A federated learning method based on progressive aggregation and related apparatuses

Abstract

The application belongs to the technical field of intelligent industry, and discloses a federated learning method based on progressive aggregation and related devices. K The federated learning method comprises the following steps: M Marking the model update with the maximum similarity as an abnormal model update and performing directional aggregation;Constructing a hypersphere centering on the aggregated abnormal model update, randomly sampling a disturbed model update on the hypersphere, and stacking the disturbed model update and the remaining K M model updates to form a model update matrix, calculating the arithmetic mean of the projection values of each model update in the main direction, generating a global model update, and updating the global model of the federated learning according to the global model update. The technical scheme disclosed by the application can effectively defend against backdoor attacks while maintaining the effectiveness and robustness of the global model.

Description

Technical Field

[0001] This invention belongs to the field of smart industrial technology, and specifically relates to a federated learning method and related apparatus based on progressive aggregation. Background Technology

[0002] In recent years, federated learning has gained increasing popularity, enabling mobile and IoT devices to jointly train a shared model without exposing their private local data. More interpretably, federated learning methods guarantee data privacy by retaining each user's data on the device, which is particularly important in IoT systems because sensitive information is frequently generated by sensors and devices distributed across various locations. Federated learning has become an indispensable technology in privacy-sensitive IoT applications such as medical image analysis, speech recognition, forest fire prediction, and anomaly detection in industrial IoT devices. By leveraging the inherent scalability and privacy-preserving properties of federated learning, the IoT ecosystem can achieve more efficient machine learning results while addressing data security and privacy concerns.

[0003] Despite the immense potential of federated learning, its practical applications face several challenges, one key one being security threats, particularly backdoor attacks. Specifically, when numerous clients participate in training, federated learning often involves multiple malicious clients that can upload carefully crafted model updates during the federated training process, ultimately aggregating them on a central server. Since the server inherently cannot see the local training process, it is vulnerable to backdoor attacks, which can compromise the model's effectiveness. It's worth noting that while Byzantine attacks aim to disrupt convergence or steer the model to a suboptimal solution, backdoor attacks aim to execute targeted poisoning attacks. These attacks attempt to induce the model to misclassify specific test samples with high confidence. For example, in medical image analysis, if a skin cancer screening system is implanted with a backdoor, it might misdiagnose images of skin lesions as another disease specified by the attacker, leading to potentially catastrophic consequences. Furthermore, because attackers can ensure that the global model converges to a highly accurate solution during the inference phase, detecting or defending against such attacks becomes extremely difficult. This raises serious security vulnerabilities and hinders the widespread application of federated learning in real-world IoT systems.

[0004] Currently, there are numerous studies on how to mitigate backdoor attacks in federated learning. One typical approach is to limit the impact of local updates with statistical anomalies (i.e., statistical outliers), thereby reducing the impact of these attacks on the global model. Some heuristic aggregation methods suggest dividing model updates into benign and malicious groups, and then aggregating only the benign group. Additionally, other robust aggregation methods utilize differential privacy to inject moderate noise into the model, thereby enhancing its resistance to backdoor attacks. Recent research has also developed provably robust federated learning protocols that guarantee the global model's protection against hostile attackers. However, experiments show that these defenses fail to prevent high-intensity attacks. Under high-intensity attacks, the probability of being attacked in each round is high; for example, in the experimental setting, the probability of being attacked in each round can reach 0.5, meaning that attacks may occur in nearly half of the rounds. In adversarial rounds, malicious clients account for more than 50% of all participants, and in extreme cases, even up to 70%. These malicious clients share common malicious targets, can share similar malicious datasets, and follow the same distribution. In this attack scenario, most existing defense methods are not only difficult to resist the attack, but also inevitably affect the overall model performance. Therefore, additional defense methods are urgently needed to mitigate the high-intensity attacks in federated learning. Summary of the Invention

