Fair and robustness evaluation method and device based on federated learning system

Abstract

The invention discloses a fairness and robustness evaluation method and device based on a federated learning system, and the method comprises the steps: a central server issues a global model to a client set, and a normal client carries out the training of the global model, and generates a local model parameter; the test client disturbs the global model, constructs a disturbance model, and optimizes the disturbance model through a double-layer projection mechanism to obtain disturbance model parameters; the central server aggregates the local model parameters and the disturbance model parameters, aggregates the local model parameters to obtain a first global model and a second global model, and performs model release and model parameter aggregation processes of a plurality of communication rounds to obtain a second global model; and evaluating the first global model and the second global model after a single communication round or a plurality of communication rounds to obtain fairness and robustness evaluation results. According to the technical scheme, more effective fair and robust performance evaluation is provided for the federated learning system, and the accuracy of the global model in different task environments is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology, and in particular to a fairness and robustness evaluation method and device based on a federated learning system. Background Art

[0002] Artificial intelligence has become an emerging technology that leads the new generation of industrial transformation, especially having a significant impact on application innovation, enterprise transformation and social development. However, machine learning, as the core technology of artificial intelligence, faces problems such as data collection difficulties, making traditional centralized machine learning based on centralized data collection and training increasingly difficult. Federated learning, as a new branch of machine learning technology, can meet the premise of keeping privacy data local, conduct efficient joint modeling and model training among multiple participants, and fully release the potential value of data. It is an effective solution to the dilemma of traditional machine learning. With the increasing application of federated learning in industrial scenarios, such as training image classification models on Android phones and keyboard prediction used by Google in Gboard, it becomes increasingly important to ensure the fairness and reliability of the output of federated learning models.

[0003] However, currently deployed federated learning systems have serious fairness and robustness issues. On the one hand, due to the data heterogeneity of the clients, federated learning models tend to show better performance for participants with more data, resulting in serious performance imbalance. On the other hand, a threatening adversary who controls some participants can launch poisoning attacks by modifying the training process of some clients, destroying the federated learning process and ultimately rendering the obtained model unusable. However, current research on federated learning mainly focuses on improving the accuracy of federated learning models. Fairness and accuracy are equally important model performance indicators and can both be targeted by adversaries. For example, an adversary targeting fairness can cause the performance of the global model to significantly degrade on some clients. Therefore, evaluating the fairness and robustness of federated learning systems under the threat of poisoning attacks has important practical significance in many fields.

[0004] Currently, there is still a lack of technical solutions for evaluating the fairness and robustness of federated learning systems in insecure environments, which makes the federated learning systems deployed in practice potentially dangerous. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a fairness and robustness evaluation method and device based on a federated learning system, which provides a more effective fairness and robustness performance evaluation for the federated learning system in actual deployment, while ensuring the accuracy of the global model in different task environments, so as to solve the problems existing in the above-mentioned prior art.

[0006] To achieve the above objectives, the present invention provides a fairness and robustness evaluation method based on a federated learning system, including:

[0007] The central server publishes the global model to the client set, where the client set includes normal clients and test clients;

[0008] The normal client trains the global model to generate local model parameters;

[0009] The test client perturbs the global model, constructs a perturbation model, and optimizes the perturbation model through a double-layer projection mechanism to obtain perturbation model parameters;

[0010] The central server aggregates the local model parameters and the disturbance model parameters, and separately aggregates the local model parameters to obtain a first global model and a second global model;

[0011] The model publishing and model parameter aggregation processes of several communication rounds are performed, and the first global model and the second global model after a single communication round or several communication rounds are evaluated to obtain fairness and robustness evaluation results.

[0012] Optionally, in the client set, the normal client trains the global model based on local data; the test client perturbs the global model based on local data, and the local data of each client in the client set obeys non-independent and identically distributed.

[0013] Optionally, the perturbation model is constructed by perturbing the global model through an over-forgetting strategy, wherein the over-forgetting strategy is based on a federated forgetting method using projected gradient ascent.

