A data poisoning identification method and device for computing power scheduling model training

Abstract

The present application relates to the field of federated learning technology and provides a data poisoning identification method and device for computing power scheduling model training. The method includes: clustering model updates to obtain multiple model update clusters, and generating a representative model for each model update cluster; scoring the representative models to obtain an average score for each representative model, and dividing all representative models into multiple benign representative models and multiple suspected toxic representative models based on all average scores; determining multiple benign model updates that meet benign conditions from the model update clusters corresponding to the suspected toxic representative models, and generating secondary benign representative models based on all benign model updates; calculating the update weights of each benign representative model and each secondary benign representative model; updating the global model based on all update weights and all model updates to obtain the final global model. The method of the present application can improve the security and accuracy of computing power scheduling model training.

Description

Technical Field

[0001] The present application relates to the field of federated learning technology, and in particular to a data poisoning identification method and device for computing power scheduling model training. Background Art

[0002] The Computational Power Scheduling Model (CPSM) is a key tool for optimizing the allocation of computing resources, aiming to improve system efficiency, reduce costs, and ensure timely task completion. In different application scenarios, the CPSM can optimize the utilization of computing resources through various scheduling algorithms and make adjustments based on different constraints (such as real-time performance, cost, and load).

[0003] To improve the performance of computing scheduling models, they must be trained before being deployed in actual scheduling tasks. The training phase typically requires processing massive amounts of data and performing complex parameter optimization. This places significant demands on computing resources such as central processing units (CPUs), graphics processing units (GPUs), and tensor processing units (TPUs), making traditional single-server training insufficient. Consequently, computing scheduling model training is increasingly shifting toward federated learning architectures, leveraging these approaches to collaboratively optimize models and conduct asynchronous training across multiple computing nodes. However, in practical systems, data collection by individual nodes is often subject to interference from various factors, such as hardware failures, network anomalies, and malicious attacks. This can lead to contamination of training data, often exposing nodes to data poisoning attacks. Using tainted data for model training can lead to incorrect scheduling patterns, reducing overall scheduling performance and resource utilization. Ensuring model security while achieving efficient model training remains a critical challenge.

[0004] To address these issues, existing research has proposed two defense strategies: First, directly calculating the gradient similarity of each edge computing node's model to distinguish between benign and toxic model updates. However, since this requires uploading plaintext model parameters, this can expose edge computing nodes to membership inference attacks and leak training data. Second, based on clustering algorithms, clusters with smaller data volumes are considered toxic and removed. However, under heterogeneous data conditions, model updates vary significantly across nodes, which can easily lead to misjudgments and affect computing scheduling effectiveness. Therefore, existing data poisoning identification methods for computing scheduling model training struggle to balance security and accuracy. Summary of the Invention

[0005] This application provides a data poisoning identification method and device for computing power scheduling model training, which can solve the problem of not being able to strike a balance between security and accuracy during computing power scheduling model training.

[0006] In a first aspect, an embodiment of the present application provides a data poisoning identification method for computing power scheduling model training, the data poisoning identification method comprising:

[0007] Obtain the model update of the local model trained by each edge computing node; the model update is the parameter change between the local model parameters and the parameters of the global model received by the edge computing node, where the global model is the computing power scheduling model;

[0008] Cluster all model updates to obtain multiple model update clusters, and generate a representative model for each model update cluster;

[0009] Each representative model is scored to obtain the average score of each representative model, and all representative models are divided into multiple benign representative models and multiple suspected toxic representative models based on all the average scores; the benign representative model is a representative model with an average score less than the scoring threshold, and the suspected toxic representative model is a representative model with an average score greater than or equal to the scoring threshold;

[0010] For each suspected toxicity representative model, multiple benign model updates that meet the benign condition are determined from the model update clusters corresponding to the suspected toxicity representative model, and a secondary benign representative model is generated based on all the benign model updates;

[0011] Calculate the update weight of each benign representative model and each secondary benign representative model;

[0012] The global model is updated according to all update weights and all model updates to obtain the final global model, which is then used to formulate computing power scheduling strategies.

[0013] Optionally, generate a representative model for each model update cluster, including:

[0014] By formula:

[0015] ;

[0016] Generate the The representative model of the cluster is updated by the model ;

[0017] in, represents the global model, Indicates the The set of all model updates in a model update cluster, Indicates average, , Indicates the number of clusters for model update.

[0018] Optionally, score each representative model to obtain the average score of each representative model, including:

[0019] Use the test sets of all edge computing nodes to score all representative models and obtain a scoring matrix;

[0020] For each representative model, the mean of the corresponding elements in the scoring matrix is ​​calculated to obtain the average score of the representative model.

[0021] Optionally, use the test set of all edge computing nodes to score all representative models and obtain a scoring matrix, including:

[0022] By formula:

[0023] ;

[0024] Calculate the scoring matrix ;

[0025] in, Indicates local data of edge computing nodes, Indicates edge computing nodes The corresponding real test data, Indicates the A test set of edge computing nodes, represents the set of all representative models, represents the global model, represents the number of edge computing nodes, and MSE represents the root mean square error.

[0026] Optionally, multiple benign model updates that meet benign conditions are determined from the model update clusters corresponding to the suspected toxicity representative models, including:

[0027] Calculate the mean and covariance matrix of all model updates in the model update cluster corresponding to each benign representative model;

[0028] For each benign representative model, the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and the model update cluster corresponding to the benign representative model is calculated using the mean and covariance matrix corresponding to the benign representative model, and all Mahalanobis distances are averaged to obtain the mean Mahalanobis distance;

[0029] The benign representative model corresponding to the smallest mean Mahalanobis distance is taken as the target benign representative model, and the target mean and target standard deviation of the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and all model updates in the model update cluster corresponding to the target benign representative model are calculated.