[0005] The purpose of this invention is to provide a federated learning method and related apparatus based on progressive aggregation to solve one or more of the aforementioned technical problems. The technical solution disclosed in this invention penalizes the impact of anomalous updates on global updates from a directional perspective, and maintains overall model performance by simultaneously considering both benign and anomalous updates. This effectively defends against backdoor attacks while preserving the effectiveness and robustness of the global model.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, this invention provides a federated learning method based on progressive aggregation, comprising the following steps: Federal server receives K For each participant's model update, calculate the similarity between each pair of model updates, and label the previous ones. M The update of the model with the highest similarity is identified as the abnormal model update and then subjected to targeted aggregation to obtain the aggregated abnormal model update and the remaining updates. K - M Each model is updated; A hypersphere is constructed centered on the aggregated anomaly model update. Perturbed model updates are generated by randomly sampling on the hypersphere. The perturbed model updates are then compared with the remaining... K - MThe model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the principal direction is extracted. The arithmetic mean of the projection values ​​of each model update on the principal direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model based on the global model update.

[0007] A further improvement to the technical solution of the present invention is that, in the step of calculating the similarity between each pair of model updates, The formula for calculating the similarity between each pair of model updates is as follows: ; In the formula, It is the first t Wheel Client i , j Model updates; It is the client in round t. i , j The model is updated in the last layer.

[0008] A further improvement to the technical solution of the present invention is that, in the step of performing directional polymerization, Targeted aggregation operations are represented as: ; In the formula, It is the aggregated value of the anomaly model update in the t-th round; It is the client in round t. k Model updates.

[0009] A further improvement to the technical solution of this invention lies in the fact that the step of constructing a hypersphere centered on the aggregation anomaly model update, and then randomly sampling and generating perturbations on the hypersphere before updating the model specifically includes: In the process of constructing the hypersphere with the aggregation anomaly model update as the center, the expression of the hypersphere is: ; In the formula, Ω is the hypersphere; It is the perturbation angle for updating the aggregated anomaly model; It is a unit direction vector; It is the first t The aggregated value updated by the round anomaly model; Random from a uniform distribution A perturbation angle is sampled from the standard normal distribution. A direction vector is sampled from the sample, and a perturbed model update is generated based on the expression for the hypersphere. The expression for the perturbed model update is: ; In the formula, This is the model update after the t-th round of perturbation; The perturbation angle for updating the aggregated anomaly model follows a uniform distribution. ; It is a direction vector that follows a standard normal distribution. .

[0010] A further improvement to the technical solution of the present invention lies in that the step of updating the perturbed model and the remaining K - M The steps for generating a global model update include: stacking model updates to form a model update matrix; normalizing the column vectors of the model update matrix to extract the principal direction; calculating the arithmetic mean of the projection values ​​of each model update onto the principal direction; and using the arithmetic mean as the step size. Update the perturbated model with the remaining ones. K - M The model updates are stacked column-wise to construct a model update matrix of dimension d×(K-M+1). ∈R (d×(K-M+1)) ; Update the matrix of the model Each column is normalized using the L2 norm, and the covariance matrix of the normalized matrix is ​​calculated. The largest eigenvalue of the covariance matrix is ​​then obtained through eigenvalue decomposition. and corresponding feature vector ; to feature vector With model update matrix Perform a linear combination to generate the principal direction vector. The principal direction vector satisfies Normalization constraints; The magnitude of each model update is clipped to the minimum modulus value, which is calculated as follows: ; In the formula, It is in the t The minimum modulus value updated by all models during each training round; It is the first t Model update after wheel perturbation; It is the client in round t. K Model updates; The calculation expression for the global model update after performing the projected mean synthesis operation is as follows: ; In the formula, It is the first t Global model update for the wheel.

[0011] A further improvement to the technical solution of the present invention lies in the step of the federated server updating the global model of the federated learning based on the global model update. The computational expression for updating the global model of federated learning is as follows: ; In the formula, It is the global learning rate; It is the first t A global model of the wheel; It is the global model in round t+1; It is the first t Global model update for the wheel.

