An anti-data-poisoning federated learning method
By evaluating Shapley value and calculating median in each dimension, the client selection probability is dynamically adjusted to eliminate malicious nodes, thus solving the data poisoning problem in federated learning, improving the model's security and robustness, and adapting to different data distribution scenarios.
Patent Information
- Application Number
- CN202510179067.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-18
- Publication Date
- 2025-12-16
- Estimated Expiration
- 2045-02-18
Smart Images
Figure CN120145182B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to an anti-data-poisoning federated learning method, and belongs to the technical field of federated machine learning. BACKGROUND
[0002] With the continuous development of big data technology, the trend of data privacy protection is becoming increasingly strict, which brings new challenges to the artificial intelligence industry, especially in various stages of data collection, cleaning, modeling and application. The progress of artificial intelligence depends on the analysis of big data, and with the strengthening of data privacy protection, it becomes increasingly difficult to use data sets containing private information to train AI models.
[0003] Federated learning (FL) technology finds a balance between protecting data privacy and continuing model training, providing a new way to solve such problems. In the federated learning environment, clients work together to tackle machine learning challenges under the guidance of a central server, keeping the original data localized, and collaboratively training by uploading model updates (i.e. local gradients) without sharing data, effectively protecting data privacy and security.
[0004] Although federated learning provides a solution to data privacy protection, the technology still faces many challenges that have not been fully addressed. There is a lack of effective auditing of potential malicious trainers in the system, and dishonest actors can disrupt the entire model training process by uploading incorrect gradient data to the parameter server. And the parameter server, as the core of the system, is vulnerable to single-point attacks, which can endanger the interests of all participants. It still faces challenges in security, especially the problem of data poisoning attacks.
[0005] Therefore, developing a federated learning method that can resist data poisoning attacks, optimize client selection and ensure secure aggregation is the key to achieving system robustness and anti-poisoning. SUMMARY
[0006] The purpose of the present application is to provide an anti-data-poisoning federated learning method that can effectively identify and eliminate potential malicious clients, improving the security of the model.
[0007] To achieve the above purpose, the present application provides the following technical solutions:
[0008] In a first aspect, the present application provides an anti-data-poisoning federated learning method, comprising:
[0009] The central server initializes the global model parameters and the selection probability of each client;
[0010] According to the selection probability of each client, the global model parameters are randomly selected and distributed to the clients;
[0011] According to the updated local model parameters returned by the selected clients, the Sharpe values and the Sharpe value weights of the local models are calculated;
[0012] According to the Sharpe value weights of the local models, the updated local model parameters are selected for aggregation and updating of the global model parameters;
[0013] According to the Sharpe values of the local models, the selection probabilities of the clients are updated, and the clients with selection probabilities lower than a probability threshold are marked as malicious clients and removed;
[0014] The federated learning is repeated until an iteration termination condition is reached;
[0015] The local model parameters are updated by the selected clients according to the global model parameters issued by the central server, and the local models are locally trained using the local data sets.
[0016] In combination with the first aspect, further, according to the updated local model parameters returned by the selected clients, the Sharpe values and the Sharpe value weights of the local models are calculated, including:
[0017] The updated local model parameters returned by the selected clients are evaluated using the evaluation function, and the Sharpe values of the local models are calculated using the Monte Carlo approximation method;
[0018] The Sharpe values of the local models are subjected to minimum-maximum normalization processing to obtain the Sharpe value weights of the local models.
[0019] In combination with the first aspect, further, the evaluation function is:
[0020] ;
[0021] wherein, represents the evaluation function, represents the data quantity of the i-th client, represents the input data set of the i-th client, represents the label data set of the i-th client, represents the spatial dimension of the local model parameters, represents the estimated real set of the local model parameters; The estimated value of the updated local model parameters returned by the client is:
[0022] ;
[0023] ;
[0024] wherein, , denotes the i-th client denotes the i-th client , the updated local model parameter estimate returned in the i-th iteration, denotes the input data of the i-th client denotes the label data of the i-th client denotes the global model parameter issued by the central server in the i-th iteration denotes the set of selected clients in the i-th iteration
[0025] The formula for calculating the Shapley value is:
[0026] ;
[0027] wherein, denotes the Shapley value of the local model of the i-th client in the i-th iteration denotes the subset of clients traversed when summing, denotes the subset containing only the i-th client denotes all subsets in except the i-th client denotes the local training machine learning algorithm denotes the local dataset corresponding to and denotes the local dataset corresponding to denotes the local training process denotes the function for calculating the contribution of the client
[0028] The formula for min-max normalization is:
[0029] ;
[0030] wherein, denotes the Shapley value weight of the local model of the i-th client in the i-th iteration denotes the minimum value and the maximum value of the Shapley value of each local model in the i-th iteration
[0031] According to the Shapley value weights of the local models, the updated local model parameters are selected to aggregate and update the global model parameters, including:
[0032] The updated local model parameters corresponding to the local model with the minimum Shapley value weight are removed;
[0033] The remaining updated local model parameters are aggregated and the global model parameters are updated by using a dimension-by-dimension median calculation method;
[0034] wherein, represents the removal ratio, represents the set of selected clients in the i-th iteration.