[0030] For each model update in the model update cluster corresponding to the suspected toxicity representative model, if the target mean and target standard deviation corresponding to the model update meet the benign condition, the model update is regarded as a benign model update.

[0031] Optionally, using the mean and covariance matrix corresponding to the benign representative model, the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and the model update cluster corresponding to the benign representative model is calculated, including:

[0032] By formula:

[0033] ;

[0034] Calculate the Mahalanobis distance matrix between the model updates in the model update clusters corresponding to the suspected toxic representative model and the model update clusters corresponding to the benign representative model ;

[0035] in, Represents all model updates in the model update cluster corresponding to the suspected toxicity representative model, represents the mean of all model updates in the model update cluster corresponding to the benign representative model, Represents the covariance matrix of all model updates in the model update cluster corresponding to the benign representative model;

[0036] Benign conditions are:

[0037] ;

[0038] in, Represents a positive number, Indicates the target mean corresponding to the model update in the model update cluster corresponding to the suspected toxicity representative model, Indicates the target standard deviation of the model update corresponding to the model update cluster of the suspected toxicity representative model.

[0039] Optionally, a secondary benign representative model is generated based on all benign models, including:

[0040] By formula:

[0041] ;

[0042] Generating a quadratic benign representative model ;

[0043] in, represents the global model, represents the set of all benign model updates, Indicates the A benign model update.

[0044] Optionally, calculate the update weights of each benign representative model and each secondary benign representative model, including:

[0045] Assign the update weight of each benign representative model to the ratio of the number of benign representative models to the number of model update clusters;

[0046] For each quadratic benign representative model, perform the following steps:

[0047] Calculate the cosine similarity between the quadratic benign representative model and the benign cluster representative model;

[0048] Determine whether the cosine similarity is greater than the cosine similarity threshold;

[0049] If so, assign the update weight of the quadratic benign representative model to:

[0050] ;

[0051] in, Indicates the number of clusters updated by the model, represents the number of benign representative models, represents the number of model updates in the model update cluster corresponding to the quadratic benign representative model, represents the number of benign model updates corresponding to the quadratic benign representative model;

[0052] Otherwise, reduce , and returns the steps of determining, for each suspected toxicity representative model, multiple benign model updates that meet the benign conditions from the model update clusters corresponding to the suspected toxicity representative model, and generating a secondary benign representative model based on all benign model updates.

[0053] Optionally, the global model is updated according to all updated weights to obtain the final global model, including:

[0054] For each benign representative model, the updated weight of the benign representative model is used as the final weight of the model update corresponding to the benign representative model;

[0055] For each quadratic benign representative model, the updated weight of the quadratic benign representative model is used as the final weight of the model update corresponding to the quadratic benign representative model;

[0056] For each model update except the model update corresponding to the benign representative model and the model update corresponding to the quadratic benign representative model, assign the final weight of the other model updates to 0;

[0057] By formula:

[0058] ;

[0059] ;

[0060] Update the global model to obtain the final global model ;

[0061] in, represents the global model, Indicates the number of edge aggregation servers, Indicates the Aggregation model update of edge aggregation servers, Indicates the The final weight of the model update of the edge computing nodes, Indicates the Model update of edge computing nodes, Indicates the The number of edge computing nodes corresponding to each edge aggregation server.

[0062] In a second aspect, an embodiment of the present application provides a data poisoning identification device for computing power scheduling model training, comprising:

[0063] The acquisition module obtains the model update of the local model obtained by training each edge computing node; the model update is the parameter change between the local model parameters and the parameters of the global model received by the edge computing node, and the global model is the computing power scheduling model;

[0064] The clustering module clusters all model updates to obtain multiple model update clusters and generates a representative model for each model update cluster;

[0065] A scoring module scores each representative model to obtain an average score for each representative model, and divides all representative models into multiple benign representative models and multiple suspected toxic representative models based on all average scores; a benign representative model is a representative model with an average score less than a scoring threshold, and a suspected toxic representative model is a representative model with an average score greater than or equal to the scoring threshold;

[0066] a determination module, for each suspected toxicity representative model, determining a plurality of benign model updates that meet the benign condition from the model update clusters corresponding to the suspected toxicity representative model, and generating a secondary benign representative model based on all the benign model updates;

[0067] A calculation module calculates the update weight of each benign representative model and each secondary benign representative model;

[0068] The update module updates the global model based on all update weights and all model updates to obtain the final global model, and uses the final global model to formulate computing power scheduling strategies.

[0069] In a third aspect, an embodiment of the present application provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the data poisoning identification method for computing power scheduling model training is implemented.

[0070] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned data poisoning identification method for computing power scheduling model training.

