Defence method and system for federal learning model poisoning attack

Abstract

The application discloses a kind of federal learning model poisoning attack defense method and system, its method includes the following steps: the model update uploaded by client is voted with K-means clustering;Consensus graph is constructed according to voting record, and community is detected by Louvain algorithm to divide model update;Cosine similarity is used to filter model update in each community;Representative update is generated by aggregating each community;During initial training, evaluate community update based on key parameters, and after stabilization, use historical information to predict, take the highest evaluation as the benign update of this round to aggregate new global model.Compared with the traditional method, the application can effectively resist model poisoning attack in the complex scene where data is highly dependent and there is a high proportion of malicious clients, and significantly improves the security and robustness of federal learning model.

Description

Technical Field

[0001] This invention belongs to the technical field of distributed machine learning security defense and is widely used in transmission security in the Internet of Things or Industrial Internet, intrusion detection in network security, and proactive defense. Specifically, it relates to a defense method and system for poisoning attacks using federated learning models. Background Technology

[0002] Federated learning enables privacy-preserving machine learning training and has been widely applied in many fields, such as the Internet of Things (IoT) and finance. As a decentralized machine learning technique, federated learning aims to solve the problems of centralized data storage and privacy breaches in traditional centralized machine learning. In federated learning, model training is performed on various local devices, and only the model or gradients are shared with the central server. In this way, the privacy of the training data can be protected.

[0003] However, due to its distributed nature, the central server cannot control client behavior or access its local data, making federated learning vulnerable to model poisoning attacks. Malicious clients can use poisoned datasets for training or contribute malicious model updates to the central server during the federated learning training process, potentially causing catastrophic failures in the performance and reliability of the global model. Therefore, designing secure and robust aggregation mechanisms has become a key focus for federated learning.

[0004] To mitigate the impact of model poisoning attacks, many secure and robust defense frameworks have been developed. Some recent studies have proposed deploying a carefully selected root dataset on the server to evaluate the credibility of model updates uploaded by the client. However, such a defense framework that verifies with the server dataset is impractical and violates the privacy principles of federated learning.

[0005] Existing mainstream robust federated learning defense methods aim to eliminate outliers by analyzing all uploaded client model updates from a global perspective using anomaly detection techniques based on distance and statistical properties. While these schemes perform well when the data is independent and identically distributed and the number of malicious clients is limited, they perform poorly when the client data is highly non-independent and identically distributed or when there are a large number of malicious clients.

[0006] In this scenario, defense methods based on server data suffer from performance limitations imposed by the server dataset on their global model. Defense methods based on distance and statistical properties, however, are hampered by the non-independent and identically distributed nature of the data, leading to significant differences between benign and malicious model updates. This makes it difficult to identify malicious updates as outliers. Furthermore, defense methods based on distance and statistical properties are inherently ineffective against situations where malicious clients constitute the majority.

[0007] In summary, current mainstream defense methods typically suffer from one or more of the following shortcomings: 1) They rely on a trusted server-side verification dataset that is independent and identically distributed with the client data, which is difficult to obtain in real-world scenarios; 2) When the proportion of malicious clients is high (e.g., close to or exceeding 50%), defense mechanisms based on statistical anomalies or distance metrics are prone to failure; 3) When client data exhibits highly non-independent and identically distributed characteristics, the model updates of benign clients themselves vary significantly, causing defense methods to incorrectly identify benign updates as malicious attacks. Summary of the Invention

[0008] The purpose of this invention is to provide a method and system for defending against poisoning attacks on federated learning models, so as to overcome the limitations of existing methods for defending against poisoning attacks on federated learning models. In particular, it can still ensure the security and stability of the federated learning process in harsh scenarios with a high proportion of malicious clients, highly non-independent and identically distributed data, and no server verification set.

