Chaotic encryption and double-server enabled robust federated learning method and system

Abstract

The application relates to a chaotic encryption and double-server-enabled robust federated learning method and system, and belongs to the technical field of data security. The application is proposed in view of the problems that the existing federated learning privacy protection method has large calculation overhead, and the existing method for protecting the privacy of federated learning by using chaotic encryption does not support the encryption of initial values of edge nodes. Technical points: the application allows edge nodes to encrypt local model parameters by using different initial values, and the ciphertexts have the characteristics of mutual offset, and the plaintext results can be obtained after aggregation; secondly, a double-server detection mode is constructed to detect the local model in layers; finally, a credit mechanism is proposed to evaluate the credit of edge nodes according to the detection results, filter the byzantine edge nodes, and aggregate the local model parameters of the honest edge nodes. Security analysis shows that the method can effectively prevent the privacy leakage of edge nodes; experimental results show that under the byzantine attack, the test accuracy of the method is 18.33% higher than that of the baseline scheme on average, and compared with homomorphic encryption methods such as CKKS and BFV, the time overhead is reduced by at least 69.8%, and the privacy protection and byzantine robustness can be efficiently considered. The application is suitable for fault diagnosis of rolling bearings.

Description

Technical Field

[0001] The present invention relates to a robust federated learning method and system, and belongs to the field of data security technology. Background Art

[0002] In the digital age, data has gradually become an important means of production. [1] As a powerful engine for mining data value, artificial intelligence has achieved rapid development in recent years. As a result, the data generated by user devices has also exploded. According to a report released by Statista, the number of IoT devices in use in 2025 will reach 30.9 billion. [2] By then, the amount of data generated daily will increase significantly compared to today, and how to protect the privacy of the data has become a hot topic. In addition, in the process of data circulation and sharing, attacks and leaks occur frequently, such as the user information leak incident on Facebook in 2019, in which more than 50 million private information were illegally downloaded. [3] Privacy issues are receiving increasing attention from all parties, and data sharing is becoming increasingly difficult, leading to the emergence of data silos.

[0003] Federated Learning [4] Federated Learning (FL) has emerged as a solution to data silos. Unlike traditional machine learning methods, federated learning is an efficient decentralized machine learning framework consisting of remote clients and aggregation servers. Users can collaborate with multiple parties by uploading local models, which avoids uploading large amounts of data and alleviates privacy issues.

[0004] However, there are still two problems that need to be solved in federated learning. The first problem is that the user's model information is still at risk of being leaked. [5-6] To address the issue of privacy leakage, a variety of solutions have been proposed: differential privacy [7-8] , homomorphic encryption [9-10] and Chaos Encryption [11-12] The scheme based on differential privacy protects user privacy by adding random noise, but sacrifices test accuracy to achieve high efficiency; the scheme based on homomorphic encryption uses complex cryptographic methods, which ensures the test accuracy of the global model but has high computational overhead; the scheme based on chaotic encryption and image encryption scheme

[13] The core idea of ​​

[15] is similar to that of

[16] , which uses chaotic sequences to mask user privacy information. However, since users use the same initial value to generate chaotic sequences, the degree of privacy protection is limited. Therefore, how to design a secure and efficient federated learning privacy protection method is the first problem to be solved in this paper.

[0005] The second problem is that federated learning under privacy protection is vulnerable to Byzantine attacks. [14-15]Byzantine users may pollute training data or randomly generate model parameters, causing the server to aggregate incorrect results, thereby destroying the performance of the global model. Most existing defense solutions compare the distance between models. [16-17] , calculate reputation value and similarity [18-19] Or use generative adversarial networks to complete the test set

[20] Methods such as these are used to filter out Byzantine users. However, ciphertext is not analyzable in privacy-preserving scenarios. For example, after homomorphic encryption, model parameters completely lose the numerical characteristics of their plaintext form, making Byzantine defense solutions difficult to implement. Therefore, the second issue that needs to be addressed is balancing Byzantine robustness while protecting user privacy.

[0006] In recent years, some schemes have been proposed to achieve privacy protection in federated learning using chaotic encryption methods. However, these schemes require users to use the same initial value for chaotic encryption, which is not suitable for scenarios with Byzantine users.

[0007] Currently, many encryption methods have been proposed to achieve privacy protection in federated learning, but few use encryption methods based on chaotic systems to protect model parameters. Because chaotic sequences have good pseudo-random properties, most existing schemes use chaotic systems to encrypt images. For example, reference

[13] proposed combining Chen hyperchaotic system with DNA coding technology to encrypt images, aiming to improve the diversity of coding and the anti-attack capability of ciphertext. However, encryption methods based on chaotic systems can also be used to achieve privacy protection in federated learning. Reference

[11] proposed using chaotic sequences generated by chaotic systems to scramble model parameters. Reference

[12] proposed combining chaotic encryption methods with homomorphic encryption technology to achieve dual protection of model information.

[0008] In addition, users in federated learning may be malicious. To address this problem, many researchers have proposed some defense schemes. The main defense ideas can be divided into three categories: 1) Behavior-based defense. This type of defense scheme filters Byzantine users by analyzing the similarity between local models, calculating the user's reputation value, or comparing the threshold of local model updates. Reference

[16] proposed the Krum method, where the server calculates the norm distance between each user's local model and selects the model with the smallest distance score as the global model. Reference

[17] proposed the FABA method, which discards some gradients with a large distance from the average gradient and selects the remaining gradients to calculate the global model. Reference

[18] proposed the SSPA mechanism, which uses the Beta distribution to evaluate the user's reputation score and filters Byzantine users based on the threshold. Reference

[19] proposed using the cosine similarity between models to calculate the node's credibility and filter Byzantine users whose credibility is lower than the threshold. Reference

[20] proposed using a generative adversarial network to generate a test set on the server side and filter users whose test scores are lower than the threshold. Reference

[21] proposed a detection method based on matrix mapping. The server constructs a mapping matrix and obtains the Softmax layer probability distribution of the user's local model, and filters Byzantine users based on this probability distribution. 2) Clustering-based defense. This type of method performs cluster analysis on model parameters to identify and filter Byzantine users. Reference

[22] proposed a heterogeneous quantitative security aggregation method. Users are divided into groups according to their communication capabilities, and local models are divided into segments. Finally, the global model is updated based on the grouping and segmentation strategy and the repeated median regression strategy. Reference

[23] proposed a robust aggregation method poly. First, the cosine similarity between users is calculated, and then the GMM clustering method is used to divide users into different clusters. Clusters with average similarity higher than the threshold are filtered. Finally, the median aggregation method is used to update the global model between the remaining clusters. Reference

[24] proposed a gradient clustering method. PCA dimensionality reduction is performed on the local model parameters uploaded by users. After PCA dimensionality reduction, the local model parameters of Byzantine users show results that are completely different from those of honest users. They can be divided into different clusters through K-means clustering. In order to produce better results after reducing the dimensionality of the user's local model parameters, reference

[25] uses the KCPA dimensionality reduction method instead of the PCA dimensionality reduction method, and uses K-means clustering to distinguish Byzantine users. The improved strategy has a better defense effect against poisoning attacks. 3) Defense based on the model itself. This type of method mainly defends the model itself. Reference

[26] proposes a method for pruning abnormal parameters, which defends against Byzantine attacks by pruning model parameters whose update amplitude exceeds a threshold. Reference

[27] proposes a joint pruning method that aims to delete abnormal neurons, constrain neuron weights, and fine-tune the model.

