Federal learning method based on progressive aggregation and related device

Abstract

The invention belongs to the technical field of smart industry, and discloses a federal learning method based on progressive aggregation and a related device. The federal learning method comprises the following steps: receiving model updates of K participants by a federal server, marking the first M model updates with the maximum similarity as abnormal model updates, and performing directional aggregation; constructing a hypersphere by taking the update of the aggregation anomaly model as a center, randomly sampling on the hypersphere to generate disturbance, and updating the model; stacking the disturbed model update and the remaining K-M model update to form a model update matrix, calculating an arithmetic mean value of projection values of each model update in the main direction, and generating global model update; and updating the federated learning global model according to the global model update. According to the technical scheme disclosed by the invention, backdoor attacks can be effectively defended, and meanwhile, the effectiveness and robustness of a global model are kept.

Description

Technical Field

[0001] The present invention belongs to the field of smart industrial technology, and in particular relates to a federated learning method based on progressive aggregation and related devices. Background Art

[0002] Federated learning has become increasingly popular in recent years, enabling mobile and IoT devices to jointly train a shared model without exposing their private local data. Specifically, federated learning ensures data privacy by retaining each client's data on the device. This is particularly important in IoT systems, as sensitive information is constantly generated by distributed sensors and devices. Federated learning has become an indispensable technology for privacy-sensitive IoT applications such as medical image analysis, speech recognition, forest fire prediction, and anomaly detection in industrial IoT devices. By leveraging the inherent scalability and privacy-preserving properties of federated learning, the IoT ecosystem can achieve more efficient machine learning results while addressing data security and privacy concerns.

[0003] Despite its enormous potential, federated learning faces several challenges in practical applications. One key challenge is security threats, particularly backdoor attacks. Specifically, when training with a large number of clients, federated learning often involves multiple malicious clients, which can upload carefully crafted model updates during the federated training process and ultimately aggregate them on a central server. Because the server inherently lacks visibility into the local training process, it is vulnerable to backdoor attacks, thereby undermining the model's effectiveness. It is worth noting that, unlike Byzantine attacks, which aim to disrupt convergence or guide the model to a suboptimal solution, backdoor attacks aim to perform targeted poisoning attacks, attempting to trick the model into misclassifying specific test samples with high confidence. For example, in medical image analysis, a backdoored skin cancer screening system could misdiagnose images of skin lesions as another disease specified by the attacker, leading to potentially catastrophic consequences. Furthermore, because the attacker can ensure that the global model converges to a highly accurate solution during inference, detecting or defending against such attacks becomes extremely difficult, raising serious security concerns and hindering the widespread adoption of federated learning in real-world IoT systems.

[0004] There have been numerous studies on how to mitigate backdoor attacks in federated learning. A typical approach is to limit the impact of statistically anomalous local updates (i.e., statistical outliers), thereby reducing their impact on the global model. Some heuristic aggregation methods propose dividing model updates into benign and malicious groups and then aggregating only the benign group. Other robust aggregation methods leverage differential privacy to inject moderate noise into the model to enhance resistance to backdoor attacks. Recent research has also developed provably robust federated learning protocols that guarantee that the global model cannot be influenced by adversarial attackers. However, experiments have shown that these defenses fail to prevent high-intensity attacks. Under high-intensity attacks, each round has a high probability of being attacked. For example, in our experimental setting, the probability of being attacked per round can reach 0.5, meaning that nearly half of the rounds are subject to attack. In adversarial rounds, malicious clients account for over 50% of all participants, and in extreme cases, up to 70%. These malicious clients share a common malicious goal, can share similar malicious datasets, and follow the same distribution. In this attack scenario, most existing defense methods are not only difficult to resist attacks, but also inevitably affect the overall model performance. Therefore, additional defense methods are urgently needed to mitigate high-intensity attacks in federated learning. Summary of the Invention

[0005] The present invention aims to provide a federated learning method and related apparatus based on progressive aggregation to address one or more of the aforementioned technical problems. The disclosed technical solution penalizes the impact of abnormal updates on global updates from a directional perspective and maintains overall model performance by considering both benign and abnormal updates. This effectively defends against backdoor attacks while maintaining the effectiveness and robustness of the global model.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: In a first aspect, the present invention provides a federated learning method based on progressive aggregation, comprising the following steps: The federated server receives K The model updates of participants are calculated, and the similarity between each pair of model updates is calculated. M The model updates with the largest similarity are regarded as abnormal model updates and directed aggregation is performed to obtain the aggregated abnormal model updates and the remaining K - M Model update; Construct a hypersphere with the aggregated abnormal model update as the center, randomly sample on the hypersphere to generate the perturbed model update; combine the perturbed model update with the remaining K - MThe model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model according to the global model update.