[0071] The above solution of the present application has the following beneficial effects:

[0072] In an embodiment of the present application, the model update of the local model obtained by training each edge computing node is obtained, and then all model updates are clustered to obtain multiple model update clustering clusters, and a representative model of each model update clustering cluster is generated, and then each representative model is scored to obtain the average score of each representative model, and all representative models are divided into multiple benign representative models and multiple suspected toxic representative models according to all average scores, and then for each suspected toxic representative model, multiple benign model updates that meet the benign conditions are determined from the model update clustering cluster corresponding to the suspected toxic representative model, and a secondary benign representative model is generated based on all benign model updates, and then the update weights of each benign representative model and each secondary benign representative model are calculated, and finally the global model is updated according to all update weights and all model updates to obtain the final global model, and the final global model is used to formulate computing power scheduling strategy. Among them, the benign representative models and the suspected toxic representative models are divided according to the average score, and a preliminary distinction between benign and toxic is made. The benign model update is determined according to the suspected toxic representative model, and a detailed benign identification of the model update corresponding to the suspected toxic representative model is achieved, thereby improving the recognition accuracy of benign model updates and toxic model updates. By setting different update weights for different types of model updates to update the global model, the security and accuracy of updating the computing power scheduling model are improved, thereby ensuring the security and accuracy of using the computing power scheduling model to formulate computing power scheduling strategies.

[0073] In addition, when identifying the benign or toxic nature of model updates, there is no need to directly transmit model parameters in plain text, which effectively improves the privacy of model updates.

[0074] Other beneficial effects of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0076] Figure 1 A flowchart of a data poisoning identification method for computing power scheduling model training provided in one embodiment of the present application;

[0077] Figure 2 A schematic diagram of the structure of a federated learning system provided in one embodiment of the present application;

[0078] Figure 3A flowchart of a Gaussian mixture dynamic clustering algorithm provided in one embodiment of the present application;

[0079] Figure 4 A detailed process diagram of a data poisoning identification method for computing power scheduling model training provided in one embodiment of the present application;

[0080] Figure 5 A schematic diagram of the structure of a data poisoning identification device for computing power scheduling model training provided in one embodiment of the present application;

[0081] Figure 6 A schematic diagram of the structure of a terminal device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0082] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0083] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0084] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0085] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0086] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0087] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present invention. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0088] In response to the problem that security and accuracy cannot be taken into account at the same time during the training of existing computing power scheduling models, an embodiment of the present application provides a data poisoning identification method for computing power scheduling model training. The data poisoning identification method obtains the model update of the local model obtained by training each edge computing power node, and then clusters all model updates to obtain multiple model update clustering clusters, and generates a representative model for each model update clustering cluster, and then scores each representative model to obtain the average score of each representative model, and divides all representative models into multiple benign representative models and multiple suspected toxic representative models according to all average scores, and then, for each suspected toxic representative model, determines multiple benign model updates that meet the benign conditions from the model update clustering cluster corresponding to the suspected toxic representative model, and generates a secondary benign representative model based on all benign model updates, and then calculates the update weights of each benign representative model and each secondary benign representative model, and finally updates the global model according to all update weights and all model updates to obtain the final global model, and uses the final global model to formulate computing power scheduling strategies. Among them, the benign representative models and the suspected toxic representative models are divided according to the average score, and a preliminary distinction between benign and toxic is made. The benign model update is determined according to the suspected toxic representative model, and a detailed benign identification of the model update corresponding to the suspected toxic representative model is achieved, thereby improving the recognition accuracy of benign model updates and toxic model updates. By setting different update weights for different types of model updates to update the global model, the security and accuracy of updating the computing power scheduling model are improved, thereby ensuring the security and accuracy of using the computing power scheduling model to formulate computing power scheduling strategies.

[0089] In addition, when identifying the benign or toxic nature of model updates, there is no need to directly transmit model parameters in plain text, which effectively improves the privacy of model updates.

[0090] Next, an example explanation is given of the data poisoning identification method for computing power scheduling model training provided in this application.

[0091] like Figure 1 As shown, the data poisoning identification method for computing power scheduling model training of this application includes the following steps:

[0092] Step 11: Obtain the model update of the local model trained by each edge computing node.

[0093] The above model update is the parameter change between the parameters of the local model and the parameters of the global model received by the edge computing node. The global model is a computing power scheduling model, such as a computing power scheduling linear optimization model.

[0094] In some embodiments of the present application, the global model can be sent to the edge aggregation server through the cloud, and the edge aggregation server then sends the global model to the corresponding multiple edge computing nodes. The edge computing nodes use local data to train the global model, and then upload the trained model updates to the corresponding edge aggregation servers, so that the edge aggregation servers receive the model updates from the edge computing nodes, and the edge aggregation servers then aggregate all the model updates and upload them to the cloud.

[0095] For example, in some federated learning, including the cloud, at least one edge aggregation server, and multiple edge computing nodes, when formulating computing scheduling strategies, the cloud can be a cloud computing platform for parameter fusion, and the edge aggregation server can be a router, switch, and other equipment deployed in various places for edge data aggregation, local model fusion, and scheduling information transmission. The edge computing nodes can be smart terminals, sensors, and other data processing equipment that provide local data processing and real-time task execution. The real-time task can be pedestrian detection. Correspondingly, the local data is real-time images and videos of the area where pedestrian recognition is required. If there are multiple edge aggregation servers, all edge computing nodes are divided into multiple edge aggregation servers, such as Figure 2 As shown in the figure, the federated learning system includes a cloud and multiple edge aggregation servers (1, n, and m are the numbers of the edge servers in the figure). Each edge aggregation server corresponds to multiple edge computing nodes. Each edge aggregation server downloads the global model from the cloud and then sends the global model to the corresponding edge computing node. The edge computing node uses the local data set (historical computing data set) to train the global model and uploads the model update to the corresponding edge aggregation server. The edge aggregation server aggregates the model update and uploads the preliminary aggregated model update to the cloud. The cloud aggregates the model updates received from all edge aggregation servers again to obtain the updated global model and sends the updated global model to each edge aggregation server, so that the edge aggregation server and edge computing node repeat the above process until the global model converges, and sends the converged global model to the edge aggregation server for computing power scheduling strategy formulation. Use as Figure 2The federated learning system shown executes the above process to achieve effective formulation of computing power scheduling strategies.

