Anti-data poisoning federal learning method

Abstract

The invention discloses an anti-data poisoning federated learning method, and belongs to the technical field of federated machine learning, and the method comprises the steps: a central server initializes global model parameters and the selected probability of each client; randomly selecting the clients to issue global model parameters according to the selected probability of each client; according to the updated local model parameters returned by the selected client, calculating a Shapley value and a Shapley value weight of each local model; selecting the updated local model parameters according to the Shapley value weights of the local models to aggregate and update the global model parameters; and updating the selected probability of each client according to the Shapley value of each local model, and marking the client of which the selected probability is lower than a probability threshold as a malicious client and removing the malicious client. According to the method, potential malicious clients can be effectively identified and eliminated, and the security of the model is improved.

Description

Technical Field

[0001] The present invention relates to an anti-data poisoning federated learning method, belonging to the technical field of federated machine learning. Background Art

[0002] With the continuous development of big data technology, the trend of data privacy protection has become increasingly strict. This change has brought new challenges to the artificial intelligence industry, especially in all stages of data collection, cleaning, modeling, and application. The progress of artificial intelligence depends on the analysis of big data. With the strengthening of data privacy protection, it has become increasingly difficult to use datasets containing privacy information to train AI models.

[0003] Federated Learning (FL) technology has found a balance between ensuring data privacy and continuing model training, providing a new way to solve such problems. In a federated learning environment, clients jointly address machine learning challenges under the guidance of a central server, keeping the original data local. Without sharing data, they collaboratively train by uploading model updates (i.e., local gradients), effectively ensuring data privacy and security.

[0004] Although federated learning provides a solution for data privacy protection, this technology still faces many challenges that have not been fully addressed. There is a lack of effective auditing of potential malicious trainers in the system, and dishonest actors may disrupt the entire model training process by uploading incorrect gradient data to the parameter server. Moreover, the parameter server, which is the core of the system, is extremely vulnerable to single-point attacks, endangering the interests of all participants. It still faces challenges in terms of security, especially the data poisoning attack problem.

[0005] Therefore, developing a federated learning method that can resist data poisoning attacks, optimize client selection, and ensure secure aggregation is the key to achieving system robustness and anti-poisoning. Summary of the Invention

[0006] The purpose of the present invention is to provide an anti-data poisoning federated learning method that can effectively identify and eliminate potential malicious clients and improve the security of the model.

[0007] To achieve the above object, the present invention provides the following technical solutions: In the first aspect, the present invention provides an anti-data poisoning federated learning method, including: The central server initializes the global model parameters and the selection probabilities of each client; According to the selection probabilities of each client, randomly select clients and send the global model parameters; According to the updated local model parameters returned by the selected clients, calculate the Shapley value and Shapley value weight of each local model; Select the updated local model parameters according to the Shapley value weights of each local model, aggregate them, and update the global model parameters; According to the Shapley values of each local model, update the selection probabilities of each client, and mark and remove the clients with selection probabilities lower than the probability threshold as malicious clients; Repeat the iterative federated learning until the iterative termination condition is reached; Among them, the local model parameters are updated by the selected clients after locally training the local model using the local dataset according to the global model parameters issued by the central server.

[0008] Combined with the first aspect, further, calculating the Shapley values and Shapley value weights of each local model according to the updated local model parameters returned by the selected clients includes: Use the evaluation function to evaluate the updated local model parameters returned by the selected clients, and use the Monte Carlo approximation method to calculate the Shapley values of each local model; Perform min-max normalization processing on the Shapley values of each local model to obtain the Shapley value weights of each local model.

