Federal learning security test method and system based on multi-objective optimization
Through multi-objective optimization and dynamic control strategies, the problem of insufficient defense of dynamic attacks in the federated learning system is solved, and the stability and defense capabilities of the system in complex scenarios are improved.
Patent Information
- Application Number
- CN202510644838.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-20
- Publication Date
- 2025-08-08
AI Technical Summary
The existing federated learning system lacks the defense ability to deal with dynamic adaptive attacks, and the differences in high-dimensional model parameters and non-independent and homogeneous data distributions increase the attacker's operable space, making it difficult for existing defense mechanisms to effectively deal with abnormal updates.
Multi-objective optimization technology and dynamic control strategy are adopted to simulate dynamic disturbance update strategies, generate disturbance parameter populations, adaptively adjust the disturbance intensity and direction, and evaluate the robustness of the system under different defense conditions.
Multidimensional performance testing of federated learning systems in non-static environments is realized, potential vulnerabilities are revealed, and the stability of the system in complex scenarios and the robustness of defense strategies are improved.
Smart Images
Figure CN120449168A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to security protection technology in machine learning, and specifically to the field of model poisoning attacks in a federated learning environment, and in particular to a federated learning security testing method and system based on multi-objective optimization. Background Art
[0002] With the widespread application of artificial intelligence and machine learning technologies, especially in areas involving privacy protection, federated learning has become an important distributed learning framework. In federated learning, each participant trains a model on local data and shares updates to the local model with a central server to update the global model. Due to this distributed architecture, federated learning effectively avoids centralized data storage and protects the data privacy of participants. It has been widely used in privacy-sensitive fields such as healthcare and finance. While federated learning offers significant advantages in privacy protection, its decentralized nature also poses new security challenges. In actual deployments, some participants may upload model parameters that deviate from the normal distribution due to device failures, network anomalies, or potentially risky behavior, thereby affecting the training performance of the global model. Therefore, identifying and defending against such anomalous updates has become a key issue in the design of federated learning systems. In recent years, significant research has been devoted to detecting and mitigating poisoning attacks. These can be summarized into three main categories: impact reduction, robust aggregation, and detection and filtering. These defense mechanisms deployed in federated learning systems provide a rich toolkit to combat the threat of model poisoning attacks. However, these defense methods often rely on static rules or assume that attack methods are fixed, without fully considering the attacker's dynamic adaptability. Attackers can adjust their attack strategies in real time based on changes in model parameters during each training round, thereby bypassing detection by existing defense mechanisms.
[0003] Currently, research on dynamic adaptive attacks is still relatively limited, and existing defense mechanisms generally have the following problems: First, most defense methods assume that attack behavior is fixed and lack the ability to respond to adaptive changes in attack strategies. Second, in federated learning systems, model parameters are typically high-dimensional, and traditional defense methods fail to fully consider the additional complexity brought by this high-dimensional data. Third, the data distribution in federated learning systems is typically non-independent and identically distributed, which leads to large differences in model updates between different clients, providing attackers with more room for maneuver. Therefore, constructing a security testing mechanism with multi-objective optimization and dynamic strategy adjustment capabilities, which can be used to simulate abnormal update behavior in different scenarios and systematically evaluate the robustness of existing federated learning defense algorithms under complex conditions, has important research and practical value. Summary of the Invention
[0004] The purpose of this invention is to provide a federated learning security testing method and system based on multi-objective optimization. This method and system simulates dynamic perturbation update strategies to systematically evaluate the robustness of federated learning models under different defense conditions. This method integrates multi-objective optimization techniques with dynamic control strategies to adaptively adjust the perturbation intensity and direction based on the federated model state and defense mechanism feedback, effectively testing system security at different stages.
[0005] To achieve the above objectives, an embodiment of the present invention provides a federated learning system security testing method based on multi-objective optimization. The multi-objective optimization-based federated learning system security testing method includes:
[0006] The test client participates in local model updates and calculates key indicators such as Euclidean distance and cosine similarity, which serve as the data basis for subsequent tests.