[0007] A further improvement of the technical solution of the present invention is that in the step of calculating the similarity between each pair of model updates, The similarity between each pair of model updates is calculated as follows: ; Where, It is t Round Client i 、 j Model update; It is the client of round t i 、 j Model update for the last layer.

[0008] A further improvement of the technical solution of the present invention is that in the step of performing directional polymerization, The directed aggregation operation is expressed as: ; Where, is the aggregate value of the anomaly model update in round t; It is the client of round t k Model update.

[0009] A further improvement of the technical solution of the present invention is that the step of constructing a hypersphere with the aggregated anomaly model update as the center and randomly sampling on the hypersphere to generate disturbances and then updating the model specifically includes: In the process of constructing the hypersphere with the update of the aggregated anomaly model as the center, the expression of the hypersphere is: ; Where Ω is a hypersphere; is the disturbance angle for updating the aggregate anomaly model; is the unit direction vector; It is t Aggregate value of round anomaly model update; Random from uniform distribution A disturbance angle is sampled randomly from the standard normal distribution Sample a direction vector in , and generate the perturbed model update according to the expression of the hypersphere. The expression of the perturbed model update is: ; Where, is the model update after the tth round of disturbance; is the disturbance angle for updating the aggregate anomaly model, which obeys uniform distribution ; is the direction vector, which obeys the standard normal distribution .

[0010] A further improvement of the technical solution of the present invention is that the post-disturbance model update is combined with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size. The steps of generating a global model update include: Combine the perturbed model update with the remaining K - M Model updates are stacked column by column to construct a model update matrix of dimension d×(K-M+1) ∈R (d×(K-M+1)) ; Update the matrix for the model Each column of performs L2 norm normalization, and calculates the covariance matrix of the normalized matrix, and obtains the maximum eigenvalue of the covariance matrix through eigenvalue decomposition and The corresponding eigenvector ; The feature vector Update the matrix with the model Perform linear combination to generate the main direction vector , the main direction vector satisfies Normalization constraints; The amplitude of each model update is clipped to a minimum modulus value, which is calculated as follows: ; Where, It is in t The minimum modulus value for all model updates during a round of training; It is t Model update after round disturbance; It is the client of round t K Model update; Perform the projection mean synthesis operation, and the calculation expression for the global model update is as follows: ; Where, It is t Global model update of the wheel.

[0011] A further improvement of the technical solution of the present invention is that in the step of updating the federated learning global model according to the global model update, The calculation expression for updating the global model of federated learning is as follows: ; Where, is the global learning rate; It is t Global model of the wheel; is the global model at round t+1; It is t Global model update of the wheel.

[0012] A second aspect of the present invention provides a federated learning system based on progressive aggregation, comprising: Model update acquisition unit, used to receive updates from the federated server K The model updates of participants are calculated, and the similarity between each pair of model updates is calculated. M The model updates with the largest similarity are regarded as abnormal model updates and directed aggregation is performed to obtain the aggregated abnormal model updates and the remaining K - M Model update; The global model update unit is used to construct a hypersphere with the aggregated abnormal model update as the center, randomly sample on the hypersphere to generate the perturbed model update; and combine the perturbed model update with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model according to the global model update.

[0013] In a third aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the federated learning method based on progressive aggregation as described in any one of the first aspects of the present invention is implemented.

[0014] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the federated learning method based on progressive aggregation as described in any one of the first aspects of the present invention is implemented.