[0009] In recent years, some scholars have simultaneously solved the privacy leakage and robustness problems of federated learning. Reference

[28] proposed a federated learning method that combines homomorphic encryption and anomaly detection technology. It uses homomorphic encryption technology to protect the user's local model information and filters Byzantine users based on the detection method of the normal distribution 3-sigma principle. Reference

[29] also filters malicious models based on the distance between models. The user uploads the user's local model parameters to the edge node through secret sharing technology. The edge node calculates the Euclidean distance between models based on the secret share. Finally, the blockchain filters the Byzantine users and updates the global model. Different from the distance-based detection method, reference

[30] proposed a federated learning method PEMFL that combines homomorphic encryption and cosine similarity. It uses homomorphic encryption technology to protect model information, performs similarity calculation on ciphertext and filters Byzantine users. Reference

[31] proposed the PBFL method, which uses fully homomorphic encryption technology to protect the user's local model information, cosine similarity to identify and filter Byzantine users, and blockchain to improve transparency, but it may bring huge computational overhead. Reference

[32] proposed a lightweight federated learning method that uses differential privacy technology to protect model information, evaluates the credibility of the current state based on the node's past performance, and filters Byzantine users based on the credibility. To achieve privacy protection and robust aggregation more flexibly, reference

[33] proposed the SecureFL method, which uses the joint computing of SP servers and CS servers and several cryptographic protocols for robust aggregation. Reference

[34] proposed the LSFL method, in which users split the model parameters and transmit them to two servers respectively. The two servers collaborate to filter Byzantine users and aggregate the model parameters of honest users. However, LSFL only selects k local models based on similarity to update the global model, and the local models of a small number of honest users may be discarded.

[0010] Therefore, there is an urgent need to address the issue of the local models of a small number of honest users being discarded and the problem that the existing method of using chaotic encryption to protect the privacy of federated learning does not support users using different initial values ​​for encryption. Summary of the Invention

[0011] The technical problems to be solved by the present invention are:

[0012] In response to the problems that existing federated learning privacy protection methods generally have high computational overhead, and existing methods using chaotic encryption to protect federated learning privacy do not support edge nodes using different initial values ​​for encryption, the present invention proposes a robust federated learning method and system with chaotic encryption and dual-server empowerment. This method integrates the chaotic encryption scheme with the robust aggregation scheme, which can deal with the problems of privacy leakage and Byzantine attacks in a lightweight manner.

[0013] The technical solution adopted by the present invention to solve the above technical problems is: content of the certificate of right.

[0014] The application has the following technical effects:

[0015] The method fuses a chaotic encryption scheme and a robust aggregation scheme, can deal with the problems of privacy leakage and Byzantine attack in a lightweight manner, and effectively solves the problems that the existing federated learning privacy protection method has large calculation overhead, and the method using chaotic encryption to protect the privacy of federated learning does not support the encryption of edge nodes using different initial values.

[0016] The federated learning technology can solve the data island problem, but still faces two challenges: one is that the local model parameters in plaintext form may leak the privacy of the edge nodes; the second is that it is difficult to defend against Byzantine attacks while protecting privacy. The application proposes a robust federated learning method empowered by chaotic encryption and dual-server mechanism (CDRFL) to solve the above problems. The method is a chaotic encryption strategy suitable for federated learning, which allows edge nodes to encrypt local model parameters using different initial values, and the ciphertexts have the characteristics of mutual offset, and the plaintext form can be obtained after aggregation; secondly, a dual-server detection mode is constructed to detect the local model in layers; finally, a reputation mechanism is proposed to evaluate the reputation of edge nodes according to the detection results, filter Byzantine edge nodes, and aggregate the local model parameters of honest edge nodes. Security analysis shows that the proposed method can effectively prevent the privacy leakage of edge nodes; experimental results show that under Byzantine attack, the test accuracy of the proposed method is 18.33% higher than that of the baseline scheme on average, and compared with homomorphic encryption methods such as CKKS and BFV, the time overhead is reduced by at least 69.8%, which can efficiently balance privacy protection and Byzantine robustness. The application is suitable for fault diagnosis of rolling bearings. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is an example diagram of the DBSCAN method; Figure 2 is a system architecture diagram of the dual-server federated learning; Figure 3 is an example diagram of edge nodes exchanging random numbers; Figure 4 is an example diagram of constructing a chaotic parameter model; Figure 5 is a flowchart of the robust federated learning method empowered by chaotic encryption and dual-server mechanism; Figure 6 is a comparison curve diagram of convergence under the CWRU bearing dataset and the CIFAR-10 dataset; Figure 7 is a comparison bar chart of test accuracy under the CWRU bearing dataset and the CIFAR-10 dataset; Figure 8 is a test accuracy diagram of different schemes under the free-rider attack; Figure 9The test accuracy graph of different schemes under label flipping attack; Figure 10 This is the credit score change curve of the edge node; Figure 11 Comparison of the test accuracy of CDRFL and FedAvg under free-rider attack; Figure 12 This is the test accuracy graph of CDRFL and FedAvg under label flipping attack; Figure 13 A histogram showing the single training time consumption of different methods in the IID scenario of the CWRU bearing dataset. DETAILED DESCRIPTION

[0018] Combined with attachment Figures 1 to 13 The implementation of the robust federated learning method with chaotic encryption and dual-server empowerment is described as follows:

[0019] This paper proposes a robust federated learning method that combines chaotic encryption with dual-server empowerment. Unlike existing chaotic encryption methods, the proposed method is innovative in that edge nodes can use different initial values ​​to perform chaotic encryption on local models, successfully integrating robust aggregation with chaotic encryption. The contributions of this invention are as follows:

[0020] (1) A chaotic encryption strategy suitable for federated learning is proposed. This strategy uses elements of a chaotic sequence to replace model parameters to construct a new model. The constructed model is added or subtracted from the local model to obfuscate the model information. As the encrypted model aggregates, the constructed models cancel each other out internally, and the aggregated result is finally obtained in plain text.

