Federal learning label flipping attack defense method and device, equipment and medium

Abstract

The invention discloses a federated learning label flipping attack defense method and device, equipment and a medium, and belongs to the technical field of machine learning. The method comprises the following steps: sending a current global model to an auxiliary client and a plurality of local clients for respective training, and obtaining an update model of the local clients and an auxiliary model of the auxiliary client; dividing the update model into a benign cluster and a malicious cluster based on the auxiliary model; through cosine similarity projection, removing components, opposite to the cluster center direction of the benign cluster, of the model in the malicious cluster; introducing cluster center information of a benign cluster into the model in the malicious cluster through linear interpolation projection; and updating the current global model based on the models in the benign cluster and the malicious cluster, and taking the updated global model as the current global model of the next round of training. According to the method, label flipping attacks can be effectively defended, the performance of the model can be maintained, the expression difference of model updating is reserved, and the utilization rate of correct information of a local client is increased.

Description

Technical Field

[0001] The present invention belongs to the field of machine learning technology and relates to a federated learning label flip attack defense method, device, equipment and medium. Background Art

[0002] Federated learning demonstrates significant advantages in protecting data privacy and enhancing collaborative modeling capabilities, but its distributed training approach also introduces new security challenges. Because participating parties' data and training processes are all local, it's difficult for a central server to directly verify the reliability and authenticity of model updates uploaded by each party. This information asymmetry makes federated learning vulnerable to various malicious attacks. Label flipping attacks, a typical example of data poisoning, involve malicious clients intentionally altering the labels of private data while leaving the data's characteristics unchanged. This alters the model's training direction and decision boundary, thereby impacting model performance.

[0003] Currently, defense mechanisms against label flipping attacks can be categorized into three types based on their tolerance to attack: detection, fault tolerance, and remediation. Detection-based defenses focus on identifying malicious clients' attack behaviors, promptly detecting anomalies and preventing them from further impacting global model training. For example, auditing mechanisms can verify each client's model update and determine whether it can be included in the global aggregation phase. However, detection-based defenses rely on the salience of malicious model updates to identify them. However, in non-IID scenarios, model updates between benign clients can vary significantly, making them susceptible to misclassification as malicious. Furthermore, these defenses typically exclude malicious clients from subsequent model aggregation after detection. However, even malicious clients may contain valuable information in their model updates. Therefore, detection-based defenses are prone to high misclassification rates and demanding high classification metrics. They can also lose potentially useful information and fail to maximize data utilization.

[0004] Fault-tolerant defense methods enhance system robustness by assigning different weights to client models. For example, dimensionality reduction techniques are used to extract credible, clean components to obtain a credit score for each client model update. The server then weights and aggregates local models based on the credit score to optimize the global model. Fault-tolerant defense methods enhance the fault tolerance of the global model, making it insensitive to malicious model updates. However, this fault tolerance is typically achieved through a loss of model robustness, which can lead to a decrease in overall model performance. Furthermore, to enhance tolerance to malicious model updates, additional computational steps, such as noise injection and weighted averaging, are often required. This not only increases computational overhead but can also affect training efficiency.

[0005] The core goal of repair-based defense methods is to identify and correct contaminated model updates uploaded by malicious clients to mitigate their negative impact on the global model. Unlike punitive methods such as direct elimination or reduction of aggregation weights, this type of method uses a specific repair mechanism to adjust suspicious model updates, aligning them with benign behavior. This effectively defends against label flipping attacks while preserving as much valuable information as possible and maximizing data utilization. However, existing defense methods use pruning to adjust malicious model parameters. This is essentially a method of scaling the model update amplitude, making it difficult to fundamentally identify semantic label flipping attacks, resulting in poor defense effectiveness. Furthermore, pruning adjustments cause the model to tend toward averaging during aggregation, smoothing out previously discriminative features, thereby reducing the model's expressive power and affecting its overall performance. Furthermore, these methods do not employ a weighted aggregation mechanism, failing to increase the proportion of benign clients and further weakening the interference of malicious clients on the global model, impacting both defense effectiveness and overall model performance. Summary of the Invention

[0006] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a federated learning label flip attack defense method, apparatus, device and medium to effectively defend against label flip attacks while retaining the correct knowledge in the malicious model.