[0015] In a fifth aspect, the present invention provides a computer program product, comprising a computer program or an instruction, which, when executed by a communication device, enables the federated learning method based on progressive aggregation as described in any one of the first aspects of the present invention to be executed. Compared with the prior art, the present invention has the following beneficial effects: The present invention specifically provides a federated learning method based on progressive aggregation; specifically, first, by calculating the similarity between the model updates of the participants, potential abnormal model updates are identified and directionally aggregated to generate an aggregated abnormal model update. This is because in federated learning, high-intensity backdoor attacks often come from multiple malicious clients sending significantly similar abnormal updates. In this way, these abnormal updates can be identified and aggregated in advance, reducing their destructive power on the global model; then, a hypersphere is constructed with the aggregated abnormal model update as the center, and random sampling is performed on the hypersphere to generate a perturbed model update, while adjusting its norm to be consistent with the global model update. This is because the attacker may set a specific malicious direction to guide the model to generate backdoor behavior, which affects the aggregated abnormal model update. Abnormal model updates perform directional perturbations, which can bypass malicious directions, protect the model from malicious tampering, and maintain its effectiveness and robustness; then, the perturbed model updates and the remaining normal model updates are combined into a model update matrix, and after normalizing the column vectors of the matrix, the main direction is extracted and the global update direction is calculated. Based on this direction, the projection mean of each model update in the global update direction is calculated as the step size, thereby generating a global model update. This is done to comprehensively consider the normal and abnormal model update information after processing, so that the global model can iterate according to a reasonable direction and step size, so that the model can effectively integrate useful information from all parties and enhance resistance to high-intensity attacks; finally, the federal server updates the global model of federated learning based on the calculated global update. In summary, the technical solution of the present invention can effectively defend against high-intensity backdoor attacks through the implementation of the above-mentioned innovative technical means, while maintaining the effectiveness and robustness of the global model. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below; obviously, the drawings described below are some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 1 is a flowchart of a federated learning method based on progressive aggregation in an embodiment of the present invention; Figure 2 1 is a schematic diagram of a framework of a federated learning method based on progressive aggregation in an embodiment of the present invention; Figure 3 1 is a schematic diagram of the backdoor accuracy of the attack based on the model replacement trigger in an embodiment of the present invention; Figure 4 Schematic diagram of backdoor accuracy and global model performance for performing label flipping attacks in an embodiment of the present invention; Figure 5 Schematic diagram of the defense performance against projected gradient descent attack with model replacement in an embodiment of the present invention; Figure 6 Schematic diagram of the effectiveness of defense against more powerful backdoor attacks in an embodiment of the present invention; Figure 7 1 is a schematic diagram showing the effectiveness of an extremely powerful backdoor attack when the number of clients is increased in an embodiment of the present invention; Figure 8 2 is a schematic diagram of a federated learning system based on progressive aggregation in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention; it is obvious that the described embodiments and technical solutions are only part of the embodiments of the present invention, not all of the embodiments.

[0019] All other embodiments obtained by persons of ordinary skill in the art based on the technical solutions disclosed in the embodiments of the present invention without creative effort shall fall within the scope of protection of the present invention. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatuses.

[0020] See also Figure 1 , an embodiment of the present invention provides a federated learning method based on progressive aggregation, comprising the following steps: Step 1: The federated server receives K The model updates of participants are calculated, and the similarity between each pair of model updates is calculated. M The model updates with the largest similarity are regarded as abnormal model updates and directed aggregation is performed to obtain the aggregated abnormal model updates and the remaining K - M Model update; Step 2: Construct a hypersphere with the aggregated abnormal model update as the center, randomly sample on the hypersphere to generate the perturbed model update; combine the perturbed model update with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model according to the global model update.

[0021] To further explain, during a round of federated learning, participants will first download the global model from the central server, and then use their own data sets to train and update the parameters of the local global model. The difference in parameters between the updated local global model and the global model initially downloaded in this round is the model update, and the participants will then upload the model update to the central server.

[0022] In the technical solution disclosed in the embodiment of the present invention, the impact of abnormal updates on global updates is punished from the perspective of direction, and the overall model performance is maintained by considering both benign and abnormal updates. It can effectively defend against backdoor attacks while maintaining the effectiveness and robustness of the global model.