[0014] Optionally, the perturbation model is enhanced by a momentum scheme, the process comprising:

[0015]

[0016] in, is the test client set, θ is the perturbation model, F i (θ) is the optimization target of a normal client, For testing clients Test loss function, For testing clients The test loss function is The gradient is calculated on the local data set of the test client, μ is the attenuation factor, t is the number of local iterations, and v t is the gradient of the driving momentum.

[0017] Optionally, the disturbance model is optimized by a double-layer projection mechanism, wherein the double-layer projection mechanism includes scale projection and directional projection, the scale projection is projected based on an upper bound projection function and a lower bound projection function, and the directional projection is projected based on an upper bound projection function.

[0018] Optionally, the calculation process using the projection function in the scale projection includes:

[0019]

[0020] ∏ inf (·) is the lower bound projection function, ∏ sup (·) is the upper bound projection function, Update the parameters of the perturbation model, that is, the difference between the perturbation model parameters and the global model parameters, is the reference model update parameter set, that is, the difference between the reference model and the global model. The reference model is the trained local model calculated by all test clients simulating the normal training process. Update parameters for the projected perturbation gradient model.

[0021] Optionally, the calculation process using the projection function in the directional projection includes:

[0022]

[0023] Among them, λ rev is the elimination factor used to set the degree of influence on the normal model update parameters in the aggregation. Avg(·) is the average function. Represents the average value of the reference model update parameter set.

[0024] Optionally, the projection function adopts a projection function based on fine-grained statistics or a projection function based on disturbance distance;

[0025] The projection function based on fine-grained statistics is:

[0026] Upper bound projection function ∏ sup The specific calculation process of (·) is:

[0027]

[0028] in, Update parameters for the perturbation model The dth dimension, u min Update parameter sets for reference models The minimum value of the d-th dimension, u max Update parameter sets for reference models The maximum value of the d-th dimension of ;

[0029] Lower bound projection function ∏ inf The specific calculation process of (·) is:

[0030]

[0031] Among them, Δ represents The direction of change between two projections, l min Update parameter sets for reference models The smaller value of the d-th dimension is calculated as in That is, the average value of the reference model update parameter set in the dth dimension, l max Update the parameter set for the perturbation model The larger value of the d-th dimension of is calculated as

[0032] The projection function based on the perturbation distance is:

[0033] Upper bound projection function ∏ sup The specific calculation process of (·) is:

[0034]

[0035] Lower bound projection function ∏ inf The specific calculation process of (·) is:

[0036]

[0037] in, is the L2 norm of the perturbation model update parameters, γ * The optimal L2 norm for updating the parameters of the perturbation model, λ inf Scaling factor for the lower bound on the norm of the perturbed model update parameters.

[0038] Optionally, the first global model and the second global model are evaluated by the degree of performance fairness impact, the degree of accuracy impact, the degree of performance fairness impact continuity and the degree of accuracy impact continuity;

[0039] The degree of performance fairness impact is calculated by calculating the difference between the accuracy variance of the first global model and the second global model after a single round or several rounds of communication;

[0040] The accuracy impact degree is calculated by calculating the difference between the average accuracy of the first global model and the second global model after a single round or several rounds of communication;

[0041] The degree of persistence of the performance fairness impact is obtained by performing an integral calculation of the degree of performance fairness impact on the first global model and the third global model after several rounds of communication;

[0042] The accuracy impact persistence is obtained by performing integral calculation of the accuracy impact of the first global model and the third global model after several rounds of communication;

[0043] The third global model is a global model obtained by aggregating each communication round in the aggregation optimization process by performing normal model aggregation optimization on the first global model after several rounds of communication.

[0044] On the other hand, the present invention also provides a fairness and robustness evaluation device based on a federated learning system, which is characterized by being used to execute the above method.