[0021] (2) A dual-server detection strategy for Byzantine edge nodes is proposed. First, the local model of the edge node is detected by the joint calculation of two non-collusive servers. Then, the proposed reputation score mechanism is used to screen the Byzantine edge nodes and expand the punishment of Byzantine edge nodes. Finally, only the model parameters of honest edge nodes are aggregated to ensure the fairness of federated learning.

[0022] (3) Through security analysis and experiments, it is proved that the proposed method can effectively deal with malicious attacks and privacy leakage problems, and can filter out malicious models while protecting the privacy information of edge nodes, effectively taking into account the security and robustness of federated learning.

[0023] 2. Commonly used symbols and their meanings in the present invention are shown in Table 1. Table 1 shows commonly used symbols and their meanings in the present invention.

[0024] Table 1 Symbols and meanings

[0025]

[0026] 3. Description of the relevant technical means in this invention:

[0027] 3.1 Logistic Chaotic System

[0028] Logistic mapping is one of the most commonly used chaotic systems, and its difference equation expression is shown in formula (1):

[0029] x n+1 =f(x n ,μ)=μx n (1-x n ) (1)

[0030] Where: x n ∈(0,1), μ is a system parameter. When μ∈[3.569945,4], after a certain number of iterations, the Logistic Map enters a chaotic state. In short, the Logistic Map in a chaotic state can generate a random sequence based on an initial value that is highly sensitive to the initial conditions.

[0031] 3.2DBSCAN Clustering Method

[0032] DBSCAN is a density clustering method that does not require a pre-specified number of clusters. It can determine the number of clusters based on the data itself and can identify clusters of various shapes, even when the amount of data is small. This method mainly relies on two parameters: neighborhood radius (ε) and minimum number of points. Through these two parameters, DBSCAN divides data points into three categories: If there are more than points, it is the core point; if the number of points in the ε neighborhood of a point is less than But if it is connected to at least one core point, it is a boundary point; otherwise, it is an outlier. Figure 1 As shown, if Then A, B, and C are core points, D and E are boundary points, and N is an outlier.

[0033] 3.3 Beta Distribution

[0034] Beta distribution is a continuous probability distribution defined on [0,1]. Its probability density expression is shown in formula (2):

[0035]

[0036] In the formula

[0037]

[0038] Its shape is determined by two parameters, α and β, which can simulate various distribution forms. This study uses the dual-server detection results to assign values ​​to α and β, constructs a probabilistic model of edge node integrity, and designs a reputation scoring mechanism based on the Beta distribution.

[0039] 4 Method overview

[0040] 4.1 System architecture

[0041] Figure 2 The system architecture of the double-server-based federated learning is shown. The system architecture consists of 3 types of entities: TP servers, SP servers, and edge nodes. The specific role of each entity:

[0042] (1) TP server: The TP server is responsible for filtering Byzantine nodes and assisting the SP server in updating the global model.

[0043] (2) SP server: The SP server is responsible for aggregating the model parameters of honest edge nodes.

[0044] (3) Edge node: Edge nodes are generally equipped with certain computing resources, such as edge servers in industrial Internet of Things, intelligent sensors, etc. They are willing to train better models through joint training. In the upload phase, edge nodes only upload ciphertexts without uploading private data.

[0045] 4.2 Threat objectives

[0046] The threat objectives of the model mainly consider honest and curious TP servers, SP servers, and Byzantine nodes.

[0047] (1) Honest and curious SP server and TP server: The SP server and TP server comply with the protocol and do not actively generate errors, but actively infer the local data of edge nodes.

[0048] (2) Byzantine node: Byzantine nodes refer to edge nodes with malicious or attacked by attackers. In federated learning, Byzantine nodes may destroy the performance of the global model by colluding with each other or uploading malicious models. This paper assumes that Byzantine nodes may initiate free-rider attacks and label flipping attacks. Free-rider attacks refer to Byzantine nodes that only enjoy the benefits of the global model without actively contributing to the training of the model. They may randomly generate model parameters and upload them to the server due to their inability to train models. Label flipping attacks refer to Byzantine nodes maliciously modifying the labels of training data and using contaminated data to poison the global model.

[0049] 5 CDRFL

[0050] To address the problem that chaotic encryption methods in federated learning are difficult to support edge nodes using different initial values to encrypt model parameters, and that chaotic encryption schemes are difficult to combine with robust aggregation schemes, this paper proposes a chaotic encryption and double-server-enabled robust federated learning method, CDRFL. The flowchart is as follows: Figure 5As shown, Section 5.1 mainly explains the chaotic encryption strategy, dual-server detection strategy and reputation score calculation strategy in CDRFL; Section 5.2 gives the complete workflow of CDRFL.

[0051] 5.1 Method Design

[0052] (1) Chaotic encryption strategy

[0053] Take edge node P i For example. First, P i Receive the global model w from the SP server global , use local data to train and get the local model w i .

[0054] Then, P i Randomly generate a set of random numbers shared To node P j And from node P j take over P j ∈P and j≠i. After the sharing between edge nodes is completed, P i Available and Two sets of random numbers, taking n=4 as an example, Figure 3 Demonstrates the process of random number sharing between edge nodes.

[0055] If P i by As the initial value of the Logistic chaotic system, the Logistic chaotic system can obtain a set of chaotic sequences through iteration. The elements in the chaotic sequence are replaced by the model parameters in turn to construct a new model, which is called the "chaotic parameter model" and is recorded as Figure 4 The process of constructing a chaotic parameter model is demonstrated.

[0056] The two sets of random numbers are used to construct corresponding chaotic parameter models according to the above steps, and the local model w is realized through formulas (4)-(6) i The encryption of is a shape with w i Same, the internal element size is b i vector.

[0057]

[0058] To facilitate the subsequent detection of Byzantine nodes, P i We also need to calculate a ciphertext B i , as shown in formula (7):

[0059]

[0060] Finally, the W i is uploaded to the SP server, B i to the TP server. Take P i for example, the specific process of chaotic encryption is shown in method 1:

[0061]

[0062]

[0063] (2) Double server detection strategy

[0064] First, the SP server aggregates all the encrypted models W i of the current round, and obtains the average result w of the local model by using the property of mutual cancellation, as shown in formula (8):

[0065]

[0066] Second, the SP server calculates W i -w and sends it to the TP server, i∈[1,n].