[0012] A second aspect of the present invention provides a federated learning system based on progressive aggregation, comprising: Model update acquisition unit, used to receive updates through the federated server. K For each participant's model update, calculate the similarity between each pair of model updates, and label the previous ones. M The update of the model with the highest similarity is identified as the abnormal model update and then subjected to targeted aggregation to obtain the aggregated abnormal model update and the remaining updates. K - M Each model is updated; The global model update unit is used to construct a hypersphere centered on the aggregated abnormal model updates, randomly sample on the hypersphere to generate perturbed model updates, and then combine the perturbed model updates with the remaining... K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the principal direction is extracted. The arithmetic mean of the projection values ​​of each model update on the principal direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model based on the global model update.

[0013] In a third aspect, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements a federated learning method based on progressive aggregation as described in any one of the first aspects of the present invention.

[0014] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the federated learning method based on progressive aggregation as described in any one of the first aspects of the present invention.

[0015] In a fifth aspect, the present invention provides a computer program product comprising a computer program or instructions that, when executed by a communication device, cause the federated learning method based on progressive aggregation as described in any one of the first aspects of the present invention to be executed. Compared with the prior art, the present invention has the following beneficial effects: This invention specifically provides a federated learning method based on progressive aggregation. Specifically, firstly, potential anomalous model updates are identified and aggregated in a targeted manner by calculating the similarity between participant model updates, generating an aggregated anomalous model update. This is because in federated learning, high-intensity backdoor attacks often originate from multiple malicious clients sending significantly similar anomalous updates. This method allows for the early identification and aggregation of these anomalous updates, reducing their destructive power on the global model. Next, a hypersphere is constructed centered on this aggregated anomalous model update, and perturbed model updates are generated by randomly sampling on the hypersphere. Simultaneously, its norm is adjusted to be consistent with the global model update. This is because attackers may set specific malicious directions to guide the model to generate backdoor behavior, thus affecting the aggregated model. The abnormal model update undergoes directional perturbation to bypass malicious directions, ensuring the model is not maliciously tampered with and maintaining its effectiveness and robustness. Subsequently, the perturbed model update is combined with the remaining normal model updates to form a model update matrix. After normalizing the column vectors of this matrix, the principal direction is extracted, and the global update direction is calculated. Based on this direction, the mean projection of each model update onto the global update direction is calculated as the step size, thereby generating the global model update. This approach comprehensively considers both normal and processed abnormal model update information, allowing the global model to iterate according to a reasonable direction and step size. This enables the model to effectively integrate beneficial information from various sources, enhancing its resistance to high-intensity attacks. Finally, the federated server updates the federated learning global model based on the calculated global update. In summary, the technical solution of this invention, through the implementation of the above innovative technical means, can effectively defend against high-intensity backdoor attacks while maintaining the effectiveness and robustness of the global model. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a federated learning method based on progressive aggregation, as described in an embodiment of the present invention. Figure 2 This is a schematic diagram of the framework of a federated learning method based on progressive aggregation in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the backdoor accuracy of a model replacement trigger-based attack in an embodiment of the present invention. Figure 4 This is a schematic diagram illustrating the backdoor accuracy and global model performance of performing a tag-flipping attack in an embodiment of the present invention. Figure 5 This is a schematic diagram of the defense performance against projection gradient descent attacks with model replacement in an embodiment of the present invention. Figure 6 This is a schematic diagram illustrating the effectiveness of defense against more powerful backdoor attacks in an embodiment of the present invention; Figure 7 This is a schematic diagram illustrating the effectiveness of this invention against extremely powerful backdoor attacks when the number of clients is increased. Figure 8 This is a schematic diagram of a federated learning system based on progressive aggregation in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention; obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] Based on the technical solutions disclosed in the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this invention. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0020] Please see Figure 1 The present invention provides a federated learning method based on progressive aggregation, comprising the following steps: Step 1, the federated server receives K For each participant's model update, calculate the similarity between each pair of model updates, and label the previous ones. M The update of the model with the highest similarity is identified as the abnormal model update and then subjected to targeted aggregation to obtain the aggregated abnormal model update and the remaining updates. K - M Each model is updated; Step 2: Construct a hypersphere centered on the aggregated anomaly model update, and randomly sample on the hypersphere to generate perturbed model updates; then combine the perturbed model updates with the remaining... K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the principal direction is extracted. The arithmetic mean of the projection values ​​of each model update on the principal direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model based on the global model update.

