Federal recommendation defense method

Abstract

The invention discloses a federal recommendation defense method, which comprises the following steps of: clustering project embedding gradients uploaded by clients, dividing the clients into two client clusters, and marking the client cluster with a small number of clients as a suspicious client cluster; and detecting whether the client in the suspicious client cluster is a malicious client, and if the detection result is yes, enabling the malicious client not to participate in the aggregation of the global item gradient vector and the global learnable model parameter in the current round. Project embedding gradients uploaded by the clients are clustered, suspicious clients in the clients are found out, gradients of different clusters are aggregated, global project embedding is updated in a false manner, false global project embedding with a guiding property is distributed in batches, malicious clients are attracted to upload malicious gradients according to attack targets, and the malicious gradients are distributed in batches. And the client uploads different project embedding gradients after receiving different global project embedding, analyzes the direction and size change of the gradients obtained before and after verification, and determines the attribute of the client and the attack type of the malicious client.

Description

Technical Field

[0001] This invention belongs to the field of recommendation technology, and more specifically, this invention relates to a federal recommendation defense method. Background Technology

[0002] Recommender systems can provide prediction and recommendation services from massive amounts of information. However, traditional recommender systems build recommendation models by collecting and storing user data on servers. With increasing user concerns about their privacy and the emergence of privacy protection regulations such as the GDPR, centralized recommender systems need to further improve their privacy protection mechanisms. Therefore, federated learning has been applied to recommender systems.

[0003] In federated recommender systems, the recommender model is divided into public and private parts. The private part mainly consists of user attribute information such as user embeddings, while the public part mainly includes item embeddings. During training, selected clients receive public parameters distributed by a central server, train the model using local data, and then update and upload the public parameters back to the server. In this way, users' personal data is well protected. However, federated learning is a distributed framework, and the clients and the central server are independent of each other. Therefore, attackers can control clients to upload malicious updates, thereby compromising the global model.

[0004] Existing defense methods primarily involve the server performing anomaly detection and removing malicious updates before aggregating common parameter updates, or reducing the proportion of malicious updates during aggregation to mitigate the attacker's impact. Most existing defense methods are based on this objective. Cai et al. proposed the FLMAAcBD method, which detects backdoor behavior in the global model based on the penultimate layer neurons of the updated models, and then adaptively prunes anomalous model updates and adds Gaussian noise to eliminate their impact. Liu et al. proposed the FLOW method, which clusters gradients based on the cosine distance between gradients, treating the smallest clusters as malicious and removing them. RoseAgg uses item embedding gradient clustering to extract the representative gradient for each cluster, obtains the clean principal gradient based on the representative gradient, and assigns aggregation weights to other gradients based on the principal gradient.

[0005] Existing federated learning defense methods are mainly used in classification models. However, in recommender systems, different users are often heterogeneous, and users have different preferences for different items. Therefore, the updates of common parameters uploaded by the client are also inconsistent. Simply comparing the updates of local common parameters uploaded by the client is not enough to detect malicious updates. This can lead to the incorrect classification of benign updates as malicious updates, resulting in performance degradation. Summary of the Invention

[0006] This invention provides a federally recommended defense method aimed at improving at least one of the aforementioned problems.

[0007] This invention is implemented as a federally recommended defense method, the method comprising the following steps:

[0008] (1) Cluster the embedded gradient of the project uploaded by the client, divide the client into two client clusters, and mark the client cluster with fewer clients as a suspicious client cluster;

[0009] (2) Detect whether the clients in the suspicious client cluster are malicious clients. If the detection result is yes, reset the aggregation weight of the malicious client to zero and do not participate in the aggregation of global project gradient vector and global learnable model parameters in the current round.

[0010] Furthermore, the specific methods for detecting malicious clients are as follows:

[0011] The item embedding gradients and learnable model parameter gradients of client cluster j are aggregated to obtain the aggregated item embedding gradient of client cluster j. and aggregate learnable model parameter gradients Where j = 0, 1;

[0012] Gradient embedding of aggregated items based on client cluster j Aggregate the gradients of learnable model parameters Update the aggregated item embedding vector of client cluster j Aggregate learnable model parameters

[0013] Embed aggregated items into vectors Aggregate learnable model parameters and aggregated project embedding vectors Aggregate learnable model parameters The distribution was split into two batches and sent to all clients. The clients used the aggregated project embedding vector. Aggregate learnable model parameters Update the local model to obtain the item embedding gradient. The client is based on the aggregated project embedding vector Aggregate learnable model parameters Update the local model to obtain the item embedding gradient. Then embed the project into the gradient. and project embedding gradient Upload to the server;

[0014] The server embeds gradients into the projects of clients in both client clusters. Aggregate to form an embedded gradient of aggregated items. Embed gradients in projects on clients within the two client clusters respectively. Aggregate to form an embedded gradient of aggregated items.