[0035] According to the first aspect, further, the update formula of the selection probability of the client is:
[0036]
[0037] wherein, , represents the selection probability of the i-th client in the j-th iteration, , represents the second selection ratio, represents the Shapley value of the local model of the i-th client in the j-th iteration.
[0038] According to the first aspect, further, the probability threshold is wherein, represents the first selection ratio, represents the initial selection probability of each client, , represents the total number of clients, represents the expected number of selected clients.
[0039] The second aspect of the present application provides an anti-data-poisoning federated learning system, comprising a central server and a plurality of clients;
[0040] The central server is configured to initialize global model parameters and selection probabilities of the clients, randomly select the clients according to the selection probabilities of the clients and distribute the global model parameters, calculate Shapley values and Shapley value weights of the local models according to the updated local model parameters returned by the selected clients, select the updated local model parameters for aggregation and update the global model parameters according to the Shapley value weights of the local models, update the selection probabilities of the clients according to the Shapley values of the local models, mark and remove the clients with selection probabilities lower than a probability threshold as malicious clients, and repeat the federated learning until an iteration termination condition is reached.
[0041] The local model parameters are updated by the selected clients according to the global model parameters distributed by the central server, and by locally training the local models using local data sets.
[0042] In a third aspect, the present application provides a computer device, comprising:
[0043] A storage medium configured to store a computer program.
[0044] A processor configured to execute the computer program to implement the anti-data-poisoning federated learning method of any one of the first aspect.
[0045] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the anti-data-poisoning federated learning method of any one of the first aspect.
[0046] In a fifth aspect, the present application provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the anti-data-poisoning federated learning method of any one of the first aspect.
[0047] Compared with the prior art, the present application has the following advantages:
[0048] The anti-data-poisoning federated learning method provided by the present application uses Shapley values to evaluate the contribution of each client to the global model, dynamically adjusts the selection probability of the client through the Shapley value, ensures that high-quality data nodes are selected more frequently, and gradually reduces the selection probability of low-quality or malicious nodes. Once the selection probability of a client is lower than a probability threshold, the client is removed and marked as a malicious client, which can effectively prevent the client from continuously participating in training and damaging the model. The combination of the Medium method for safe aggregation can effectively resist data poisoning attacks. After removing the clients with lower contribution, the dependence of model aggregation on abnormal parameters is greatly reduced, and the overall training process is more stable and reliable.
[0049] By randomly selecting part of the clients to participate in each round of training, the communication bandwidth requirement is reduced, and the cost of model parameter transmission is also reduced. The calculation of the Shapley value adopts the Monte Carlo approximation method, which significantly reduces the calculation complexity and ensures the availability of the algorithm in large-scale distributed scenarios.
[0050] By reasonably allocating the selection probability of the clients, the participation of high-quality data nodes is gradually improved, which accelerates the training convergence of the global model. At the same time, by eliminating low-contribution nodes, redundant calculation is reduced, and the training efficiency is further improved, so that the global model can reach a high precision in a shorter time.