[0009] Based on the first main aspect of the present invention, a method for defending against poisoning attacks using federated learning models is provided, comprising the following steps performed by a computer hardware system:

[0010] For each model update uploaded by a client, a voting method based on K-means clustering is used;

[0011] A consensus graph is constructed based on the voting records of each model update. The Louvain algorithm is applied to the consensus graph to perform community detection and divide the model update into multiple communities.

[0012] Within each community, a cosine similarity-based filtering method is used to screen model updates;

[0013] Each of the divided communities is aggregated to generate a representative community model update;

[0014] In the early stages of training, community updates are evaluated based on key parameters. Once stable, historical information is used for prediction, and the highest-rated update is selected as the benign update for the current round to aggregate a new global model.

[0015] As a further preferred option, in the aforementioned method, the model update uploaded by each client is voted on using a K-means clustering-based method, including:

[0016] For each client model update, calculate its distance from other client model updates;

[0017] For each client model update, L-2 normalization is performed, and its directional features are calculated.

[0018] Each client-side model update runs K-means independently to guide the voting.

[0019] Furthermore, calculating the distance between each client model update and other client model updates includes: the server receiving... Client model update ;

[0020] For each client model update Calculate its Euclidean distance to updates from other client models. .in, For the number of clients, For training rounds.

[0021] Furthermore, the step of performing L-2 normalization for each client model update and calculating its directional features includes:

[0022] For each client model update Calculate its directional characteristics This feature is not sensitive to the magnitude of the update and better reflects the essential direction of the update.

[0023] Furthermore, each client-side model update will independently run K-means to guide the voting, including:

[0024] Each model update Based on the obtained Euclidean distance, K cluster centers are initialized for the voting process. Use itself as the first initial center, and choose to... The K-1 client models with the furthest Euclidean distance are updated as the initial center points for the rest;

[0025] After determining the cluster centers, the obtained directional features Clustering is performed using the data for clustering.

[0026] The model update of each client is completed by voting on the model update that belongs to the same cluster; for a network with an L layer, L-fold voting is performed layer by layer.

[0027] As a further preferred option, in the aforementioned method, a consensus graph is constructed based on the voting records of each model update, and the Louvain algorithm is applied to perform community detection on the consensus graph, dividing the model updates into multiple communities, specifically including:

[0028] A consensus graph is constructed based on the updated voting records of each client model;

[0029] The Louvain community detection algorithm is applied to the constructed consensus graph to divide the model update into multiple communities.

[0030] Furthermore, the specific implementation method for constructing the consensus graph based on the updated voting records of each client model is as follows:

[0031] Based on the updated voting records of each client model, a consensus graph is constructed according to the following edge-building conditions. If and only if any two models are updated , When they vote for each other on each level, their corresponding vertices There is only one edge in G. This represents the set of vertices (nodes) in the consensus graph. This represents the set of edges in the consensus graph.

[0032] Furthermore, the Louvain community detection algorithm is applied to the constructed consensus graph, and the model update is divided into multiple communities. The implementation method is as follows:

[0033] Apply the Louvain community detection algorithm to the constructed consensus graph G:

[0034] ,

[0035] in It is a collection of divided communities. It refers to the number of communities.

[0036] As a further preferred option, in the aforementioned method, within each community, a cosine similarity-based filtering method is used to screen model updates, specifically including:

[0037] For each community, calculate the average cosine similarity of each client model update within that community;

[0038] The mean cosine similarity of each client model update within the community is normalized by the minimum-maximum method, and client model updates with a normalized mean cosine similarity less than a preset threshold are removed from the community.

[0039] Furthermore, the specific implementation of calculating the average cosine similarity of each client model update in each community is as follows:

[0040] For any community Arbitrary model update Calculate its average cosine similarity in this community. .

[0041] Furthermore, the mean cosine similarity of each client model update within the community is normalized using a maximum-minimum method. Client model updates with a normalized mean cosine similarity less than a preset threshold are then removed from the community. The specific implementation method is as follows:

[0042] Each Scale to the range of 0 to 1, and Model updates below a preset threshold are considered outliers and removed from the community.

