Fairness and robustness evaluation method and device based on federated learning system

Abstract

The present invention discloses a fairness and robustness evaluation method and device based on a federated learning system, comprising: a central server publishes a global model to a set of clients, normal clients train the global model and generate local model parameters; a test client perturbs the global model to construct a perturbation model, and optimizes the perturbation model through a double-layer projection mechanism to obtain perturbation model parameters; the central server aggregates the local model parameters and the perturbation model parameters, aggregates the local model parameters to obtain a first global model and a second global model, performs a model publishing and model parameter aggregation process for several communication rounds, and evaluates the first global model and the second global model after a single communication round or several communication rounds to obtain fairness and robustness evaluation results. Through the above technical solution, the present invention provides a more effective fairness and robustness performance evaluation for the federated learning system, ensuring the accuracy of the global model in different task environments.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology, and in particular relates to a fairness and robustness evaluation method and device based on a federated learning system. Background Art

[0002] Artificial intelligence (AI) has become an emerging technology leading the next generation of industrial transformation, with a significant impact on application innovation, enterprise transformation, and social development. However, machine learning, as a core AI technology, faces challenges such as data collection difficulties, making traditional centralized machine learning, which relies on centralized data collection and training, increasingly difficult. Federated learning, a new branch of machine learning, enables efficient joint modeling and training among multiple participants, while ensuring that private data remains locally, fully unlocking the potential value of data and offering an effective solution to the challenges of traditional machine learning. With the increasing application of federated learning in industrial scenarios, such as training image classification models on Android phones and Google's keyboard predictions in Gboard, ensuring the fairness and reliability of federated learning model outputs is becoming increasingly important.

[0003] However, currently deployed federated learning systems face serious fairness and robustness issues. On the one hand, due to the heterogeneity of client data, federated learning models tend to perform better for participants with more data, leading to severe performance imbalances. On the other hand, a threatening adversary controlling some participants can launch poisoning attacks by modifying the training process of a portion of clients, disrupting the federated learning process and ultimately rendering the resulting model unusable. While current research on federated learning primarily focuses on improving the accuracy of federated learning models, fairness and accuracy are equally important model performance metrics and can both be targeted by adversaries. For example, an adversary targeting fairness could significantly degrade the performance of the global model on certain clients. Therefore, evaluating the fairness and robustness of federated learning systems under the threat of poisoning attacks has important practical significance in many fields.

[0004] Currently, there is still a lack of technical solutions for evaluating the fairness and robustness of federated learning systems in insecure environments, which makes federated learning systems potentially dangerous when deployed in practice. Summary of the Invention

[0005] To solve the above technical problems, the present invention proposes a fairness and robustness evaluation method and device based on a federated learning system, which provides a more effective fairness and robustness performance evaluation for the federated learning system in actual deployment, while ensuring the accuracy of the global model in different task environments, so as to solve the problems existing in the above-mentioned existing technologies.

[0006] To achieve the above objectives, the present invention provides a fairness and robustness evaluation method based on a federated learning system, including:

[0007] The central server publishes the global model to the client set, where the client set includes normal clients and test clients;

[0008] The normal client trains the global model to generate local model parameters;

[0009] The test client perturbs the global model to construct a perturbation model, and optimizes the perturbation model through a double-layer projection mechanism to obtain perturbation model parameters;

[0010] The central server aggregates the local model parameters and the disturbance model parameters, and separately aggregates the local model parameters to obtain a first global model and a second global model;

[0011] The model release and model parameter aggregation processes are carried out for several communication rounds, and the first global model and the second global model after a single communication round or several communication rounds are evaluated to obtain fairness and robustness evaluation results.

[0012] Optionally, in the client set, the normal client trains the global model based on local data; the test client perturbs the global model based on local data, and the local data of each client in the client set obeys non-independent and identically distributed.

[0013] Optionally, the perturbation model is constructed by perturbing the global model through an over-forgetting strategy, where the over-forgetting strategy is based on a federated forgetting method using projected gradient ascent.