[0021] To explain further, in a round of federated learning, participants first download the global model from the central server, and then use their own dataset to train and update the parameters of their local global model. The difference between the parameters of the updated local global model and the global model initially downloaded in this round is the model update, and the participants then upload the model update to the central server.

[0022] In the technical solution disclosed in this invention, the impact of abnormal updates on global updates is penalized from the perspective of direction, and the overall model performance is maintained by considering both benign and abnormal updates simultaneously. This effectively defends against backdoor attacks while maintaining the effectiveness and robustness of the global model.

[0023] Please see Figure 1 and Figure 2 The present invention provides a federated learning method based on progressive aggregation, comprising the following steps: Step S1: The federated server receives model updates from participants, calculates the similarity between each pair of model updates, and marks the previous updates. M The update of the model with the highest similarity is identified as the anomalous model update; targeted aggregation is then performed on the anomalous model updates to generate aggregated anomalous model updates. Meanwhile, the remaining K - M A normal model update; Step S2: Update the aggregated anomaly model generated in step S1. Construct a hypersphere centered on... Where Ω is the hypersphere, For the disturbance angle, It is a unit direction vector (i.e., ∥) ∥=1); This is the aggregated value of the abnormal model update in round t; the model update is performed after randomly sampling and generating perturbations on the hypersphere. And adjust its norm to make it consistent with The norms are consistent; Step S3: Update the perturbation model generated in step S2. With the remaining from step S1 K - M A normal stack of model updates forms the model update matrix. For the matrix After normalizing the column vectors, feature vectors are extracted. Calculate the global update direction Based on the main direction, calculate the update of each model in The mean of the projection along the direction is used as the step size to generate a global model update. ; Step S4: Global update calculated in step S3 The federated server updates the global model for federated learning; In one embodiment of the present invention, step S1, in which the federated server performs the targeted aggregation anomaly model update operation, specifically involves: S101. Calculate the similarity between model updates. After the federated server receives a series of model updates submitted by the participants, it first calculates the similarity between each pair of model updates. The calculation formula is as follows: ; S102. Based on the similarity calculated in step S101 Sort the data from largest to smallest and mark the top M most similar model updates as anomalous model updates. These anomalous model updates may come from a group of colluding adversarial attackers. S103. For model updates marked as anomalous, perform targeted aggregation operations: ; This step merges all model updates marked as anomalous into a single model update for further analysis or processing.

[0024] In one embodiment of the present invention, in step S2, the federated server performs directional perturbation to mitigate the impact of abnormal model updates, specifically including: S201, Assumption As a summary of abnormal model updates, this invention proposes to perturb its direction in order to bypass malicious directions as much as possible; in the specific technical solution, in Build a center for , radius is The hypersphere is calculated as follows: ; Where Ω is the hypersphere. Yes The angle of disturbance; It is a unit direction vector (i.e., ∥) ∥=1); It is the aggregated value of the anomaly model update in round t.

[0025] S202, Sampling perturbation parameters. Randomly selected from a uniform distribution. Sampling a perturbation angle Randomly from the standard normal distribution Sampling a direction vector ; S503. Update the perturbated model based on the hyperspherical formula. The model update after perturbation is generated and calculated as follows: ; This step ensures that the perturbed model update maintains the same modulus as the original model update.