[0009] Combined with the first aspect, further, the evaluation function is: ; Among them, represents the evaluation function, represents the number of data of the th client, represents the input data set of the th client, represents the label data set of the th client, represents the spatial dimension of the local model parameters, represents the set of real numbers of the estimated values of the local model parameters; The estimated value of the updated local model parameters returned by the client is: ; Among them, 、 represents the th client in the 、 th round of iteration, the estimated value of the updated local model parameters returned, represents the input data of the th client, represents the label data of the th client, represents the The global model parameters sent by the central server in the -th round of iteration; The calculation formula of the Shapley value is: ; where denotes the Shapley value of the local model of the -th client in the -th round of iteration, denotes the subset of clients traversed during summation, denotes the subset that only contains the -th client, denotes all subsets in except denotes the machine learning algorithm for local training, denotes and corresponding local datasets, denotes corresponding local dataset, denotes the local training process, denotes the function used to calculate the contribution of the client; The formula for min-max normalization processing is: ; where denotes the Shapley value weight of the local model of the -th client in the -th round of iteration, , denotes the minimum and maximum values of the Shapley values of each local model in the -th round of iteration.

[0010] Combined with the first aspect, further, selecting the updated local model parameters for aggregation and updating the global model parameters according to the Shapley value weights of each local model includes: Removing the updated local model parameters corresponding to the local models with the smallest Shapley value weights; Using the median calculation method for each dimension to aggregate the remaining updated local model parameters and update the global model parameters; where denotes the removal ratio, denotes the set of clients selected in the -th round of iteration.

[0011] In combination with the first aspect, further, the update formula for the selection probability of the client is as follows: ; Wherein, , represents the selection probability of the -th client in the , -th round of iteration, represents the second selection ratio, represents the Shapley value of the local model of the -th client in the -th round of iteration.

[0012] In combination with the first aspect, further, the probability threshold is , wherein, represents the first selection ratio, represents the initial selection probability of each client, , represents the total number of clients, represents the expected number of clients to be selected.

[0013] In a second aspect, the present invention provides an anti-data poisoning federated learning system, including a central server and a plurality of clients; The central server is configured to initialize the global model parameters and the selection probabilities of each client; randomly select clients according to the selection probabilities of each client and send the global model parameters to the selected clients; calculate the Shapley value and the Shapley value weight of each local model according to the updated local model parameters returned by the selected clients; select the updated local model parameters according to the Shapley value weights of each local model for aggregation and update the global model parameters; update the selection probabilities of each client according to the Shapley values of each local model, mark the clients with selection probabilities lower than the probability threshold as malicious clients and remove them; repeat the iteration of federated learning until the iteration termination condition is reached; Wherein, the local model parameters are updated by the selected clients according to the global model parameters sent by the central server and by locally training the local model using the local dataset.

[0014] In a third aspect, the present invention provides a computer device, including: A storage medium for storing a computer program; A processor for executing the computer program to implement the anti-data poisoning federated learning method according to any one of the first aspect.

[0015] Fourthly, the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the anti-data poisoning federated learning method according to any one of the first aspect is implemented.

[0016] Fifthly, the present invention provides a computer program product, including a computer program, and when the computer program is executed by a processor, the anti-data poisoning federated learning method according to any one of the first aspect is implemented.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: The anti-data poisoning federated learning method provided by the present invention uses the Shapley value to evaluate the contribution of each client to the global model, dynamically adjusts the selection probability of the client through the Shapley value, ensures that high-quality data nodes are selected more, and gradually reduces the selection probability of low-quality or malicious nodes. Once the selection probability of a certain client is lower than the probability threshold, it is removed and marked as a malicious client, which can effectively prevent it from continuously participating in the training and damaging the model; combined with the per-dimensional median calculation (Medium) method for secure aggregation, it can effectively resist data poisoning attacks. After removing the clients with lower contributions, the dependence of model aggregation on abnormal parameters is greatly reduced, and the overall training process is more robust and reliable.

[0018] By randomly selecting some clients to participate in each round of training, the communication bandwidth requirement is reduced, and at the same time, the cost of model parameter transmission is reduced. The calculation of the Shapley value uses the Monte Carlo approximation method, which significantly reduces the computational complexity and ensures the usability of the algorithm in large-scale distributed scenarios.

[0019] By reasonably allocating the selection probability of the clients, the participation degree of high-quality data nodes is gradually improved, accelerating the training convergence of the global model. At the same time, by removing the low-contribution nodes, redundant calculations are reduced, further improving the training efficiency, so that the global model can reach a higher accuracy in a shorter time.