[0007] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0008] In a first aspect, the present invention provides a method for defending against a federated learning label flipping attack, the method comprising:

[0009] Send the current global model to the auxiliary client and multiple local clients as the current local model of each client;

[0010] Each client trains the current local model based on its private data, and obtains the updated model of the local client and the auxiliary model of the auxiliary client;

[0011] Based on the auxiliary model, the plurality of update models are divided into benign clusters and malicious clusters;

[0012] By using cosine similarity projection, the components of the model in the malicious cluster that are contrary to the cluster center direction of the benign cluster are removed;

[0013] By linear interpolation projection, the cluster center information of the benign cluster is introduced into the model of the malicious cluster;

[0014] Based on the models in the benign cluster and the malicious cluster, the current global model is updated, and the updated global model is used as the current global model for the next round of training.

[0015] Furthermore, based on the auxiliary model, the plurality of update models are divided into benign clusters and malicious clusters, including:

[0016] Dividing the multiple updated models into two clusters using a k-means algorithm;

[0017] The cosine similarity between the cluster centers of the two clusters and the auxiliary model is calculated respectively, and the cluster with the higher cosine similarity is called the benign cluster, and the other is called the malicious cluster.

[0018] Furthermore, the components of the model in the malicious cluster that are contrary to the cluster center direction of the benign cluster are removed by cosine similarity projection, including:

[0019] ,

[0020] in, Indicates the current training round; represents a malicious cluster; Indicates the number of malicious clusters Models; represents the cluster center of the benign cluster; represents the two-norm of a vector; Representation Model The model after removing the components that are contrary to the direction of the benign cluster center.

[0021] Furthermore, the cluster center information of the benign cluster is introduced into the model of the malicious cluster through linear interpolation projection, including:

[0022] ,

[0023] in, Indicated in the model The model after introducing the cluster center information of the benign cluster; represents the interpolation coefficient, The calculation formula is:

[0024] .

[0025] Furthermore, based on the models in the benign cluster and the malicious cluster, the current global model is updated, including:

[0026] Calculate the distance between the models in the benign cluster and the malicious cluster and the cluster center of the benign cluster to obtain the deviation of each model;

[0027] Based on the deviation, obtaining the weight of the corresponding model;

[0028] The current global model is updated according to the models and weights in the benign cluster and the malicious cluster.

[0029] Furthermore, the distance between the models in the benign cluster and the malicious cluster and the cluster center of the benign cluster is calculated to obtain the deviation of each model, including:

[0030] ,

[0031] in, Model representing the malicious cluster The degree of deviation;

[0032] Based on the deviation, the weight of the corresponding model is obtained, including:

[0033] The Gaussian decay function is used to calculate the weight of the corresponding model. The calculation formula is:

[0034] ,

[0035] in, Representation Model The weight of represents the attenuation coefficient, The calculation formula is:

[0036] ,

[0037] in, represents the average distance between the models in the benign and malicious clusters and the cluster center of the benign cluster; represents the scaling factor; Represents the total number of models in the benign and malicious clusters.

[0038] Further, updating the current global model includes:

[0039] ,

[0040] ,

[0041] in, Represents the updated current global model.

[0042] In a second aspect, the present invention further provides a federated learning label flipping attack defense device, the device comprising:

[0043] The current local model distribution module is used to send the current global model to the auxiliary client and multiple local clients as the current local model of each client;

[0044] The current local model training module is used by each client to train the current local model based on its private data, and obtain the updated model of the local client and the auxiliary model of the auxiliary client;

[0045] An update model division module, configured to divide the plurality of update models into benign clusters and malicious clusters based on the auxiliary model;

[0046] A malicious component removal module for a malicious model, configured to remove components of the malicious cluster whose directions are contrary to those of the cluster centers of the benign clusters through cosine similarity projection;

[0047] A malicious model benign information introduction module, configured to introduce cluster center information of the benign cluster into the model in the malicious cluster through linear interpolation projection;

[0048] The current global model update module is used to update the current global model based on the models in the benign cluster and the malicious cluster, and the updated global model is used as the current global model for the next round of training.