[0007] Based on the retained key indicators, a population set of perturbation model parameters for testing is generated under multi-objective optimization constraints, and multiple test model parameters are initialized;
[0008] Execute parameter individual selection, crossover and mutation operations in the candidate perturbation model parameter population set to simulate different perturbation strategies;
[0009] Adopting an adaptive parameter selection mechanism, the disturbance parameters corresponding to the optimal solution are selected from the candidate disturbance parameters;
[0010] Generate dynamic testing strategies based on the global model state and its response to perturbations;
[0011] The test client uploads the disturbance parameters corresponding to the optimal solution to the server to verify the anti-interference ability of the server aggregation strategy in the face of disturbance behavior, and realizes a comprehensive evaluation of the system stability and detection mechanism by controlling the intensity and direction of the disturbance.
[0012] Preferably, the test client participates in the local model update and calculates the key indicators of Euclidean distance and cosine similarity as the data basis for subsequent tests, including:
[0013] The test client collects the parameters of the global model and the local model by participating in T rounds of federated learning training;
[0014] Calculate the Euclidean distance d between the parameters of the global model and the local model m and cosine similarity cos m , as an important reference indicator for evaluating the influence range and similarity of perturbation parameters, it is used to simulate perturbation effects similar to real updates.
[0015] Preferably, generating a population set of perturbation model parameters for testing under multi-objective optimization constraints based on the retained key indicators and initializing multiple test model parameters includes:
[0016] Data indicator constraints are used to restrict the multi-objective perturbation parameter initialization process:
[0017] Constraint 1:
[0018] Constraint 2:
[0019] Constraint 3:
[0020] Within the above constraints, a random initialization strategy is used to generate multiple groups of perturbation parameter individuals to ensure the diversity of the test and prevent the test from falling into local optimality too early.
[0021] Preferably, the performing of parameter individual selection, crossover and mutation operations in the candidate perturbation model parameter population set to simulate different perturbation strategies includes:
[0022] Using a comprehensive potential evaluation function M(i), by calculating Evaluate the quality of individuals in the population and guide the evolution of the population; the function consists of three components: cross entropy loss function L(i), stability function S(i) and constraint satisfaction function P(i); where, d(i) refers to the Euclidean distance between the perturbation parameter and the global model parameter, cos(i) refers to the cosine similarity; P(i) refers to the satisfaction of the constraint conditions, and a penalty value is given if the constraint conditions are violated;
[0023] Each perturbed individual is assigned a probability of entering the next generation according to the score of M(i) Where N represents the current population size;
[0024] The selected individuals undergo a simulated binary crossover operation at a set crossover rate to generate the next generation of perturbation parameters;
[0025] New individuals introduce small perturbations through polynomial mutation to enhance the diversity and exploration of test parameters and prevent them from falling into local optimality.
[0026] Preferably, the adaptive parameter selection mechanism is used to select disturbance parameters corresponding to the optimal solution from candidate disturbance parameters, including:
[0027] The system identifies the perturbation parameter with the highest potential from the parameter population:
[0028] First calculate the specific indicators To evaluate the disturbance parameters, in order to obtain the final high potential disturbance parameter population set, where M(i) is the potential evaluation value of each disturbance parameter individual, C(i) is the distance from each disturbance parameter individual to the population center, and λ(t) is the adaptive balance factor, which determines the trade-off between population diversity and fitness. Perform calculations, The variance of the potential evaluation value indicates the dispersion of the fitness of individuals in the population. is the variance of the distance from individuals in the population to the population center, indicating population diversity;
[0029] The perturbed individuals with the top P% potential scores are retained, and the rest are used to generate a new generation of perturbed individuals through crossover and mutation to ensure population quality and diversity;
[0030] Calculate the cosine similarity between each candidate perturbation parameter in the final high-potential perturbation parameter population set and the global model of the previous round, and select the individual with the highest similarity as the final perturbation parameter.