[0020] The present invention is applicable to both independent and identically distributed (IID) and non-independent and identically distributed (Non-IID) data scenarios, and can flexibly adapt to different application requirements. At the same time, it can effectively defend against various malicious attacks, including Gaussian attacks and sign-flipping attacks, demonstrating the strong adaptability and versatility of the algorithm. Description of the Drawings

[0021] Figure 1 is the flowchart of the anti-data poisoning federated learning method provided by the embodiment of the present invention; Figure 2 is the schematic diagram of the robustness test of the MNIST dataset provided by the embodiment of the present invention, where (a) is the result under the IID condition, and (b) is the result under the Non-IID condition; Figure 3 It is a schematic diagram of the robustness test of the Cifar10 dataset provided by an embodiment of the present invention. Among them, (a) is the result under the IID condition, and (b) is the result under the Non-IID condition; Figure 4 It is a statistical chart of the cumulative number of times that the client participates in training provided by an embodiment of the present invention. Among them, (a) is the result of the MNIST dataset, and (b) is the result of the Cifar10 dataset. Specific implementation manners

[0022] The technical solutions of the present application will be further described in detail below in conjunction with the specific implementation manners.

[0023] The embodiments of the present application will be described in detail below. The examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements with the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary and are only used to explain the present application and should not be construed as a limitation to the present application. Without conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0024] An embodiment of the present application provides an anti-data poisoning federated learning method, including: The central server initializes the global model parameters and the selection probabilities of each client; According to the selection probabilities of each client, randomly select clients and send the global model parameters; According to the updated local model parameters returned by the selected clients, calculate the Shapley values and Shapley value weights of each local model; According to the Shapley value weights of each local model, select the updated local model parameters for aggregation and update the global model parameters; According to the Shapley values of each local model, update the selection probabilities of each client, mark the clients with selection probabilities lower than the probability threshold as malicious clients and remove them; Repeat the iterative federated learning until the iterative termination condition is reached; Among them, the local model parameters are updated by the selected clients after locally training the local model using the local dataset according to the global model parameters sent by the central server.

[0025] In a possible embodiment, the anti-data poisoning federated learning method specifically includes the following steps: Step 1, initialize parameters: Initialize the probability of each client being selected as , initialize the predefined global model parameters to the initial value , and send the global model to all federated learning clients; Step 2, randomly select clients for training and model update according to the selected probability: Each client uses the local dataset for local model training and uploads the local model parameters to the server; Step 3, the central server performs secure aggregation on the local model parameters: The central server collects the model parameters uploaded by local clients in a certain round, calculates the Shapley values for each model. Since the calculation complexity of the Shapley value is relatively large, the Monte Carlo approximation method is used for calculation. The calculation in the round is performed and normalized to obtain the weights based on the Shapley value . According to a certain proportion, remove the weight parameters corresponding to the clients with relatively poor data quality, and use the Medium method to aggregate and update the global model for the remaining client model parameters; Step 4, update the probability of client selection: According to the Shapley value, update the probability of client selection. When drops to a certain threshold ( ), remove it from the training set and mark it as a malicious client; Step 5, iterative training: Repeat the above steps for several rounds of federated learning iterative training; Step 6, model evaluation: Set the convergence condition and evaluate the final global model.

[0026] Suppose there is labeled data and a model for predicting based on , which is represented as , where are the model parameters. These model parameters will be learned by minimizing a certain loss function . Suppose the training distribution is on multiple clients , where the data of client is represented as .

[0027] In a possible embodiment, an evaluation function is set up to evaluate each client. After the calculation is completed, each client returns their calculation results to the central server, and these data will be used to determine the sampling distribution for the next round of training. Due to the high cost of model transmission and the large time consumption of Shapley value calculation, update the valuation of the client during the training iteration: ; where , represent the a client In the th, estimated value of the updated local model parameters returned in the round of iteration, denotes the input data of the th client, denotes the label data of the th client, denotes the global model parameters sent by the central server in the th round of iteration, denotes the set of clients selected in the th round of iteration.