[0049] In a third aspect, the present invention further provides a computer device, comprising:

[0050] memory for storing computer programs;

[0051] A processor is configured to execute the computer program to implement the steps of the above-mentioned federated learning label flipping attack defense method.

[0052] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the steps of the above-mentioned federated learning label flipping attack defense method.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] (1) In combination with auxiliary clients, a local client update model clustering strategy is designed. By clustering the update models, malicious clients can be effectively distinguished from benign clients, and malicious models can be clearly isolated from benign models to prevent malicious models from interfering with the global model. At the same time, it provides a solid foundation for subsequent malicious model parameter adjustment.

[0055] (2) Using the cosine similarity projection method, the update direction of the malicious model is aligned with the benign direction, reducing the negative impact of the malicious model on the global model while retaining the correct knowledge that may exist in the malicious model; the malicious model is further adjusted by linear interpolation to make it closer to the benign model. While effectively defending against label flipping attacks, the method of the present invention maximizes the retention of useful correct information in the malicious model, while retaining the individual expression of the model, avoiding excessive averaging during the model aggregation process, and improving the robustness and generalization ability of the model;

[0056] (3) A weighted aggregation strategy based on model deviation is proposed. By calculating the distance between the models in the benign cluster and the cluster center of the malicious cluster and the benign cluster, the contribution of the model to the global model is evaluated, and the aggregation weight of the corresponding model is calculated according to the degree of contribution. The weighted aggregation strategy of the present invention can maintain a stable optimization path of the global model during the training process, while maximally retaining useful information from benign clients, further weakening the interference of malicious models. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A flowchart of a method for defending against a federated learning label flipping attack provided by an embodiment of the present invention;

[0058] Figure 2 Schematic diagram of the framework of the federated learning label flip attack defense method in an embodiment of the present invention;

[0059] Figure 3 This is a scatter diagram of the updated model after clustering in an embodiment of the present invention;

[0060] Figure 4 A schematic diagram showing the performance comparison of the federated learning label flipping attack defense method provided by an embodiment of the present invention and various comparative methods on the MNIST dataset under low attack rates;

[0061] Figure 5 A schematic diagram showing the performance comparison of the federated learning label flipping attack defense method provided by an embodiment of the present invention and various comparison methods on the Fashion-MNIST dataset under low attack rates;

[0062] Figure 6 A schematic diagram showing a performance comparison of the federated learning label flipping attack defense method provided by an embodiment of the present invention and various comparative methods on the MNIST dataset under a high attack rate.

[0063] Figure 7 A schematic diagram showing the performance comparison of the federated learning label flipping attack defense method provided by an embodiment of the present invention and various comparison methods on the Fashion-MNIST dataset under high attack rates;

[0064] Figure 8 A schematic diagram of the structure of a federated learning label flip attack defense device provided by an embodiment of the present invention;

[0065] Figure 9 This is a diagram of the internal structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The technical solution of the present invention is described in detail below through the accompanying drawings and specific embodiments. The same reference numerals in the drawings indicate the same or similar components or parts. It should be understood by those skilled in the art that these drawings are not necessarily drawn to scale. The embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations of the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0067] The term "and / or" in this document simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. Additionally, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0068] Example 1:

[0069] like Figures 1 to 7 As shown, an embodiment of the present invention provides a method for defending against federated learning label flipping attacks. Figure 1 This is a flow chart of the method for defending against the federated learning label flipping attack. This flow chart only shows the logical sequence of the method described in this embodiment. In other possible embodiments of the present invention, different methods may be used without conflict. Figure 1 The steps shown or described are accomplished in the order shown.

[0070] The federated learning label flip attack defense method provided in this embodiment can be applied to a terminal and can be executed by a federated learning label flip attack defense device, which can be implemented by software and / or hardware and can be integrated into the terminal.