[0067] Then, the TP server calculates the distance d i between the local model w i and the average model w, as shown in formula (9):

[0068]

[0069] Finally, since d i is a vector, the shape is the same as w i , so the TP server calculates the l2 norm of d i , denoted as d i (k), k∈[1,K], K is the number of layers of the model. The TP server sets the norm of all edge nodes in the same layer to a set {d1(k),…,d n (k)}, and uses the DBSCAN clustering method to cluster it, outputs outliers, traverses all layers, and finally identifies the number of normal and abnormal layers in the local model w i .

[0070] (3) Reputation mechanism

[0071] The reputation score is composed of three parts: ① the latest score A i : the score determined by the current round performance of the edge node; ② the historical score N i : the score determined by the performance of the edge node in the past Q rounds; ③ the continuous honest score h: the score determined by whether the edge node has continuously performed honestly, and the reputation score The calculation method of is shown in formula (10), where q+p+h=1.

[0072]

[0073] Let the expected value of the Beta distribution be the latest score A i , as shown in formulas (11)-(12), where the two shape parameters of the Beta distribution are given by the local model w i Normal number of layers C i and the number of abnormal layers F i Assignment, Much greater than ζ.

[0074]

[0075] A time decay mechanism is used to assist in calculating the historical score N of edge nodes. i , reducing but not ignoring the impact of the past Q round scores on the current round reputation score, the calculation method is shown in formulas (13)-(15):

[0076]

[0077]

[0078] c is a constant, and its value is generally 0.5 to 1. Indicates existence.

[0079] If the edge node behaves honestly in r consecutive rounds, it will receive a reward of h. Finally, the final reputation score is calculated by formula (10): Assume the threshold is δ, if If the node is a Byzantine edge node, then it is an honest edge node; otherwise, it is an honest edge node.

[0080] 5.2 Method Flow

[0081] ①The edge node downloads the initial model from the SP server;

[0082] ② The edge node uses the local data set to train the local model w i , encrypt the model parameters chaotically, upload W i To SP server, B i To TP server, i∈[1,n];

[0083] ③SP server aggregates the encryption model W of all edge nodes through formula (8) i , get the average model w;

[0084] ④SP server calculates W i -w, send Wi -w to TP server;

[0085] ⑤TP obtains the local model w according to formula (9) i The distance d from the mean model w i , i∈[1,n], layer-wise calculation d i The l2 norm of the same layer is set as a set of {d1(k),…,d n (k)}k∈[1,K], cluster them using the DBSCAN method, identify outliers, and record the local model w i the number of normal and abnormal layers;

[0086] ⑥W i Medium normal layer C i and the number of abnormal layers F i Assigning the shape parameters α and β of the Beta distribution, i∈[1,n], the TP server calculates the reputation score of each edge node. Then determine P i It is a Byzantine edge node;

[0087] ⑦TP server aggregates the ciphertext B of honest edge nodes through formula (16) i , aggregate the results Sent to SP server:

[0088]

[0089] ⑧ Encryption model W of SP server aggregating honest edge nodes i , the global model is restored through formulas (17)-(18):

[0090]

[0091] ⑨SP server sends w global To the honest edge nodes.

[0092] Repeat the above steps ②-⑨ until the number of iterations is reached. The specific process is shown in Method 2:

[0093]

[0094]

[0095] 6. Security Analysis

[0096] This section describes in detail the security of the CDRFL method against various potential adversaries and proves the security of the proposed method in an honest and curious model:

[0097] Theorem 1: Chaotic encryption can prevent the leakage of sensitive information at edge nodes.

[0098] Proof: From the properties of the Logistic chaotic system, we know that when the initial value changes, the chaotic sequence generated by the system will be completely different. Therefore, we first analyze the initial value sensitivity of the chaotic encryption strategy. Assuming that there are Byzantine edge nodes in the system, when the initial value of the edge node changes by 10 -15 -10 -5 When there is a slight change, the test accuracy of the global model changes as shown in Table 2:

[0099] Table 2 Effect of changes in initial values ​​on the accuracy of global model testing

[0100]

[0101] As shown in Table 2, even if the initial value of chaotic encryption only occurs 10 -15 The performance of the global model will also drop significantly if the order of magnitude changes, because a small change in the initial value will lead to a completely different chaotic sequence. The encryption model constructed using this chaotic sequence does not have the property of canceling each other out, so the server cannot calculate the local model w i The distance between the two models is greater than the average model w, and ultimately the Byzantine edge nodes cannot be correctly filtered, resulting in a decrease in the performance of the global model. Therefore, the proposed method has good key sensitivity.

[0102] Similar to image encryption systems, in order to resist exhaustive attacks, the scheme based on chaotic encryption must have a sufficiently large key space. If the number of edge nodes in the system is 10 and the initial value uses 15 significant digits, then the key space is 10 270 ≈2 897 , when the number of edge nodes increases to 50, the key space can be increased to 10 1470 ≈2 4883 ,Therefore, the proposed method has good anti-exhaustive attack capability.

[0103] In addition, each edge node only has two sets of initial values ​​and cannot infer the initial values ​​of other edge nodes. If M Byzantine edge nodes collude to obtain the initial values ​​of honest edge nodes (M <n),显然,只有M=n-1时,拜占庭边缘节点才能推断出诚实边缘节点的全部初始值,然而这种假设是无意义的,不适用现实场景。综上,所提混沌加密策略可防止边缘节点的信息泄露。

[0104] Theorem 2: As long as the TP server does not collude with the edge nodes, the dual-server update is safe.

[0105] Proof: Assuming that the attacker will contaminate the TP server, in order to analyze the security of the system, this paper builds a simulator executed in an ideal world to simulate the view of the TP server, that is, the values ​​sent to the TP server by other participants during the execution of the simulation protocol. The ideal view of the TP server can be defined as IDEAL TP =(Bi',(W i -w)'), where, Bi', (W i -w)' is randomly generated by the simulator. In the real world, the realistic view of the TP server is REAL TP =(B i ,W i -w), P i ∈P. Because B i , W i -w internally superimposes a chaotic parameter model, which is generated by a chaotic sequence. The chaotic sequence has pseudo-randomness and can better conceal the model information, so B i , W i -w and Bi', (W i -w)' is computationally indistinguishable. In summary, the simulator generates a view that is computationally indistinguishable from reality.

[0106] If the attacker will contaminate the SP server, similarly, using the simulation-based security proof method, a simulator executed in the ideal world is constructed. The view of the SP server in the ideal world can be defined as Among them, Wi', Randomly generated by the simulator. The SP's realistic view is Because W i and The chaotic parameter model is superimposed inside, and the chaotic parameter model is generated by a chaotic sequence with pseudo-random properties, so W i , With Wi', Computationally indistinguishable: The simulator generates a view that is computationally indistinguishable from reality. In summary, the TP server and the SP server are ideal executions that are indistinguishable from reality; as long as the TP server does not collude with the edge node, the compromised TP server and SP server cannot infer any private information about the honest edge node.