[0028] Specifically, in step 3, given federated learning clients and their datasets , is the performance of the model evaluated on the standard test set. Define the training of each round ( ) as a cooperative game , where represents the global model parameters of this round, is the subset of selected clients, is the machine learning algorithm. For a subset of clients , the algorithm trains the model on the dataset denoted by . This application uses to denote the Shapley value of the client t in the round in the context, which can be abbreviated as . In the cooperative game , the federated Shapley value of the client in the round can be expressed as: ; where denotes the Shapley value of the local model of the th client in the th round of iteration, denotes the subset of clients traversed when summing, denotes the subset containing only the th client, denotes excluding from all subsets, denotes the machine learning algorithm for local training,​ represent and the corresponding local dataset represent the corresponding local dataset represent the local training process represent the function for calculating the contribution of the client

[0029] Specifically, in step 3, the federated Shapley values of each round are processed by min-max normalization. Given : ; wherein represent the th client's Shapley value weight of the local model in the 、 represent the round of iteration, the minimum and maximum values of the Shapley values of each local model

[0030] Specifically, in step 3, due to limited communication bandwidth, only a small number of clients send update information to the server in each round. Therefore, this application designs a client sampling method to ensure faster convergence of the model and prevent malicious nodes from continuously affecting the model. The probability of selecting each client in each round of this algorithm is , and it is set that the influence of the normalized federated Shapley value on is proportional to , is the expected number of clients to be selected is the probability of each client being selected. The probability update formula for the th round for the th client is as follows: 、 represent the th 、 round of iteration, the probability of the th client being selected, represent the th

[0031] Specifically, in step 3, the round calculates , and performs normalization to obtain the weight based on the Shapley value , remove the smallest number of corresponding weight parameters. The Medium method calculates the per - dimension median of the remaining client model parameters to aggregate and update the global model.

[0032] The embodiments of this application adopt a Shapley - value - based anti - data - poisoning federated learning secure aggregation algorithm, which can solve the problems of model security and robustness caused by malicious clients in existing federated learning. The overall process includes initializing the global model parameters and distributing them to clients, randomly selecting some clients for local training and uploading model parameters, the central server performing Shapley - value evaluation on the uploaded parameters, removing clients with poor performance or potential maliciousness through normalization processing, and then using the Medium method to calculate the per - dimension median of the remaining clients for model aggregation and updating the global model; dynamically adjusting the selection probability of clients according to the Shapley value. If the selection probability of a client drops below the threshold, it is marked as a malicious client and removed from the training set; repeating the above steps for iterative training until the model converges, and finally evaluating the performance of the global model. The improvements of this application include optimizing the sampling distribution by establishing a client contribution evaluation mechanism, reducing communication overhead and computational complexity, quantifying client contributions using cooperative game methods, improving training efficiency, and effectively ensuring the anti - poisoning ability and robustness of model aggregation.

[0033] The detailed algorithm of the anti - data - poisoning federated learning method provided by the embodiments of this application is as follows: Input: Client set , expecting to select a certain number of clients each time, maximum number of communication rounds , minimum local data training batch , learning rate , local training rounds , total data volume of all clients , initial selection probability , of length malicious client array all 0; Output: Aggregated server model parameters ; 1. Central server side: 2. Initialize global model parameters ; 3. foreach round do; 4. Sample the client set , do not select clients with a value of 1; 5. The central server sends to Distribution model parameters ; 6. foreach client in parallel do; 7. ; 8. end for; 9. The round of calculation is performed and normalized to obtain the weights based on Shapley values ; 10. , and the weight parameters corresponding to the smallest quantity are removed to obtain ; 11. , ; 12. The central server updates , and corrects ; 13. end for; 14. return ; 15. Client: 16. ; 17. ; 18. ; 19. foreach local epoch do; 20. foreach batch do; 21. ; 22. endfor; 23. ; 24. endfor; 25. ; 26. return .