[0023] See also Figure 1 and Figure 2 , an embodiment of the present invention provides a federated learning method based on progressive aggregation, comprising the following steps: Step S1: The federated server receives the model updates from the participants, calculates the similarity between each pair of model updates, and marks the previous M The model update with the largest similarity is regarded as the abnormal model update; the abnormal model update is directed aggregated to generate the abnormal model update after aggregation. , while retaining the remaining K - M A normal model update; Step S2: Update the aggregated anomaly model generated in step S1 As the center, construct a hypersphere , where Ω is a hypersphere, is the disturbance angle, is the unit direction vector (i.e. ∥ ∥=1); is the aggregate value of the abnormal model update in the tth round; the model is updated after random sampling on the hypersphere to generate disturbances , and adjust its norm to make it consistent with The norm of is consistent; Step S3: Update the disturbed model generated in step S2 With the remaining K - M Normal model updates are stacked to form the model update matrix ; For the matrix After normalizing the column vector of , calculate the global update direction Based on the main direction, calculate the update of each model The projected mean in the direction is used as the step size to generate the global model update ; Step S4: Global update calculated according to step S3 , the federated server updates the federated learning global model; In one embodiment of the present invention, in step S1, the federated server performs the following operations to update the directed aggregated anomaly model: S101. Calculate the similarity between model updates. After the federated server receives a series of model updates submitted by the participant, it first calculates the similarity between each pair of model updates. The calculation formula is as follows: ; S102: similarity calculated in step S101 , sort from large to small, and mark the top M model updates with the highest similarity as abnormal model updates. These abnormal model updates may come from a group of colluding adversarial attackers; S103. For model updates marked as abnormal, perform a directed aggregation operation: ; This step combines all model updates that are marked as anomalous into a single model update for further analysis or processing.

[0024] In one embodiment of the present invention, in step S2, the federated server performs directional perturbation to mitigate the impact of abnormal model updates, specifically including: S201, Assumption As the sum of abnormal model updates, the present invention proposes to perform directional perturbations on it to avoid malicious directions as much as possible; in the specific technical solution, Build a center for , the radius is The hypersphere of is calculated as follows: ; where Ω is a hypersphere, Yes The disturbance angle; is the unit direction vector (i.e. ∥ ∥=1); is the aggregate value of the anomaly model update in round t.

[0025] S202, sampling disturbance parameters. Randomly from uniform distribution Sampling a disturbance angle , randomly drawn from a standard normal distribution Sampling a direction vector ; S503: Generate perturbed model update according to hypersphere formula , generating the perturbed model update, is calculated as follows: ; This step ensures that the perturbed model update maintains the same modulus as the original model update.

[0026] In one embodiment of the present invention, in step S3, the federation server performs the main direction analysis operation specifically as follows: S301, update the model vector after K-M+1 directional aggregation Construct an update matrix of dimension d×(K-M+1) by stacking columns ∈R (d×(K-M+1)) ; S302, matrix Each column of performs L2 norm normalization to eliminate the amplitude difference interference of model update; S303, calculate normalized matrix The covariance matrix of , obtain its maximum eigenvalue through eigenvalue decomposition and the corresponding eigenvector ; S304, the feature vector With the matrix Perform linear combination to generate the main direction vector , the vector satisfies Normalization constraints; S305: Clip each model update to the minimum modulus value, limiting the amplitude of each model update to not exceed this minimum value. The minimum amplitude threshold for all model updates is calculated as follows: ; S306: Perform the projection mean synthesis operation, and the global model update calculation is as follows: .

[0027] In one embodiment of the present invention, in step S4, the federated server performs a global model update, specifically: S401, after calculating the global update After that, the federated learning (FL) server updates the global model and calculates it as follows:

[0028] Here, γ is the global learning rate.