[0043] As a further preferred embodiment, in the aforementioned method, the aggregation of each divided community to generate a representative community model update specifically includes:

[0044] For each community Aggregate model updates from all its internal clients to generate community model updates.

[0045] .

[0046] As a further preferred approach, in the aforementioned method, community updates are evaluated based on key parameters during the initial training phase. After stabilization, historical information is used for prediction, and the highest-rated update is selected as the benign update for the current round to aggregate the new global model. Specifically, this includes:

[0047] When training round t=1, for each community update Calculate the importance of its parameters to obtain the key parameters. Calculate the benign parameter reference set However, it does not update the global model; This indicates that the parameters are ranked higher in importance. Indicates community q The set of key parameters;

[0048] When training round t=2, calculate the Jaccard similarity between the key parameters updated by each community and the benign parameter reference set as its score, and select the community model update with the highest score as the global model update for this round.

[0049] When training rounds When the previous round of global update is used as the benchmark, a comprehensive score based on Jaccard similarity, correlation coefficient and cosine similarity is used to evaluate the community update, and the community model update with the highest score is selected as the global model update for this round.

[0050] When training rounds When the time comes, switch to a prediction method based on historical information to identify benign community updates, and select the community model update with the highest score as the global model update for this round.

[0051] Based on the second main aspect of the present invention, a defense system for poisoning attacks using a federated learning model that implements the aforementioned method is provided, the system comprising the following components:

[0052] The clustering voting module receives model updates uploaded by each client and uses a K-means clustering method to vote on each model update to generate voting records.

[0053] The community detection module constructs a consensus graph based on the voting records generated by the clustering voting module, and applies the Louvain algorithm to perform community detection on the consensus graph, thereby adaptively dividing the model into multiple communities.

[0054] The community cleaning module uses a cosine similarity-based filtering method within each community to screen model updates and remove outlier model updates within the community.

[0055] The community update module is responsible for aggregating each cleaned community, merging the model updates from multiple clients within the community into a single, representative community model update.

[0056] The key parameter analysis module, in the absence of reliable historical information, selects benign updates for the current round by identifying community model updates most similar to the consensus key parameter set. The consensus key parameter set refers to the set of parameters commonly agreed upon by multiple communities and crucial to model performance, extracted during the early stages of federated learning training (when reliable historical information is lacking) through analysis of the key parameters of each community's model updates. Essentially, it is the intersection of key parameters across different communities, reflecting the consistency trend of benign model updates on core parameters, and providing a consensus benchmark for judging whether a community update is benign.

[0057] The historical information prediction module uses the stable model evolution trajectory as reliable prior knowledge. By measuring the similarity with the historical benchmark, it accurately identifies the benign updates that are most consistent with the normal training process, thereby effectively resisting deviation attacks launched in the later stages of training.

[0058] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0059] This invention starts by revealing the underlying intent of client model updates, and combines client voting and community division to determine whether the client is engaging in model poisoning attacks and provides a basis for defense aggregation.

[0060] Compared to traditional methods based on distance or statistical analysis, this invention can efficiently detect security issues related to poisoning attacks in various models of federated learning, and features low false alarm rate, high accuracy, and the ability to detect new attacks. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0062] Figure 1 The flowchart of a defense method against poisoning attacks using a federated learning model is shown in one embodiment of the present invention. Detailed Implementation

[0063] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the present invention. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are merely illustrative of the essential spirit of the technical solution of the present invention.

[0064] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0065] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0066] Please see Figure 1 The present invention provides a method for defending against poisoning attacks using a federated learning model, comprising steps S101-S105 executed by a computer hardware system:

[0067] Step S101: For each model update uploaded by a client, a voting method based on K-means clustering is used;

[0068] Step S102: Construct a consensus graph based on the voting records of each model update, and apply the Louvain algorithm to perform community detection on the consensus graph to divide the model update into multiple communities;

[0069] Step S103: Within each community, a cosine similarity-based filtering method is used to screen model updates;

[0070] Step S104: Aggregate each of the divided communities to generate a representative community model update;

[0071] Step S105: In the early stage of training, the community update is evaluated based on key parameters. After stabilization, historical information is used for prediction, and the highest evaluation is taken as the benign update for the current round to aggregate the new global model.