[0026] In one embodiment of the present invention, step S3, in which the federated server performs the main direction analysis operation, specifically includes: S301. Update the model vectors after K-M+1 directional aggregations. Construct an update matrix of dimension d×(K-M+1) by stacking columns. ∈R (d×(K-M+1)) ; S302, Regarding the matrix Each column is normalized using the L2 norm to eliminate interference from differences in the magnitude of model updates; S303, Calculate the normalization matrix covariance matrix The largest eigenvalue is obtained through eigenvalue decomposition. and the corresponding feature vectors ; S304, The feature vector With matrix Perform a linear combination to generate the principal direction vector. The vector satisfies Normalization constraints; S305. Clip each model update to this minimum modulus value, limiting the magnitude of each model update to not exceed this minimum value. The minimum magnitude threshold for all model updates is calculated as follows: ; S306. Perform the projected mean synthesis operation. The global model update calculation is as follows: .

[0027] In one embodiment of the present invention, in step S4, the federated server performs a global model update, specifically as follows: S401, After calculating the global update Then, the Federated Learning (FL) server updates the global model, calculating as follows:

[0028] Where γ is the global learning rate.

[0029] In summary, this invention specifically proposes a federated learning method based on progressive aggregation to defend against high-intensity backdoor attacks. It maintains the contribution of benign updates and penalizes the contribution of anomalous updates from a directional perspective, thereby defending against backdoor attacks. This invention designs a targeted aggregation strategy to discover anomaly parameter spaces and aggregate model updates within these spaces. Furthermore, it introduces a directional perturbation scheme to attempt to adjust parameters away from malicious directions. Further, this invention introduces a master direction analysis mechanism, which extracts the direction of global updates based on the majority principle to bypass backdoor directions. The technical solution of this invention can effectively prevent high-intensity backdoor attacks, where the attack frequency and the proportion of malicious clients are both high. Moreover, this invention is robust to backdoor attacks even when only one adversarial attacker exists. This invention maintains the overall performance (i.e., accuracy) of the global model while defending against backdoor attacks; furthermore, in the absence of adversarial attackers, this invention can achieve the expected accuracy (or other performance metrics) on the test dataset. Specifically, step S1 of this invention, through targeted aggregation of model updates with high similarity, can identify anomalous model updates among colluding adversarial attackers, while also preserving the contributions of both benign and anomalous model updates. Step S2 of this invention addresses the anomalous model updates from the targeted aggregation. Perturbation in the direction of the update can mitigate the impact of abnormal model updates to some extent. Step S3 of this invention performs a main direction analysis based on the majority principle. After step S1, only one abnormal model update exists. Compared to abnormal model updates, benign model updates constitute the majority. Therefore, the direction of the global update will be determined by benign updates, which completely bypasses malicious directions, thereby mitigating the impact of abnormal model updates on the global model update. In summary, the technical solution disclosed in this invention, through a hybrid aggregation method, can effectively defend against high-intensity backdoor attacks in federated learning systems while maintaining overall model performance.

[0030] In a specific exemplary technical solution of this invention, simulation experiments were conducted using the CIFAR-10 dataset to evaluate the feasibility and effectiveness of the invention as follows: The experiment evaluated the defensive effectiveness of this invention against state-of-the-art backdoor attacks such as model replacement, label flipping, and projective gradient descent attacks with model replacement on the CIFAR10 dataset. Specifically, a shared model was trained on a total of 100 clients, with 10 clients randomly selected to participate in each communication round; furthermore, a ResNet18 was trained on CIFAR10. In addition, to simulate non-independent and identically distributed training data in the real world and to provide imbalanced samples from each class to different clients, the experiment used a Dirichlet distribution with a hyperparameter of 0.9 to partition the training data. Before executing the backdoor attack, the model was trained to approximately convergence for each dataset. The attacker ratio in each adversarial round was set to 0.6. Each communication round was set as an adversarial round with a probability of 0.5.