[0034] Central server side: First, client selection is based on . If the value corresponding to the client is 1, it means that its dataset quality is poor or it is a malicious node (line 4). The server will use the current central model parameters Broadcast to the selected clients (line 5). The selected clients perform local training, update the received parameters using local data, and return the gradient update vector (lines 6 to 8). Then, the Shapley value is calculated for the local training results to obtain the global federated Shapley value , and normalization is performed to obtain the weights , making their sum equal to 1 (line 9). According to the round number and the gradient update vector of the th client in this round, the central server model parameters obtained in this round are calculated , where is the learning rate of model training. The per-dimensional median of the remaining clients is calculated using the Medium method to obtain , representing the remaining model parameters in the round. Subsequently, model aggregation is performed to update the global model (line 11). The central server adaptively modifies the client selection probability based on the Shapley value. For clients with poor data quality, the corresponding

[0035] is set to 1 to ensure that it will not be selected again later (line 12). Clients: Perform local training on the dataset in batches, record the gradient vectors of each training, then integrate them, and return the overall gradient vector of the corresponding client (lines 19 to 26). represents the dataset divided into batches, represents the gradient of this batch of data,

[0036] However, since the time complexity required to calculate the exact Shapley value is relatively high, this application uses Monte Carlo simulation to approximate the Shapley value calculation, and its calculation method is as follows: Input: The set of selected clients , the number of Monte Carlo simulations ; Output: The Shapley value of the client ; 1. A set of random permutations; 2.foreach permutation do; 3. ; 4. ; 5. ; 6.end for; 7.return 。

[0037] The Shapley value is used to measure the contribution degree of each participant in a cooperative game. In applications such as federated learning, the Shapley value can be used to calculate the contribution of each client to the global model training. denotes all clients in the permutation that are before Calculate the difference in value after client joins the set and the value before joining, which represents the contribution of client to the cooperation.

[0038] This application embodiment provides a secure aggregation algorithm for federated learning against data poisoning based on Shapley. Its entire process is as Figure 1 shown, including the following steps: Step 1: The central server initializes a global model and then distributes it to all client nodes participating in federated learning; in this embodiment, the training sets of the main tasks are the MNIST and Cifar10 datasets, and the corresponding initialized global models are custom convolutional models; Step 2: Divide the adopted datasets into all client nodes according to independent and identically distributed and non-independent and identically distributed, and then set 10% of the clients as malicious nodes. The main poisoning means of malicious nodes are Gaussion attack, sign flipping, and sign flipping; Step 3: The central server randomly selects some clients to participate in the training according to the initialized selection probability. Local clients use their respective datasets to perform local model training, and after training is completed, upload the updated local model parameters to the central server. During this process, malicious clients may upload abnormal parameters through data poisoning means; Step 4: The central server performs secure aggregation; The server collects the model parameters uploaded by all clients in the current round and performs the following operations: 1) Shapley value calculation and normalization processing: The server uses the Monte Carlo approximation method to calculate the Shapley value of each client to quantify the contribution of each client to the global model. After the calculation is completed, the Shapley value is standardized using the min-max normalization method for subsequent weight assignment; 2) Remove malicious clients: According to the normalized Shapley values, remove the clients with low contribution. Specifically, remove the 20% clients with the smallest Shapley value weights to reduce the negative impact of malicious nodes on model aggregation; 3) Aggregate using the Medium method: For the remaining clients, calculate the per-dimension median of the uploaded model parameters to obtain the global model update value. The introduction of the Medium method effectively resists abnormal parameters and enhances the robustness of model aggregation.

[0039] Step Five: The server dynamically adjusts the selection probability according to the Shapley values of the clients. The update formula of the selection probability makes the probability of selecting clients with high contribution gradually increase, while the selection probability of clients with low contribution or malicious clients gradually decreases. Once the selection probability of a certain client is lower than the set threshold, the server marks the client as a malicious node and removes it from the training set; Step Six: The server distributes the globally updated model after secure aggregation to the clients in the next round, and the clients continue local training and uploading based on the new global model. The whole process is repeated until the preset convergence condition is met; Step Seven: After each round of iteration is completed, the server evaluates the performance of the current global model and checks whether the convergence standard is reached. If not, continue to jump to Step Two for the next round of iterative training; if so, terminate the training and output the final global model.

[0040] The embodiments of this application evaluate the anti-poisoning ability in the symbol flipping attack scenario using the MNIST dataset and the CIFAR-10 dataset, and compare the performance of the FedAvg federated learning algorithm under IID and Non-IID data distributions respectively. The setting includes a total of 50 clients, among which 5 are malicious clients.