[0072] The following provides a feasible embodiment.

[0073] Step S101. Clustering vote for client model update.

[0074] Step 1: This invention spontaneously distinguishes between benign and malicious model updates from the client's perspective. Each client-side model update first votes for the model update most similar to it. Since "similarity" is difficult to define precisely, after receiving the set of model updates from the client, the server independently runs K-means for each model update to guide the voting. Specifically:

[0075] Step 1.1: After receiving the set of model updates from the clients, the server must first quantify the differences between them in order for each client's model update to identify the other most similar model updates in the subsequent voting process. The core purpose of this step is to provide a reliable distance metric for subsequent K-means clustering voting, especially to provide key input for the initialization of cluster centers, as follows:

[0076] The server received Client model update For each client model update Calculate its Euclidean distance to updates from other client models. ;

[0077] Step 1.2, the clustering process is performed on the directional features of the model update. These features are not sensitive to the magnitude of the update and better reflect the essential direction of the update. Therefore, L-2 normalization is performed on each client model update, and its directional features are calculated. .

[0078] Step 1.3, update each model Based on the distance obtained in step 1.1, initialize K cluster centers for the voting process. Use itself as the first initial center, and choose to... The K-1 client models with the furthest Euclidean distance are updated as the initial center points for the rest.

[0079] After determining the cluster centers, the directional features obtained in step 1.2 are used. Clustering is performed using the data as clustering data. The model updates belonging to the same cluster are voted on, and this is done for each client model update. Since the number of parameters differs across layers, for an L-layer network, voting is performed at the L-layer level.

[0080] Step S102: Initially classify client model updates through community detection.

[0081] Step 2: Construct a consensus graph based on the voting records of each model update, and apply the Louvain algorithm to perform community detection on the consensus graph, thereby adaptively dividing the model update into multiple communities, as follows:

[0082] Step 2.1: After voting is completed, an undirected consensus graph is constructed based on the updated voting records of each client model. This is used to represent voting relationships. Among them, This represents the set of vertices (nodes) in the consensus graph. This represents the set of edges in the consensus graph. The vertices of the graph represent model updates submitted by clients. The edges of the graph represent the consensus relationships between model updates. , This represents the total number of clients.

[0083] In most embodiments, the present invention designs the following edge-building condition: if and only if any two models are updated , When they vote for each other on each level, their corresponding vertices There is only one edge in G, namely:

[0084]

[0085] in, Indicates the first Voting indicator function of layered networks Indicates the index of the number of network layers in the federated learning training model ( , (Total number of layers in the model) Indicates the index of the initiator of the model update. Indicates the receiver index for model updates.

[0086] This edge-building condition can naturally create a clear boundary between benign and malicious model updates in the graph structure;

[0087] Step 2.2: Apply the Louvain community detection algorithm to the constructed consensus graph:

[0088] ,

[0089] in, It is a collection of divided communities. It refers to the number of communities.

[0090] Step S103, perform community cleaning, which aims to maximize class consistency within the community.

[0091] Step 3: To further enhance robustness, this invention uses cosine similarity to cleanse each community. This step aims to eliminate heterogeneous members within the community, forming benign or malicious clusters with pure attributes. Specifically:

[0092] Step 3.1, for any community Arbitrary model update Calculate its average cosine similarity in this community:

[0093]

[0094] in It is a community The number of model updates in the middle Indicates the cosine similarity between them;

[0095] Step 3.2, perform min-max normalization on each Scale to the range of 0 to 1, and Below the preset threshold The model update treats outliers as outliers and removes them from the community.

[0096] Step S104, aggregation and generation of community updates.