[0015] Calculate the embedding gradient of the aggregated items respectively Cosine similarity between CS t Aggregate project embedding gradient Cosine similarity between and the embedding gradient of aggregated projects Cosine similarity between

[0016] Calculate cosine similarity Cosine similarity Compared to cosine similarity cs t If a change value is greater than the threshold ε1, then the client in the suspicious client cluster is marked as a malicious client.

[0017] Furthermore, the specific methods for determining the attack type of a malicious client are as follows:

[0018] Calculate the aggregated item embedding gradient of client cluster j Embedded gradients with aggregated projects The difference

[0019] If satisfied The corresponding malicious client's attack type is marked as a sign-flipping attack; if it satisfies The corresponding malicious client's attack type is then marked as a noise attack; if it satisfies and If the attack type of the malicious client is not a sign-flipping attack, noise attack, or target attack, then the attack type of the malicious client is marked as other attacks.

[0020] Furthermore, the difference The specific calculation formula is as follows:

[0021]

[0022] Furthermore, client u i Aggregate weights The specific method for determining this is as follows:

[0023] According to client u i Attribute update client u i Suspicious score in the current round t Increase the suspicious score of malicious clients, client u i The attributes are benign clients and malicious clients;

[0024] Based on suspicious scores Update client u i Trust weight Suspicious scores Large trust weight Low;

[0025] For client u i Trust weight Assign corresponding aggregate weights

[0026] Furthermore, client u i Suspicious scores in round t The specific calculation formula is as follows:

[0027]

[0028] in, For client u i Suspicious scores in round t-1

[0029] Furthermore, client u i Trust weight in round t The specific calculation formula is as follows:

[0030]

[0031] Furthermore, aggregate weights The specific calculation formula is as follows:

[0032]

[0033] in, Let be the set of clients participating in the t-th round of training.

[0034] Furthermore, based on aggregate weights The global parameter update formula is as follows:

[0035]

[0036] Where lr is the learning rate, V t-1 Θ t-1 V represents the global item embedding vector and the globally learnable model parameters in round t-1, respectively. t Θ t Let represent the global item embedding vector and the global learnable model parameters in round t, respectively.

[0037] This invention clusters the gradients of item embeddings uploaded by clients to identify suspicious clients and verifies them. During the verification process, gradients from different clusters are aggregated and the global item embeddings are feignedly updated. The server distributes fake global item embeddings with guiding properties in batches to attract malicious clients to upload malicious gradients according to their attack targets. After receiving different global item embeddings, clients will upload different item embedding gradients. The server analyzes the changes in the direction and magnitude of the gradients before and after verification to determine the client's attributes and the attack type of the malicious client. The suspiciousness score of the client is adjusted according to the client's attributes, and the aggregation weight is determined based on the suspiciousness score, thereby reducing the impact of malicious clients on the performance of the recommendation system. Attached Figure Description

[0038] Figure 1 A flowchart of the recommended defense method for the base federation provided in the embodiments of the present invention;

[0039] Figure 2 The following are the accuracy changes of different defense methods under MovieLens-100k provided in the embodiments of the present invention when dealing with attacks, where (a) is the accuracy change of symbol flip attack, (b) is the accuracy change of random noise attack, and (c) is the accuracy change of target attack.

[0040] Figure 3 The following are the accuracy changes of different defense methods under Steam-200k provided in the embodiments of the present invention when dealing with attacks, where (a) is the accuracy change of symbol flip attack, (b) is the accuracy change of random noise attack, and (c) is the accuracy change of target attack.

[0041] Figure 4 The following are the accuracy changes of different defense methods under Last.fm provided in the embodiments of the present invention when dealing with attacks, where (a) is the accuracy change of symbol flip attack, (b) is the accuracy change of random noise attack, and (c) is the accuracy change of target attack.

[0042] Figure 5 The following are the project embedding gradient distributions for client-uploaded items under different attack types provided in the embodiments of the present invention, wherein (a) is the project embedding gradient distribution without attack, (b) is the project embedding distribution under sign flip attack, (c) is the project embedding distribution under noise attack, and (d) is the project embedding distribution under target attack.

[0043] Figure 6The following are examples of the impact of different components on recommendation performance under different datasets provided in this embodiment of the invention: (a) the impact of different components on HR on ML-100K, (b) the impact of different components on NDCG on ML-100K, (c) the impact of different components on HR on Steam-200k, (d) the impact of different components on NDCG on Steam-200k, (e) the impact of different components on HR on Last.fm, and (f) the impact of different components on NDCG on Last.fm.