[0041] In the non-independent and identically distributed setting, due to the diversity of gradients, the performance of the federated learning central model in this environment has always been a well-known challenge. Therefore, similar to previous studies, focus on the inconsistency and simulate the synthetic non-independent and identically distributed of the MNIST and CIFAR-10 datasets. For the sake of illustration, in the experiment, the total number of clients is set to 50, and the proportion of clients participating in training in each round of communication is set to 0.1. The training data is sorted by label and divided into 200 segments. Each segment contains 300 MNIST dataset images and 250 Cifar10 dataset images. Subsequently, four data segments are assigned to each client to ensure that the distributions among clients are different. The training parameters are shown in Table 1.

[0042] Table 1 Training Parameters

[0043] The neural network structure is as follows: 1) MNIST: It is trained using a CNN model, which contains two convolutional layers, two pooling layers, and two fully connected layers. The number of input channels accepted by the first convolutional layer is specified by a parameter, and it outputs 10 feature maps; the second convolutional layer generates 20 feature maps and includes a Dropout layer to prevent overfitting. The convolutional kernel size is 5 for both, and the activation functions ReLU and log_softmax are used for output; 2) Cifar10: It is trained using a CNN model, which contains two convolutional layers, two pooling layers, and two fully connected layers. The input is a 32×32 image with 3 channels. The first convolutional layer outputs 16 feature maps, and the second convolutional layer outputs 32 feature maps. Subsequently, the feature map size is halved through a max pooling layer. The fully connected layer flattens the features and maps them to 512 neurons, and finally outputs 10 categories. The model also includes a dropout layer to prevent overfitting, and the activation functions ReLU and log_softmax are used.

[0044] The training results of different algorithms (FedAvg and FedSVMED) for the MNIST dataset under IID and Non-IID conditions are as Figure 2 shown.

[0045] In the experiment under IID conditions, as Figure 2 shown in (a) below, in the absence of malicious clients, the convergence speed of FedAvg is slightly faster than that of FedSVMED. The accuracy of FedAvg stabilizes at around 96.8%, and that of FedSVMED stabilizes at around 95.9%, with an accuracy difference of 0.9%. However, when 5 malicious clients are introduced, the convergence speed and final accuracy of the FedSVMED algorithm hardly decrease, and the accuracy stabilizes at 96.1%, while the FedAvg algorithm is severely affected, and the accuracy is only about 11.2%.

[0046] Under Non-IID conditions, as Figure 2 shown in (b) below, due to the uneven data distribution, the overall accuracy of both algorithms decreases and the volatility increases. The accuracy of FedAvg is about 92.4%, and that of FedSVMED is about 84.0%. In the presence of 5 malicious clients, the accuracy of FedSVMED is about 83.3%, and that of FedAvg is about 11.1%. The accuracy fluctuation during the training process of FedSVMED is significantly smaller than that of FedAvg. In the face of interference from malicious clients, the training results of FedSVMED are significantly better than those of FedAvg, indicating that FedSVMED more effectively alleviates the impact of malicious clients and can provide a more stable learning effect in an environment with inconsistent data distributions.

[0047] The training results of different algorithms (FedAvg and FedSVMED) on the Cifar10 dataset under IID and Non-IID conditions are shown in Figure 2. Figure 3 shown.

[0048] In the experimental results under IID conditions, such as Figure 3 As shown in (a), the FedSVMED algorithm performs well in the absence of malicious clients, with an accuracy rate of 65.0% and a FedAvg accuracy rate of 67.8%. The FedSVMED algorithm is slightly lower than the FedAvg algorithm by about 2.8%, but the overall performance is stable. This shows that FedSVMED can effectively learn and maintain a high accuracy rate in scenarios with strong data consistency, reflecting its reliability in traditional federated learning. In the presence of 5 malicious clients, the accuracy of FedSVMED is stable at around 62.7%, while the accuracy of FedAvg fluctuates around 48.4%. The accuracy fluctuation of FedSVMED during training is significantly smaller than that of FedAvg, showing its stronger robustness.