[0051] The present application is applicable to both independent and identically distributed (IID) and non-independent and identically distributed (Non-IID) data scenarios, and can flexibly adapt to different application requirements. At the same time, it can effectively defend against various malicious attacks, including Gaussian attacks and sign flip attacks, and shows the strong adaptability and universality of the algorithm. BRIEF DESCRIPTION OF DRAWINGS
[0052] Figure 1 is a flowchart of the federated learning method against data poisoning provided by the embodiment of the present application;
[0053] Figure 2 is a robustness test schematic diagram of the MNIST data set provided by the embodiment of the present application, wherein (a) is the result under the IID condition, and (b) is the result under the Non-IID condition;
[0054] Figure 3 is a robustness test schematic diagram of the Cifar10 data set provided by the embodiment of the present application, wherein (a) is the result under the IID condition, and (b) is the result under the Non-IID condition;
[0055] Figure 4 is a cumulative number of times of client participation in training provided by the embodiment of the present application, wherein (a) is the result of the MNIST data set, and (b) is the result of the Cifar10 data set. DETAILED DESCRIPTION
[0056] The technical solutions of the present application will be further described in detail below in combination with specific implementation manners.
[0057] The embodiments of the present application will be described in detail below, and examples of the embodiments are shown in the drawings, wherein the same or similar reference numerals represent the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the present application, and cannot be understood as a limitation on the present application. The technical features in the embodiments of the present application and the embodiments can be combined with each other without conflict.
[0058] This application provides a federated learning method resistant to data poisoning, including:
[0059] The central server initializes the global model parameters and the selection probability of each client;
[0060] Based on the selection probability of each client, randomly select clients to receive global model parameters;
[0061] Calculate the Shapley value and Shapley value weight for each local model based on the updated local model parameters returned by the selected client.
[0062] Based on the Shapley weights of each local model, the updated local model parameters are aggregated and the global model parameters are updated.
[0063] Based on the Shapley value of each local model, update the selection probability of each client, and mark clients with selection probabilities below the probability threshold as malicious clients and remove them;
[0064] Repeat the federated learning process iteratively until the iteration termination condition is met;
[0065] The local model parameters are updated by the selected client using the local dataset to train the local model based on the global model parameters issued by the central server.
[0066] In one possible embodiment, the anti-data poisoning federated learning method specifically includes the following steps:
[0067] Step 1, Initialize parameters: Initialize the probability of each client being selected as follows: Initialize the predefined global model parameters to their initial values. The global model is sent to all federated learning clients;
[0068] Step 2: Randomly select clients for training and model updates based on the probability of selection: Each client uses a local dataset to train a local model and uploads the local model parameters to the server;
[0069] Step 3: The central server performs secure aggregation of local model parameters: The central server collects local client data for a certain round. The uploaded model parameters were used to calculate the Shapley value for each model. Due to the high complexity of Shapley value calculation, a Monte Carlo approximation method was employed. Round calculation Then, normalization is performed to obtain weights based on Shapley values. , according to a certain proportion, remove the weight parameters of the clients with poor data quality, and use the Medium method to aggregate and update the model parameters of the remaining clients;
[0070] Step 4, update the probability of being selected by the client: according to the Shapley value, update the probability of being selected by the client, when is reduced to a certain threshold ( ), remove it from the training set and mark it as a malicious client;
[0071] Step 5, iterative training: repeat the above steps for several rounds of federated learning iterative training;
[0072] Step 6, model evaluation: set the convergence condition and evaluate the final global model.
[0073] Suppose there is labeled data and a model that predicts according to , denoted as , where are model parameters. These model parameters will be learned by minimizing a certain loss function . Assuming that the training distribution is on multiple clients, , where the data of client is denoted as .
[0074] In one possible embodiment, an evaluation function is set up to evaluate each client. After the calculation is completed, each client returns their calculation results to the central server, which will be used to determine the sampling distribution of the next round of training. Due to the high cost of model transmission and the time-consuming nature of Shapley value calculation, the evaluation of clients is updated during the training iteration process:
[0075] ;
[0076] where , denote the updated local model parameter evaluation of the th client returned in the , th iteration, denote the input data of the th client, denote the label data of the th client, denote the label data of the Global model parameters issued by the central server during each iteration. Indicates the first The set of clients selected in the round of iteration.
[0077] Specifically, in step 3, given A federated learning client and its dataset , To evaluate the model's performance on the standard test set, define each round. ( The training is a cooperative game. ,in, Represents the global model parameters for this round. For the selected subset of clients, For a machine learning algorithm. For a subset of clients ,algorithm In the dataset Use the training model This application uses... Indicates the first t Round Client exist exist Shapley value in the background can be abbreviated as Cooperative game theory In Client in round The federal Shapley value can be represented as:
[0078] ;
[0079] in, Indicates the first The client in the first The Shapley value of the local model in each iteration. This represents a subset of clients traversed during summation. It means that it only contains the first A subset of clients, express Except All other subsets, This refers to machine learning algorithms trained locally. express and The corresponding local dataset, express The corresponding local dataset, This indicates the local training process. This represents a function used to calculate the client's contribution.