[0044] Figure 7 The present invention provides the impact of the proportion of selected clients and the size of the β value on recommendation performance on different datasets, wherein (a) is the impact of the proportion of clients on HR on ML-100K, (b) is the impact of the size of the β value on NDCG on ML-100K, (c) is the impact of the proportion of clients on HR on Steam-200K, (d) is the impact of the size of the β value on NDCG on Steam-200K, (e) is the impact of the proportion of clients on HR on Last.fm, and (f) is the impact of the size of the β value on NDCG on Last.fm. Detailed Implementation

[0045] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0046] Recommendation systems include user sets and project portfolio Where N and M represent the number of users and projects, respectively. Each user Each has an embedding vector U that describes its latent features. i Similarly, each project Each has an embedding vector V j .

[0047] The recommendation model in this invention is trained within a federated framework, comprising a server and a large number of user clients. Each user (client) is a participant, represented by the character U. i Indicates user u i The embedding vector, V j Indicates item v j The embedding vector, Θ, represents the learnable model parameters. Due to the sparsity of the recommender system, each user u... i There are many non-interactive items, and the non-interactive items are grouped into u. i Each interactive item is assigned a non-interactive item, that is, each positive sample is assigned a negative sample, forming u. itraining set According to the rules of the federal framework, U i and V and Θ are stored locally on the client as local parameters, while V and Θ are passed as global parameters during training.

[0048] Initially, the server and all clients initialize their respective parameters. Then, during the training phase, several communication rounds are performed, with the t-th round executing as follows:

[0049] The server randomly selects a user set. A subset of users Participate in training and to a subset of users The client distributes the updated global parameter V from the previous round (round t-1). t-1 and Θ t-1 ;

[0050] Client u i Update the local parameters to the received global parameters V. i t-1 and and the embedding vector of the local user Combined to form a local recommendation model Next, use the local dataset. For local recommendation models Perform training and calculate user embedding gradients. Project Embedded Gradient and learnable model parameter gradient Among them, user embedding gradient For local parameter gradients, the project embeds gradients. and learnable model parameter gradient Gradient for common parameters;

[0051] Client u i Use user-embedded gradients Update the user embedding vector using the following formula:

[0052]

[0053] Where lr is the learning rate, and u is the client-side value. i Embed the project into gradient and learnable model parameter gradient Uploaded to the server, the server aggregates based on the common parameter gradient. and This is used to identify malicious clients. Malicious clients do not participate in the aggregation of global parameters in the current round; only benign clients participate in the aggregation of global parameters in the current round.

[0054] This invention clusters the item embedding gradients uploaded by clients to identify suspicious clients and verifies them. During verification, gradients from different clusters are aggregated, and the global item embedding is feignedly updated. The server distributes fake global item embeddings with guiding properties in batches to attract malicious clients to upload malicious gradients according to their attack targets. After receiving different global item embeddings, clients upload different item embedding gradients. The server analyzes the changes in the direction and magnitude of the gradients before and after verification to determine the client's attributes and the attack type of the malicious client. The suspiciousness score of the client is adjusted according to the client's attributes, and the aggregation weight is determined based on the suspiciousness score, thereby reducing the impact of malicious clients on the performance of the recommendation system. The following describes the process in conjunction with... Figure 1 The federally recommended defense methods are explained in detail below:

[0055] In this embodiment of the invention, the server receives the common parameter gradient uploaded by the client. and Subsequently, K-means clustering was used to divide the received gradients into two classes, with the smaller number of clients identified as malicious. This was attributed to attackers controlling the number of clients to not exceed half. In federated recommendation scenarios, client heterogeneity is high, and without attacks, client gradients may be incorrectly divided into two classes, misclassifying a small number of benign clients with poor data quality as malicious. Therefore, this invention identifies clients with a smaller number as suspicious clients, and further verifies these suspicious clients to determine if they are malicious, and identifies the attack types of malicious clients.

[0056] All client-uploaded items on the server are embedded with gradients. Preprocessing is performed, including: item embedding gradients. The normalization, and the gradient of the item embedding through principal component analysis. Dimensionality reduction and preprocessing of item embedding gradients from different attack methods reveal obvious anomalies. Suspicious clients can be initially identified through clustering. K-means analysis is then used to refine the preprocessed item embedding gradients. Clustering is performed to divide the clients into two categories: client cluster Cluster0 and client cluster Cluster1. Cluster0 is a client cluster with a small number of clients, i.e., a suspicious client cluster.