[0014] Optionally, the perturbation model is enhanced by a momentum scheme, the process comprising:

[0015]

[0016] in, is the test client set, θ is the perturbation model, F i (θ) is the optimization target of the normal client, For testing clients Test loss function, For testing clients The test loss function The gradient is calculated on the local dataset of the test client, μ is the decay factor, t is the number of local iterations, and v t is the gradient of the driving momentum.

[0017] Optionally, the perturbation model is optimized by a double-layer projection mechanism, wherein the double-layer projection mechanism includes scale projection and direction projection, the scale projection is projected based on an upper bound projection function and a lower bound projection function, and the direction projection is projected based on an upper bound projection function.

[0018] Optionally, the calculation process using the projection function in the scale projection includes:

[0019]

[0020] ∏ inf (·) is the lower bound projection function, ∏ sup (·) is the upper bound projection function, Update parameters for the perturbation model, i.e., the difference between the perturbation model parameters and the global model parameters, It is the reference model update parameter set, that is, the difference between the reference model and the global model. The reference model is the trained local model calculated by simulating the normal training process of all test clients. Update parameters for the projected perturbation gradient model.

[0021] Optionally, the calculation process using the projection function in the directional projection includes:

[0022]

[0023] Among them, λ rev is an elimination factor used to set the degree of influence on the normal model update parameters in the aggregation, Avg(·) is an average function, Represents the average value of the reference model update parameter set.

[0024] Optionally, the projection function adopts a projection function based on fine-grained statistics or a projection function based on disturbance distance;

[0025] The projection function based on fine-grained statistics is:

[0026] Upper bound projection function ∏ sup The specific calculation process of (·) is:

[0027]

[0028] in, Update parameters for the perturbation model The dth dimension, u min Update parameter sets for reference models The minimum value of the d-th dimension, u max Update parameter sets for reference models The maximum value of the d-th dimension;

[0029] Lower bound projection function ∏ inf The specific calculation process of (·) is:

[0030]

[0031] Where Δ represents The direction of change between two projections, l min Update parameter sets for reference models The smaller value of the d-th dimension is calculated as in That is, the average value of the reference model update parameter set in the dth dimension, l max Update the parameter set for the perturbation model The maximum value of the d-th dimension is calculated as

[0032] The projection function based on the perturbation distance is:

[0033] Upper bound projection function ∏ sup The specific calculation process of (·) is:

[0034]

[0035] Lower bound projection function ∏ inf The specific calculation process of (·) is:

[0036]

[0037] in, is the L2 norm of the perturbation model update parameters, γ * The optimal L2 norm for updating the parameters of the perturbation model, λ inf Scaling factor for the lower bound of the norm of the perturbed model update parameters.

[0038] Optionally, the first global model and the second global model are evaluated based on the degree of performance fairness impact, the degree of accuracy impact, the degree of performance fairness impact persistence, and the degree of accuracy impact persistence;

[0039] The degree of performance fairness impact is calculated by calculating the difference in accuracy variance between the first global model and the second global model after a single round or several rounds of communication;

[0040] The accuracy impact is calculated by calculating the difference between the average accuracy of the first global model and the average accuracy of the second global model after a single round or several rounds of communication;

[0041] The performance fairness impact persistence degree is obtained by performing an integral calculation of the performance fairness impact degree on the first global model and the third global model after several rounds of communication;

[0042] The accuracy impact persistence is obtained by performing an integral calculation of the accuracy impact of the first global model and the third global model after several rounds of communication;

[0043] The third global model is a global model obtained by aggregating each communication round in the aggregation optimization process based on the normal model aggregation optimization of the first global model after several communication rounds.

[0044] On the other hand, the present invention also provides a fairness and robustness evaluation device based on a federated learning system, which is characterized by being used to execute the above method.