[0096] In each update of the global model, the model update is the parameter change between the parameters of the global model sent to the edge computing node at the time of the update and the parameters of the local model obtained after the edge computing node trains the global model.

[0097] Step 12: cluster all model updates to obtain multiple model update clusters, and generate a representative model for each model update cluster.

[0098] In some embodiments of the present application, the steps of clustering all model updates to obtain multiple model update clusters and generating a representative model for each model update cluster include:

[0099] In the first step, all model updates are clustered to obtain multiple model update clusters.

[0100] Specifically, all parameter changes in the model update are used as the basis for clustering, and a Gaussian mixture dynamic clustering algorithm is used to cluster all model updates to obtain multiple model update clusters.

[0101] For example, the flowchart of the Gaussian mixture dynamic clustering is as follows: Figure 3 As shown in the figure, multiple Gaussian mixture clustering is performed on the local model updates uploaded by the edge computing node to obtain multiple clustering results and the number of clusters corresponding to the clustering results. Then, the Silhouette Coefficient (SC) score of each clustering result is calculated to obtain the SC score set. The cluster number with the highest SC score is selected and the corresponding clustering result is output. The calculation formula for the above SC score is:

[0102] ;

[0103] in, represents a data point in a cluster, express The average distance to other data points in the same cluster, express The average distance to all data points in the nearest other cluster, Indicates the total number of data points in the cluster.

[0104] The second step is to generate a representative model for each model update cluster.

[0105] Specifically, through the formula:

[0106] ;

[0107] Generate the The representative model of the cluster is updated by the model .

[0108] in, represents the global model, Indicates the The set of all model updates in a model update cluster, Indicates average, , Indicates the number of clusters for model update.

[0109] Exemplarily, the above steps can be performed on an edge aggregation server. If there are multiple edge aggregation servers, each edge aggregation server performs the above steps on all received model updates to obtain multiple model update clusters and generate a representative model for each model update cluster.

[0110] Step 13: Score each representative model to obtain an average score of each representative model, and divide all representative models into multiple benign representative models and multiple suspected toxic representative models according to all average scores.

[0111] The above-mentioned benign representative model is a representative model with an average score less than the score threshold, and the suspected toxic representative model is a representative model with an average score greater than or equal to the score threshold.

[0112] In some embodiments of the present application, the steps of scoring each representative model to obtain an average score of each representative model, and dividing all representative models into a plurality of benign representative models and a plurality of suspected toxic representative models according to all average scores include:

[0113] In the first step, all representative models are scored using the test sets of all edge computing nodes to obtain a scoring matrix.

[0114] The scoring matrix includes the score of each edge computing node for each representative model.

[0115] Specifically, through the formula:

[0116] ;

[0117] Calculate the scoring matrix .

[0118] in, Indicates local data of edge computing nodes, Indicates edge computing nodes The corresponding real test data, Indicates the A test set of edge computing nodes, represents the set of all representative models, represents the global model, represents the number of edge computing nodes, and MSE represents the root mean square error.

[0119] It should be noted that the formula for calculating the scoring matrix is ​​the overall expression of the calculation process, which means that all representative models are sent to each edge computing node respectively, and each edge computing node uses its own test set to calculate the score set of all representative models according to the root mean square error (that is, the score set in the above formula). ), and then upload the calculated score set to the edge aggregation server, which calculates the score matrix using the above formula.

[0120] In the second step, for each representative model, the mean of the elements corresponding to the representative model in the scoring matrix is ​​calculated to obtain the average score of the representative model.

[0121] Specifically, all scores of the same representative model are obtained from the score matrix, and the mean of these scores is calculated to obtain the average score of the representative model.

[0122] In the third step, all representative models are divided into multiple benign representative models and multiple suspected toxic representative models according to all average scores.

[0123] Specifically, the representative model with an average score less than the score threshold is regarded as a benign representative model, and the representative model with an average score greater than or equal to the score threshold is regarded as a suspected toxic representative model.

[0124] For example, the scoring threshold is 1.8, and the average scores of the three representative models are 1.2, 1.9, and 2.1, respectively. The representative model corresponding to the average score of 1.2 is a benign representative model, and the two representative models corresponding to the average scores of 1.9 and 2.1 are suspected toxic representative models.

[0125] Step 14 : for each suspected toxicity representative model, determine multiple benign model updates that meet the benign condition from the model update cluster corresponding to the suspected toxicity representative model, and generate a secondary benign representative model based on all the benign model updates.

[0126] In some embodiments of the present application, the steps of determining multiple benign model updates that meet the benign condition from the model update clusters corresponding to the suspected toxicity representative models, and generating a secondary benign representative model based on all benign model updates are specifically as follows:

[0127] The first step is to calculate the mean and covariance matrix of all model updates in the model update cluster corresponding to each benign representative model.

[0128] For example, the mean can be obtained by averaging all model updates in the model update cluster corresponding to the benign representative model; the covariance matrix can be obtained by combining all the above model updates into a matrix and then calculating the matrix using the formula for calculating the covariance matrix.

[0129] In the second step, for each benign representative model, the mean and covariance matrix corresponding to the benign representative model are used to calculate the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and the model update cluster corresponding to the benign representative model, and all Mahalanobis distances are averaged to obtain the mean Mahalanobis distance.