[0071] See also Figure 1 The method of the embodiment of the present invention specifically includes the following steps:

[0072] Step 1: Send the current global model to the auxiliary client and multiple local clients as the current local model of each client.

[0073] like Figure 2 As shown, the participants in the method of the present invention include a central server, auxiliary clients, and multiple local clients. Each client has its own independent local data set, and data between clients is not interoperable. The auxiliary clients and the central server constitute the server layer. The auxiliary clients are verified by the central server to ensure that the data in their local data sets is not contaminated. The multiple local clients constitute the client layer, and some of the local clients may be malicious.

[0074] Step 2: Each client trains the current local model based on its private data, and obtains the updated model of the local client and the auxiliary model of the auxiliary client.

[0075] The local client and auxiliary client receive the current local model sent by the central server and perform training based on their local private data to optimize the model parameters. After local training is completed, the local client uploads the updated model to the central server, and the auxiliary client uploads the auxiliary model to the central server.

[0076] In the embodiment of the present invention, each client uses the stochastic gradient descent algorithm to train the current local model, adopts the cross entropy loss function to better adapt to the classification problem, the learning rate is 0.001, and the sample batch is 128.

[0077] Step 3: Based on the auxiliary model, the multiple updated models are divided into benign clusters and malicious clusters.

[0078] The present invention sets up an auxiliary client to ensure that the data in its local data set is not polluted, and uses its updated model as a benchmark to assist in distinguishing benign clusters from malicious clusters.

[0079] In this embodiment of the present invention, step 3 specifically includes:

[0080] Step 31: Divide the multiple updated models into two clusters using the k-means algorithm;

[0081] Step 32: Calculate the cosine similarity between the cluster centers of the two clusters and the auxiliary model respectively, and call the cluster with high cosine similarity a benign cluster. , the other is called the malicious cluster .

[0082] The calculation formula of the cosine similarity is:

[0083] ,

[0084] in, represents the angle between two vectors, represents the auxiliary model, Indicates cluster heart, Represents the two-norm of a vector.

[0085] The updated model that is classified into the benign cluster is called a benign model, and the updated model that is classified into the malicious cluster is called a malicious model.

[0086] When facing federated learning label flipping attacks, it is very necessary to properly adjust the malicious model in order to reduce its interference on the global model while retaining as much useful information as possible.

[0087] Step 4: Using cosine similarity projection, remove the components of the malicious cluster whose model is in a direction contrary to the cluster center of the benign cluster.

[0088] The present invention designs a malicious model parameter adjustment method that combines cosine similarity projection and linear interpolation. By projecting malicious model updates in the direction of benign clusters, this method reasonably constrains model updates based on valid information. This method can retain valuable information as much as possible while ensuring global model stability, thereby improving the robustness and generalization ability of the federated learning system.

[0089] Specifically, the cosine similarity projection includes:

[0090] ,

[0091] in, Indicates the current training round; represents a malicious cluster; Indicates the number of malicious clusters A malicious model; represents the cluster center of the benign cluster; represents the two-norm of a vector; Representation Model The model after removing the components that are contrary to the direction of the benign cluster center.

[0092] If the model Cluster center of benign cluster The direction is consistent, that is, the cosine similarity is close to 1, then the adjustment range is small, and the beneficial part can be retained as much as possible; if the model Direction deviation , that is, the cosine similarity is close to 0, and its malicious influence is greatly weakened after projection and adjusted to a benign direction; if the cosine similarity is negative, it means that the model The direction is opposite to the benign direction, and after projection, its update direction will be reversed to make it converge towards the benign cluster.

[0093] Step 5: By linear interpolation projection, the cluster center information of the benign cluster is introduced into the model of the malicious cluster.

[0094] By calculating the projection of the malicious model in the direction of the benign cluster center, the components that are contrary to the direction of the benign cluster center are removed, and the components that are consistent with the direction of the cluster center are retained, making the adjusted update more consistent with the optimization trend of the global model. However, simply correcting the direction of the model update is not enough, and the projected result still contains erroneous information from the malicious client. Therefore, the present invention further performs linear interpolation adjustment on the malicious model after projection to introduce a certain proportion of benign cluster center information, neutralize the erroneous components remaining after projection, make the malicious model closer to the benign cluster center, and further weaken the adverse effects of the malicious client.