[0057] Next, it is necessary to verify whether the clients in the suspicious client cluster are malicious clients. The specific detection method is as follows:

[0058] The gradients of the two client clusters are aggregated separately to obtain the aggregated item embedding gradient of client cluster Cluster0. and aggregate learnable model parameter gradients And the gradient embedded in the aggregated project of client cluster Cluster1 and aggregate learnable model parameter gradients The calculation formula is as follows:

[0059]

[0060] Among them, u Clusterj This represents the set of clients in client cluster j. In the (t-1)th round, client u i Aggregate weights, This represents client u belonging to client cluster j in round t. i Project embedding gradient, This represents client u belonging to client cluster j in round t. i The gradient of the learnable model parameters, This represents the gradient of the aggregated item embedding in client cluster j during round t. Let represent the gradient of the aggregate learnable model parameters of client cluster j in round t.

[0061] In this embodiment of the invention, the server aggregates the learnable model parameter gradients based on client cluster j. and the embedding gradient of aggregated projects Update the aggregate learnable model parameters of client cluster j Aggregate project embedding vector The specific calculation formula is as follows:

[0062] The specific calculations relative to its formula are as follows:

[0063]

[0064] in, Let each represent the gradient of the aggregated item embedding for clients within client cluster j in round t. Aggregate the gradients of learnable model parameters The aggregated item embedding vectors and aggregated learnable model parameters are obtained separately.

[0065] The server first embeds the aggregated items into the vector. Aggregate learnable model parameters and aggregated project embedding vectors Aggregate learnable model parameters The distribution was split into two batches and sent to all clients. The clients used the aggregated project embedding vector. Aggregate learnable model parameters Update the local model to obtain the item embedding gradient. The client is based on the aggregated project embedding vector Aggregate learnable model parameters Update the local model to obtain the item embedding gradient. Then embed the project into the gradient. and project embedding gradient Upload to the server.

[0066] The server embeds gradients into the projects of clients in both client clusters. Project Embedded Gradient Aggregation is performed, embedding gradients into client items within client clusters Cluster0 and Cluster1 on the server. When performing aggregation, the aggregation formula is as follows:

[0067]

[0068] in, In round t, client u within client cluster j represents... i Project Embedding Gradient This represents the gradient of the item embeddings uploaded by all clients in client cluster j at round t. The aggregated items are embedded with gradients.

[0069] The server embeds gradients into client projects within client clusters Cluster0 and Cluster1. When performing aggregation, the aggregation formula is as follows:

[0070]

[0071] in, In round t, client u within client cluster j represents... i Project Embedding Gradient This represents the gradient of the item embeddings uploaded by all clients in client cluster j at round t. The aggregated items are embedded with gradients.

[0072] Based on formula (1), a set of aggregated item embedding gradients are obtained. Based on formula (3), a set of aggregated item embedding gradients are obtained. Based on formula (4), a set of aggregated item embedding gradients are obtained. Calculate the cosine similarity of the embedding gradients of the above three sets of aggregated items between the two client clusters;

[0073] Aggregate project embedding gradient The cosine similarity between them is cs tAggregate project embedding gradient The cosine similarity between them is Aggregate project embedding gradient The cosine similarity between them is In the absence of attack, the cosine similarity of the gradient embeddings of the three aggregated items is approximately the same. Cosine similarity cosine similarity cs t The difference in variation is within 5%. Under attack-free conditions, both client clusters are benign. Clients in benign clusters are benign clients, trained on their own data, and will not cause significant shifts in the gradient direction. Therefore, the relationship between the three sets of cosine similarities is determined by the following formula:

[0074]

[0075] in, This means taking the maximum value among the cosine similarity change differences, setting the threshold ε1 to 5%. If the maximum value is less than or equal to the threshold ε1, it is considered that there is no attacker in the current round t, and all client types are marked as benign. If the maximum value is greater than the threshold ε1, the clients in the client cluster Cluster0 are marked as malicious clients, i.e. attackers, and it is necessary to identify the attack type of the malicious client.

[0076] In this embodiment of the invention, the method for detecting the attack type of a malicious client is as follows:

[0077] The difference between the aggregated item embedding gradient obtained during the verification process and the original aggregated item embedding gradient is calculated using the following formula:

[0078]

[0079] When a signflipping attack exists, and The result is one positive and one negative, because the sign flipping reverses the gradient direction.

[0080] When noise attacks are present, and The changes all increase sharply, with absolute values ​​at least above ε3(100), because the addition of noise changes the mean of the gradient;

[0081] When a target attack exists, and The absolute value of the change is very small within ε2 (0.1), because all Cluster 0 clusters are malicious clusters, and their target is the recommended target project, so the gradient change remains stable;

[0082] Based on this, the attack type can be determined using the following formula: function The definition is as follows:

[0083]

[0084] The above formula is used to detect the attack type of a malicious client. If the attack type of the malicious client does not belong to the sign-flipping attack, noise attack, or target attack, then the attack type of the malicious client is marked as other attacks.