[0031] Preferably, generating a dynamic test strategy based on the global model state and its response to disturbance behavior includes:
[0032] The test module is based on principal component analysis (PCA) technology by calculating From the simplified neural NTKs and calculation The basic information is obtained from the parameter gradient similarity distance GSD, and then the entropy (H) of the model parameters is calculated by the formula D = exp(-λ·H·PCA(NTK s ,GSD)) calculates D. Among them, entropy is calculated by formula The kernel function considers K, which is a Gaussian kernel function; wt represents the output parameter of the t-th global model; h is the bandwidth of K, which is a user-defined constant value related to the learning classifier;
[0033] The intelligent test adjustment factor D is introduced to balance the effectiveness and concealment of the perturbation test. Specifically, two key objectives are defined: (1) the loss function L(i) is used to characterize the degree of performance change after the model perturbation; the cross entropy loss function is used; (2) the hidden function S(i) is used to measure whether the perturbation is easy to be detected by the defense mechanism. The optimization objective function is calculated by the following equation: L′(i) = w1(D)·L(i)+w2(D)·S(i), where w1(D) = w 1,start ·e -β·D +w 1,end ·(1-e -β·D ), w2(D)=1-w1(D).
[0034] In addition, the present invention also provides a machine-readable storage medium, which stores instructions for enabling a machine to execute the multi-objective optimization-based federated learning system security testing method described in any one of claims 1-6.
[0035] In addition, the present invention also provides a processor for running a program, wherein the program is used to execute: the above-mentioned federated learning system security testing method based on multi-objective optimization when running.
[0036] By introducing a multi-objective optimization strategy and a dynamic adjustment mechanism, this paper constructs a dynamic perturbation generation and security assessment method suitable for federated learning systems. The aim is to systematically simulate abnormal update behaviors of different stages and intensities, thereby deeply evaluating the robustness of the system and the adaptability of the defense strategy. In this mechanism, the system adaptively generates representative perturbation parameters based on the global model state and defense feedback, realizing multi-dimensional performance testing of the federated learning system in a non-static environment. By introducing the dynamic control factor DDD, the perturbation strategy can be adjusted in real time to ensure that the test process is diverse, continuous, and scientific, close to the system stability assessment requirements in real scenarios. The system uses multi-objective optimization technology to constrain and evolve the perturbation parameters, making the generated parameters controllable and representative, and able to reveal the potential vulnerabilities of the system in long-term training without deviating from the normal update trajectory. The present invention is particularly suitable for security assessment in non-independent and identically distributed (non-IID) data environments, and can still maintain high test coverage and dynamic adaptability in such complex scenarios. This mechanism can not only be used to reveal the shortcomings of existing defense strategies, but also provide important technical support and research reference for the design of more robust and intelligent defense mechanisms in future federated learning systems.
[0037] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following detailed description, they are used to explain the embodiments of the present invention, but do not constitute a limitation of the embodiments of the present invention. In the accompanying drawings:
[0039] Figure 1 This is a schematic diagram of a system model of a federated learning security testing mechanism based on multi-objective optimization in the present invention.
[0040] Figure 2 This is a workflow diagram of a federated learning security testing mechanism based on multi-objective optimization in the present invention. DETAILED DESCRIPTION
[0041] The following describes the specific implementation of the embodiment of the present invention in detail with reference to the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiment of the present invention and is not used to limit the embodiment of the present invention.
[0042] like Figure 1 As shown in the figure, the present invention proposes a system model diagram of a federated learning security testing mechanism based on multi-objective optimization. The method mainly includes the following key steps:
[0043] The simulated client participates in the local model update as a normal person in the early stage of federated learning system training, collects global model and local model parameters after each round, and calculates key indicators such as Euclidean distance and cosine similarity as a reference for subsequent disturbance generation.