[0045] Compared with the prior art, the present invention has the following advantages and technical effects:

[0046] 1. The present invention adopts an over-forgetting strategy to construct a perturbation model of the test client to evaluate the fairness and robustness of the federated learning system. It can intuitively show the degree of performance fairness impairment and convergence speed of the global model under perturbation, which is conducive to discussing its robustness and fairness performance. At the same time, the perturbation model optimization strategy based on the double-layer projection mechanism can effectively solve the problem of gradual dilution of the perturbation effect caused by the iteration process of the global model under the premise of meeting the constraints, and can further observe the degree of continuity of the fairness and robustness of the model during the training process. The present invention realizes a comprehensive evaluation of the fairness and robustness of the federated learning system from multiple aspects such as model convergence speed, overall performance changes, performance balance and stability.

[0047] In the present invention, only the local data of the test client is used when constructing the perturbation model, and no additional external data set needs to be constructed. This is closer to the actual deployment environment of the federated learning system and has strong practical value. In addition, the present invention has conducted evaluation experiments on five mainstream Byzantine robust federated learning systems and two federated learning systems in real task scenarios to ensure the effectiveness of the evaluation results. Therefore, the proposal of the present invention helps to deepen the understanding of the fairness and robustness of the federated learning system, draw attention to potential threats, and promote more research and development on trusted federated learning systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0049] Figure 1 Schematic diagram of a flow chart of a fairness and robustness evaluation method based on a federated learning system according to an embodiment of the present invention;

[0050] Figure 2A schematic diagram of the federated learning system framework and training process of an embodiment of the present invention;

[0051] Figure 3 A schematic diagram of a process for evaluating fairness and robustness in a federated learning system according to an embodiment of the present invention;

[0052] Figure 4 A schematic diagram of the construction principle of a disturbance model according to an embodiment of the present invention;

[0053] Figure 5 Schematic diagram of a projection function based on fine-grained statistics according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0055] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0056] The present invention discloses a fairness and robustness evaluation method and device based on a federated learning system, the method comprising: step S1, determining a client set participating in the evaluation; step S2, a normal client training a local model; step S3, a test client constructing a perturbation model and optimizing it through a double-layer projection mechanism; step S4, a central server aggregating local models and generating a new global model; step S5, selecting different projection functions and performing fairness and robustness performance evaluations to evaluate the fairness and robustness of the federated learning system in actual deployment.

[0057] The technical solution of the present invention adopts an over-forgetting strategy to construct a perturbation model and a perturbation model optimization strategy based on a double-layer projection mechanism, and completes a comprehensive evaluation of the fairness and robustness of the federated learning system according to aspects such as the global model convergence speed, accuracy and performance fairness in different task scenarios.

[0058] The federated learning system targeted by the present invention is described as follows: the federated learning system is a distributed machine learning system, which includes a central server and a client. The central server provides a global model to different clients. After the distributed clients train and optimize the model, the trained and optimized model parameters are provided to the central server. The central server aggregates the model parameters transmitted by the client to obtain the optimized global model parameters to achieve global model optimization. The federated learning system aims to achieve data privacy protection and efficient data utilization by having multiple participants (clients) train the model without data leaving the local area. The main advantages of the federated learning system include: 1. Data privacy protection: Federated learning allows data to remain locally and does not require centralized storage or processing, thereby reducing the risk of data leakage and enhancing data privacy protection. 2. Data diversity: Since the data is trained on multiple different devices or servers, federated learning can utilize more diverse data sets, which helps to improve the generalization ability of the model. 3. Scalability: Federated learning can be easily extended to thousands of clients and is suitable for large-scale distributed systems while maintaining efficient model training. 4. Flexibility: Federated learning can adapt to different network environments and device capabilities, allowing model training on resource-constrained devices.

[0059] Application scenarios: Federated learning is widely used in many fields, including healthcare, finance, telecommunications, and government affairs. For example, in the healthcare field, federated learning can help multiple medical institutions jointly train disease diagnosis models without sharing patient data.