[0130] Specifically, through the formula:

[0131]

[0132] Calculate the Mahalanobis distance matrix between the model updates in the model update clusters corresponding to the suspected toxic representative model and the model update clusters corresponding to the benign representative model ;

[0133] in, Represents all model updates in the model update cluster corresponding to the suspected toxicity representative model, represents the mean of all model updates in the model update cluster corresponding to the benign representative model, Represents the covariance matrix of all model updates in the model update cluster corresponding to the benign representative model.

[0134] In the third step, the benign representative model corresponding to the smallest mean Mahalanobis distance is used as the target benign representative model, and the target mean and target standard deviation of the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and all model updates in the model update cluster corresponding to the target benign representative model are calculated.

[0135] Specifically, the Mahalanobis distance between the model update corresponding to the suspected toxicity representative model and each model update corresponding to the target benign representative model is calculated using the Mahalanobis distance calculation formula, and then all Mahalanobis distances are averaged to obtain the target mean corresponding to the model update corresponding to the suspected toxicity representative model. The standard deviation of all Mahalanobis distances is calculated using the formula for calculating the standard deviation to obtain the target standard deviation corresponding to the model update corresponding to the suspected toxicity representative model.

[0136] In the fourth step, each model update in the model update cluster corresponding to the suspected toxicity representative model is performed. If the model update and the corresponding target mean and target standard deviation meet the benign conditions, the model update is regarded as a benign model update.

[0137] Specifically, the benign conditions are:

[0138] ;

[0139] in, Represents a positive number, Indicates the target mean corresponding to the model update in the model update cluster corresponding to the suspected toxicity representative model, Indicates the target standard deviation of the model update corresponding to the model update cluster of the suspected toxicity representative model.

[0140] The fifth step is to generate a secondary benign representative model based on all benign models.

[0141] Specifically, through the formula:

[0142] ;

[0143] Generating a quadratic benign representative model .

[0144] in, represents the global model, represents the set of all benign model updates, Indicates the A benign model update.

[0145] It is worth mentioning that the benign model updates are determined based on the suspected toxic representative models, which enables detailed benign identification of the model updates corresponding to the suspected toxic representative models, thereby improving the identification accuracy of benign model updates and toxic model updates.

[0146] Step 15: Calculate the update weight of each benign representative model and each secondary benign representative model.

[0147] In some embodiments of the present application, the step of calculating the update weight of each benign representative model and each secondary benign representative model includes:

[0148] In the first step, the update weight of each benign representative model is assigned as the ratio of the number of benign representative models to the number of model update clusters.

[0149] In the second step, for each quadratic benign representative model, perform the following steps:

[0150] Calculate the cosine similarity between the quadratic benign representative model and the benign cluster representative model;

[0151] Determine whether the cosine similarity is greater than the cosine similarity threshold;

[0152] If so, assign the update weight of the quadratic benign representative model to:

[0153] ;

[0154] in, Indicates the number of clusters updated by the model, represents the number of benign representative models, represents the number of model updates in the model update cluster corresponding to the quadratic benign representative model, represents the number of benign model updates corresponding to the quadratic benign representative model;

[0155] Otherwise, reduce , and returns the steps of determining, for each suspected toxicity representative model, multiple benign model updates that meet the benign conditions from the model update clusters corresponding to the suspected toxicity representative model, and generating a secondary benign representative model based on all benign model updates.

[0156] It should be noted that the above-mentioned benign cluster representative model is the benign representative model among the representative models of all model update clusters under the edge aggregation server corresponding to the secondary benign representative model. If there are multiple benign representative models in the edge aggregation server, one of them is randomly selected as the benign cluster representative model. When taking the value of , take the preset value, such as the preset The values ​​include 7, 6, 5, 4, and 3. The value of is 6, which reduces After taking the value of The value of is 5. If When the value of is 3, the condition that the loss mean is less than the preset mean is still not met, and the loop ends.

[0157] Step 16: Update the global model based on all updated weights and all model updates to obtain the final global model, and use the final global model to formulate the computing power scheduling strategy.

[0158] In some embodiments of the present application, the above steps of updating the global model according to all update weights and all model updates to obtain the final global model are specifically:

[0159] In the first step, for each benign representative model, the updated weight of the benign representative model is used as the final weight of the model update corresponding to the benign representative model.

[0160] In the second step, for each quadratic benign representative model, the updated weight of the quadratic benign representative model is used as the final weight of the model update corresponding to the quadratic benign representative model.

[0161] In the third step, for each model update except the model update corresponding to the benign representative model and the model update corresponding to the quadratic benign representative model, the final weight of the other model updates is assigned to 0.

[0162] The fourth step is through the formula:

[0163] ;

[0164] ;

[0165] Update the global model to obtain the final global model .

[0166] in, represents the global model, Indicates the number of edge aggregation servers, Indicates the Aggregation model update of edge aggregation servers, Indicates the The final weight of the model update of the edge computing nodes, Indicates the Model update of edge computing nodes, Indicates the The number of edge computing nodes corresponding to each edge aggregation server.

[0167] It should be noted that after obtaining the final global model, the cloud can send the final global model to each edge aggregation server. The edge aggregation server collects the computing resources of each computing power node, and uses the final global model to allocate computing tasks based on the computing tasks collected in the federated learning system to realize the formulation of computing power scheduling strategy.