[0049] Under Non-IID conditions, such as Figure 3 As shown in (b), due to the uneven distribution of data, the overall accuracy of each algorithm has decreased, among which the performance of the FedSVMED algorithm is particularly outstanding. The FedSVMED algorithm performs well in the absence of malicious clients, with an accuracy rate of 56.1% and a FedAvg accuracy rate of 57.5%. The FedSVMED algorithm is slightly lower than the FedAvg algorithm by about 1.4%, and the difference between the two is not large. In the presence of 5 malicious clients, the accuracy of FedSVMED is stable at around 50.9%, and the accuracy of FedAvg fluctuates around 19.1%. The accuracy fluctuation of FedSVMED during training is significantly smaller than that of FedAvg, showing its stronger robustness. The accuracy of FedAvg is significantly reduced and the volatility is increased, which shows that FedSVMED more effectively alleviates the interference of malicious clients and can provide more stable learning effects in environments with inconsistent data distribution, highlighting its advantages in federated learning.

[0050] Figure 4 The cumulative statistics of the number of clients participating in the training of the FedSVMED algorithm in different datasets are shown, under the condition that there are malicious clients and the data distribution is different. Figure 4The red lines represent malicious clients, and the green lines represent benign clients. It can be clearly seen that in the total of 100 epochs of training, the number of times malicious clients actually participated in training was at most no more than 2 times. FedSVMED can effectively identify malicious clients, effectively reflecting the improvement in client data tampering detection. Under the IID data distribution, the probability of each client being selected is relatively uniform, while under the Non-IID data distribution, the number of times some clients are selected is significantly more, which also conforms to the objective reality of uneven data distribution.

[0051] Through experiments on image classification tasks such as MNIST and Cifar10, compared with the non-attack scenario, for the convolutional neural network model, when the proposed system is dealing with sign-flipping attacks, under the independent and identically distributed conditions, the accuracy rate on the MNIST dataset increased by 0.2%, and the accuracy rate on the Cifar10 dataset decreased by 2.3%; under the non-independent and identically distributed conditions, the accuracy rate on the MNIST dataset decreased by 0.7%, and the accuracy rate on the Cifar10 dataset decreased by 5.2%, demonstrating the good anti-poisoning effect of this application.

[0052] An embodiment of this application provides an anti-data poisoning federated learning system, including a central server and a number of clients; The central server is used to initialize the global model parameters and the selection probabilities of each client; randomly select clients according to the selection probabilities of each client and send the global model parameters; calculate the Shapley values and Shapley value weights of each local model according to the updated local model parameters returned by the selected clients; select the updated local model parameters for aggregation and update the global model parameters according to the Shapley value weights of each local model; update the selection probabilities of each client according to the Shapley values of each local model, mark the clients with selection probabilities lower than the probability threshold as malicious clients and remove them; repeat and iterate the federated learning until the iteration termination condition is reached; Among them, the local model parameters are updated by the selected clients according to the global model parameters sent by the central server and using the local dataset to locally train the local model.

[0053] The anti-data poisoning federated learning system provided in this embodiment can execute the anti-data poisoning federated learning method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing the method.

[0054] An embodiment of this application provides a computer device, including: A storage medium for storing a computer program; A processor for executing the computer program to implement the anti-data poisoning federated learning method provided in any embodiment of this application.

[0055] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the anti-data poisoning federated learning method provided by any embodiment of the present application.

[0056] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the anti-data poisoning federated learning method provided by any embodiment of the present application.

[0057] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0058] The present application is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the specified functions in one Figure 1 flow or multiple flows and / or blocks Figure 1 block or multiple blocks.

[0059] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including instruction means, and the instruction means implements the specified functions in one Figure 1 flow or multiple flows and / or blocks Figure 1 block or multiple blocks.

[0060] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable device provide steps for implementing the specified functions in one Figure 1 flow or multiple flows and / or blocks Figure 1 block or multiple blocks.

[0061] The above are only the preferred embodiments of the present application. It should be noted that for those of ordinary skill in the art, without departing from the technical principle of the present application, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the protection scope of the present application.