[0085] The method described above identifies malicious clients in the current round. However, blacklisting clients identified as malicious in only one round of detection, preventing them from participating in subsequent training, might remove some benign clients with poor data quality. Furthermore, some attacks are sudden, and removing their contributions even when they are not attacking can slow down model convergence. Therefore, this invention proposes the concepts of suspiciousness score and trust weight. The trust weight is adjusted based on each client's suspiciousness score, rather than simply considering the client's performance in the current round.

[0086] A suspicious score attribute is set for all clients, initially all of which have a suspicious score of 0. The client's suspicious score is adjusted and its trust weight is modified based on the results of each round of assessments. (Client u) i Suspicious scores in round t and trust weight The definition is as follows:

[0087]

[0088] If client u i In round t, the client u was flagged as malicious. i Suspicious scores in round t Suspicious scores in the previous round (round t-1) Add one to the base and assign it a trust weight. If the value is 0, its influence in this round of aggregation is removed; if client u i If an item is marked as benign, its suspicious value is not adjusted, and a trust weight is assigned, where β is a number ranging from (0,1). Therefore, as the suspicious value increases, its trust weight decreases accordingly. This eliminates the influence of malicious clients in this round of aggregation and also reduces the trust weight of clients with poor data quality or random attackers, thus mitigating their impact during aggregation.

[0089] The server depends on the client u i Trust weight Assign aggregate weights to it The formula for calculating the aggregate weight is as follows:

[0090]

[0091] The specific formula for updating global parameters is as follows:

[0092]

[0093] Among them, V t-1 Θ t-1 V represents the global item embedding vector and the globally learnable model parameters in round t-1, respectively. t Θ t Let represent the global item embedding vector and the global learnable model parameters in round t, respectively. After completing the current round t training, start the (t+1)th round training.

[0094] This invention was tested on three popular recommendation datasets: MovieLens-100K, Steam-200K, and Last.fm. MovieLens-100K includes 100,000 interaction records between 943 users and 1683 movies; Steam-200K includes 114,713 interaction records between 3753 users and 5134 games; and Last.fm includes 186,479 interaction records between 1892 users and 12,532 songs. The experiments followed common settings in implicit feedback recommendation, where all user feedback ratings were converted to y. ij =1, negative instances are sampled at a 1:1 ratio. We use the leave-one-out method, keeping the last-ranked item in each user's interaction list as test data, and using the remaining items for training.

[0095] In our experiments, we chose the widely used Neural Collaborative Filtering (NCF) as the recommendation model, with a hidden dimension of 128. We trained using the FedAvg and Adam optimizers as a federated framework with a learning rate of 0.1. Each user was treated as a client in the federated recommendation system and received recommendations from the entire user set. The server randomly selects 30% of users as malicious clients. In each round, the server randomly selects 30% of clients for model training, for a total of 200 rounds.

[0096] Based on the prior conditions set for attackers in this paper, in order to evaluate the robustness of the federated recommendation system, we consider two classic non-targeted attack methods and one targeted attack method, choosing them to achieve significant attack effects without requiring a large amount of prior knowledge.

[0097] SignFlip_attack: Adjusts the client-side item embedding gradient to the opposite direction;

[0098] Noise_attack: Adds random noise to the gradient of the client-side item embedding;

[0099] Target_attack: Modify 50% of the positive samples in the client interaction set to target items.

[0100] Two widely used metrics were employed to measure the performance of the recommendation model: the hit rate on the top 10 items (HR) and the normalized discount cumulative gain (NDCG). HR reflects the proportion of the top 10 recommended items in a set of items relevant to the user, while NDCG considers the position of the true items. These metrics were calculated only on benign clients using a full-ranking protocol, i.e., all items not interacted with by the user were used as candidate items. Each experiment was repeated 5 times, and the average results were reported.

[0101] The proposed defense approach, FedRecPot, is compared with the following defense baselines and integrated into the federated recommendation system.

[0102] Krum: Apply Krum to the project embedding gradient on the server, that is, we select the project gradient that is closest to the average of all client upload gradients as the aggregate gradient.

[0103] FoolsGold: Distinguishes between benign and malicious clients by evaluating pairwise similarity between model updates, and then reduces the weight of aberrant updates on the server.

[0104] RoseAgg: After embedding the project into gradient clustering, it takes the representative gradient in each cluster, obtains the clean principal gradient based on the representative gradient, and assigns weights to other gradients based on the principal gradient.

[0105] FLOW: Calculates the cosine distance between gradients and clusters them. Classes with fewer gradients are considered malicious, increasing the client's suspicion level and adjusting the weights in the current round.