[0029] In summary, the present invention proposes a federated learning defense method based on progressive aggregation for high-intensity backdoor attacks. This method maintains the contribution of benign updates while penalizing the contribution of anomalous updates from a directional perspective, thereby preventing backdoor attacks. The present invention designs a targeted aggregation strategy to discover anomalous parameter spaces and aggregate model updates within them. Furthermore, a directional perturbation scheme is introduced to adjust parameters away from malicious directions. Furthermore, the present invention introduces a dominant direction analysis mechanism, which extracts the direction of global updates based on the majority principle to circumvent backdoor directions. This technical solution effectively protects against high-intensity backdoor attacks, where both the attack frequency and the proportion of malicious clients are high. Furthermore, the present invention is robust against backdoor attacks even in the presence of only one adversarial attacker. While protecting against backdoor attacks, the present invention maintains the overall performance (i.e., accuracy) of the global model. Furthermore, in the absence of an adversarial attacker, the present invention achieves the expected accuracy (or other performance metrics) on the test dataset. Specifically, step S1 of the present invention can identify abnormal model updates from colluding adversarial attackers by directional aggregation of model updates with large pairwise similarity, while also retaining the contributions of benign model updates and abnormal model updates. direction, can mitigate the impact of abnormal model updates to a certain extent. Step S3 of the present invention performs a main direction analysis based on the majority principle. After step S1, there is only one abnormal model update; compared with the abnormal model updates, benign model updates account for the majority, so the direction of the global update will be determined by the benign update, which will completely bypass the malicious direction, thereby mitigating the impact of abnormal model updates on the global model update. In summary, the technical solution disclosed in the embodiment of the present invention can effectively defend against high-intensity backdoor attacks in the federated learning system through a hybrid aggregation method, while maintaining the overall model performance.

[0030] In a specific exemplary technical solution of the present invention, simulation experiments were conducted using the CIFAR-10 dataset to evaluate the feasibility and effectiveness of the invention as follows: The experiment evaluated the defense effectiveness of the present invention against state-of-the-art backdoor attacks such as model replacement, label flipping, and projected gradient descent attacks with model replacement on the CIFAR10 dataset. Specifically, the experiment trained a shared model on a total of 100 clients, randomly selecting 10 of them to participate in each communication round; further, the experiment trained a ResNet18 on CIFAR10. In addition, in order to simulate non-independent and identically distributed training data in the real world and provide unbalanced samples from each category to different clients, the experiment used a Dirichlet distribution with a hyperparameter of 0.9 to divide the training data. Before executing the backdoor attack, the experiment trained the model to a roughly converged state for each dataset. The proportion of attackers in each adversarial round was set to 0.6. Each communication round was set as an adversarial round with a probability of 0.5.

[0031] The experimental results of the embodiments of the present invention show that: (1) Figure 3 The backdoor accuracy of the defense measures of the present invention against MR trigger-based attacks in the first 60 communication rounds is demonstrated. Figure 3 In the "Pixel (Semantic) Pattern - No Defense" section, no defense measures were applied when executing backdoor attacks based on pixel pattern (or semantic) triggers. "Pixel (Semantic) Pattern - Invention's Defense" section indicates that the invention's defense measures were applied to protect against backdoor attacks based on pixel pattern (or semantic) triggers. Results show that even with high attack frequencies and a high proportion of malicious actors, the invention can still effectively mitigate the impact of such trigger-based backdoor attacks.

[0032] (2) Figure 4This report demonstrates the backdoor accuracy and global model performance of the present invention for a label-flipping attack performed over the first 60 communication rounds. The attacker aims to misclassify test samples belonging to class 7 (horses) as class 2 (birds). "No defenses" indicates that no defenses were applied when performing the label-flipping attack. "Present defenses" indicates that the present invention was applied to defend against the label-flipping attack. "No defenses - other classes test set" indicates the global model accuracy on the test dataset after removing the 7 classes without defenses. "No defenses - entire test set" indicates the global model accuracy on the entire test dataset without defenses. "Present defenses - entire test set" indicates the global model accuracy achieved on the entire test dataset by applying the present invention's defenses. The results show that the present invention effectively prevents label-flipping attacks without compromising global model performance, even at high attack frequencies. This is because the present invention reduces the impact of anomalous model updates while preserving the contributions of both benign and anomalous model updates.

[0033] (3) Figure 5 The defense performance of the present invention against the projected gradient descent attack with model replacement in the first 60 communication rounds is demonstrated. As shown in the figure, in this attack, the attacker uses edge case data to build a backdoor and updates the local model using the PGD algorithm, and then amplifies its update through the model replacement strategy to offset the contribution of benign participants. "Measures of the present invention" represents the backdoor accuracy of the present invention in defending against the projected gradient descent attack with model replacement. "No defense measures" represents the backdoor accuracy against the projected gradient descent attack with model replacement in the absence of defense measures. "Measures of the present invention - entire test set" represents the global model accuracy obtained on the entire test dataset by applying the defense measures of the present invention. The results show that the present invention can effectively prevent projected gradient descent attacks with model replacement while maintaining good performance of the model.