[0107] 7. Experimentation and Evaluation

[0108] This experiment was conducted on a server with an Intel(R) i5-12600KF CPU, 16GB RAM, and NVIDIA 3070Ti, and was simulated using PyTorch 1.13.0 in Python 3.7.13.

[0109] 7.1 Experimental Setup

[0110] (1) Dataset

[0111] The experiment uses the Case Western Reserve University (CWRU) bearing dataset in the field of fault diagnosis

[37] With the public CIFAR-10 dataset

[38] CDRFL was evaluated.

[0112] CWRU bearing dataset: The CWRU bearing dataset contains four states: normal state, inner ring fault, outer ring fault, and rolling element fault. Each fault has a different fault size.

[0113] CIFAR-10 dataset: The CIFAR-10 dataset has a total of 50,000 training samples and 10,000 test samples. It is suitable for image classification and contains color images of 10 categories, such as airplanes, cars, cats, etc.

[0114] (2) Data segmentation and hyperparameter setting

[0115] The CWRU bearing dataset and the CIFAR-10 dataset were partitioned using either independent and identically distributed (IID) or non-independent and identically distributed (Non-IID) methods. Specifically, IID partitioning randomly and evenly distributes the training samples of the dataset to each edge node. Non-IID partitioning divides the training samples of each label into 200 blocks, and each edge node randomly selects two blocks of samples for two labels, meaning that each edge node only has data for two labels.

[0116] During local training, the network model consists of three convolutional layers and three fully connected layers. Both the convolutional layers and the fully connected layers use the ReLU function as the activation function. The learning rate of local training is set to 0.01, the SGD momentum is set to 0.9, the number of local iterations is set to 5, the initial assets of the edge nodes are set to 10, and the number of communication rounds and edge nodes is set to 50.

[0117] (3) Baseline

[0118] ①FedAvg [2] : The edge node uploads the local model, and the server takes the mean to update the global model.

[0119] ② Reference

[12] : Edge nodes use chaotic sequences to scramble parameters and use CKKS homomorphic encryption technology to encrypt model parameters.

[0120] ③Krum

[16] : The edge node uploads the gradient information, and the server selects several nearest neighbor edge nodes for each edge node and calculates their average gradient, and selects the smallest average gradient as the final aggregate gradient.

[0121] ④SignSGD

[35] :The edge node uploads the gradient symbol instead of the gradient value. The server accumulates the gradient symbol information of the edge node and obtains the global gradient symbol information. The edge node continues to perform local updates based on the global gradient symbol information.

[0122] ⑤Median

[36] : The edge node uploads its own local model, and the server takes the value to update the global model.

[0123] (4) Attack

[0124] The experiment considers two types of attacks: free-rider attacks and label flipping attacks. For free-rider attacks, we assume that Byzantine edge nodes randomly generate model parameters, and we use chaotic sequences to simulate these randomly generated model parameters. For label flipping attacks, we assume that Byzantine edge nodes maliciously modify the labels of training samples, causing the model's prediction results to be incorrect.

[0125] 7.2 Fidelity Assessment

[0126] In order to evaluate the fidelity of the method, the experiment compares CDRFL with FedAvg without setting an attacker. In terms of convergence, the experiment calculates the loss values ​​of CDRFL and FedAvg on the CWRU bearing dataset and CIFAR-10 dataset. Figure 6 As shown in Figure 3, the loss curve of CDRFL converges on the two datasets and is very close to FedAvg. Therefore, CDRFL has good convergence.

[0127] At the same time, in order to evaluate the test accuracy of the global model, the experiment compares FedAvg and CDRFL on two datasets. Figure 7 It can be observed that the test accuracy of CDRFL is almost identical to that of FedAvg. This is because CDRFL uses the proposed chaotic encryption strategy to protect the local model of the edge node. No noise is introduced during the encryption and aggregation process, so the test accuracy of the global model is not affected. Therefore, the proposed method has good fidelity in both the IID and non-IID cases.

[0128] 7.3 Safety Assessment

[0129] 7.3.1 CDRFL Test Accuracy under Byzantine Attacks

[0130] Byzantine attackers aim to reduce the overall accuracy of the global model on the test set, so this paper uses the global model's test accuracy to evaluate the security performance of our method. Experiments compare the test accuracy of CDRFL and FedAvg on two datasets with 10%-40% Byzantine edge nodes, using free-rider attacks and label flipping attacks, respectively. Only the IID case is considered for defense against label flipping attacks. As shown in Tables 3 and 4, while FedAvg achieves high prediction accuracy in the absence of attacks, its performance degrades significantly after introducing 10%-40% Byzantine edge nodes, with test accuracy dropping as low as 10.00%. The free-rider attack has a greater impact on FedAvg than the label flipping attack, with FedAvg's test accuracy dropping by up to 87.87% under the free-rider attack and by up to 31.41% under the label flipping attack. After introducing 10%-40% Byzantine edge nodes, CDRFL's test accuracy is within 0.92% of that of FedAvg in the absence of attacks, maintaining a high test accuracy. This is due to CDRFL's combination of the DBSCAN clustering method and a reputation scoring mechanism, which can identify abnormal models and effectively filter out Byzantine edge nodes. Therefore, compared to FedAvg, CDRFL not only has good privacy protection capabilities but also has better Byzantine robustness in the face of attacks.

[0131] Table 3 Test accuracy of CDRFL and FedAvg under free-rider attack (%)

[0132]

[0133]

[0134] Table 4 Accuracy of CDRFL and FedAvg under label flipping attack (%)

[0135]

[0136] 7.3.2 Robustness Comparison of CDRFL and Baseline Solutions

[0137] To further evaluate the security of CDRFL, the experiment compared the test accuracy of CDRFL with that of the baseline schemes (Krum, Signsgd, Median). The experiment introduced 10-40% of Byzantine edge nodes into CDRFL and the baseline schemes respectively. Figure 8 and Figure 9It can be seen that the prediction accuracy of CDRFL is generally higher than that of several other baseline schemes, and the accuracy is not affected by the increase in the number of Byzantine edge nodes. For example, in the IID case, when facing free-rider attacks, the test accuracy of CDRFL on the two datasets is 0.77% and 13.55% higher than that of other baseline schemes on average. When facing label flipping attacks, the test accuracy of CDRFL on the two datasets is 1.41% and 18.33% higher than that of other baseline schemes on average. This shows that CDRFL has stronger Byzantine robustness because when using the DBSCAN clustering method, the neighborhood radius ε is set to half the median of the edge node norm, and the minimum number of data points is set to This setting makes abnormal models tend to appear in smaller clusters and helps to distinguish Byzantine edge nodes.