Claims

1. A method for federated learning to resist data poisoning, characterized in that: include: The central server initializes the global model parameters and the probability of each client being selected; According to the selection probability of each client, randomly select a client to send the global model parameters; Calculate the Shapley value and Shapley value weight of each local model according to the updated local model parameters returned by the selected client; According to the Shapley value weights of each local model, the updated local model parameters are selected for aggregation and the global model parameters are updated; According to the Shapley value of each local model, the selection probability of each client is updated, and the clients whose selection probability is lower than the probability threshold are marked as malicious clients and removed; Repeat the iterative federated learning until the iteration termination condition is reached; Among them, the local model parameters are updated by the selected client after local training of the local model using the local data set based on the global model parameters sent by the central server.

2. The anti-data poisoning federated learning method according to claim 1, characterized in that: According to the updated local model parameters returned by the selected client, calculating the Shapley value and Shapley value weight of each local model includes: Using the evaluation function to evaluate the updated local model parameters returned by the selected client, and using the Monte Carlo approximation method to calculate the Shapley value of each local model; The Shapley value of each local model is normalized by minimum and maximum, and the Shapley value weight of each local model is obtained.

3. The anti-data poisoning federated learning method according to claim 2 is characterized in that: The evaluation function is: ； in, represents the evaluation function, Indicates The amount of data per client, Indicates The input data set of the client, Indicates The label data set of each client, represents the spatial dimension of the local model parameters, A set of real numbers representing the estimated values ​​of the local model parameters; The estimated value of the updated local model parameters returned by the client is: ； in, , Indicates Clients In the , The updated local model parameter estimates returned in the round iteration, Indicates The input data of the client, Indicates The tag data of each client, Indicates The global model parameters sent by the central server in the round iteration, Indicates The set of clients selected in the round iteration; The calculation formula of Shapley value is: ； in, Indicates Client No. The Shapley value of the local model in the round iteration, represents the subset of clients traversed when summing, Indicates that only the A subset of clients, express Medium All subsets except represents a locally trained machine learning algorithm, express and The corresponding local dataset, express The corresponding local dataset, represents the local training process, represents the function used to calculate the client's contribution; The formula for minimum-maximum normalization is: ； in, Indicates Client No. The Shapley value weight of the local model in the round iteration, , Indicates The minimum and maximum values ​​of the Shapley value of each local model in the round iteration.

4. The anti-data poisoning federated learning method according to claim 1, characterized in that: According to the Shapley value weights of each local model, the updated local model parameters are selected for aggregation and the global model parameters are updated, including: Remove the one with the smallest Shapley value The updated local model parameters corresponding to the local models; The remaining updated local model parameters are aggregated and the global model parameters are updated using the dimension-by-dimension median calculation method; in, represents the removal ratio, Indicates The set of clients that are selected in the round iteration.

5. The anti-data poisoning federated learning method according to claim 1, characterized in that: The update formula of the client's selection probability is: ； in, , Indicates Client No. , The probability of being selected in the round iteration, represents the second choice ratio, Indicates Client No. The Shapley value of the local model in the round iteration.

6. The anti-data poisoning federated learning method according to claim 1, characterized in that: The probability threshold is ,in, represents the first choice ratio, represents the initial selection probability of each client, , Indicates the total number of clients. Indicates the number of clients expected to be selected.

7. A data poisoning resistant federated learning system, characterized in that: Includes a central server and several clients; The central server is used to initialize the global model parameters and the selection probability of each client; according to the selection probability of each client, randomly select the client to send the global model parameters; according to the updated local model parameters returned by the selected client, calculate the Shapley value and Shapley value weight of each local model; according to the Shapley value weight of each local model, select the updated local model parameters for aggregation and update the global model parameters; according to the Shapley value of each local model, update the selection probability of each client, mark the client whose selection probability is lower than the probability threshold as a malicious client and remove it; repeat the iterative federated learning until the iteration termination condition is reached; Among them, the local model parameters are updated by the selected client after local training of the local model using the local data set based on the global model parameters sent by the central server.

8. A computer device, characterized in that: include: Storage medium for storing computer programs; A processor, configured to execute the computer program to implement the anti-data poisoning federated learning method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the anti-data poisoning federated learning method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the anti-data poisoning federated learning method according to any one of claims 1 to 6 is implemented.

Images