[0080] Specifically, in step 3, the federated Shapley value of each round is normalized by minimum-maximum normalization, given :
[0081] ;
[0082] wherein, denotes the Shapley value weight of the local model of the i-th client in the j-th iteration, , denotes the minimum value and the maximum value of the Shapley value of each local model in the j-th iteration.
[0083] Specifically, in step 3, due to limited communication bandwidth, only a small part of clients send update information to the server in each round. Therefore, the application designs a client sampling method to ensure faster convergence of the model and prevent malicious nodes from continuously affecting the model. The probability of selecting each client in each round of the algorithm is , and the influence of the normalized federated Shapley value on is proportional to , is the expected number of selected clients, is the probability of being selected by each client. The probability update formula of the i-th client in the j-th round is as follows: wherein, ,
[0084] ;
[0085] wherein, , denotes the selection probability of the i-th client in the j-th iteration, denotes the second selection ratio, denotes the Shapley value of the local model of the i-th client in the j-th iteration. Specifically, in step 3, the is calculated in the j-th round,
[0086] and normalized to obtain the Shapley value weight , and the weight parameters corresponding to the minimum number of are removed. The Medium method is to calculate the dimension-by-dimension median of the model parameters of the remaining clients to aggregate and update the global model.
[0087] The embodiments of the present application adopt an anti-data poisoning federated learning security aggregation algorithm based on Shapley value, which can solve the model security and robustness problems caused by malicious clients in existing federated learning. The overall process includes initializing global model parameters and distributing them to clients, randomly selecting some clients for local training and uploading model parameters, the central server evaluating the Shapley value of the uploaded parameters, removing the clients with poor performance or possible malicious behavior through normalization processing, and then using the Medium method to calculate the dimension-by-dimension median of the remaining clients to update the global model. According to the Shapley value, the selection probability of the client is dynamically adjusted. If the selection probability of the client falls below the threshold, it is marked as a malicious client and removed from the training set. Repeat the above steps for iterative training until the model converges, and finally evaluate the performance of the global model. The improvements of the present application include optimizing the sampling distribution by setting up a client contribution evaluation mechanism, reducing communication overhead and computational complexity, using cooperative game method to quantify client contribution, improving training efficiency and effectively guaranteeing the anti-poisoning ability and robustness of model aggregation.
[0088] The detailed algorithm of the anti-data poisoning federated learning method provided by the embodiments of the present application is as follows:
[0089] Input: client set , expected to select clients each time, maximum communication round , minimum training batch of local data , learning rate , local training round , total data volume of all clients , initial selection probability , length of malicious client all 0 array;
[0090] Output: aggregated server model parameters ;
[0091] 1. Central server:
[0092] 2. Initialize global model parameters ;
[0093] 3. foreach round do;
[0094] 4. Sample the client set , do not select clients with 1;
[0095] 5. The central server distributes model parameters to ;
[0096] 6. for each client in parallel do;
[0097] 7. ;
[0098] 8. end for;
[0099] 9. The first round of computation is normalized to get the Shapley value based weight ;
[0100] 10. The smallest number of weight parameters are removed to get ;
[0101] 11. , ;
[0102] 12. The central server updates , corrects ;
[0103] 13. end for;
[0104] 14. return ;
[0105] 15. Client:
[0106] 16. ;
[0107] 17. ;
[0108] 18. ;
[0109] 19. for each local epoch do;
[0110] 20. for each batch do;
[0111] 21. ;
[0112] 22. endfor;
[0113] 23. ;
[0114] 24. endfor;
[0115] 25. ;
[0116] 26. return .
[0117] Central server side: First based on Select a client; if the client corresponds to... A value of 1 indicates that the dataset is of poor quality or is a malicious node (line 4). The server will then display the current central model parameters. Broadcast to selected clients (line 5). The selected clients perform local training, update the received parameters using local data, and return the gradient update vector. (Lines 6 to 8). Then, the Shapley value is calculated from the local training results to obtain the global federated Shapley value. Normalization is performed to obtain the weights. Make their sum equal to 1 (line 9). According to the... Rounds gradient update vector for each client The central server model parameters obtained in this round are calculated. (Line 10) This is the learning rate for model training. The median for each dimension of the remaining clients is calculated using the Medium method. , representing the The remaining model parameters from each round are then used for model aggregation and to update the global model (line 11). The central server adaptively modifies the client selection probability based on the Shapley value, adjusting the corresponding probability for clients with poor data quality. Set it to 1 to ensure it will not be selected again (line 12).