[0060] Embodiment 1:

[0061] like Figure 1 As shown, the embodiment of the present invention provides a fairness and robustness evaluation method based on a federated learning system, comprising the following steps:

[0062] Step S1: Determine a client set participating in the evaluation, where the client set includes a number of normal clients and test clients;

[0063] Step S2: Each normal client performs training based on local data to generate local model parameters;

[0064] Step S3: Each test client constructs a perturbation model based on local data and optimizes it through a double-layer projection mechanism;

[0065] Step S4: The central server aggregates the local model parameters of each client in the client set through an aggregation algorithm and generates a new global model;

[0066] Step S5: Select different projection functions to optimize the perturbation model and perform global model fairness and robustness performance evaluation.

[0067] like Figure 2 , 3 As shown, the embodiment of the present invention provides a fairness and robustness evaluation method based on a federated learning system, including the following specific contents:

[0068] Step S1: Determine the client set participating in the evaluation

[0069] In the specific application scenario of the federated learning system, the federated learning system consists of a central server and a set of clients participating in the federated learning. and a collection of test clients The set of clients that make up the evaluation Each client c i Have an independently collected local dataset In actual scenarios, for the local data in each client participating in the evaluation, each local data set usually follows a non-independent and identically distributed distribution. At the beginning of the system, the central server first generates an initialized global model and distributed to all clients.

[0070] Step S2: Normal client trains local model and generates local model parameters

[0071] n normal clients train local models by solving the following optimization objective:

[0072]

[0073] Among them, f(θ; x j ,y j ) indicates that the model θ is in the sample The loss value on is f(θ; x j ,y j ) in the dataset The mathematical expectation of the upper loss value, F i (θ) is the optimization objective function of model θ on the i-th client, that is, model θ in its local dataset experience loss.

[0074] In the tth round of communication in the federated learning system, the central server randomly selects k clients from the client set Each normal client Get the current global model parameters from the central server And in the local dataset Train on it to get the local model

[0075] Step S3: The test client constructs a perturbation model and optimizes it through a double-layer projection mechanism

[0076] This embodiment constructs a perturbation model through an over-forgetting strategy to maximize the loss of some clients. The over-forgetting strategy is based on a federated forgetting method using projected gradient ascent, which can quickly reduce the performance of the model on some clients, thereby forming a perturbation model that threatens fairness and is enhanced by a momentum scheme. The test clients share local data in each test client through a secret channel.

[0077] The construction process of the perturbation model is expressed by the following optimization problem:

[0078]

[0079] in, represents the optimization objective of the perturbation model θ, Indicates the client set in the test client set that needs to reduce performance. Indicates the client set in the test client set whose performance needs to be guaranteed.

[0080] Since the normal client independently trains on its local dataset and uploads its local model parameters, and participates in the aggregation process of the central server together with the test client, the test client only needs to maximize the loss of the perturbation model on the local dataset and stabilize the perturbation reversal through the momentum scheme.

[0081] The specific process is as follows:

[0082]

[0083] Among them, θ is the perturbation model, For testing clients Test loss function, For testing clients The test loss function is The gradient is calculated on the local data set of the test client, μ is the decay factor, t is the number of local iterative training, and v t is the gradient of the driving momentum. In particular, here represents the gradient operator, and Appear together only to indicate The gradient of The meaning is different.

[0084] Furthermore, the perturbation model is optimized through a double-layer projection mechanism to ensure that the perturbation effect lasts as long as possible, and the perturbation model is more difficult to distinguish from the normal model. The double-layer projection mechanism includes scale projection and directional projection, wherein the scale projection is based on the upper bound projection function and the lower bound projection function, and the directional projection is based on the upper bound projection function. In this example, the perturbation model constrains the training process through scale projection during the training process based on the over-forgetting strategy; after the training process is completed, the perturbation model is further optimized through directional projection. For ease of understanding, the following projection process is described from the perspective of model update:

[0085] 1) Scale projection. This projection process improves the perturbation ability of the perturbation model of the test client during the aggregation process and makes it more difficult to distinguish the perturbation model from the normal model. Figure 4 As shown, the perturbation model is constructed within the ring through lower bound projection and upper bound projection. The specific calculation process is:

[0086]

[0087] Among them, inf (·) is the lower bound projection function, ∏ sup (·) is the upper bound projection function, Update the parameters of the perturbation model, that is, the difference between the perturbation model parameters and the global model parameters, is the reference model update parameter set, that is, the set of differences between the reference model and the global model. The reference model is the trained local model calculated by all test clients simulating the normal training process. Update parameters for the projected perturbation model.