[0044] Based on the above data indicators, the system constructs a candidate perturbation parameter population under multi-objective optimization constraints and initializes multiple perturbation model parameters for robustness testing.
[0045] Selection, crossover, and mutation operations are performed on the candidate parameter population to generate more representative and diverse perturbation behaviors, simulating non-ideal update patterns that may occur in real applications.
[0046] An adaptive perturbation parameter selection mechanism is introduced to select the most representative perturbation parameters for the current round from the evolved population. First, low-quality individuals are screened out based on fitness indicators, and then the parameters most similar to the global model in the previous round are selected as test updates.
[0047] During the entire testing process, the system adaptively adjusts the intensity and direction of the disturbance parameters based on the global model state and defense mechanism feedback, realizing dynamic evaluation of the robustness of the federated learning system at different stages.
[0048] The generated disturbance parameters are eventually uploaded to the server by the simulation client to test the robustness of the aggregation mechanism and the system's ability to respond to abnormal updates.
[0049] like Figure 2 Figure 2 shows a flow chart of a security testing mechanism for a federated learning system based on multi-objective optimization, which includes the following steps:
[0050] Step 1: Normal training and data indicator collection;
[0051] Step 2: Initialize the perturbation model parameters;
[0052] Step 3: parameter selection, crossover and mutation;
[0053] Step 4: Adaptive perturbation parameter selection;
[0054] Step 5: Dynamic test strategy generation and adjustment.
[0055] In this implementation method, the normal training and data indicator collection method in step 1 includes:
[0056] Step 11: The test client participates in T rounds of federated learning training to collect parameters of the global model and the local model for subsequent security assessment.
[0057] Step 12: Calculate the Euclidean distance d between the parameters of the global model and the local model m and cosine similarity cos m , as an important reference indicator for evaluating the influence range and similarity of perturbation parameters, it is used to simulate perturbation effects similar to real updates.
[0058] The method for initializing the disturbance model parameters in step 2 includes:
[0059] Step 21: In order to ensure that the generated perturbation parameter w does not deviate from the normal trajectory of federated learning, data indicator constraints are used to restrict the multi-objective perturbation parameter initialization process:
[0060] Constraint 1:
[0061] Constraint 2:
[0062] Constraint 3:
[0063] Step 22: Within the above constraints, a random initialization strategy is used to generate multiple groups of perturbation parameter individuals to ensure the diversity of the test and prevent the test from falling into the local optimum too early.
[0064] The parameter selection, crossover and mutation methods in step 3 include:
[0065] Step 31: The system uses a comprehensive potential evaluation function M(i) by calculating Evaluate the quality of individuals in the population and guide the evolution of the population. This function consists of three components: cross entropy loss function L(i), stability function S(i) and constraint satisfaction function P(i). d(i) refers to the Euclidean distance between the perturbation parameter and the global model parameter, cos(i) refers to the cosine similarity. P(i) refers to the satisfaction of the constraint conditions, and a penalty value is given if the constraint conditions are violated.
[0066] Step 32: Each perturbed individual is assigned a probability of entering the next generation according to the score of M(i) High-quality individuals are more likely to be retained. Where N represents the current population size.
[0067] Step 33: The selected individuals undergo a simulated binary crossover operation at a set crossover rate to generate the next generation of perturbation parameters.
[0068] Step 34: The new individuals are introduced with small perturbations through polynomial mutation to enhance the diversity and exploration of the test parameters and prevent them from falling into local optimality.
[0069] The adaptive perturbation parameter selection method in step 4 includes:
[0070] Step 41: The system identifies the most potent disturbance parameter from the parameter population. First, a specific indicator is calculated: To evaluate the disturbance parameters, we can obtain the final set of high potential disturbance parameter populations. Where M(i) is the potential evaluation value of each disturbance parameter individual, C(i) is the distance from each disturbance parameter individual to the population center, and λ(t) is the adaptive balance factor, which determines the trade-off between population diversity and fitness. Perform calculations, The variance of the potential evaluation value indicates the dispersion of the fitness of individuals in the population. is the variance of the distance from individuals in the population to the population center, indicating the diversity of the population.