[0095] Specifically, the linear interpolation projection includes:

[0096] ,

[0097] in, Indicated in the model The model after introducing the cluster center information of the benign cluster; represents the interpolation coefficient, The calculation formula is:

[0098] .

[0099] When the model and When the directions are close, the interpolation coefficient is larger and the adjustment range is smaller; when the model and When the direction deviates greatly, the interpolation coefficient takes a smaller value and the adjustment amplitude is larger, making it closer to the benign cluster center.

[0100] Step 6: Based on the models in the benign cluster and the malicious cluster, the current global model is updated, and the updated global model is used as the current global model for the next round of training.

[0101] After adjusting the model parameters by combining cosine similarity projection and linear interpolation projection, the malicious model in the malicious cluster has been adjusted to a "benign model" and can be aggregated with the benign model in the benign cluster to update the current global model.

[0102] The present invention chooses to adopt a weighted aggregation strategy based on model deviation to ensure that the updates of benign clients dominate, so that the global model maintains a stable optimization path.

[0103] The parameter-adjusted model in the above malicious cluster Taking this as an example, the present invention explains how to update the current global model. The specific steps include:

[0104] Step 61: Calculate the distance between the models in the benign cluster and the malicious cluster and the cluster center of the benign cluster to obtain the deviation of each model.

[0105] ,

[0106] in, Representation Model The degree of deviation.

[0107] Step 62: Based on the deviation, obtain the weight of the corresponding model.

[0108] The present invention uses the Gaussian attenuation function calculation model The weight is calculated as follows:

[0109] ,

[0110] in, Representation Model The weight of Represents the attenuation coefficient, which is used to control the attenuation speed and will automatically adjust with the different data distribution. The calculation formula is:

[0111] ,

[0112] in, Represents the average distance between the models in the benign and malicious clusters and the center of the benign cluster, which is used to adaptively set the standard deviation of the Gaussian decay function ; Indicates the scaling factor, used to control The scaling ratio; represents the total number of models in the benign and malicious clusters, and is also the number of local clients.

[0113] Step 63: Update the current global model according to the models and weights in the benign cluster and the malicious cluster.

[0114] In order to ensure that the models of all clients occupy an appropriate proportion during global aggregation and avoid excessively large or small gradient updates, the present invention chooses to normalize the weights so that the sum of the weights of all clients is 1. The normalized weights are used for weighted aggregation to update the current global model. The calculation formula is:

[0115] ,

[0116] ,

[0117] in, Represents the normalized model weight; Represents the updated current global model.

[0118] Steps 1 to 6 are the processing flow of a cyclic training process in the federated learning process. The updated global model is used as the current global model for the next round of training, and multiple iterations are performed until the model converges.

[0119] In order to verify the effectiveness of the method of the present invention, this embodiment conducted a related experiment, in which 10 local clients were set up and the proportion of malicious clients was adjusted.

[0120] Figure 3 (a) Figure 3 (b) and Figure 3(c) The scatter plots of the 10 update models clustered by the k-means clustering algorithm when the proportion of malicious clients is 0.1, 0.3, and 0.6. " represents the cluster centers of two clusters. Cluster 1 (yellow) in the figure is the malicious cluster, containing malicious models of malicious clients. Cluster 2 (blue) is the benign cluster, containing benign models of benign clients. The scatter plot is obtained by performing principal component analysis (PCA) on the updated model to reduce its dimensionality. This method constructs new coordinate axes by finding the direction with the largest variance in the data. The horizontal axis PC1 represents the first principal component, which represents the projection of the data along the direction with the largest variance and is the direction that best explains data changes. The vertical axis PC2 represents the second principal component, which represents the projection of the data along the direction with the least significant variance. It still retains some information, but contributes less than PC1.