[0118] Client: Perform local training on the dataset in batches, record the gradient vector of each training session, integrate them, and return the overall gradient vector of the corresponding client (lines 19 to 26). This represents the dataset after being divided into batches. This represents the gradient of the data in this batch. This means that in each training round, the client iterates through all batches, calculates the gradient of each batch, and sums these gradients to obtain the total gradient of the local model in the current epoch.
[0119] However, since calculating the accurate Shapley value requires a high time complexity, this application uses Monte Carlo simulation to approximate the Shapley value, and the calculation method is as follows:
[0120] Input: selected client set , number of Monte Carlo simulations ;
[0121] Output: Shapley value of client ;
[0122] 1. Set of random permutations
[0123] 2. foreach permutation do
[0124] 3. ;
[0125] 4. ;
[0126] 5. ;
[0127] 6. end for
[0128] 7. return .
[0129] Shapley value is used to measure the contribution of each participant in a cooperative game. In applications such as federated learning, Shapley value can be used to calculate the contribution of each client to the training of the global model. represents all clients before in the permutation. Calculate the value of the client after joining the set , and the difference between the value before joining and the value after joining, represents the contribution of the client to the cooperation.
[0130] The embodiments of the present application provide a Shapley-based federated learning security aggregation algorithm against data poisoning, and the whole process is as shown in Figure 1 , including the following steps:
[0131] Step 1: The center server initializes a global model, and then distributes it to all client nodes participating in federated learning; in this embodiment, the training sets of the main task are MNIST and Cifar10 data sets, and the corresponding initialized global models are self-defined convolutional models;
[0132] Step 2: Divide the adopted data set into all client nodes according to independent and identically distributed and non-independent and identically distributed, and then set 10% of the client nodes as malicious nodes. The main poisoning means of the malicious nodes is Gaussion attack, symbol flipping and symbol flipping;
[0133] Step three: the central server randomly selects some clients to participate in training according to the initialized selection probability. The local clients use their own data sets to perform local model training, and upload the updated local model parameters to the central server after training. In this process, malicious clients may upload abnormal parameters through data poisoning;
[0134] Step four: the central server performs secure aggregation;
[0135] The server collects the model parameters uploaded by all clients in the current round and performs the following operations:
[0136] 1) Shapley value calculation and normalization: the server uses the Monte Carlo approximation method to calculate the Shapley value of each client to quantify the contribution of each client to the global model. After calculation, the Shapley value is standardized by using the min-max normalization method for subsequent weight allocation;
[0137] 2) Eliminate malicious clients: according to the normalized Shapley value, remove the clients with low contribution. Specifically, remove the 20% of clients with the smallest Shapley value to reduce the negative impact of malicious nodes on model aggregation;
[0138] 3) Medium method aggregation: for the remaining clients, calculate the dimension-by-dimension median of their uploaded model parameters to obtain the global model update value. The introduction of the Medium method effectively resists abnormal parameters and enhances the robustness of model aggregation.
[0139] Step five: the server dynamically adjusts the selection probability of the clients according to their Shapley values. The update formula of the selection probability gradually increases the probability of being selected for clients with high contribution, while the selection probability of clients with low contribution or malicious clients gradually decreases. Once the selection probability of a client is lower than the set threshold, the server marks the client as a malicious node and removes it from the training set;
[0140] Step six: the server distributes the global model update after secure aggregation to the clients in the next round, and the clients continue local training and uploading according to the new global model. The whole process is repeated until the preset convergence condition is met;
[0141] Step seven: after each iteration is completed, the server evaluates the performance of the current global model and checks whether the convergence standard is reached. If not, continue to jump to step two for the next round of iteration training; if so, the training is terminated and the final global model is output.
[0142] The anti-poisoning ability in the symbol flipping attack scenario is evaluated by the MNIST dataset and the CIFAR-10 dataset, and the performance of the FedAvg federated learning algorithm is compared under the IID and Non-IID data distribution respectively. There are 50 clients in the setting, of which 5 are malicious clients.