[0168] For example, the performance of the final global model can be evaluated by calculating the accuracy (Acc), precision (Prec), recall (Rec), and F1 score of the final global model to evaluate whether it meets expectations. If the change between the above evaluation indicators and the evaluation indicators of the initial global model is greater than the change threshold, the final global model is used as the initial global model, and the model update step of the global model obtained by training each edge computing node is returned to, and multiple iterations are performed until the change between the evaluation indicators and the evaluation indicators of the initial global model is less than or equal to the change threshold in multiple consecutive iterations, and the iteration is terminated. The calculation formula of the above evaluation indicators is:

[0169] ;

[0170] in, Indicates the number of cases predicted to be benign and actually benign. Indicates the number that is predicted to be toxic and is actually toxic. It indicates the number of predicted benign diseases that are actually toxic, that is, the number of false positives. It indicates the number of cases predicted to be toxic but actually benign, that is, the number of missed cases.

[0171] The method of the present application is illustrated below with reference to a specific example.

[0172] like Figure 4 As shown, after the start, the edge computing node uploads the local model gradient (i.e., model update), then uses the Gaussian mixture model for dynamic clustering, selects the clustering result with the highest SC score, and then generates a representative model based on the clustering result. , then calculate different edge computing nodes and verify the mean of the representative model (ie, average score), determine whether it is less than the threshold If so, the cluster corresponding to the representative model is a benign cluster, and the weight of all model updates is set to the ratio of the number of benign representative models to the number of model update clusters Otherwise, the cluster corresponding to the representative model is a suspected toxic cluster, and the toxicity update identification is performed and the weight is set again. The process ends after all the weights are set.

[0173] The method of the present application is illustrated below with reference to a specific example.

[0174] Taking the global model as an example, the linear optimization model of computing power scheduling based on linear programming, the expression of the model is:

[0175] ;

[0176] in, is the total completion time of computing power scheduling, Indicates the The completion time of a task, represents the benchmark scheduling time, To calculate the required weights for the task, the parameters to be trained are and error term For the convenience of explanation, we assume that the error term is a fixed value, the number of tasks is two, Take 1. The specific model to be trained is , the parameters need to be obtained through model training and .

[0177] In this process, the federated learning framework consists of three parts: the cloud, the edge aggregation server (EAS) and the edge computing node (ECN). The edge aggregation server includes the validation center (VC). In this case, the edge computing node refers to the computing resource unit located on the edge server, which is responsible for processing the data collected by the sensors and performing preliminary calculations or analysis.

[0178] Examples of data points in the local dataset of an edge computing node are shown in Table 1.

[0179] Table 1

[0180]

[0181] One part is the training data set and the other part is the testing data set.

[0182] In edge aggregation server 1, 50 edge computing nodes use their own training data sets to train the model and update the trained model to the new state. Upload to edge aggregation server 1; in edge aggregation server 2, 20 edge computing nodes use their own training data sets to train the model and update the trained model Upload to edge aggregation server 2. The model update uploaded by the edge computing node in edge aggregation server 2 is as follows:

[0183]

[0184] When clustering, the model in edge aggregation server 1 updates the Gaussian mixture dynamic clustering score (i.e., the silhouette coefficient) as shown in Table 2.

[0185] Table 2

[0186]

[0187] The results of the Gaussian mixture dynamic clustering score (i.e., silhouette coefficient SilhouetteScore) of the model update in edge aggregation server 2 are shown in Table 3.

[0188] Table 3

[0189]

[0190] Therefore, cluster 4 is selected in edge aggregation server 1, and cluster 5 is selected in edge aggregation server 2.

[0191] Generate representative models based on the clustering results. Four representative models are generated in edge server 1. 、 、 、 , sent to 50 edge computing nodes; 5 representative models are generated in edge aggregation server 2, 、 、 、 、 Distributed to 20 edge computing nodes.

[0192] The edge computing node uses the method of this application and the local test dataset to obtain the score of the representative model and upload it to the edge aggregation server. The average mean of each representative model in edge aggregation server 1 is shown in Table 4.

[0193] Table 4

[0194]

[0195] The average means of each representative model in edge aggregation server 2 are shown in Table 5.

[0196] Table 5

[0197]

[0198] Setting scoring thresholds In edge aggregation server 1, only the score of representative model 4 is less than the threshold Therefore, the class where representative model 4 belongs is defined as a benign cluster, and the other three clusters are defined as suspected toxic clusters; in edge aggregation server 2, only the score of representative model 3 is less than the threshold , so the class where the representative model 3 belongs is defined as a benign cluster, and the other four clusters are defined as suspected toxic clusters. In the edge aggregation server 1, the model update weight of the class where the representative model 4 belongs is set to , in edge aggregation server 2, the model update weight representing the class of model 3 is set to .

[0199] Then, the benign model update that satisfies the benign conditions is determined from the suspected toxic clusters, and the setting According to the method of the present application, the weight of the benign model update is obtained, and the model updates other than the benign model updates and the model updates in the benign clusters are identified as toxic updates, and their weights are set to 0.

[0200] The edge aggregation server uploads the model obtained by aggregation based on the weights to the cloud, and the edge aggregation server 1 Upload to the cloud, edge aggregation server 2 will Upload to the cloud.

[0201] The cloud performs secondary aggregation based on the weighted aggregation updates uploaded by each edge aggregation server and updates the global model. The new global model is .