[0121] observe Figure 3 (a) Figure 3 (b) and Figure 3 (c) It can be seen that after dimensionality reduction, the benign and malicious models are concentrated on both sides of the PC1 axis, and there is clear differentiation between the two along the PC1 principal direction. This indicates that the distribution of the malicious model in the feature space is significantly different from that of the benign model. Furthermore, regardless of the proportion of malicious clients, the first principal component of the benign and malicious clients remains consistent, indicating that their data change directions are consistent and have the same characteristics, demonstrating that the clustering method proposed in this paper can accurately distinguish benign from malicious clients.

[0122] Figure 4 The performance comparison of the method of the present invention and various comparative methods on the MNIST dataset under low attack rate conditions is shown. Figure 5 The performance comparison of the method of the present invention and various comparative methods on the Fashion-MNIST dataset under low attack rates is shown. The higher the proportion of malicious clients, the higher the attack rate. represents the proportion of malicious clients. FedAvg_NoA, used as a control method, represents aggregation using FedAvg in a non-attack environment. It represents the ideal model accuracy, that is, the optimal performance the model can achieve in the absence of attacks. Therefore, the closer the model performance of other methods is to FedAvg_NoA, the better the defense effect of that method.

[0123] from Figure 4As can be seen, all methods demonstrate a certain degree of defensive effectiveness, with model accuracy exceeding 97%. The proposed method and FLGT are closest to the optimal performance, namely 98.87% for FedAvg_NoA. As the proportion of malicious clients increases, the accuracy of each method decreases to varying degrees. The Krum algorithm's accuracy drops from 97.81% to 97.24%, the Median algorithm's accuracy drops from 98.51% to 97.81%, and the proposed method's accuracy drops from 98.83% to 98.69%, showing a smaller decrease. Furthermore, the proposed method's model accuracy is closest to that of FedAvg_NoA, demonstrating that the proposed method offers superior defensive effectiveness.

[0124] In the Fashion-MNIST dataset, due to the late stage of Multi-krum training, the model began to fluctuate and failed to converge when the model accuracy reached about 85%. Figure 5 Its performance is not shown. Figure 5 As shown, the accuracy of FedAvg_NoA is 89.54%, which is lower than the 98.74% of the MNIST dataset. This is mainly because MNIST is a handwritten digit dataset with relatively simple samples, clean backgrounds, and clear outlines, while the Fashion-MNIST dataset involves the shape and texture of clothing, and its features are relatively difficult to capture. The accuracy of the Krum algorithm dropped from 87.77% to 86.27%, and the accuracy of the Median algorithm dropped from 89.09% to 87.59%, a more significant decrease. The accuracy of FLGT dropped from 88.56% to 88.14%, a smaller decrease, but the accuracy was not as good as the defense method of the present invention. It can be seen that the model accuracy of the method of the present invention is closer to the optimal performance in the non-attack scenario, and the defense effect is the best.

[0125] When the proportion of malicious clients exceeds 50%, most existing defense methods cannot make the model converge normally and cannot resist attacks from a high proportion of malicious clients.

[0126] Figure 6 The performance comparison of the method of the present invention and various comparative methods on the MNIST dataset under high attack rate conditions is shown. Figure 7 The performance comparison of the method of the present invention and various comparative methods on the Fashion-MNIST dataset under high attack rate conditions is shown. Indicates the proportion of malicious clients.

[0127] like Figure 6 and Figure 7As shown in the figure, when the proportion of malicious clients is 0.5, only the Krum algorithm and the method of the present invention can make the model converge normally, thereby effectively defending against attacks. When the proportion of malicious clients reaches 0.6, only the method of the present invention is still effective in defending against label flipping attacks.