[0138] 7.3.3 Trends in Reputation Score Changes under Byzantine Attacks

[0139] The reputation score mechanism is a key part of CDRFL's ability to resist Byzantine attacks. In order to better visualize the reputation score mechanism, the experiment demonstrates the changes in the reputation score for the following two situations: (1) the attack is launched only in a certain round; (2) the attack is launched continuously. The experiment assumes that the models of edge nodes 1 to edge nodes 5 have different numbers of abnormal layers, node 6 represents an honest edge node, and the threshold is set to 0.75. Figure 10 As shown in (a), if a Byzantine edge node launches an attack in the third round, the reputation score of the Byzantine edge node will drop sharply after the attack and fall below the threshold. In subsequent iterations, if the edge node remains honest, its reputation score will gradually recover. When the score exceeds the threshold, the edge node will participate in the aggregation again. However, if the Byzantine edge node continues to attack, its reputation score will continue to decline, as shown in Figure 10 As shown in (b), after continuous attacks, the reputation score of a Byzantine edge node will drop below 0.4. Since Byzantine edge nodes have 10% of their assets deducted each round, when their assets are cleared, they will be forced to exit the federated learning system. A single attack may cause the edge node to be identified as a Byzantine edge node for multiple consecutive rounds, preventing it from participating in aggregation. Therefore, the reputation score mechanism can amplify the penalties imposed on Byzantine edge nodes, providing a strong defense against Byzantine attacks.

[0140] 7.4 Efficiency Evaluation

[0141] In terms of efficiency, we first test the convergence speed of CDRFL. The experiment introduces 10-30% of Byzantine edge nodes into CDRFL and FedAvg respectively, such as Figure 11 and Figure 12As shown in the figure, when facing different Byzantine attack ratios, CDRFL's test accuracy is essentially the same as FedAvg (no attack) in the same round. In other words, the convergence rate of CDRFL's test accuracy is similar to that of FedAvg (no attack). In short, while balancing privacy protection and Byzantine robustness, CDRFL has little impact on the model's convergence rate.

[0142] In order to further study the efficiency of CDRFL, the proposed method was compared with Paillier

[39] 、BFV

[40] and CKKS

[41] The time overhead of the encryption method records the time it takes for edge nodes to complete a single computation (encryption, aggregation, and decryption) using different encryption methods. As shown in Table 5, compared to the CKKS, BFV, and Paillier encryption methods, the time overhead of the proposed chaotic encryption strategy is reduced by 69.8%, 94.8%, and 99.7%, respectively. Because the proposed method uses chaotic sequences to encrypt the model, the main time consumption lies in the generation of the chaotic sequence. This further demonstrates that CDRFL does not impose excessive burden on the system when achieving privacy protection.

[0143] Table 5 Time overhead of different encryption methods (s)

[0144]

[0145] Finally, in order to intuitively study the training time of CDRFL, the experiment compares the time it takes to complete one training session of the proposed method, FedAvg, and the method in reference [6] on the CWRU bearing dataset IID. Figure 13 As shown in the figure, the time it takes for the proposed method to complete a training run is similar to that of FedAvg, and much lower than the solution in reference [6]. The time overhead of the proposed chaotic encryption strategy is related to the number of edge nodes. Compared with FedAvg, when the number of edge nodes increases from 10 to 40, the average training time per edge node increases by 0.09s. In reference [6], the average training time per edge node is 3.64s longer than that of FedAvg. This is because the core of the proposed chaotic encryption strategy lies in the generation of chaotic sequences, without using complex cryptographic methods. This further proves that CDRFL can achieve federated learning privacy protection and Byzantine robustness more efficiently.

[0146] 8. Conclusion

[0147] This paper proposes a robust federated learning method that combines chaotic encryption and dual-server empowerment. First, edge nodes perform chaotic encryption on model parameters. Second, a dual-server detection model is established to hierarchically detect local models of edge nodes without leaking their privacy information. Finally, a reputation mechanism is used to filter Byzantine edge nodes and aggregate the model parameters of honest edge nodes. The following conclusions are drawn:

[0148] (1) Aiming at the problem that the initial values ​​used by edge nodes in chaotic encryption are the same and single, a chaotic encryption strategy is proposed, which can not only ensure that edge nodes use different initial values ​​for encryption, but also be integrated with the robust aggregation method, and has good initial value sensitivity and key space. Even if the initial value is 10 -15 The performance of the global model will drop below 10% due to the change of orders of magnitude. The key space increases with the number of edge nodes. When the number of edge nodes is 10, the key space can reach 2 897 , which is much larger than the key space of low-dimensional chaotic encryption scheme.

[0149] (2) A dual-server detection strategy for Byzantine edge nodes is proposed. The TP server, assisted by the SP server, uses the DBSCAN clustering method to perform hierarchical detection of the edge node model and filters the Byzantine edge nodes based on the reputation score mechanism. Experiments show that under Byzantine attacks, the test accuracy of CDRFL on the CWRU bearing dataset is improved by at least 0.89% compared with other baseline schemes, and on the CIFAR-10 dataset by at least 13.89%, which improves the robustness of the model to a certain extent.

[0150] (3) A robust federated learning method based on chaotic encryption and dual-server empowerment is proposed. The proposed method not only protects the privacy of edge nodes during model aggregation but also detects and filters Byzantine edge nodes. Compared with CKKS, BFV, and Paillier encryption methods, the proposed method reduces encryption time overhead by up to 99.7%, effectively improving the efficiency of privacy protection.

[0151] Although the proposed method takes into account both the privacy protection and Byzantine robustness of federated learning, it does not consider the problem that the server may be vulnerable to single-point attacks. The next step will be to use the blockchain framework for further in-depth research.

[0152] The references cited in this invention are listed as follows:

[0153] [1] Zhang Zhigang, Yang Dongshu, Wu Hongxia. Research and application of data asset value assessment model [J]. Modern Electronic Technology, 2015, 38(20): [1]

[0154] [2]L.S.Vailshery.(2021).Internet of Things(IoT)—Statistics andFacts.[Online].Available:https: / / www.statista.com / study / 27915 / internet-of-things-iot-statista-dossier /

[0155] [3]Wikipedia.2018.FacebookCambridge Analytica DataScandal. https: / / en.wikipedia.org / wiki / Faceb ook-Cambridge_Analytica%_data_scandal.

[0156] [4]B.McMahan,E.Moore,D.Ramage,S.Hampson,and B.A.y Arcas,“Communication-efficient learning of deep networks from decentralized data,”in Proc.Int.Conf.Artif.Intell.Statist.,A.Singh and X.J.Zhu,Eds.,2017,pp.1273--1282.