[0034] (4) Figure 6 This paper demonstrates the effectiveness of our defense approach against more powerful backdoor attacks. Specifically, the experiment increases the attacker ratio to 0.7 and 0.8 in each adversarial round. Furthermore, for the first 60 communication rounds, each round is set as an adversarial round. Furthermore, our defense measures are evaluated against semantically triggered backdoor attacks on the CIFAR10 dataset. Figure 6The backdoor accuracy and global model performance when the defense method of the present invention is applied are demonstrated. "0.7, B" and "0.7, M" respectively represent the backdoor accuracy and global model accuracy on the test dataset when the attacker ratio in each adversarial round is set to 0.7. It can be seen that when the attacker ratio in the adversarial round reaches 0.7, the defense method of the present invention can still effectively prevent backdoor attacks in federated learning. However, when the attacker ratio reaches 0.8, the defense of the present invention fails to prevent backdoor attacks. The reason for the failure is that the number of benign participants in each adversarial round is significantly reduced, resulting in an increase in the impact of directed aggregation model updates when extracting global updates. Moreover, when the attacker ratio rises to 0.8, the performance of the global model is also affected.

[0035] (5) Figure 7 This paper demonstrates the effectiveness of our defense method against extremely powerful backdoor attacks as the number of participating clients increases. Specifically, the experiment selected 20 clients (20% of the total number of clients) for federated training. Furthermore, the attacker ratio in each adversarial round was set to 0.7 and 0.8, respectively, and the backdoor attack was executed in each communication round. Figure 7 We demonstrate backdoor accuracy and global model performance when applying our defense method. When the attacker ratio increases to 0.8, our defense still prevents backdoor attacks without compromising model performance. The results demonstrate that as the number of participants in an adversarial round increases, our defense method can tolerate a higher attacker ratio in federated learning.

[0036] In summary, the present invention discloses an innovative progressive aggregation method that successfully defends against multiple types of backdoor attacks, even in the face of numerous malicious clients and frequent attacks, while ensuring that the performance of the global model remains intact. Furthermore, as the number of participants in the adversarial round increases, the present invention demonstrates increased tolerance, enabling it to handle a higher proportion of attackers. These findings further demonstrate the potential and effectiveness of the present invention's technical solution in practical applications, particularly in highly secure federated learning environments.

[0037] The following are device embodiments of the present invention, which can be used to implement the method embodiments of the present invention. For details not disclosed in the device embodiments, please refer to the method embodiments of the present invention.

[0038] See also Figure 8 In an embodiment of the present invention, a federated learning system based on progressive aggregation is provided, including: Model update acquisition unit, used to receive updates from the federated server K The model updates of participants are calculated, and the similarity between each pair of model updates is calculated. MThe model updates with the largest similarity are regarded as abnormal model updates and directed aggregation is performed to obtain the aggregated abnormal model updates and the remaining K - M Model update; The global model update unit is used to construct a hypersphere with the aggregated abnormal model update as the center, randomly sample on the hypersphere to generate the perturbed model update; and combine the perturbed model update with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model according to the global model update.

[0039] In one embodiment of the present invention, a computer device is provided, comprising a processor and a memory, wherein the memory is configured to store a computer program, the computer program including program instructions, and the processor is configured to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or may be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. It is the computing core and control core of the terminal and is suitable for implementing one or more instructions, specifically loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used to perform operations of a federated learning method based on progressive aggregation.

[0040] In one embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory). The computer-readable storage medium is a memory device in a computer device, used to store programs and data. It is understood that the computer-readable storage medium herein may include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for being loaded and executed by a processor. These instructions may be one or more computer programs (including program code). It should be noted that the computer-readable storage medium herein may be a high-speed random access memory (RAM) or a non-volatile memory, such as at least one disk storage device. The processor may load and execute the one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the federated learning method based on progressive aggregation in the above-mentioned embodiment.

[0041] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, optical storage, etc.) containing computer-usable program code.