[0106] Generally, an effective defense method should meet the following two requirements: (1) it can cope with different types of attacks, destroy the attack target, and maintain the recommended performance; (2) it can ensure the accuracy of model predictions. Sign flip, noise attacks, and target attacks were launched on three datasets, and these three attacks were continuously launched. The baseline defense method and FedRecPot were then used together to deal with these three attacks. For sign flip attacks, RoseAgg and FedAvg performed similarly. This is because RoseAgg mainly deals with multi-target attacks and is not suitable for sign flip attacks. Other defense methods achieved better performance than FedAvg, with FedRecPot being the best, improving performance by an average of 19.253% compared to the second-best defense method across the three datasets. For noise attacks, Foolsgold, Krum, RoseAgg, and FedAvg performed similarly or slightly worse. This is because random noise disrupts the data distribution of the original gradient set, making it difficult to analyze clean gradients. FLOW and FedRecPot outperform FedAvg because they record gradient performance over multiple rounds, exhibiting strong defense. FedRecPot is the best among the three datasets, achieving an average improvement of 19.833% over the second-best defense method. For targeted attacks, Krum is worse than FedAvg, while Foolgold is slightly better. This is because targeted attacks only modify the gradient values ​​of the target item, making them difficult to detect through data analysis. RoseAgg and FLOW show varying defense capabilities across different datasets, possibly due to differences in sparsity. FedRecPot provides the best defense, achieving an average improvement of 14.562% over the second-best defense method across the three datasets. FedRecPot performs well against different types of persistent attacks on datasets with varying sparsity, effectively maintaining the model's recommendation performance.

[0107] Table 1. Impact of different defense methods on model performance across different datasets.

[0108]

[0109] exist Figures 2 to 4This study investigated the impact of different defense methods on model accuracy when dealing with attacks on three datasets. Figure (a) shows that for sign-flipping attacks, FedRecPot maintains the highest accuracy across all datasets, improving prediction accuracy by an average of 4.655% compared to the second-best method across the three datasets. Figure (b) shows that for random noise attacks, only FLOW and FedRecPot consistently maintain an increasing accuracy trend. Other defense methods are affected by irregular noise, resulting in a decreasing accuracy trend. Foolsgold and FedAvg, in particular, experience a severe accuracy drop, leading to model training failure. This may be because FLOW and FedRecPot consider client historical performance, resulting in better defense. FedRecPot maintains the highest accuracy across all datasets, improving prediction accuracy by an average of 5.134% compared to the second-best method across the three datasets. Figure (c) shows that for targeted attacks, FedRecPot maintains the highest accuracy across all datasets, improving prediction accuracy by an average of 1.948% compared to the second-best method across the three datasets. In summary, FedRecPot can cope with different types of attack methods, reduce the impact of attacks on model accuracy, and maintain high model prediction accuracy. In conclusion, the defense method of this invention combines multiple components such as suspicious client identification, honeypot verification, and suspiciousness score adjustment, which can cope with different types of persistent attack methods and maintain recommendation performance while improving model prediction accuracy.

[0110] In federated recommendations, different users are often heterogeneous, with varying preferences for different items. Therefore, the direction of updates to public parameters uploaded by the client is also inconsistent. For example... Figure 5 As shown, in attack-free scenarios, client heterogeneity leads to diverse update directions. Furthermore, low data quality can cause unreliable client updates. For defense methods, we need to consider not only accurately identifying malicious clients during attacks, but also identifying unreliable clients in attack-free situations and pinpointing the timing of attacks during random attacks. Therefore, common clustering methods that assume small clusters contain more malicious clients are not suitable.

[0111] Table 2 shows how the baseline defense method and FedRecPot were used together to address three attack methods on three datasets, including targeted and untargeted attacks. These attacks were not continuous but random, and a scenario without attacks was also set up.

[0112] Table 2 shows the impact of different defenses on recommendation performance in attack-free and random attack scenarios for different datasets.

[0113]

[0114] Compared to previous persistent attacks, most aggregation methods showed some performance improvement, likely because the attack power of random attacks is weaker than that of persistent attacks. However, the performance of the Krum method generally declined compared to the previous methods, failing to adapt well to random attacks. Similarly, the FLOW method did not show improvement on Steam-200K and Last.fm, possibly because these two datasets have many users but little interaction data, leading to inaccurate analysis.

[0115] For attack-free scenarios, Krum, RoseAgg, and FLOW all outperform federated average aggregation, possibly due to the loss caused by extracting some benign gradients. Foolsgold and FedRecPot show significant performance improvements over federated average. For random attacks, the aggregation method is more critical to correctly identify when the attack occurred and eliminate its influence. Results show that due to the randomness of attacks, RoseAgg and Krum perform at or below the average aggregation, FLOW performs well in most cases, Foolsgold outperforms the average aggregation, and our method is the best among all compared methods. Therefore, introducing a honeypot verification mechanism helps us better distinguish updates under different scenarios.