[0143] In the non-independent and identically distributed setting, due to the diversity of gradients, the performance of the federated learning center model in this environment has always been a well-known challenge. Therefore, similar to previous studies, attention is paid to inconsistency, and the synthetic non-independent and identically distributed of MNIST and CIFAR-10 datasets are simulated. For ease of illustration, in the experiment, the total number of clients is set to 50, and the proportion of clients participating in training in each round of communication is set to 0.1. The training data is sorted by label and divided into 200 segments. Each segment contains 300 MNIST dataset images and 250 Cifar10 dataset images. Then, each client is assigned four data segments to ensure that the distribution between clients is not the same. The training parameters are shown in Table 1.
[0144] Table 1 Training parameters
[0145]
[0146] The neural network structure is as follows:
[0147] 1) MNIST: A CNN model is used for training, which includes two convolutional layers, two pooling layers and two fully connected layers. The first convolutional layer accepts the input channel number specified by the parameter, and outputs 10 feature maps; the second convolutional layer generates 20 feature maps and includes a Dropout layer to prevent overfitting. The size of the convolution kernel is 5, and the activation function uses ReLU and log_softmax for output;
[0148] 2) Cifar10: A CNN model is used for training, which includes two convolutional layers, two pooling layers and two fully connected layers. The input is a 3-channel 32x32 image, the first convolutional layer outputs 16 feature maps, and the second convolutional layer outputs 32 feature maps, followed by a max pooling layer to halve the feature map size. The fully connected layer maps the features to 512 neurons after flattening, and finally outputs 10 categories. The model also includes a dropout layer to prevent overfitting, and the activation function uses ReLU and log_softmax.
[0149] The training results of the MNIST dataset under IID and Non-IID conditions for different algorithms (FedAvg and FedSVMED) are shown in Table 2. Figure 2
[0150] In the IID condition experiment, as shown in Table 3, the performance of the FedAvg algorithm is better than that of the FedSVMED algorithm.Figure 2 As shown in (a), without malicious clients, FedAvg converges slightly faster than FedSVMED, with FedAvg's accuracy stabilizing at around 96.8% and FedSVMED at around 95.9%, a difference of 0.9%. However, when five malicious clients are introduced, the convergence speed and final accuracy of the FedSVMED algorithm hardly decrease, with its accuracy stabilizing at 96.1%, while the FedAvg algorithm is severely affected, with its accuracy dropping to only about 11.2%.
[0151] Under Non-IID conditions, such as Figure 2 As shown in Figure (b), due to uneven data distribution, the overall accuracy of both algorithms decreased and their volatility increased. FedAvg's accuracy was approximately 92.4%, while FedSVMED's accuracy was approximately 84.0%. In the presence of five malicious clients, FedSVMED's accuracy was approximately 83.3%, while FedAvg's was approximately 11.1%. The accuracy fluctuation of FedSVMED during training was significantly less than that of FedAvg. When faced with interference from malicious clients, FedSVMED's training results were significantly better than FedAvg's, indicating that FedSVMED more effectively mitigated the impact of malicious clients and provided more stable learning results in environments with inconsistent data distribution.
[0152] Training results of different algorithms (FedAvg and FedSVMED) on the Cifar10 dataset under both IID and Non-IID conditions are as follows: Figure 3 As shown.
[0153] In the experimental results under IID conditions, such as Figure 3 As shown in (a), the FedSVMED algorithm performs well in the absence of malicious clients, with an accuracy stable at 65.0%, while the FedAvg algorithm maintains a stable accuracy of 67.8%. The FedSVMED algorithm is slightly lower than the FedAvg algorithm by about 2.8%, but its overall performance is stable. This indicates that FedSVMED can effectively learn and maintain a high accuracy in scenarios with strong data consistency, demonstrating its reliability in traditional federated learning. In the presence of 5 malicious clients, the accuracy of FedSVMED remains stable at around 62.7%, while the accuracy of FedAvg fluctuates around 48.4%. The accuracy fluctuation of FedSVMED during training is significantly smaller than that of FedAvg, showing its stronger robustness.