[0157] [5]E.Bagdasaryan,A.Veit,Y.Hua,D.Estrin and V.Shmatikov,"How tobackdoor federatedlearning",inProc.Int.Conf.Artif.Intell.Stat.,Jun.2020,pp.2938-2948.

[0158] [6]A.N.Bhagoji,S.Chakraborty,P.Mittal,S.B.Calo,Analyzing FederatedLearning through anAdversarial Lens,2019,pp.634-643.

[0159] [7]H.B.McMahan,D.Ramage,K.Talwar,L.Zhang,Learning DifferentiallyPrivate RecurrentLanguage Models,2018.

[0160] [8] S.Shen, T.Zhu, D.Wu, W.Wang, W.Zhou, From distributed machine learning to federated learning: In the view of data privacy and security, Concurr.Comput.Pract.Exp.34(16)(2022).

[0161] [9] Y.Li, H.Li, G.Xu, T.Xiang, X.Huang, R.Lu, Toward Secure and Privacy-PreservingDistributed Deep Learning in Fog-Cloud Computing, IEEE InternetThings J.7(12)(2020)11460-11472.

[0162]

[10] G.Xu,H.Li,S.Liu,K.Yang,X.Lin,VerifyNet: Secure and VerifiableFederated Learning,IEEE Trans.Inf.Forensics Secur.15(2020)911-926.

[0163]

[11] Z.Zhang, L.Zhang, Q.Li, K.Wang, N.He, T.Gao, Privacy-enhanced momentumfederated learning via differential privacy and chaotic system in industrialCyber–Physical systems, ISATransactions 128(2022)17-31.

[0164]

[12] Zhang Zehui, Li Qingdan, Fu Yao, et al. Adaptive federated deep learning algorithm for non-IID data [J / OL]. Automation: 1-13 [2023-10-16]. DOI: 10.16383 / j.aas.c201018.

[0165]

[13] Zhao Qiao, Li Bo, Xiang Rongrong. Color image encryption algorithm based on chaotic system and dynamic DNA coding [J / OL]. Computer Measurement and Control: 1-12 [2023-10-13]

[0166]

[14] E.Bagdasaryan,A.Veit,Y.Hua,D.Estrin,V.Shmatikov,How To BackdoorFederatedLearning,2020,pp.2938-2948.

[0167]

[15] A.N.Bhagoji,S.Chakraborty,P.Mittal,S.B.Calo,Analyzing FederatedLearning through anAdversarial Lens,2019,pp.634-643.

[0168]

[16] P.Blanchard,E.M.E.Mhamdi,R.Guerraoui,J.Stainer,Machine learningwith adversaries:byzantine tolerant gradient descent,Proceedings ofthe 31stInternational Conference on NeuralInformation Processing Systems,CurranAssociates Inc.,Long Beach,California,USA,2017,pp.118–128.

[0169]

[17] Q.Xia,Z.Tao,Z.Hao,Q.Li,FABA:An Algorithm for Fast Aggregationagainst ByzantineAttacks in Distributed Neural Networks,Twenty-EighthInternational Joint Conference onArtificial Intelligence,2019.

[0170]

[18] T.Chu, García-Recuero,C.Iordanou,G.Smaragdakis,N.Laoutaris,Securing FederatedSensitive Topic Classification against PoisoningAttacks,CoRR abs / 2201.13086(2022).

[0171]

[19] K.Zhai, Q.Ren, J.Wang, C.Yan, Byzantine-robust federated learning viacredibilityassessment on non-IID data, Mathematical Biosciences and Engineering 19(2)(2022)1659-1676.

[0172]

[20] Y. Zhao, J. Chen, J. Zhang, D. Wu, J. Teng, S. Yu, PDGAN: A Novel PoisoningDefenseMethod in Federated Learning Using Generative Adversarial Network, 2020, pp.595-609.

[0173]

[21] Liu Biao, Zhang Fangjiao, Wang Wenxin, et al. Byzantine robust federated learning algorithm based on matrix mapping [J]. Journal of Computer Research and Development, 2021, 58(11): 2416-2429.

[0174]

[22] ARElkordy, ASAvestimehr, HeteroSAg: Secure Aggregation With Heterogeneous Quantization in Federated Learning, IEEE Transactions on Communications 70(4)(2022)2372-2386.

[0175]

[23] Wang Yongkang, Zhai Dihua, Xia Yuanqing. Robust aggregation algorithm against a large number of backdoor clients in federated learning[J]. Chinese Journal of Computers, 2023, 46(06): 1302-1314.

[0176]

[24] V.Tolpegin, S.Truex, MEGursoy, L.Liu, Data PoisoningAttacks AgainstFederated Learning Systems, Springer International Publishing, Cham, 2020, pp.480-501.

[0177]

[25] Y.Zhao,JJChen,JLZhang,D.Wu,M.Blumenstein,S.Yu,Detecting and mitigating poisoning attacks in federated learning using generativeadversarial networks,Concurr.Comput.-Pract.Exp.34(7)(2022)12

[0178]

[26] Z.Sun,P.Kairouz,ATSuresh,HBJAMcMahan,Can You ReallyBackdoor Federated Learning? ,abs / 1911.07963(2019).

[0179]

[27] C. Wu, X. Yang, S. Zhu, P. Mitra, Mitigating Backdoor Attacks in Federated Learning, CoRRabs / 2011.01767(2020).

[0180]

[28] Huang Xiuli, Yu Pengfei, Gao Xianzhou. Secure aggregation method for horizontal federated learning system [J / OL]. Computer Engineering and Applications: 1-13 [2023-11-04].

[0181]

[29] Jiang Xiaoyu, Gu Ruichun, Zhang Huan. Research on blockchain-enabled multi-edge secure federated learning model [J / OL]. Computer Application Research: 1-7 [2023-10-13].

[0182]

[30] Z. Zhang, N. He, Q. Li, K. Wang, H. Gao, T. Gao, DetectPMFL: Privacy-Preserving Momentum Federated Learning Considering Unreliable Industrial Agents, IEEE Transactions on Industrial Informatics 18(11)(2022)7696-7706.

[0183]

[31] Y.Miao, Z.Liu, H.Li, KKRChoo, RHDeng, Privacy-PreservingByzantine-RobustFederated Learning via Blockchain Systems, IEEETrans.Inf.Forensic Secur.17(2022)2848-2861.

[0184]

[32] Li Haiyang, Guo Jingjing, Liu Jiuzun, et al. Privacy-preserving Byzantine robust federated learning algorithm[J]. Journal of Xidian University, 2023, 50(04): 121-131.