[0116] The impact of different components on recommendation performance was evaluated. The FedRecPot defense approach comprises three main components: suspicious client identification, honeypot verification, and adjustment of suspiciousness scores.

[0117] Effectiveness of Suspicious Client Identification: Suspicious client identification is achieved through clustering, a crucial component of defense methods and involved in honeypot design during the verification phase. Therefore, this paper selected K-means clustering after considering multiple clustering methods. Before clustering, we need to process the gradient set; different processing methods will produce different results. Based on the properties of the gradients, we consider analyzing the alignment direction and magnitude. First, we normalize the received gradients, then perform PCA principal component analysis to obtain the part that has the greatest impact on each gradient. We considered two metrics to evaluate the effectiveness of this clustering method: 1) PCR: the proportion of malicious clients in a toxic cluster; a larger proportion indicates better clustering results. 2) BCR: the proportion of benign clients in a benign cluster; a larger proportion indicates better clustering results. Table 3 shows the specific results and model performance of PCR and BCR when using our processing method compared to other processing methods in round 10. Through data comparison, we can conclude that our processing method can more accurately distinguish between benign and malicious clients and achieve better model performance.

[0118] Table 3. Impact of different gradient processing methods on clustering results and model performance.

[0119]

[0120] Honeypot validation effectiveness: Honeypot technology is one of the most effective parts of our defense method. To validate its effectiveness, we removed this component from three datasets to demonstrate its effect. For example... Figure 6 As shown, removing honeypot verification and classifying the smaller number of clusters as malicious significantly reduces HR@10. The data demonstrates that further verification of clustering results using honeypot technology, and then identifying malicious clusters based on client behavior, leads to better model performance.

[0121] Validity of Suspicious Values: Due to inconsistencies in client objectives and instability during model training, some clients may upload unreliable local updates. To avoid errors caused by chance, we introduce the definition of suspicious values. To verify its effectiveness, we remove this component from three datasets to demonstrate its effect. For example... Figure 6 As shown, removing suspicious values ​​without considering the impact of chance significantly reduces HR@10. Further constraints on the client-side over time can be achieved by using a suspicious value definition, resulting in better model performance.

[0122] To verify the impact of the randomly selected client ratio on model performance, we conducted experiments by keeping other parameters constant and simulating different clients using the same dataset. Figure 7 As shown, as the number of clients increases, the number of malicious clients selected also increases, exacerbating the performance degradation.

[0123] To verify the impact of the penalty mechanism on model performance, experiments were conducted by modifying the value of β. Figure 7 As shown, the model performs best when β is chosen to be 0.5. This is because when β is too large, the impact on unreliable clients is too great, causing errors; when β is too small, the penalty is insufficient, and malicious clients can still operate.

[0124] The client's attributes were determined by comparing the relationship between the direction and magnitude of the aggregate gradient before and after honeypot verification, with three threshold values ​​set: ε1, ε2, and ε3.

[0125] For ε1, we compare the cosine similarity changes of the aggregated gradients before the honeypot in the same cluster to determine client attributes. Based on experiments on different datasets, we set its value to 0.05. To ensure the accuracy of this threshold, we further analyzed and set ε1 values ​​to 0.01, 0.05, and 0.1 respectively. The experimental results are shown in Table 4. For ε2 and ε3, we determine the attack type based on the magnitude changes of the aggregated gradients before the honeypot in the same cluster after confirming the presence of an attacker in the current round. ε2 determines whether it is a targeted attack. Based on experiments on different datasets, we set its value to 0.1. To ensure the accuracy of this threshold, we set ε2 values ​​to 0.05, 0.1, and 0.15 respectively. The experimental results are shown in Table 5. Similarly, ε3 determines whether it is a noise attack. We set ε3 values ​​to 50, 100, and 200 respectively. The experimental results are shown in Table 6.

[0126] Table 4 shows the impact of ε1 values ​​on recommendation performance.

[0127]

[0128] Table 5 shows the impact of ε2 values ​​on recommendation performance.

[0129]

[0130]

[0131] Table 6 shows the impact of ε3 values ​​on recommendation performance.

[0132]

[0133] The results show that the effect is not good when the value is too low or too high. This is because when the value is too low, some gradients that are normal changes in model training will be removed, resulting in insufficient training. When the value is too high, some malicious or poor gradients will be added to the aggregation, which will affect the model. Therefore, setting ε1, ε2 and ε3 to 0.05, 0.1 and 100 respectively can achieve better results.