[0154] Under Non-IID conditions, such as Figure 3In (b), due to uneven data distribution, the overall accuracy of each algorithm decreases, and the performance of FedSVMED algorithm is particularly prominent. FedSVMED algorithm performs well without malicious clients, with an accuracy of 56.1%, and FedAvg algorithm has an accuracy of 57.5%. FedSVMED algorithm is about 1.4% lower than FedAvg algorithm, and the difference between the two is not large. In the presence of 5 malicious clients, the accuracy of FedSVMED is stable at about 50.9%, and the accuracy of FedAvg fluctuates around 19.1%. The accuracy fluctuation of FedSVMED during training is significantly smaller than that of FedAvg, showing its stronger robustness. The accuracy of FedAvg decreases significantly and becomes more volatile, indicating that FedSVMED more effectively mitigates the interference of malicious clients and can provide more stable learning results in environments with inconsistent data distribution, highlighting its advantages in federated learning.
[0155] Figure 4 The cumulative number of times that the client participates in training in the FedSVMED algorithm is shown in different data sets, provided that there are malicious clients and the data distribution is different. Figure 4 The red line represents the malicious client, and the green line represents the benign client. It can be clearly seen that in the total of 100 epochs of training, the number of times the malicious client actually participates in training is no more than 2 times, and FedSVMED can effectively identify malicious clients, effectively reflecting the improvement in client data tampering detection. Under IID data distribution, the probability of each client being selected is relatively uniform, while under Non-IID data distribution, some clients are selected significantly more often, which also conforms to the objective reality of uneven data distribution.
[0156] Through experiments on image classification tasks such as MNIST and Cifar10, the accuracy of the convolutional neural network model compared to the non-attack scenario, the proposed system when dealing with symbol flipping attacks, under the condition of independent and identically distributed, the accuracy of MNIST dataset increased by 0.2%, and the accuracy of Cifar10 dataset decreased by 2.3%; under the condition of non-independent and identically distributed, the accuracy of MNIST dataset decreased by 0.7%, and the accuracy of Cifar10 dataset decreased by 5.2%, showing good anti-poisoning effect.
[0157] The embodiment of the application provides an anti-data poisoning federated learning system, comprising a central server and a plurality of clients;
[0158] The central server is configured to initialize global model parameters and selection probabilities of the clients, randomly select a client according to the selection probabilities of the clients and distribute the global model parameters to the selected client, calculate Shapley values and Shapley value weights of the local models according to the updated local model parameters returned by the selected client, select the updated local model parameters according to the Shapley value weights of the local models, aggregate and update the global model parameters, update the selection probabilities of the clients according to the Shapley values of the local models, mark and remove a client whose selection probability is lower than a probability threshold as a malicious client, and repeat the federated learning until an iteration termination condition is reached.
[0159] The local model parameters are updated by the selected client according to the global model parameters distributed by the central server, and by locally training the local model using a local data set.
[0160] The anti-data-poisoning federated learning system provided by the embodiment can execute the anti-data-poisoning federated learning method provided by any embodiment of the application, and has the corresponding function modules and beneficial effects of the execution method.
[0161] The embodiment of the application provides a computer device, comprising:
[0162] A storage medium is configured to store a computer program.
[0163] A processor is configured to execute the computer program to implement the anti-data-poisoning federated learning method provided by any embodiment of the application.
[0164] The embodiment of the application provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the anti-data-poisoning federated learning method provided by any embodiment of the application.
[0165] The embodiment of the application provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the anti-data-poisoning federated learning method provided by any embodiment of the application.
[0166] Those skilled in the art should understand that the embodiments of the application can be provided as a method, a system or a computer program product. Therefore, the application can be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
[0167] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps in one or more flowcharts and / or blocks
[0168] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps in one or more flowcharts and / or blocks
[0169] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps in one or more flowcharts and / or blocks
[0170] The above merely provides the preferred embodiment of the present application, and it should be noted that for those skilled in the technical field, some improvements and modifications can be made without departing from the technical principles of the present application, and these improvements and modifications should also be considered as falling within the protection scope of the present application.