[0042] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0043] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0044] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0045] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A federated learning method based on progressive aggregation, characterized in that: The following steps are involved: The federated server receives K The model updates of participants are calculated, and the similarity between each pair of model updates is calculated. M The model updates with the largest similarity are regarded as abnormal model updates and directed aggregation is performed to obtain the aggregated abnormal model updates and the remaining K - M Model update; Construct a hypersphere with the aggregated abnormal model update as the center, randomly sample on the hypersphere to generate the perturbed model update; combine the perturbed model update with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size to generate the global model update. The federated server updates the federated learning global model based on the global model update.

2. A federated learning method based on progressive aggregation according to claim 1, characterized in that: In the step of calculating the similarity between each pair of model updates, The similarity between each pair of model updates is calculated as follows: ； Where, It is t Round Client i 、 j Model update; It is the client of round t i 、 j Model update for the last layer.

3. The federated learning method based on progressive aggregation according to claim 1, characterized in that: In the step of performing directional polymerization, The directed aggregation operation is expressed as: ； Where, is the aggregate value of the anomaly model update in round t; It is the client of round t k Model update.

4. The method for federated learning based on progressive aggregation according to claim 1, characterized in that: The steps of constructing a hypersphere with the aggregated anomaly model update as the center and randomly sampling on the hypersphere to generate disturbances and then updating the model specifically include: In the process of constructing the hypersphere with the update of the aggregated anomaly model as the center, the expression of the hypersphere is: ； Where Ω is a hypersphere; is the disturbance angle for updating the aggregate anomaly model; is the unit direction vector; It is t Aggregate value of round anomaly model update; Random from uniform distribution A disturbance angle is sampled randomly from the standard normal distribution Sample a direction vector in , and generate the perturbed model update according to the expression of the hypersphere. The expression of the perturbed model update is: ； Where, is the model update after the tth round of disturbance; is the disturbance angle for updating the aggregate anomaly model, which obeys uniform distribution ; is the direction vector, which obeys the standard normal distribution .

5. The method of federated learning based on progressive aggregation according to claim 1, characterized in that: The post-perturbation model update is combined with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size. The steps of generating a global model update include: Combine the perturbed model update with the remaining K - M Model updates are stacked column by column to construct a model update matrix of dimension d×(K-M+1) ∈R (d×(K-M+1)) ; Update the matrix for the model Each column of performs L2 norm normalization, and calculates the covariance matrix of the normalized matrix, and obtains the maximum eigenvalue of the covariance matrix through eigenvalue decomposition and The corresponding eigenvector ; The feature vector Update the matrix with the model Perform linear combination to generate the main direction vector , the main direction vector satisfies Normalization constraints; The amplitude of each model update is clipped to a minimum modulus value, which is calculated as follows: ； Where, It is in t The minimum modulus value for all model updates during a round of training; It is t Model update after round disturbance; It is the client of round t K Model update; Perform the projection mean synthesis operation, and the calculation expression for the global model update is as follows: ； Where, It is t Global model update of the wheel.

6. The method for federated learning based on progressive aggregation according to claim 1, characterized in that: In the step of updating the federated learning global model according to the global model update, The calculation expression for updating the global model of federated learning is as follows: ； Where, is the global learning rate; It is t Global model of the wheel; is the global model at round t+1; It is t Global model update of the wheel.

7. A federated learning system based on progressive aggregation, characterized in that: include: Model update acquisition unit, used to receive updates from the federated server K The model updates of participants are calculated, and the similarity between each pair of model updates is calculated. M The model updates with the largest similarity are regarded as abnormal model updates and directed aggregation is performed to obtain the aggregated abnormal model updates and the remaining K - M Model update; The global model update unit is used to construct a hypersphere with the aggregated abnormal model update as the center, randomly sample on the hypersphere to generate the perturbed model update; and combine the perturbed model update with the remaining K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the main direction is extracted. The arithmetic mean of the projection values of each model update in the main direction is calculated. The arithmetic mean is used as the step size to generate the global model update. The federated server updates the federated learning global model based on the global model update.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the federated learning method based on progressive aggregation according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the federated learning method based on progressive aggregation according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product includes a computer program or instructions, and when the computer program or instructions are executed by a communication device, the progressive aggregation-based federated learning method according to any one of claims 1 to 6 is executed.

Images