[0202] It is worth mentioning that, based on the average score, benign representative models and suspected toxic representative models were divided, and a preliminary distinction between benign and toxic was made. Benign model updates were determined based on the suspected toxic representative models, and more detailed benign identification of model updates corresponding to suspected toxic representative models was achieved, thereby improving the recognition accuracy of benign model updates and toxic model updates. By setting different update weights for different types of model updates to update the global model, the security and accuracy of updating the computing power scheduling model were improved, thereby ensuring the security and accuracy of using the computing power scheduling model to formulate computing power scheduling strategies.

[0203] In addition, when identifying the benign or toxic nature of model updates, there is no need to directly transmit model parameters in plain text, which effectively improves the privacy of model updates.

[0204] The key to the method of this application is:

[0205] Key Point 1: Gaussian mixture dynamic clustering is used for model updates uploaded by each edge computing node to eliminate the impact of heterogeneous data on the clustering effect of model updates, while also eliminating the negative impact of the traditional method of using a fixed number of clusters on the clustering effect.

[0206] Key Point 2: Using a test dataset based on edge computing nodes to identify toxicity model updates improves the accuracy of identifying toxicity model updates and greatly reduces the amount of computation compared to traditional methods that directly perform similarity comparisons.

[0207] Key Point 3: Setting different weights for benign model updates and toxic model updates greatly reduces the impact of toxic model updates on the global model.

[0208] The following is an exemplary description of the data poisoning identification device for computing power scheduling model training provided in this application.

[0209] like Figure 5 As shown, an embodiment of the present application provides a data poisoning identification device for computing power scheduling model training. The data poisoning identification device 500 for computing power scheduling model training includes:

[0210] Acquisition module 501, obtains the model update of the local model obtained by training each edge computing node; the model update is the parameter change between the parameters of the local model and the parameters of the global model received by the edge computing node, and the global model is the computing power scheduling model;

[0211] Clustering module 502 clusters all model updates to obtain multiple model update clusters, and generates a representative model for each model update cluster;

[0212] Scoring module 503 scores each representative model to obtain an average score for each representative model, and divides all representative models into a plurality of benign representative models and a plurality of suspected toxic representative models based on all the average scores; a benign representative model is a representative model with an average score less than a scoring threshold, and a suspected toxic representative model is a representative model with an average score greater than or equal to the scoring threshold;

[0213] The determination module 504 determines, for each suspected toxicity representative model, a plurality of benign model updates that meet the benign condition from the model update cluster corresponding to the suspected toxicity representative model, and generates a secondary benign representative model based on all the benign model updates;

[0214] A calculation module 505 calculates the update weight of each benign representative model and each secondary benign representative model;

[0215] The update module 506 updates the global model according to all update weights and all model updates to obtain a final global model, and uses the final global model to formulate a computing power scheduling strategy.

[0216] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0217] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0218] like Figure 6 As shown, an embodiment of the present application provides a terminal device. The terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 6Only one processor is shown in the figure), a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 implements the steps of any of the above-mentioned method embodiments when executing the computer program D102.

[0219] Specifically, when the processor D100 executes the computer program D102, it obtains the model update of the local model obtained by training each edge computing node, then clusters all model updates to obtain multiple model update clustering clusters, and generates a representative model for each model update clustering cluster, and then scores each representative model to obtain the average score of each representative model, and divides all representative models into multiple benign representative models and multiple suspected toxic representative models according to all average scores, and then, for each suspected toxic representative model, determines multiple benign model updates that meet the benign conditions from the model update clustering cluster corresponding to the suspected toxic representative model, and generates a secondary benign representative model based on all benign model updates, and then calculates the update weights of each benign representative model and each secondary benign representative model, and finally updates the global model according to all update weights and all model updates to obtain the final global model, and uses the final global model to formulate computing power scheduling strategy. Among them, the benign representative models and the suspected toxic representative models are divided according to the average score, and a preliminary distinction between benign and toxic is made. The benign model update is determined according to the suspected toxic representative model, and a detailed benign identification of the model update corresponding to the suspected toxic representative model is achieved, thereby improving the recognition accuracy of benign model updates and toxic model updates. By setting different update weights for different types of model updates to update the global model, the security and accuracy of updating the computing power scheduling model are improved, thereby ensuring the security and accuracy of using the computing power scheduling model to formulate computing power scheduling strategies.

[0220] In addition, when identifying the benign or toxic nature of model updates, there is no need to directly transmit model parameters in plain text, which effectively improves the privacy of model updates.

[0221] The processor D100 may be a central processing unit (CPU), other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0222] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may also be an external storage device of the terminal device D10, such as a plug-in hard disk, a smart memory card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device D10. Furthermore, the memory D101 may include both an internal storage unit of the terminal device D10 and an external storage device. The memory D101 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory D101 may also be used to temporarily store data that has been output or is about to be output.

[0223] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0224] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0225] If the integrated unit is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process steps in the above-mentioned method embodiments by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to the data poisoning identification method apparatus / terminal device for computing power scheduling model training, a recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunications signals, and software distribution media. Examples include a USB flash drive, a removable hard drive, a magnetic disk, or an optical disk.