[0088] 2) Directional projection. This projection process increases the duration of the perturbation model of the test client during the aggregation process. Figure 4 As shown, the test client calculates a possible normal local model, i.e., the reference model, by simulating the normal training process, and adjusts the perturbation model based on the model to maximize the duration of the perturbation effect. The specific calculation process is:

[0089]

[0090] Among them, λ rev is the elimination factor used to set the degree of influence on the normal model update in the aggregation, Avg(·) is the average function, Represents the average value of the reference model update parameter set.

[0091] It should be noted that in federated learning, model update parameters usually refer to the parameter changes generated by the model trained by each client based on local data during a certain round of training. These parameters include the model's weights, biases, and other adjustable parameters, reflecting the knowledge learned by the model. In scale projection and direction projection, by adjusting and optimizing the perturbation model update parameters, a perturbation model that cannot be distinguished from the normal model in certain features but has a serious impact on the performance of the global model is adjusted.

[0092] The test client can select two different upper bound projection functions and lower bound projection functions to optimize the perturbation model: (1) a projection function based on fine-grained statistics, which constrains and enhances the perturbation model at the parameter level; (2) a projection function based on perturbation distance, which constrains and enhances the perturbation model parameters in the Euclidean space. Any of the above projection functions can be selected to optimize the perturbation model.

[0093] Step S4: The central server aggregates local models and generates a new global model

[0094] In the tth round of communication, the central server collects the local models of all clients And calculate the new round of global model through aggregation algorithm (such as federated average algorithm or other robust aggregation algorithm) And broadcast the global model to all clients.

[0095] Step S5: Select different projection functions to optimize the perturbation model and perform global model fairness and robustness performance evaluation

[0096] In step S5, a comprehensive evaluation is given to the federated learning system. The evaluation results under different projection functions are compared and analyzed to evaluate the fairness and robustness performance changes of the federated learning system. That is, for the same federated learning system, the test evaluation experts test the cases without test clients and with test clients, and measure the performance changes of the global model after one or more rounds of communication. The fairness and robustness of the federated learning system under the threat of poisoning attacks are comprehensively evaluated by calculating the degree of performance fairness impact, the degree of accuracy impact, the degree of performance fairness impact persistence, and the degree of accuracy impact persistence.

[0097] The specific implementation process of the projection function is as follows:

[0098] The projection functions in the double-layer projection mechanism are: 1) a projection function based on fine-grained statistics, which constrains and enhances the perturbation model at the parameter level; 2) a projection function based on perturbation distance, which constrains and enhances the perturbation model parameters in Euclidean space;

[0099] 1) Projection function based on fine-grained statistics.

[0100] Upper bound projection function ∏ sup (·) Update parameters of the perturbation model The dth dimension of Projection is performed based on the maximum and minimum values ​​of the reference model. The specific calculation process is as follows:

[0101]

[0102] in, Update parameters for the perturbation model The dth dimension, u min Update parameter sets for reference models The minimum value of the d-th dimension, u max Update parameter sets for reference models The maximum value of the d-th dimension of ;

[0103] Lower bound projection function ∏ inf (·)right Based on the larger and smaller values ​​of the reference model, and The specific calculation process is as follows:

[0104]

[0105] Among them, Δ represents The direction of change between two projections, l min Update parameter sets for reference models The smaller value of the d-th dimension is calculated as in That is, the average value of the reference model update parameter set in the dth dimension, l max Update the parameter set for the perturbation model The larger value of the d-th dimension of is calculated as

[0106] like Figure 5 As shown, the projection function based on fine-grained statistics avoids placing each gradient parameter of the perturbation model in the low-impact region and ensures that each gradient parameter of the perturbation model is always in the feasible domain.

[0107] 2) Projection function based on perturbation distance.