[0031] Experimental results from embodiments of the present invention show that: (1) Figure 3 The backdoor accuracy of the present invention against MR trigger-based attacks is demonstrated in the first 60 communication rounds. Figure 3 In this context, "Pixel (Semantic) Pattern - No Defense Measures" indicates that no defense measures are applied when executing a backdoor attack based on pixel pattern (or semantic) triggers. "Pixel (Semantic) Pattern - Invention Measures" indicates that the defense measures of this invention are applied to resist backdoor attacks based on pixel pattern (or semantic) triggers. Results show that even with high attack frequency and a high proportion of malicious participants, this invention can still effectively mitigate the impact of such trigger-based backdoor attacks.

[0032] (2) Figure 4This paper demonstrates the backdoor accuracy and global model performance of this invention against label-flipping attacks during the first 60 communication rounds. The attacker aimed to misclassify test samples belonging to class 7 (horses) as class 2 (birds). "No defenses" indicates that no defenses were applied during the label-flipping attack. "Defenses of this invention" indicates that this invention was applied to defend against label-flipping attacks. "No defenses - other class test set" indicates the global model accuracy on the test dataset after removing class 7 without any defenses. "No defenses - entire test set" indicates the global model accuracy on the entire test dataset without any defenses. "Defenses of this invention - entire test set" indicates the global model accuracy obtained by applying the defenses of this invention on the entire test dataset. The results show that even with high attack frequency, this invention effectively prevents label-flipping attacks without compromising global model performance. This is because this invention retains the contributions of both benign and anomalous model updates while reducing the impact of anomalous model updates.

[0033] (3) Figure 5 This paper demonstrates the defensive performance of this invention against projective gradient descent attacks with model replacement during the first 60 communication rounds. As shown in the figure, in this attack, the attacker utilizes edge case data to construct a backdoor and updates the local model using the PGD algorithm, subsequently amplifying the update through a model replacement strategy to offset the contributions of benign participants. "Inventive Measures" indicates the backdoor accuracy achieved by applying this invention to defend against projective gradient descent attacks with model replacement. "No Defense Measures" indicates the backdoor accuracy against projective gradient descent attacks with model replacement without any defense measures. "Inventive Measures - Whole Test Set" indicates the global model accuracy obtained by applying the defensive measures of this invention across the entire test dataset. The results show that this invention effectively prevents projective gradient descent attacks with model replacement while maintaining good model performance.

[0034] (4) Figure 6 The effectiveness of the present invention's defense method against more powerful backdoor attacks is demonstrated. Specifically, the proportion of attackers was increased to 0.7 and 0.8 in each adversarial round, respectively. Furthermore, each of the first 60 communication rounds was set as an adversarial round. Further, the present invention's defense measures were evaluated against semantic trigger-based backdoor attacks on the CIFAR10 dataset. Figure 6The backdoor accuracy and global model performance when applying the defense method of this invention are demonstrated. "0.7,B" and "0.7,M" represent the backdoor accuracy and global model accuracy on the test dataset, respectively, when the attacker's proportion in each adversarial round is set to 0.7. It can be seen that when the attacker's proportion in each adversarial round reaches 0.7, the defense method of this invention can still effectively prevent backdoor attacks in federated learning. However, when the attacker's proportion reaches 0.8, the defense of this invention fails to prevent backdoor attacks. The reason for this failure is that the number of benign participants in each adversarial round is significantly reduced, leading to a greater impact on the targeted aggregation model update when extracting global updates. Moreover, when the attacker's proportion increases to 0.8, the performance of the global model is also affected.