[0071] Step 42: retain the perturbed individuals with the top P% potential scores (e.g., P=60 represents the top 60%), and generate a new generation of perturbed individuals through crossover and mutation for the rest to ensure population quality and diversity.
[0072] Step 43: Calculate the cosine similarity between each candidate perturbation parameter in the final high-potential perturbation parameter population set and the global model of the previous round, and select the individual with the highest similarity as the final perturbation parameter and upload it to the server.
[0073] The dynamic test strategy generation and adjustment method in step 5 includes:
[0074] Step 51: The test module is calculated based on the principal component analysis (PCA) technique. From the simplified neural NTKs and calculation The basic information is obtained from the parameter gradient similarity distance GSD, and then the entropy (H) of the model parameters is calculated by the formula D = exp(-λ·H·PCA(NTK s ,GSD)) calculates D. Among them, entropy is calculated by formula The kernel function considered is K, which is a Gaussian kernel function. wt represents the output parameter of the tth global model. h is the bandwidth of K, which is a user-defined constant value related to the learned classifier.
[0075] Step 52: Introduce the intelligent test adjustment factor D to balance the effectiveness and concealment of the perturbation test. Specifically, two key objectives are defined: (1) The loss function L(i) is used to characterize the degree of performance change after the model is perturbed. The cross entropy loss function is used. (2) The hidden function S(i) is used to measure whether the perturbation is easy to be detected by the defense mechanism. The optimization objective function is calculated by the following equation: L′(i) = w1(D)·L(i)+w2(D)·S(i), where w1(D) = w 1,start ·e -β·D +w 1,end ·(1-e -β·D ), w2(D)=1-w1(D).
[0076] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0077] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0078] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0079] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.
[0080] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.
[0081] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.
[0082] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.
[0083] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.
[0084] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0085] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.
Claims
1. A security testing method for a federated learning system based on multi-objective optimization, characterized in that: The multi-objective optimization-based federated learning security testing method includes: The test client participates in local model updates and calculates key indicators such as Euclidean distance and cosine similarity, which serve as the data basis for subsequent tests. Based on the retained key indicators, a population set of perturbation model parameters for testing is generated under multi-objective optimization constraints, and multiple test model parameters are initialized; Execute parameter individual selection, crossover and mutation operations in the candidate perturbation model parameter population set to simulate different perturbation strategies; Adopting an adaptive parameter selection mechanism, the disturbance parameters corresponding to the optimal solution are selected from the candidate disturbance parameters; Generate dynamic testing strategies based on the global model state and its response to perturbations; The test client uploads the disturbance parameters corresponding to the optimal solution to the server to verify the anti-interference ability of the server aggregation strategy in the face of disturbance behavior, and realizes a comprehensive evaluation of the system stability and detection mechanism by controlling the intensity and direction of the disturbance.
2. The multi-objective optimization-based federated learning system security testing method according to claim 1, characterized in that: The test client participates in local model updates and calculates key metrics such as Euclidean distance and cosine similarity, which serve as the data basis for subsequent tests, including: The test client collects the parameters of the global model and the local model by participating in T rounds of federated learning training; Calculate the Euclidean distance d between the parameters of the global model and the local model m and cosine similarity cos m , as an important reference indicator for evaluating the influence range and similarity of perturbation parameters, it is used to simulate perturbation effects similar to real updates.
3. The method for security testing of a federated learning system based on multi-objective optimization according to claim 2, characterized in that: Based on the retained key indicators, generating a population set of perturbation model parameters for testing under multi-objective optimization constraints, and initializing multiple test model parameters include: Data indicator constraints are used to restrict the multi-objective perturbation parameter initialization process: Constraint 1: Constraint 2: Constraint 3: Within the above constraints, a random initialization strategy is used to generate multiple groups of perturbation parameter individuals to ensure the diversity of the test and prevent the test from falling into local optimality too early.