[0108] The perturbation model is confined to a suitable region using a double-layer projection mechanism based on the projection function of the perturbation distance, such as Figure 4 The specific calculation formula is:

[0109]

[0110] in, is the L2 norm of the perturbation model update parameters, γ * The optimal L2 norm of the perturbation model update parameter, which can be dynamically searched by simulating the aggregation process and accelerating the search process by using the dichotomy method, or pre-specified as a fixed value by the test evaluation expert, λ inf Scaling factor for the lower bound on the norm of the perturbed model update parameters.

[0111] Compare and analyze the evaluation results under different projection functions to evaluate the fairness and robustness performance changes of the federated learning system. The specific evaluation steps are as follows:

[0112] For the same federated learning system, the test evaluation experts test the situation with and without test clients, and measure the performance changes of the global model after one or more rounds of communication. The evaluation indicators are:

[0113] 1) Impact of performance fairness

[0114]

[0115] Among them, θ g represents the global model without a test client, represents the global model with a test client, Var(·) represents the variance of the accuracy of the global model on the local datasets of all clients, and I var The performance fairness impact of the federated learning system is used to measure the fairness stability of the federated learning system when it encounters the threat of poisoning attacks. The smaller the index is, the more stable the fairness of the federated learning system is when it encounters the threat of poisoning attacks.

[0116] 2) Impact of accuracy

[0117]

[0118] Where Acc(·) represents the average accuracy of the global model on the local datasets of all clients, I acc The impact of the accuracy of the federated learning system is used to measure the robustness of the federated learning system when faced with poisoning attacks. The smaller the index is, the more stable the federated learning system is when faced with poisoning attacks.

[0119] 3) Performance fairness affects the sustainability of

[0120]

[0121] Among them, T0 is the last communication round when the test client stops constructing the perturbation model, T e For the last round of communication for evaluation, This is used to test the persistence of the impact of the client on the performance fairness of the federated learning system and to measure the recovery speed of the performance fairness of the federated learning system after encountering the threat of poisoning attacks. The smaller the indicator, the faster the recovery speed of the performance fairness of the federated learning system after encountering the threat of poisoning attacks.

[0122] 4) Accuracy affects the degree of persistence

[0123]

[0124] in, This is used to test the persistence of the impact of the client on the accuracy of the federated learning system and to measure the recovery speed of the accuracy of the federated learning system after encountering a poisoning attack threat. The smaller the indicator, the faster the accuracy of the federated learning system recovers after encountering a poisoning attack threat.

[0125] Embodiment 2:

[0126] The embodiment of the present invention further provides a fairness and robustness evaluation device based on a federated learning system, comprising:

[0127] The acquisition module is used to construct the federated learning dataset and select the client set participating in the evaluation;

[0128] The training module is used to train the local model based on the client's local data;

[0129] an aggregation module, configured to enable the central server to aggregate the local model parameters of each client in the client set and generate a new global model;

[0130] A construction module, used to enable the test client to construct a perturbation model based on local data and optimize it through a double-layer projection mechanism;

[0131] Evaluation module, which is used to select different projection functions to optimize the perturbation model and perform global model fairness and robustness performance evaluation;

[0132] As an implementation of the embodiment of the present invention, the construction module constructs a disturbance model based on the test client through an over-forgetting strategy;

[0133] As an implementation method of an embodiment of the present invention, the optional projection functions of the double-layer projection mechanism are: 1) a projection function based on fine-grained statistics; 2) a projection function based on disturbance distance.

[0134] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A fairness and robustness evaluation method based on a federated learning system, characterized in that: include: The central server publishes the global model to the client set, where the client set includes normal clients and test clients; The normal client trains the global model to generate local model parameters; The test client perturbs the global model, constructs a perturbation model, and optimizes the perturbation model through a double-layer projection mechanism to obtain perturbation model parameters; The central server aggregates the local model parameters and the disturbance model parameters, and separately aggregates the local model parameters to obtain a first global model and a second global model; The model publishing and model parameter aggregation processes of several communication rounds are performed, and the first global model and the second global model after a single communication round or several communication rounds are evaluated to obtain fairness and robustness evaluation results.