[0035] (5) Figure 7 This study demonstrates the effectiveness of the present invention's defense method against extremely powerful backdoor attacks, even with an increased number of participating clients. Specifically, the experiment selected 20 clients (20% of the total number of clients) to participate in federated training. Furthermore, the attacker's proportion was set to 0.7 and 0.8 in each adversarial round, and a backdoor attack was executed in each communication round. Figure 7 The backdoor accuracy and global model performance when our defense method is applied are demonstrated. When the attacker proportion increases to 0.8, the defense of this invention still prevents backdoor attacks without compromising model performance. The results show that as the number of participants in the adversarial rounds increases, the defense method of this invention can tolerate a higher proportion of attackers in federated learning.

[0036] In summary, this invention discloses an innovative progressive aggregation method that can successfully defend against various types of backdoor attacks in the face of numerous malicious clients and frequent attacks, while ensuring that the performance of the global model is not compromised. Furthermore, as the number of participants in the adversarial rounds increases, this invention also exhibits higher tolerance and can handle a higher proportion of attackers. These findings further demonstrate the potential and effectiveness of the technical solution of this invention in practical applications, especially in federated learning environments requiring high security.

[0037] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0038] Please see Figure 8 In this embodiment of the invention, a federated learning system based on progressive aggregation is provided, comprising: Model update acquisition unit, used to receive updates through the federated server. K For each participant's model update, calculate the similarity between each pair of model updates, and label the previous ones. MThe update of the model with the highest similarity is identified as the abnormal model update and then subjected to targeted aggregation to obtain the aggregated abnormal model update and the remaining updates. K - M Each model is updated; The global model update unit is used to construct a hypersphere centered on the aggregated abnormal model updates, randomly sample on the hypersphere to generate perturbed model updates, and then combine the perturbed model updates with the remaining... K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the principal direction is extracted. The arithmetic mean of the projection values ​​of each model update on the principal direction is calculated. The arithmetic mean is used as the step size to generate a global model update. The federated server updates the federated learning global model based on the global model update.

[0039] In one embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used to execute operations based on a federated learning method using progressive aggregation.

[0040] In one embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the operating system of the terminal. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor, which can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM (Random Access Memory) or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the federated learning method based on progressive aggregation in the above embodiments.

[0041] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0042] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0043] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0044] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0045] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A federated learning method based on progressive aggregation, characterized in that, Includes the following steps: Federation server receives K For each participant's model update, calculate the similarity between each pair of model updates, and label the previous ones. M The update of the model with the highest similarity is identified as the abnormal model update and then subjected to targeted aggregation to obtain the aggregated abnormal model update and the remaining updates. K - M Each model is updated; A hypersphere is constructed centered on the aggregated anomaly model update. Perturbed model updates are generated by randomly sampling on the hypersphere. The perturbed model updates are then compared with the remaining... K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the principal direction is extracted. The arithmetic mean of the projection values ​​of each model update on the principal direction is calculated. The arithmetic mean is used as the step size to generate the global model update. The federated server updates the global model for federated learning based on the global model update. The step of constructing a hypersphere centered on the aggregated anomaly model update, and then randomly sampling and generating perturbations on the hypersphere before updating the model specifically includes: In the process of constructing the hypersphere with the aggregation anomaly model update as the center, the expression of the hypersphere is: ； In the formula, It is a hyperspherical surface; It is the perturbation angle for updating the aggregated anomaly model; It is a unit direction vector; It is the first t The aggregated value updated by the round anomaly model; Random from a uniform distribution A perturbation angle is sampled from the standard normal distribution. A direction vector is sampled from the sample, and a perturbed model update is generated based on the expression for the hypersphere. The expression for the perturbed model update is: ； In the formula, This is the model update after the t-th round of perturbation; The perturbation angle for updating the aggregated anomaly model follows a uniform distribution. ; It is a direction vector that follows a standard normal distribution. .

2. The federated learning method based on progressive aggregation according to claim 1, characterized in that, In the step of calculating the similarity between each pair of model updates The formula for calculating the similarity between each pair of model updates is as follows: ； In the formula, It is the first t Wheel client i , j Model updates; It is the client in round t. i , j The model is updated in the last layer.