[0185]

[33] M.Hao, H.Li, G.Xu, H.Chen, T.Zhang, Efficient, Private and RobustFederated Learning, Annual Computer Security Applications Conference, Association for Computing Machinery, Virtual Event, USA, 2021, pp.45–60.

[0186]

[34] ZZZhang, LBWu, CGMa, JXLi, J.Wang, Q.Wang, S.Yu, LSFL: ALightweight and Secure Federated Learning Scheme for Edge Computing, IEEETrans.Inf.Forensic Secur.18(2023)365-379.

[0187]

[35] J.Bernstein, Y.-X.Wang, K.Azizzadenesheli, A.Anandkumar, signSGD: Compressed Optimization for Non-Convex Problems, in: D.Jennifer, K.Andreas (Eds.) Proceedings of the 35th International Conference on Machine Learning, PMLR, Proceedings of Machine LearningResearch,2018,pp.560--569.

[0188]

[36] D.Yin,Y.Chen,R.Kannan,P.Bartlett,Byzantine-Robust DistributedLearning:Towards Optimal Statistical Rates,in:D.Jennifer,K.Andreas(Eds.)Proceedings of the 35th International Conference on Machine Learning,PMLR,Proceedings of Machine Learning Research,2018,pp.5650--5659.

[0189]

[37] L.Deng,The MNIST Database of Handwritten Digit Images for MachineLearning Research [Best ofthe Web],IEEE Signal Process.Mag.29(6)(2012)141-142.

[0190]

[38] Krizhevsky A,Nair V,Hinton G.The CIFAR-10dataset[DB / OL].[2023-04-01].https: / / www.cs.toronto.edu / ~kriz / cifar.html

[0191]

[39] P.Paillier,Public-Key Cryptosystems Based on Composite DegreeResiduosity Classes,1999,

[0192] pp.223-238.

[0193]

[40] Z.Brakerski,C.Gentry,V.Vaikuntanathan,(Leveled)fully homomorphicencryption withoutbootstrapping,2012,pp.309-325.

[0194]

[41] J.H.Cheon,A.Kim,M.Kim,Y.S.Song,Homomorphic Encryption forArithmetic ofApproximate Numbers,2017,pp.409-437.

Claims

1. A robust federated learning method with chaotic encryption and dual-server empowerment, characterized by: The implementation process of the method is: ①Edge node P i Download the initial rolling bearing fault diagnosis model from the SP server; ②Edge node P i Use the local rolling bearing dataset to train the local model w i , encrypt the model parameters chaotically, upload W i To SP server, B i To the TP server, i∈[1,n], P represents the set of edge nodes; In step ②, the chaotic encryption strategy used in the chaotic encryption of model parameters is: For edge node P i First, P i Receive the global model w from the SP server global , using local rolling bearing data to train and obtain the local model w i ; Then, P i Randomly generate a set of random numbers shared To P j And from P j take over P j ∈P and j≠i; after the sharing between edge nodes is completed, P i Available and Two sets of random numbers; If the edge node P i by As the initial value of the Logistic chaotic system, the Logistic chaotic system can obtain a set of chaotic sequences through iteration. The elements in the chaotic sequence are replaced by the model parameters in turn to construct a new model, which is called the "chaotic parameter model" and is recorded as The two sets of random numbers are used to construct corresponding chaotic parameter models according to the above steps, and the local model w is realized through formulas (4)-(6) i The encryption of is a shape with w i Same, the internal element size is b i vector, To facilitate the subsequent detection of Byzantine edge nodes, the edge node P i We also need to calculate a ciphertext B i , as shown in formula (7): Finally, upload W i To SP server, B i To TP server; ③SP server aggregates the encryption model W of all edge nodes through formula (8) i , get the average model w; Where: w i represents the local model and w represents the average model; ④SP server calculates W i -w, send W i -w to TP server; ⑤TP obtains the local model w according to formula (9) i The distance d from the mean model w i , i∈[1,n], layer-wise calculation d i The l2 norm of the same layer is set as a set of {d1(k),…,d n (k)}k∈[1,K], cluster them using the DBSCAN method, identify outliers, and record the local model w i the number of normal and abnormal layers; d i is a vector with the same shape as w i same; ⑥W i Medium normal layer C i and the number of abnormal layers F i Assigning the shape parameters α and β of the Beta distribution, i∈[1,n], the TP server calculates the reputation score of each edge node. If the reputation score is less than the threshold, it determines that P i It is a Byzantine edge node; ⑦TP server aggregates the ciphertext B of honest edge nodes through formula (16) i , aggregate the results Sent to SP server: ⑧ Encryption model W of SP server aggregating honest edge nodes i , the global model is restored through formulas (17)-(18): ⑨SP server sends w global To the honest edge nodes; Repeat the above steps ②-⑨ until the number of iterations is reached.

2. The robust federated learning method with chaotic encryption and dual-server empowerment according to claim 1 is characterized by: In step ⑤, TP server layered computing i The l2 norm of i (k), k∈[1,K], K is the number of layers of the model; the TP server sets the norms of all edge nodes in the same layer into a set {d1(k),…,d n (k)}, cluster them using the DBSCAN clustering method, output outliers, traverse all layers, and finally identify the local model w i The number of normal and abnormal layers.

3. The robust federated learning method with chaotic encryption and dual-server empowerment according to claim 2 is characterized by: In step ⑥, the credit score mechanism is: Credit score It consists of three parts: ① Latest score A i : The score determined by the edge node's performance in the current round; ② Historical score N i : The score determined by the performance of the edge node in the past Q rounds; ③Continuous honesty score h: The score determined by whether the edge node continues to perform honestly, reputation score The calculation method is shown in formula (10), where q+p+h=1; Let the expected value of the Beta distribution be the latest score A i , as shown in formulas (11)-(12), where the two shape parameters of the Beta distribution are given by the local model w i Normal number of layers C i and the number of abnormal layers F i Assignment, Much greater than ζ; A time decay mechanism is used to assist in calculating the historical score N of edge nodes. i , reducing but not ignoring the impact of the past Q round scores on the current round reputation score, the calculation method is shown in formulas (13)-(15): t represents the current communication round; If the edge node behaves honestly in r consecutive rounds, it will receive a reward of h. Finally, the final reputation score is calculated by formula (10): Set the threshold to δ, if Then the edge node is judged to be a Byzantine edge node, otherwise it is an honest edge node.

4. A robust federated learning system with chaotic encryption and dual-server empowerment, characterized by: The system has a program module corresponding to the steps of any one of claims 1 to 3 above, and executes the steps in the robust federated learning method with chaotic encryption and dual-server empowerment during operation.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of a robust federated learning method for chaotic encryption and dual-server empowerment according to any one of claims 1 to 3 when called by a processor.

Images