[0045] Compared with the prior art, the present invention has the following advantages and technical effects:

[0046] 1. The present invention adopts an excessive forgetting strategy to construct a perturbation model of the test client to evaluate the fairness and robustness of the federated learning system. It can intuitively show the degree of performance fairness damage and convergence speed of the global model under perturbation, which is conducive to discussing its robustness and fairness performance. At the same time, the perturbation model optimization strategy based on the double-layer projection mechanism can effectively solve the problem of gradual dilution of the perturbation effect caused by the iteration process of the global model under the premise of meeting the constraints, and can further observe the degree of continuity of the model fairness and robustness during the training process. The present invention realizes a comprehensive evaluation of the fairness and robustness of the federated learning system from multiple aspects such as model convergence speed, overall performance changes, performance balance and stability.

[0047] This invention uses only the local data of the test client when constructing the perturbation model, eliminating the need for constructing an external dataset. This approach is closer to the actual deployment environment of federated learning systems and has strong practical value. Furthermore, this invention conducted evaluation experiments on five mainstream Byzantine-robust federated learning systems and two federated learning systems in real-world task scenarios, ensuring the effectiveness of the evaluation results. Therefore, this invention helps deepen the understanding of the fairness and robustness of federated learning systems, draws attention to potential threats, and promotes the research and development of more trustworthy federated learning systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0049] Figure 1 1 is a flow chart of a fairness and robustness evaluation method based on a federated learning system according to an embodiment of the present invention;

[0050] Figure 2Schematic diagram of the federated learning system framework and training process according to an embodiment of the present invention;

[0051] Figure 3 Schematic diagram of the process of fairness and robustness evaluation in a federated learning system according to an embodiment of the present invention;

[0052] Figure 4 This is a schematic diagram of the construction principle of a disturbance model according to an embodiment of the present invention;

[0053] Figure 5 Schematic diagram of a projection function based on fine-grained statistics according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0055] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0056] The present invention discloses a fairness and robustness evaluation method and device based on a federated learning system. The method includes: step S1, determining a set of clients participating in the evaluation; step S2, normal clients training local models; step S3, test clients constructing a perturbation model and optimizing it through a two-layer projection mechanism; step S4, a central server aggregating the local models and generating a new global model; step S5, selecting different projection functions and performing fairness and robustness performance evaluation to evaluate the fairness and robustness of the federated learning system in actual deployment.

[0057] The technical solution of the present invention adopts an over-forgetting strategy to construct a perturbation model and a perturbation model optimization strategy based on a double-layer projection mechanism, and completes a comprehensive evaluation of the fairness and robustness of the federated learning system based on the global model convergence speed, accuracy and performance fairness in different task scenarios.

[0058] The federated learning system targeted by this invention is described below: A federated learning system is a distributed machine learning system that includes a central server and clients. The central server provides a global model to different clients. After training and optimizing the model, the distributed clients provide the optimized model parameters to the central server. The central server aggregates the model parameters transmitted by the clients to obtain the optimized global model parameters, thereby optimizing the global model. A federated learning system aims to enable multiple participants (clients) to train models without leaving their local data source, thereby protecting data privacy and enabling efficient data utilization. The main advantages of a federated learning system include: 1. Data privacy protection: Federated learning allows data to remain local, eliminating the need for centralized storage or processing, thereby reducing the risk of data leakage and enhancing data privacy. 2. Data diversity: Because data is trained on multiple different devices or servers, federated learning can leverage more diverse datasets, which helps improve the model's generalization ability. 3. Scalability: Federated learning can easily scale to tens of thousands of clients, making it suitable for large-scale distributed systems while maintaining efficient model training. 4. Flexibility: Federated learning can adapt to different network environments and device capabilities, allowing model training on resource-constrained devices.

[0059] Application Scenarios: Federated learning has a wide range of applications in various fields, including healthcare, finance, telecommunications, and government affairs. For example, in the healthcare field, federated learning can help multiple medical institutions jointly train disease diagnosis models without sharing patient data.