[0226] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0227] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0228] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles described in the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data poisoning identification method for computing power scheduling model training, characterized in that: include: Obtaining a model update for the local model trained by each edge computing node; the model update is the parameter change between the parameters of the local model and the parameters of the global model received by the edge computing node, where the global model is a computing power scheduling model; Cluster all model updates to obtain multiple model update clusters, and generate a representative model for each model update cluster; Scoring each representative model to obtain an average score of each representative model, and dividing all representative models into a plurality of benign representative models and a plurality of suspected toxic representative models according to all the average scores; the benign representative model is a representative model with an average score less than a scoring threshold, and the suspected toxic representative model is a representative model with an average score greater than or equal to the scoring threshold; For each of the suspected toxicity representative models, determine a plurality of benign model updates that meet benign conditions from the model update clusters corresponding to the suspected toxicity representative model, and generate a secondary benign representative model based on all the benign model updates; Calculating the update weight of each of the benign representative models and each of the secondary benign representative models; The global model is updated according to all update weights and all model updates to obtain a final global model, and the final global model is used to formulate a computing power scheduling strategy; The step of generating a representative model for each model update cluster includes: By formula: ； Generate the The representative model of the cluster is updated by the model ; in, represents the global model, Indicates the The set of all model updates in a model update cluster, Indicates average, , Indicates the number of clusters for model update.

2. The data poisoning identification method according to claim 1, characterized in that: Scoring each representative model to obtain an average score of each representative model includes: Use the test sets of all edge computing nodes to score all representative models and obtain a scoring matrix; For each representative model, the mean of the elements corresponding to the representative model in the scoring matrix is ​​calculated to obtain the average score of the representative model.

3. The data poisoning identification method according to claim 2, characterized in that: The test set of all edge computing nodes is used to score all representative models to obtain a scoring matrix, including: By formula: ； Calculate the rating matrix ; in, Indicates local data of edge computing nodes, Indicates edge computing nodes The corresponding real test data, Indicates the A test set of edge computing nodes, represents the set of all representative models, represents the global model, represents the number of edge computing nodes, and MSE represents the root mean square error.

4. The data poisoning identification method according to claim 1, characterized in that: The step of determining a plurality of benign model updates that meet benign conditions from the model update clusters corresponding to the suspected toxicity representative models includes: Calculate the mean and covariance matrix of all model updates in the model update cluster corresponding to each benign representative model; For each of the benign representative models, using the mean and covariance matrix corresponding to the benign representative model, calculate the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and the model update cluster corresponding to the benign representative model, and average all Mahalanobis distances to obtain the mean Mahalanobis distance; The benign representative model corresponding to the smallest mean Mahalanobis distance is used as the target benign representative model, and the target mean and target standard deviation of the Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxicity representative model and all model updates in the model update cluster corresponding to the target benign representative model are calculated; For each model update in the model update cluster corresponding to the suspected toxicity representative model, if the target mean and target standard deviation corresponding to the model update meet the benign condition, the model update is regarded as a benign model update.

5. The data poisoning identification method according to claim 4, characterized in that: The calculating, using the mean and covariance matrix corresponding to the benign representative model, a Mahalanobis distance between each model update in the model update cluster corresponding to the suspected toxic representative model and the model update cluster corresponding to the benign representative model includes: By formula: ； Calculate the Mahalanobis distance matrix between the model update cluster corresponding to the suspected toxic representative model and the model update cluster corresponding to the benign representative model ; in, represents all model updates in the model update cluster corresponding to the suspected toxicity representative model, represents the mean of all model updates in the model update cluster corresponding to the benign representative model, Represents the covariance matrix of all model updates in the model update cluster corresponding to the benign representative model; The benign conditions are: ； in, Represents a positive number, Indicates the target mean corresponding to the model update in the model update cluster corresponding to the suspected toxicity representative model, Indicates the target standard deviation of the model update corresponding to the model update cluster of the suspected toxicity representative model.

6. The data poisoning identification method according to claim 1, characterized in that: The updating and generating of the secondary benign representative model based on all benign models includes: By formula: ； Generating a quadratic benign representative model ; in, represents the global model, represents the set of all benign model updates, Indicates the A benign model update.

7. The data poisoning identification method according to claim 5, characterized in that: The calculating of the update weight of each of the benign representative models and each of the secondary benign representative models includes: Assigning an update weight to each of the benign representative models as a ratio of the number of benign representative models to the number of model update clusters; For each of the quadratic benign representative models, perform the following steps: Calculating the cosine similarity between the quadratic benign representative model and the benign cluster representative model; Determining whether the cosine similarity is greater than a cosine similarity threshold; If so, the update weight of the quadratic benign representative model is assigned as: ； in, Indicates the number of clusters updated by the model, represents the number of benign representative models, represents the number of model updates in the model update cluster corresponding to the quadratic benign representative model, represents the number of benign model updates corresponding to the quadratic benign representative model; Otherwise, reduce , and returns the step of determining, for each of the suspected toxicity representative models, multiple benign model updates that meet the benign conditions from the model update clusters corresponding to the suspected toxicity representative models, and generating a secondary benign representative model based on all benign model updates.

8. The data poisoning identification method according to claim 1, characterized in that: The updating of the global model according to all update weights to obtain a final global model includes: For each benign representative model, the updated weight of the benign representative model is used as the final weight of the model update corresponding to the benign representative model; For each quadratic benign representative model, the updated weight of the quadratic benign representative model is used as the final weight of the model update corresponding to the quadratic benign representative model; For each model update other than the model update corresponding to the benign representative model and the model update corresponding to the quadratic benign representative model, assigning a final weight of the other model update to 0; By formula: ； ； Update the global model to obtain the final global model ; in, represents the global model, Indicates the number of edge aggregation servers, Indicates the Aggregation model update of edge aggregation servers, Indicates the The final weight of the model update of the edge computing nodes, Indicates the Model update of edge computing nodes, Indicates the The number of edge aggregation servers corresponds to the number of edge computing nodes.

9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the data poisoning identification method for computing power scheduling model training as described in any one of claims 1 to 8 is implemented.

Images