[0128] The Krum algorithm calculates the Euclidean distance between each client model and other models and selects the model with the smallest distance as the global model for the next round of training. Once the proportion of malicious clients is high, Figure 3 The scatter plot shows that the distances between malicious clients are smaller than those between benign clients. Therefore, malicious clients stand out when calculating the total distance from all client model updates and are selected as the global model. Therefore, the Krum algorithm only works if benign clients are the majority. Once malicious clients become the majority, it becomes completely ineffective. Similarly, the Median algorithm calculates the median of all client model parameters coordinate by coordinate, ultimately serving as the global model. For example, in the scenario set in the embodiment of the present invention, there are 10 clients, 5 of which are malicious. When calculating the median coordinate by coordinate, the 5th and 6th model updates will be selected, indicating that a malicious model must exist, thus rendering the Median robust aggregation algorithm ineffective. The FLGT method extracts attack signatures through principal component analysis and combines a trustworthy model with cosine similarity to detect malicious clients. Compared to traditional methods, it demonstrates superior robustness within a certain range. When the proportion of malicious clients is low, benign clients still dominate, and the trustworthy model maintains its correct direction, effectively mitigating the impact of the malicious gradient. However, when the proportion of malicious clients exceeds 50%, their malicious gradient updates account for a higher proportion, and their directions dominate the gradient aggregation process. Because FLGT relies on a trust model to assess client trustworthiness, the trust model is now controlled by malicious gradients, making it impossible to correctly detect malicious clients. Ultimately, FLGT may mistake some malicious clients for trustworthy ones and misclassify some benign clients as malicious, thus losing its defense capabilities.

[0129] The defense method of the present invention first accurately clusters the updated model, which is a critical step in defending against label flipping attacks. Only by distinguishing between benign and malicious clusters can the subsequent series of operations be effective. Then, through cosine similarity projection and linear interpolation projection, the malicious model is approached to the center of the benign cluster. By correcting the malicious model, its interference with model aggregation is reduced. In the global aggregation stage, weights are assigned to each model based on its distance from the center of the benign cluster. This can further increase the proportion of benign clients in the global aggregation and effectively defend against label flipping attacks.

[0130] Example 2:

[0131] Based on the same inventive concept as Example 1, this embodiment of the present invention also provides a federated learning label flip attack defense device for implementing the federated learning label flip attack defense method of Example 1. The solution provided by this device is similar to the solution described in the method of Example 1. Therefore, the specific limitations in the following embodiment of the federated learning label flip attack defense device can be found in the limitations of the federated learning label flip attack defense method in Example 1 and will not be repeated here.

[0132] like Figure 8 As shown, an embodiment of the present invention provides a federated learning label flip attack defense device, the device comprising:

[0133] The current local model distribution module is used to send the current global model to the auxiliary client and multiple local clients as the current local model of each client;

[0134] The current local model training module is used by each client to train the current local model based on its private data, and obtain the updated model of the local client and the auxiliary model of the auxiliary client;

[0135] An update model division module, configured to divide the plurality of update models into benign clusters and malicious clusters based on the auxiliary model;

[0136] A malicious component removal module for a malicious model, configured to remove components of the malicious cluster whose directions are contrary to those of the cluster centers of the benign clusters through cosine similarity projection;

[0137] A malicious model benign information introduction module, configured to introduce cluster center information of the benign cluster into the model in the malicious cluster through linear interpolation projection;

[0138] The current global model update module is used to update the current global model based on the models in the benign cluster and the malicious cluster, and the updated global model is used as the current global model for the next round of training.

[0139] Example 3:

[0140] The embodiment of the present invention further provides a computer device, which may be a server, and its internal structure diagram may be as shown in FIG. Figure 9As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. Among them, the processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements the federated learning label flipping attack defense method in the aforementioned embodiment 1.

[0141] Those skilled in the art will understand that Figure 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0142] Example 4:

[0143] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the following method:

[0144] Send the current global model to the auxiliary client and multiple local clients as the current local model of each client;

[0145] Each client trains the current local model based on its private data, and obtains the updated model of the local client and the auxiliary model of the auxiliary client;

[0146] Based on the auxiliary model, the plurality of update models are divided into benign clusters and malicious clusters;

[0147] By using cosine similarity projection, the components of the model in the malicious cluster that are contrary to the cluster center direction of the benign cluster are removed;

[0148] By linear interpolation projection, the cluster center information of the benign cluster is introduced into the model of the malicious cluster;

[0149] Based on the models in the benign cluster and the malicious cluster, the current global model is updated, and the updated global model is used as the current global model for the next round of training.

[0150] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0151] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0154] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which are all protected by the present invention.