[0060] Example 1:

[0061] like Figure 1 As shown, an embodiment of the present invention provides a fairness and robustness evaluation method based on a federated learning system, comprising the following steps:

[0062] Step S1: Determine a client set participating in the evaluation, where the client set includes a number of normal clients and test clients;

[0063] Step S2: Each normal client performs training based on local data to generate local model parameters;

[0064] Step S3: Each test client constructs a perturbation model based on local data and optimizes it through a double-layer projection mechanism;

[0065] Step S4: The central server aggregates the local model parameters of each client in the client set through an aggregation algorithm and generates a new global model;

[0066] Step S5: Select different projection functions to optimize the perturbation model and perform global model fairness and robustness performance evaluation.

[0067] like Figure 2 、 3 As shown, the embodiment of the present invention provides a fairness and robustness evaluation method based on a federated learning system, including the following specific contents:

[0068] Step S1: Determine the client set participating in the evaluation

[0069] In the specific application scenario of the federated learning system, the federated learning system consists of a central server and a set of clients participating in the federated learning. and a collection of test clients The set of clients that make up the evaluation Each client c i Have an independently collected local dataset In actual scenarios, for the local data in each client participating in the evaluation, each local data set usually follows a non-independent and identically distributed distribution. At the start of the system, the central server first generates an initialized global model and distributed to all clients.

[0070] Step S2: Normal client trains local model and generates local model parameters

[0071] n normal clients train local models by solving the following optimization objective:

[0072]

[0073] Where, f(θ; x j ,y j ) indicates that the model θ is in the sample The loss value on is f(θ; x j ,y j ) in the dataset The mathematical expectation of the upper loss value, F i (θ) is the optimization objective function of model θ on the i-th client, that is, model θ in its local dataset experience loss.

[0074] In the tth round of communication in the federated learning system, the central server randomly selects k clients from the client set Each normal client Get the current global model parameters from the central server And in the local dataset Train on it to get the local model

[0075] Step S3: The test client constructs a perturbation model and optimizes it through a double-layer projection mechanism.

[0076] This embodiment constructs a perturbation model using an over-forgetting strategy to maximize the loss of some clients. This strategy, based on a federated forgetting method using projected gradient ascent, can rapidly degrade the model's performance on some clients, creating a perturbation model that threatens fairness. This is enhanced using a momentum scheme. Test clients share their local data via a secret channel.

[0077] The construction process of the perturbation model is expressed as the following optimization problem:

[0078]

[0079] in, represents the optimization objective of the perturbation model θ, Indicates the client set in the test client set that needs to reduce performance. Indicates the client set in the test client set whose performance needs to be guaranteed.

[0080] Since the normal client independently trains on its local dataset and uploads its local model parameters, and participates in the aggregation process of the central server together with the test client, the test client only needs to maximize the loss of the perturbation model on the local dataset and stabilize the perturbation reversal through the momentum scheme.

[0081] The specific process is as follows:

[0082]

[0083] Among them, θ is the perturbation model, For testing clients Test loss function, For testing clients The test loss function The gradient is calculated on the local dataset of the test client, μ is the decay factor, t is the number of local iterative training, v t is the gradient of the driving momentum. In particular, here represents the gradient operator, and Appear together only to indicate The gradient of The meaning is different.

[0084] Furthermore, the perturbation model is optimized through a double-layer projection mechanism, so that it can ensure the perturbation effect while lasting as long as possible, and making the perturbation model more difficult to distinguish from the normal model. The double-layer projection mechanism includes scale projection and directional projection, wherein the scale projection is based on the upper bound projection function and the lower bound projection function, and the directional projection is based on the upper bound projection function. In this example, the perturbation model constrains the training process through scale projection during the training process based on the over-forgetting strategy; after the training process is completed, the perturbation model is further optimized through directional projection. For ease of understanding, the following projection process is described from the perspective of model update:

[0085] 1) Scale projection. This projection process improves the perturbation capability of the test client’s perturbation model during the aggregation process and makes it more difficult to distinguish the perturbation model from the normal model. Figure 4 As shown in the figure, the perturbation model is constructed within the ring through the lower bound projection and the upper bound projection. The specific calculation process is:

[0086]

[0087] Among them, inf (·) is the lower bound projection function, ∏ sup (·) is the upper bound projection function, Update parameters for the perturbation model, i.e., the difference between the perturbation model parameters and the global model parameters, It is the reference model update parameter set, that is, the set of differences between the reference model and the global model. The reference model is the trained local model calculated by simulating the normal training process of all test clients. Update parameters for the projected perturbation model.

[0088] 2) Directional projection. This projection process increases the duration of the perturbation model of the test client during the aggregation process. Figure 4 As shown, the test client calculates a possible normal local model, i.e., the reference model, by simulating the normal training process, and adjusts the perturbation model based on this model to maximize the duration of the perturbation effect. The specific calculation process is:

[0089]

[0090] Among them, λ rev is an elimination factor used to set the degree of influence on the normal model update in the aggregation, Avg(·) is an average function, Represents the average value of the reference model update parameter set.

[0091] It's important to note that in federated learning, model update parameters typically refer to the parameter changes in a model trained on local data by each client during a specific round of training. These parameters include the model's weights, biases, and other adjustable parameters, reflecting the knowledge learned by the model. In scale projection and directional projection, by adjusting and optimizing the update parameters of the perturbation model, a perturbation model can be created that is indistinguishable from the normal model in certain characteristics, but which nonetheless significantly impacts global model performance.

[0092] The test client can choose two different upper bound projection functions and lower bound projection functions to optimize the perturbation model, namely (1) a projection function based on fine-grained statistics, which constrains and enhances the perturbation model at the parameter level; (2) a projection function based on perturbation distance, which constrains and enhances the perturbation model parameters in Euclidean space. Any of the above projection functions can be selected to optimize the perturbation model.

[0093] Step S4: The central server aggregates local models and generates a new global model

[0094] In the tth round of communication, the central server collects the local models of all clients And calculate the new round of global model through aggregation algorithm (such as federated average algorithm or other robust aggregation algorithm) And broadcast the global model to all clients.

[0095] Step S5: Select different projection functions to optimize the perturbation model and perform global model fairness and robustness performance evaluation

[0096] In step S5, a comprehensive evaluation of the federated learning system is performed. Evaluation results under different projection functions are compared and analyzed to assess changes in the fairness and robustness of the federated learning system. Specifically, for the same federated learning system, the evaluation experts test the system with and without a test client. After one or more rounds of communication, the performance changes of the global model are measured. The fairness and robustness of the federated learning system under the threat of poisoning attacks are comprehensively evaluated by calculating the degree of impact on performance fairness, the degree of impact on accuracy, the degree of persistence of performance fairness impact, and the degree of persistence of accuracy impact.

[0097] The specific implementation process of the projection function is as follows:

[0098] The projection functions in the two-layer projection mechanism are: 1) a projection function based on fine-grained statistics, which constrains and enhances the perturbation model at the parameter level; 2) a projection function based on perturbation distance, which constrains and enhances the perturbation model parameters in Euclidean space;

[0099] 1) Projection function based on fine-grained statistics.

[0100] Upper bound projection function ∏ sup (·) Update parameters of the perturbation model The dth dimension of Projection is performed based on the maximum and minimum values ​​of the reference model. The specific calculation process is as follows:

[0101]

[0102] in, Update parameters for the perturbation model The dth dimension, u min Update parameter sets for reference models The minimum value of the d-th dimension, u max Update parameter sets for reference models The maximum value of the d-th dimension;

[0103] Lower bound projection function ∏ inf (·)right Based on the larger and smaller values ​​of the reference model, and The specific calculation process is as follows:

[0104]

[0105] Where Δ represents The direction of change between two projections, l min Update parameter sets for reference models The smaller value of the d-th dimension is calculated as in That is, the average value of the reference model update parameter set in the dth dimension, l max Update the parameter set for the perturbation model The maximum value of the d-th dimension is calculated as

[0106] like Figure 5 As shown, the projection function based on fine-grained statistics avoids placing each gradient parameter of the perturbation model in the low-influence region and ensures that each gradient parameter of the perturbation model is always in the feasible region.