3. The federated learning method based on progressive aggregation according to claim 1, characterized in that, In the step of performing targeted aggregation Targeted aggregation operations are represented as: ； In the formula, It is the aggregated value of the anomaly model update in the t-th round; It is the client in round t. k Model updates.

4. The federated learning method based on progressive aggregation according to claim 1, characterized in that, The perturbation-updated model is then compared with the remaining... K - M The steps for generating a global model update include: stacking model updates to form a model update matrix; normalizing the column vectors of the model update matrix to extract the principal direction; calculating the arithmetic mean of the projection values ​​of each model update onto the principal direction; and using the arithmetic mean as the step size. Update the perturbated model with the remaining ones. K - M The model updates are stacked column-wise to construct a model update matrix of dimension d×(K-M+1). ∈R (d×(K-M+1)) ; Update the matrix of the model Each column is normalized using the L2 norm, and the covariance matrix of the normalized matrix is ​​calculated. The largest eigenvalue of the covariance matrix is ​​then obtained through eigenvalue decomposition. and Corresponding feature vector ; to feature vector With model update matrix Perform a linear combination to generate the principal direction vector. The principal direction vector satisfies Normalization constraints; The magnitude of each model update is clipped to the minimum modulus value, which is calculated as follows: ； In the formula, It is in the t The minimum modulus value updated by all models during each training round; It is the first t Model update after wheel perturbation; It is the client in round t. K Model updates; The calculation expression for the global model update after performing the projected mean synthesis operation is as follows: ； In the formula, It is the first t Global model update for the wheel.

5. The federated learning method based on progressive aggregation according to claim 1, characterized in that, In the step where the federated server updates the global model of the federated learning system based on the global model update... The computational expression for updating the global model of federated learning is as follows: ； In the formula, It is the global learning rate; It is the first t A global model of the wheel; It is the global model in round t+1; It is the first t Global model update for the wheel.

6. A federated learning system based on progressive aggregation, characterized in that, include: Model update acquisition unit, used to receive updates through the federated server. K For each participant's model update, calculate the similarity between each pair of model updates, and label the previous ones. M The update of the model with the highest similarity is identified as the abnormal model update and then subjected to targeted aggregation to obtain the aggregated abnormal model update and the remaining updates. K - M Each model is updated; The global model update unit is used to construct a hypersphere centered on the aggregated abnormal model updates, randomly sample on the hypersphere to generate perturbed model updates, and then combine the perturbed model updates with the remaining... K - M The model updates are stacked to form a model update matrix. The column vectors of the model update matrix are normalized and the principal direction is extracted. The arithmetic mean of the projection values ​​of each model update on the principal direction is calculated. The arithmetic mean is used as the step size to generate the global model update. The federated server updates the global model for federated learning based on the global model update. Specifically, the process of constructing a hypersphere centered on the aggregation anomaly model update, and then randomly sampling and generating perturbations on the hypersphere to update the model includes: In the process of constructing the hypersphere with the aggregation anomaly model update as the center, the expression of the hypersphere is: ； In the formula, It is a hyperspherical surface; It is the perturbation angle for updating the aggregated anomaly model; It is a unit direction vector; It is the first t The aggregated value updated by the round anomaly model; Random from a uniform distribution A perturbation angle is sampled from the standard normal distribution. A direction vector is sampled from the sample, and a perturbed model update is generated based on the expression for the hypersphere. The expression for the perturbed model update is: ； In the formula, This is the model update after the t-th round of perturbation; The perturbation angle for updating the aggregated anomaly model follows a uniform distribution. ; It is a direction vector that follows a standard normal distribution. .

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the federated learning method based on progressive aggregation as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the federated learning method based on progressive aggregation as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes a computer program or instructions that, when executed by a communication device, cause the federated learning method based on progressive aggregation as described in any one of claims 1 to 5 to be executed.

Images