Claims
1. A method for anti-data-poisoning federated learning, comprising: The method comprises the following steps: The central server initializes global model parameters and selection probabilities of each client; The central server randomly selects a client to issue the global model parameters according to the selection probabilities of each client; The central server calculates Shapley values and Shapley weight values of each local model according to the updated local model parameters returned by the selected client; The central server selects the updated local model parameters for aggregation and updates the global model parameters according to the Shapley weight values of each local model; The central server updates the selection probabilities of each client according to the Shapley values of each local model, marks the client with a selection probability lower than a probability threshold as a malicious client and removes the client; The federated learning is iterated repeatedly until an iteration termination condition is reached; The local model parameters are updated by the selected client according to the global model parameters issued by the central server and by using a local data set to locally train the local model; The method of selecting the updated local model parameters for aggregation and updating the global model parameters according to the Shapley weight values of each local model comprises the following steps: remove the local model corresponding to the sharplest value weight updated local model parameters The remaining updated local model parameters are aggregated and the global model parameters are updated by using a dimension-by-dimension median calculation method; wherein, denotes the removal ratio, denotes the first set of clients selected in the current iteration of the wheel. The update formula of the selection probability of the client is: ； wherein, , denotes the th client's selected probability in the , th iteration, denotes the second selection ratio, denotes the th client's Sharpe value of the local model in the th iteration.
2. The anti-poisoning federated learning method according to claim 1, wherein, The method of calculating the Shapley values and the Shapley weight values of each local model according to the updated local model parameters returned by the selected client comprises the following steps: The updated local model parameters returned by the selected client are evaluated by using an evaluation function, and the Shapley values of each local model are calculated by using a Monte Carlo approximation method; The Shapley values of each local model are subjected to minimum-maximum normalization processing to obtain the Shapley weight values of each local model.
3. The anti-poisoning federated learning method according to claim 2, wherein, The evaluation function is: ； wherein, represents an evaluation function, represents the number of data of the client, represents the input data set of the client, represents the label data set of the client, represents the spatial dimension of the local model parameters, represents the evaluation real set of the local model parameters; The evaluation of the updated local model parameters returned by the client is: ； in, , Indicates the first Client In the , The estimated values of the updated local model parameters returned in each iteration. Indicates the first Input data from each client, Indicates the first Tag data for each client, Indicates the first Global model parameters issued by the central server during each iteration. Indicates the first The set of clients selected in each round of iteration; The calculation formula of the Shapley value is: ； wherein, denotes the Shapley value of the th client for the local model in the th round of iteration, denotes the subset of clients over which the summation is taken, denotes the subset containing only the th client, denotes all subsets except the subset containing only the th client, denotes the locally trained machine learning algorithm, denotes the local dataset corresponding to and denotes the local dataset corresponding to and denotes the local training process, denotes the function used to compute the contribution of a client; The formula of the minimum-maximum normalization processing is: ； wherein, denotes the Shapley value weight of the th client in the th iteration for the local model, , denotes the minimum, maximum of the Shapley values of the local models in the th iteration.
4. The anti-poisoning federated learning method according to claim 1, wherein, The probability threshold is wherein, denotes the first selection proportion, denotes the initial selection probability of each client, , denotes the total number of clients, denotes the number of clients expected to be selected.
5. A system for federated learning against data poisoning, the system comprising: The method comprises the following steps: The central server initializes global model parameters and selection probabilities of each client; The central server randomly selects a client to issue the global model parameters according to the selection probabilities of each client; The central server calculates Shapley values and Shapley weight values of each local model according to the updated local model parameters returned by the selected client; remove the local model corresponding to the sharplest value weight updated local model parameters The central server selects the updated local model parameters for aggregation and updates the global model parameters according to the Shapley weight values of each local model; wherein, represents the removal ratio, represents the first set of clients selected in the current iteration of the round; The central server updates the selection probabilities of each client according to the Shapley values of each local model, marks the client with a selection probability lower than a probability threshold as a malicious client and removes the client; ； in, , Indicates the first The client in the first , The probability of being selected in each round of iteration Indicates the proportion of the second choice. Indicates the first The client in the first The Shapley value of the local model during round iteration.
6. A computer device, comprising: The federated learning is iterated repeatedly until an iteration termination condition is reached; The local model parameters are updated by the selected client according to the global model parameters issued by the central server and by using a local data set to locally train the local model; The method of selecting the updated local model parameters for aggregation and updating the global model parameters according to the Shapley weight values of each local model comprises the following steps: The remaining updated local model parameters are aggregated and the global model parameters are updated by using a dimension-by-dimension median calculation method; The update formula of the selection probability of the client is: The storage medium is used for storing a computer program. A processor configured to execute the computer program to implement the federated learning method against data poisoning of any one of claims 1-4.
7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the federated learning method against data poisoning of any one of claims 1-4.
8. A computer program product comprising a computer program, characterized in that, The computer program is executed by a processor to implement the federated learning method against data poisoning of any one of claims 1-4.