[0134] This invention proposes a federated recommendation defense method, FedRecPot. FedRecPot consists of three steps: suspicious client identification, honeypot verification, and suspicious score adjustment. Specifically, the server processes and clusters suspicious clients, aggregating gradients from different clusters. In the second step, the server guides malicious clients to upload malicious gradients based on the distribution of embeddings affected by suspicious clusters. The results of this honeypot verification are compared and analyzed to determine client attributes and adjust the client's suspicious score, reducing its impact on the aggregation process. Extensive experiments on three commonly used datasets demonstrate that FedRecPot can handle three types of attacks: sign flipping, random noise, and targeted attacks. Regardless of whether the attacker's attack is persistent or sudden, it can effectively identify and maintain the model's recommendation performance and robustness.

[0135] The present invention has been described by way of example. Obviously, the specific implementation of the present invention is not limited to the above-described manner. Any non-substantial improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other occasions without modification, are all within the protection scope of the present invention.

Claims

1. A federally recommended defense method, characterized in that, The method includes the following steps: (1) Cluster the embedded gradient of the project uploaded by the client, divide the client into two client clusters, and mark the client cluster with fewer clients as a suspicious client cluster; (2) Detect whether the clients in the suspicious client cluster are malicious clients. If the detection result is yes, reset the aggregation weight of the malicious client to zero and do not participate in the aggregation of global project gradient vector and global learnable model parameters in the current round.

2. The federally recommended defense method as described in claim 1, characterized in that, The specific methods for detecting malicious clients are as follows: The item embedding gradients and learnable model parameter gradients of client cluster j are aggregated to obtain the aggregated item embedding gradient of client cluster j. and aggregate learnable model parameter gradients Where j = 0, 1; Gradient embedding of aggregated items based on client cluster j Aggregate the gradients of learnable model parameters Update the aggregated item embedding vector of client cluster j Aggregate learnable model parameters Embed aggregated items into vectors Aggregate learnable model parameters and aggregated project embedding vectors Aggregate learnable model parameters The distribution was split into two batches and sent to all clients. The clients used the aggregated project embedding vector. Aggregate learnable model parameters Update the local model to obtain the item embedding gradient. The client is based on the aggregated project embedding vector Aggregate learnable model parameters Update the local model to obtain the item embedding gradient. Then embed the project into the gradient. and project embedding gradient Upload to the server; The server embeds gradients into the projects of clients in both client clusters. Aggregate to form an embedded gradient of aggregated items. Embed gradients in projects on clients within the two client clusters respectively. Aggregate to form an embedded gradient of aggregated items. Calculate the embedding gradient of the aggregated items respectively Cosine similarity between CS t Aggregate project embedding gradient Cosine similarity between and the embedding gradient of aggregated projects Cosine similarity between Calculate cosine similarity Cosine similarity Compared to cosine similarity cs t If a change value is greater than the threshold ε1, then the client in the suspicious client cluster is marked as a malicious client.

3. The federally recommended defense method as described in claim 1 or 2, characterized in that, The specific methods for determining the attack type of a malicious client are as follows: Calculate the aggregated item embedding gradient of client cluster j Embedded gradients with aggregated projects The difference If satisfied The corresponding malicious client's attack type is marked as a sign-flipping attack; if it satisfies The corresponding malicious client's attack type is then marked as a noise attack; if it satisfies and If the attack type of the malicious client is not a sign-flipping attack, noise attack, or target attack, then the attack type of the malicious client is marked as other attacks.

4. The federally recommended defense method as described in claim 3, characterized in that, Difference The specific calculation formula is as follows:

5. The federally recommended defense method as described in claim 1, characterized in that, Client u i Aggregate weights The specific method for determining this is as follows: According to client u i Attribute update client u i Suspicious score in the current round t Increase the suspicious score of malicious clients, client u i The attributes are benign clients and malicious clients; Based on suspicious scores Update client u i Trust weight Suspicious scores Large trust weight Low; For client u i Trust weight Assign corresponding aggregate weights 6. The federally recommended defense method as described in claim 5, characterized in that, Client u i Suspicious scores in round t The specific calculation formula is as follows: in, For client u i Suspicious scores in round t-1 7. The federally recommended defense method as described in claim 5, characterized in that, Client u i Trust weight in round t The specific calculation formula is as follows:

8. The federally recommended defense method as described in claim 5, characterized in that, Aggregate weight The specific calculation formula is as follows: Among them, u t Let be the set of clients participating in the t-th round of training.

9. The federally recommended defense method as described in claim 5, characterized in that, Based on aggregate weight The global parameter update formula is as follows: Where lr is the learning rate, V t-1 Θ t-1 V represents the global item embedding vector and the globally learnable model parameters in round t-1, respectively. t Θ t Let represent the global item embedding vector and the global learnable model parameters in round t, respectively.

Images