attack (Trim class); Scaling attack: Backdoor attack, embedding trigger tags in training samples to make the model recognize them as pre-specified tags; Adaptive attack: model poisoning attack (Adaptive class); FLTrust: represents the results obtained by the currently commonly used robust aggregation algorithm; FLTG: represents the result obtained by the aggregation algorithm provided by the present invention; Scaling attack / is the attack success rate, that is, the probability that the model identifies the test sample as a pre-specified sample; The specific numerical value part, i.e. 0.1195, is the error rate of the final model for the test set, which is specifically equal to 1 minus the accuracy of the final model for the test set. It can be clearly seen that the error rate corresponding to the aggregation algorithm of the present invention is lower (better) than the currently commonly used Robin aggregation algorithm in the case of various poisoning attacks.

[0037] Please see again Figure 7 , which is a comparison chart of the results in the case of FLTrust (a commonly used robust aggregation algorithm), where the vertical axis represents the error rate and the horizontal axis represents the proportion of malicious clients; the curve represented by FedAvg w / o attacks is the error rate of the classic method federated average in federated learning without attacks, which is used as the baseline; Figure 7The dataset used is MNIST, non-iid=0.5; FLTrust can only withstand 90% of malicious clients under the Adaptiveattack model poisoning attack (Adaptive class) in the dataset MNIST, non-iid=0.5 (non-independent and identically distributed, measuring the data range in (0,1], the larger the value, the greater the difference in data distribution), and the error rate rises sharply after exceeding 90% of malicious clients; The method provided by the present invention is as follows Figure 8 As shown, Figure 7 Experimental results Using the same data, the result graph obtained by using 90% malicious client attack, the horizontal axis represents the round, the vertical axis represents the test accuracy; it can be clearly seen that after multiple rounds of training, the accuracy rate has obviously increased from 0.1-0.2 to greater than 0.8, which is significantly higher than the accuracy rate of FLTrust (the above-mentioned commonly used robust aggregation algorithm).

[0038] Please see again Fig. 9 ,The result comparison chart of FLTrust (commonly used robust aggregation algorithm), where the vertical axis represents the error rate and the horizontal axis represents the proportion of malicious clients. The curve represented by FedAvg w / o attacks is the error rate of the classic method federated average in federated learning without attacks, which is used as the baseline; Fig. 9 The dataset used is HAR, non-iid=0.17; FLTrust (a commonly used robust aggregation algorithm) can only withstand 80% of malicious clients under the adaptive attack model poisoning attack (Adaptive class) in the dataset HAR, non-iid=0.17 (non-independent and identically distributed, measuring the data range in (0,1], the larger the value, the greater the difference in data distribution); after exceeding the limit, the error rate rises sharply to 1; The method provided by the present invention is as follows Fig.10 ,and Fig. 9 The same data used in the experiment, with 85% malicious clients attacking the experimental results, the horizontal axis represents the round, the vertical axis represents the test accuracy (error rate = 1-accuracy); after multiple rounds of training, its accuracy obviously changes from 0.1-0.2 to greater than 0.8, and until the end of training, its accuracy is always maintained above 0.8, significantly exceeding Fig. 9 The accuracy of FLTrust (a commonly used robust aggregation algorithm) in .

[0039] The above is a very detailed description of one or more embodiments of the present invention, but the content is only a specific example of the present invention and cannot be considered to limit the scope of application of the present invention. Any other methods and changes proposed based on the content of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A secure federated learning method based on cosine similarity and lightweight privacy protection, characterized in that: The steps include: S1: preset global model convergence accuracy; S2: The central server initializes the global model for this round , the global model Send to several clients; S3: The client trains the local model, and the central server trains the central server model; S4: Each client randomly generates a random factor greater than 0, and each random factor is multiplied by the local model update amount of the corresponding client, which is recorded as the model update of each client , and then upload it to the central server; S5: The central server calculates the central server model update separately and model updates for each client The cosine similarity between them is used to retain non-malicious clients based on the cosine similarity results; S6: Normalize the updates of the retained non-malicious client models, and then aggregate the global model updates according to the weights of the updates of each retained non-malicious client model to determine whether the global model at this time reaches the preset global model convergence accuracy; Yes, directly output the final global model update ; No, proceed to the next round, the global model in the next round S2 Updated by the global model aggregated in this round The global model of this round Replace until the preset global model convergence accuracy is reached.

2. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 1, characterized in that: In S5: The cosine similarity is detected by the activation function ReLU; The specific rule for retaining non-malicious clients is: remove the clients and client model updates corresponding to the cosine similarity results of 0, and the remaining clients are non-malicious clients.

3. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 1, characterized in that: There are m non-malicious clients in S6, and the model update of the jth client among the m non-malicious clients is recorded as .

4. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 3, characterized in that: The normalization process of updating the non-malicious client model in S6 is shown in the following formula: ； in, The model update of the jth client among the m non-malicious clients retained in the current tth round.

5. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 4, characterized in that: The judgment process of S6 includes a first round and two rounds or more. In each round, the client model corresponding to the reserved non-malicious client needs to be updated and assigned weights before the judgment can be made.

6. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 5, characterized in that: In the first round, the method for assigning weights to the client model updates corresponding to the non-malicious clients is: directly calculated from the client model updates corresponding to the non-malicious clients retained in the first round and the global model of the central server in the first round, including the following steps: Step 1: Calculate each normalized result corresponding to the first round of retained client model updates , t represents the round, at this time t=1; Step 2: According to Assign the corresponding weight to the jth client among the m non-malicious clients retained in the first round , which is calculated directly through the ReLU function.

7. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 5, characterized in that: In the rounds greater than or equal to two, t≥2, the method for updating and assigning weights to the client model corresponding to the non-malicious client is: ； in, Update the weight assigned to the client model corresponding to the j-th non-malicious client retained in round t; The maximum angle between the normalized result of the client model update of all non-malicious clients retained in round t and the global model update aggregated in round t-1 The corresponding , denoted as ; j is the jth client among the m non-malicious clients retained in round t.

8. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 1, characterized in that: The global model updates represents the global model update aggregated at the tth round, which is specifically shown by the following formula: ； Where t is the count of aggregation rounds; m is the total number of non-malicious client models retained in the tth round, ; represents the weight assigned to the jth client among the non-malicious clients retained in the tth round; It represents the normalized result of the client model update of the jth client among the non-malicious clients retained in the tth round.

9. The secure federated learning method based on cosine similarity and lightweight privacy protection according to claim 1, characterized in that: Said Specifically: , The value range is set to any value between 0.01 and 0.2.

Images