2. The method according to claim 1, characterized in that In the client set, the normal client trains the global model according to local data; the test client perturbs the global model according to local data, and the local data of each client in the client set obeys non-independent and identically distributed.

3. The method according to claim 1, characterized in that The perturbation model is constructed by perturbing the global model through an over-forgetting strategy, which is based on a federated forgetting method using projected gradient ascent.

4. The method according to claim 1, characterized in that: The perturbation model is enhanced by a momentum scheme, which includes: in, is the test client set, θ is the perturbation model, F i (θ) is the optimization target of a normal client, For testing clients Test loss function, For testing clients The test loss function is The gradient is calculated on the local data set of the test client, μ is the attenuation factor, t is the number of local iterations, and v t is the gradient of the driving momentum.

5. The method according to claim 1, characterized in that The perturbation model is optimized through a double-layer projection mechanism, wherein the double-layer projection mechanism includes scale projection and directional projection, wherein the parameter optimization range of the perturbation model is controlled by the scale projection, and the parameter optimization direction of the perturbation model is controlled by the directional projection, the scale projection is projected based on an upper bound projection function and a lower bound projection function, and the directional projection is projected based on an upper bound projection function.

6. The method according to claim 5, characterized in that The calculation process by the projection function in the scale projection includes: ∏ inf (·) is the lower bound projection function, ∏ sup (·) is the upper bound projection function, Update the parameters of the perturbation model, that is, the difference between the perturbation model parameters and the global model parameters, is the reference model update parameter set, that is, the set of differences between the reference model and the global model. The reference model is the trained local model calculated by all test clients simulating the normal training process. Update parameters for the projected perturbation model.

7. The method according to claim 6, characterized in that The calculation process by the projection function in the directional projection includes: Among them, λ rev is the elimination factor used to set the degree of influence on the normal model update parameters in the aggregation. Avg(·) is the average function. Represents the average value of the reference model update parameter set.

8. The method according to claim 7, characterized in that The projection function adopts a projection function based on fine-grained statistics or a projection function based on disturbance distance; The projection function based on fine-grained statistics is: Upper bound projection function ∏ sup The specific calculation process of (·) is: in, Update parameters for the perturbation model The dth dimension, u min Update parameter sets for reference models The minimum value of the d-th dimension, u max Update parameter sets for reference models The maximum value of the d-th dimension of ; Lower bound projection function ∏ inf The specific calculation process of (·) is: Among them, Δ represents The direction of change between two projections, l min Update parameter sets for reference models The smaller value of the d-th dimension, l max Update the parameter set for the perturbation model The larger value of the d-th dimension of ; The projection function based on the perturbation distance is: Upper bound projection function ∏ sup The specific calculation process of (·) is: Lower bound projection function ∏ inf The specific calculation process of (·) is: in, is the L2 norm of the perturbation model update parameters, γ * The optimal L2 norm for updating the parameters of the perturbation model, λ inf Scaling factor for the lower bound on the norm of the perturbed model update parameters.

9. The method according to claim 1, characterized in that: Evaluating the first global model and the second global model by the degree of performance fairness impact, the degree of accuracy impact, the degree of performance fairness impact continuity, and the degree of accuracy impact continuity; The degree of performance fairness impact is calculated by calculating the difference between the accuracy variance of the first global model and the second global model after a single round or several rounds of communication; The accuracy impact degree is calculated by calculating the difference between the average accuracy of the first global model and the second global model after a single round or several rounds of communication; The degree of persistence of the performance fairness impact is obtained by performing an integral calculation of the degree of performance fairness impact on the first global model and the third global model after several rounds of communication; The accuracy impact persistence is obtained by performing integral calculation of the accuracy impact of the first global model and the third global model after several rounds of communication; The third global model is a global model obtained by aggregating each communication round in the aggregation optimization process by performing normal model aggregation optimization on the first global model after several rounds of communication.

10. A fairness and robustness evaluation device based on a federated learning system, characterized in that: Used to execute the method according to any one of claims 1 to 9.

Images