[0107] 2) Projection function based on perturbation distance.

[0108] The perturbation model is restricted to a suitable region using a double-layer projection mechanism based on the projection function of the perturbation distance, such as Figure 4 The specific calculation formula is:

[0109]

[0110] in, is the L2 norm of the perturbation model update parameters, γ * The optimal L2 norm of the perturbation model parameter update can be dynamically searched by simulating the aggregation process and accelerating the search process by bisection, or pre-specified as a fixed value by the test evaluation expert, λ inf Scaling factor for the lower bound of the norm of the perturbed model update parameters.

[0111] Compare and analyze the evaluation results under different projection functions to evaluate the fairness and robustness performance changes of the federated learning system. The specific evaluation steps are as follows:

[0112] For the same federated learning system, the evaluation experts tested the system with and without a test client, and measured the performance changes of the global model after one or more rounds of communication. The evaluation indicators are:

[0113] 1) Impact of performance fairness

[0114]

[0115] Among them, θ g Represents the global model without a test client, represents the global model with a test client, Var(·) represents the variance of the accuracy of the global model on the local datasets of all clients, and I var This is the performance fairness impact of the federated learning system, used to measure the fairness stability of the federated learning system when faced with poisoning attacks. A smaller metric means a more stable fairness performance of the federated learning system when faced with poisoning attacks.

[0116] 2) Impact of accuracy

[0117]

[0118] Where Acc(·) represents the average accuracy of the global model on the local datasets of all clients, I acc This is the impact on the accuracy of the federated learning system, used to measure the robustness of the federated learning system when faced with poisoning attacks. The smaller this indicator is, the more stable the federated learning system is when faced with poisoning attacks.

[0119] 3) Performance fairness affects the persistence of

[0120]

[0121] Among them, T0 is the last communication round when the test client stops constructing the perturbation model, T e This is the last round of communication for the evaluation. This metric tests the persistence of the impact of a client on the performance fairness of the federated learning system and measures how quickly the system recovers from a poisoning attack. A smaller metric indicates a faster recovery from a poisoning attack.

[0122] 4) Accuracy affects the degree of persistence

[0123]

[0124] in, This metric measures the persistence of the impact of a client on the accuracy of the federated learning system and how quickly the system recovers after a poisoning attack. A smaller metric indicates a faster recovery.

[0125] Example 2:

[0126] An embodiment of the present invention further provides a fairness and robustness evaluation device based on a federated learning system, comprising:

[0127] The acquisition module is used to construct the federated learning dataset and select the client set participating in the evaluation;

[0128] The training module is used to train the local model based on the client's local data;

[0129] an aggregation module, configured to enable the central server to aggregate the local model parameters of each client in the client set and generate a new global model;

[0130] The construction module is used to enable the test client to construct a perturbation model based on local data and optimize it through a two-layer projection mechanism;

[0131] Evaluation module, used to select different projection functions to optimize the perturbation model and perform global model fairness and robustness performance evaluation;

[0132] As an implementation method of an embodiment of the present invention, the construction module constructs a perturbation model based on the test client through an excessive forgetting strategy;

[0133] As an implementation method of an embodiment of the present invention, the optional projection functions of the double-layer projection mechanism are: 1) a projection function based on fine-grained statistics; 2) a projection function based on disturbance distance.