4. A method for security testing of a federated learning system based on multi-objective optimization according to claim 3, characterized in that: The selection, crossover and mutation operations of individual parameters are performed in the candidate perturbation model parameter population set to simulate different perturbation strategies, including: Using a comprehensive potential evaluation function M(i), by calculating Evaluate the quality of individuals in the population and guide the evolution of the population; the function consists of three components: cross entropy loss function L(i), stability function S(i) and constraint satisfaction function P(i); where, d(i) refers to the Euclidean distance between the perturbation parameter and the global model parameter, cos(i) refers to the cosine similarity; P(i) refers to the satisfaction of the constraint conditions, and a penalty value is given if the constraint conditions are violated; Each perturbed individual is assigned a probability of entering the next generation according to the score of M(i) Where N represents the current population size; The selected individuals undergo a simulated binary crossover operation at a set crossover rate to generate the next generation of perturbation parameters; New individuals introduce small perturbations through polynomial mutation to enhance the diversity and exploration of test parameters and prevent them from falling into local optimality.
5. The method for security testing of a federated learning system based on multi-objective optimization according to claim 4, characterized in that: The adaptive parameter selection mechanism is used to select the disturbance parameters corresponding to the optimal solution from the candidate disturbance parameters, including: The system identifies the perturbation parameter with the highest potential from the parameter population: First calculate the specific indicators To evaluate the disturbance parameters, in order to obtain the final high potential disturbance parameter population set, where M(i) is the potential evaluation value of each disturbance parameter individual, C(i) is the distance from each disturbance parameter individual to the population center, and λ(t) is the adaptive balance factor, which determines the trade-off between population diversity and fitness. Perform calculations, The variance of the potential evaluation value indicates the dispersion of the fitness of individuals in the population. is the variance of the distance from individuals in the population to the population center, indicating population diversity; The perturbed individuals with the top P% potential scores are retained, and the rest are used to generate a new generation of perturbed individuals through crossover and mutation to ensure population quality and diversity; Calculate the cosine similarity between each candidate perturbation parameter in the final high-potential perturbation parameter population set and the global model of the previous round, and select the individual with the highest similarity as the final perturbation parameter.
6. A method for security testing of a federated learning system based on multi-objective optimization according to claim 5, characterized in that: Generating a dynamic test strategy based on the global model state and its response to disturbance behavior includes: The test module is based on principal component analysis (PCA) technology by calculating From the simplified neural NTKs and calculation The basic information is obtained from the parameter gradient similarity distance GSD, and then the entropy (H) of the model parameters is calculated by the formula D = exp(-λ·H·PCA(NTK s ,GSD)) calculates D. Among them, entropy is calculated by formula The kernel function considers K, which is a Gaussian kernel function; wt represents the output parameter of the t-th global model; h is the bandwidth of K, which is a user-defined constant value related to the learning classifier; The intelligent test adjustment factor D is introduced to balance the effectiveness and concealment of the perturbation test. Specifically, two key objectives are defined: (1) the loss function L(i) is used to characterize the degree of performance change after the model perturbation; the cross entropy loss function is used; (2) the hidden function S(i) is used to measure whether the perturbation is easy to be detected by the defense mechanism. The optimization objective function is calculated by the following equation: ′ (i)=w1(D)·L(i)+w2(D)·S(i), where w1(D)=w 1,start ·e -β·D +w 1,end ·(1-e -β·D ), w2(D)=1-w1(D).
7. A machine-readable storage medium, characterized in that The machine-readable storage medium stores instructions for enabling a machine to execute the multi-objective optimization-based federated learning system security testing method described in any one of claims 1 to 6.
8. A processor, characterized in that: Used to run a program, wherein the program is used to execute when run: the federated learning system security testing method based on multi-objective optimization according to any one of claims 1 to 6.