Claims

1. A method for defending against label flipping attacks in federated learning, characterized in that: include: Send the current global model to the auxiliary client and multiple local clients as the current local model of each client; Each client trains the current local model based on its private data, and obtains the updated model of the local client and the auxiliary model of the auxiliary client; Based on the auxiliary model, the plurality of update models are divided into benign clusters and malicious clusters; By using cosine similarity projection, the components of the model in the malicious cluster that are contrary to the cluster center direction of the benign cluster are removed; By linear interpolation projection, the cluster center information of the benign cluster is introduced into the model of the malicious cluster; Based on the models in the benign cluster and the malicious cluster, the current global model is updated, and the updated global model is used as the current global model for the next round of training.

2. The federated learning label flip attack defense method according to claim 1, characterized in that: Based on the auxiliary model, the plurality of update models are divided into benign clusters and malicious clusters, including: Dividing the multiple updated models into two clusters using a k-means algorithm; The cosine similarity between the cluster centers of the two clusters and the auxiliary model is calculated respectively, and the cluster with the higher cosine similarity is called the benign cluster, and the other is called the malicious cluster.

3. The federated learning label flip attack defense method according to claim 1, characterized in that: By using cosine similarity projection, the components of the model in the malicious cluster that are contrary to the cluster center direction of the benign cluster are removed, including: ， in, Indicates the current training round; represents a malicious cluster; Indicates the number of malicious clusters Models; represents the cluster center of the benign cluster; represents the two-norm of a vector; Representation Model The model after removing the components that are contrary to the direction of the benign cluster center.

4. The method for defending against federated learning label flipping attacks according to claim 3, wherein: By linear interpolation projection, the cluster center information of the benign cluster is introduced into the model of the malicious cluster, including: ， in, Indicated in the model The model after introducing the cluster center information of the benign cluster; represents the interpolation coefficient, The calculation formula is: 。 5. The federated learning label flip attack defense method according to claim 4, characterized in that: Based on the models in the benign cluster and the malicious cluster, updating the current global model includes: Calculate the distance between the models in the benign cluster and the malicious cluster and the cluster center of the benign cluster to obtain the deviation of each model; Based on the deviation, obtaining the weight of the corresponding model; The current global model is updated according to the models and weights in the benign cluster and the malicious cluster.

6. The method for defending against federated learning label flipping attacks according to claim 5, characterized in that: Calculate the distance between the models in the benign and malicious clusters and the cluster center of the benign cluster to obtain the deviation of each model, including: ， in, Model representing the malicious cluster The degree of deviation; Based on the deviation, the weight of the corresponding model is obtained, including: The Gaussian decay function is used to calculate the weight of the corresponding model. The calculation formula is: ， in, Representation Model The weight of represents the attenuation coefficient, The calculation formula is: ， in, represents the average distance between the models in the benign and malicious clusters and the cluster center of the benign cluster; represents the scaling factor; Represents the total number of models in the benign and malicious clusters.

7. The method for defending against federated learning label flipping attacks according to claim 6, characterized in that: Updating the current global model, including: ， ， in, Represents the updated current global model.

8. A federated learning label flip attack defense device, characterized in that: include: The current local model distribution module is used to send the current global model to the auxiliary client and multiple local clients as the current local model of each client; The current local model training module is used by each client to train the current local model based on its private data, and obtain the updated model of the local client and the auxiliary model of the auxiliary client; An update model division module, configured to divide the plurality of update models into benign clusters and malicious clusters based on the auxiliary model; A malicious component removal module for a malicious model, configured to remove components of the malicious cluster whose directions are contrary to those of the cluster centers of the benign clusters through cosine similarity projection; A malicious model benign information introduction module, configured to introduce cluster center information of the benign cluster into the model in the malicious cluster through linear interpolation projection; The current global model update module is used to update the current global model based on the models in the benign cluster and the malicious cluster, and the updated global model is used as the current global model for the next round of training.

9. A computer device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the federated learning label flipping attack defense method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the federated learning label flipping attack defense method described in any one of claims 1 to 7 are implemented.

Images