[0134] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A fairness and robustness evaluation method based on a federated learning system, characterized by: include: The central server publishes the global model to the client set, where the client set includes normal clients and test clients; The normal client trains the global model to generate local model parameters; The test client perturbs the global model to construct a perturbation model, and optimizes the perturbation model through a double-layer projection mechanism to obtain perturbation model parameters; The central server aggregates the local model parameters and the disturbance model parameters, and separately aggregates the local model parameters to obtain a first global model and a second global model; Perform model publishing and model parameter aggregation processes for several communication rounds, evaluate the first global model and the second global model after a single communication round or several communication rounds, and obtain fairness and robustness evaluation results; Optimizing the perturbation model through a double-layer projection mechanism, wherein the double-layer projection mechanism includes scale projection and directional projection, wherein the scale projection controls the parameter optimization range of the perturbation model, and the directional projection controls the parameter optimization direction of the perturbation model, the scale projection is based on an upper bound projection function and a lower bound projection function, and the directional projection is based on an upper bound projection function; The calculation process of the projection function in the scale projection includes: is the lower bound projection function, is the upper bound projection function, Update parameters for the perturbation model, i.e., the difference between the perturbation model parameters and the global model parameters, It is the reference model update parameter set, that is, the set of differences between the reference model and the global model. The reference model is the trained local model calculated by simulating the normal training process of all test clients. Update the parameters of the projected perturbation model, To test the client collection, Represents a test client; The calculation process of the projection function in the directional projection includes: in, Elimination factor, used to set the degree of influence on the normal model update parameters in the aggregation, is the average function, Represents the average value of the reference model update parameter set.

2. The method according to claim 1, characterized in that In the client set, the normal client trains the global model according to local data; the test client perturbs the global model according to local data, and the local data of each client in the client set obeys non-independent and identically distributed.

3. The method according to claim 1, characterized in that The perturbation model is constructed by perturbing the global model through an over-forgetting strategy based on a federated forgetting method with projected gradient ascent.

4. The method according to claim 1, wherein The perturbation model is enhanced by a momentum scheme, which involves: in, To test the client collection, is the perturbation model, For the optimization goal of normal clients, For testing clients Test loss function, For testing clients The test loss function The gradient of , which is calculated on the local dataset of the test client, is the attenuation factor, is the number of local iterations, is the gradient of the driving momentum.

5. The method according to claim 1, wherein The projection function adopts a projection function based on fine-grained statistics or a projection function based on disturbance distance; The projection function based on fine-grained statistics is: Upper bound projection function The specific calculation process is: in, Update parameters for the perturbation model No. dimensions, Update parameter sets for reference models No. The minimum value of the dimension, Update parameter sets for reference models No. The maximum value of the dimension; Lower bound projection function The specific calculation process is: in, express The direction of change between two projections, Update parameter sets for reference models No. The smaller value of the dimension, Update the parameter set for the perturbation model No. The larger value of the dimension; The projection function based on the perturbation distance is: Upper bound projection function The specific calculation process is: Lower bound projection function The specific calculation process is: in, Update parameters of the perturbation model norm, The best way to update the parameters of the perturbation model is norm, Scaling factor for the lower bound of the norm of the perturbed model update parameters.

6. The method according to claim 1, wherein Evaluate the first global model and the second global model based on the degree of performance fairness impact, the degree of accuracy impact, the degree of performance fairness impact persistence, and the degree of accuracy impact persistence; The degree of performance fairness impact is calculated by calculating the difference in accuracy variance between the first global model and the second global model after a single round or several rounds of communication; The accuracy impact is calculated by calculating the difference between the average accuracy of the first global model and the average accuracy of the second global model after a single round or several rounds of communication; The performance fairness impact persistence degree is obtained by performing an integral calculation of the performance fairness impact degree on the first global model and the third global model after several rounds of communication; The accuracy impact persistence is obtained by performing an integral calculation of the accuracy impact of the first global model and the third global model after several rounds of communication; The third global model is a global model obtained by aggregating each communication round in the aggregation optimization process based on the normal model aggregation optimization of the first global model after several communication rounds.

7. A fairness and robustness evaluation device based on a federated learning system, characterized in that: Used to perform the method according to any one of claims 1 to 6.

Images