[0097] Step 4: For each community filtered in Step 3, perform an aggregation operation on all client model updates retained within it to generate a representative community model update:

[0098]

[0099] The core purpose of this step is to prepare candidate model updates for the subsequent evaluation and selection phases, that is, to transform the evaluation of the entire community into the evaluation of a single aggregate model.

[0100] Step S105: Evaluate the community model update and select the global model update.

[0101] Step 5: After dividing the client model updates, the goal of this invention is to identify the communities most likely to be benign from these community model updates. Research shows that prediction methods based on historical information perform well in identifying benign model updates, but they suffer from a "cold start" problem; in the early stages of training, the lack of historical information for reference makes it difficult for defense mechanisms to work effectively.

[0102] Therefore, this invention designs a benign model identification mechanism. In the early stages of training, this mechanism relies on key parameter analysis to identify the most likely benign community model updates. As training progresses, it transitions to a more robust identification method based on historical information prediction. Specifically:

[0103] Step 5.1: When t=1, since there is no reference information, in order to prevent the wrong selection of malicious community updates as global model updates, this invention does not update the global model in this round, but instead constructs a benign parameter reference set to provide a benchmark for benign community identification in subsequent rounds.

[0104] For each community update The present invention calculates the importance of its parameters:

[0105]

[0106] in, Indicates community update The update amount of the nth parameter, This represents the initial value of the nth parameter in the global model, thus obtaining the key parameters for each community update. The benign parameter reference set is the intersection of the key parameters for each community update. , This indicates that the parameters are ranked higher in importance. Indicates community q The set of key parameters;

[0107] Step 5.2, when t=2, this invention calculates the key parameters updated for each community. With benign parameter reference set The Jaccard similarity is used as its score:

[0108]

[0109] in, This indicates the similarity to Jaccard.

[0110] Because benign community updates exhibit greater stability on key parameters, they show higher Jaccard similarity between their key parameters and the benign parameter reference set. Based on this evaluation, the community model update with the highest Jaccard similarity score is adopted as the global model update for this round.

[0111] Step 5.3, when In this invention, the previous round of global update is used as a benchmark, and a comprehensive score based on Jaccard similarity, correlation coefficient, and cosine similarity is employed to evaluate community updates. Indicates the stage switching threshold rounds in federated learning training:

[0112]

[0113] in, Community model update Compared to the previous round of global model updates The intersection of key parameters, It is the Pearson correlation coefficient. It is a sign function that selects the community model update with the highest score as the global model update for this round;

[0114] Step 5.4, when training enters the later stage Having accumulated a wealth of historical information, we now switch to a prediction-based approach to identify positive community updates, leveraging global updates from past iterations:

[0115]

[0116] Differences from global update:

[0117]

[0118] The L-BFGS algorithm is used to approximate the Hessian matrix integration. This leads to the predicted global model update:

[0119]

[0120] Calculate the distance between each community update and the predicted global model update, and use the reciprocal of the distance as its score:

[0121]

[0122] The model with the highest score is selected for global model updating.

[0123] In one feasible embodiment, the present invention also provides a defense system against poisoning attacks using a federated learning model that implements the aforementioned method, the system comprising the following components:

[0124] The clustering voting module receives model updates uploaded by each client and uses a K-means clustering method to vote on each model update to generate voting records.

[0125] The community detection module constructs a consensus graph based on the voting records generated by the clustering voting module, and applies the Louvain algorithm to perform community detection on the consensus graph, thereby adaptively dividing the model into multiple communities.

[0126] The community cleaning module uses a cosine similarity-based filtering method within each community to screen model updates and remove outlier model updates within the community.

[0127] The community update module is responsible for aggregating each cleaned community, merging the model updates from multiple clients within the community into a single, representative community model update.

[0128] The key parameter analysis module selects the positive update of the current round by identifying the community model update that is most similar to the consensus key parameter set when there is no reliable historical information.

[0129] The historical information prediction module uses the stable model evolution trajectory as reliable prior knowledge. By measuring the similarity with the historical benchmark, it accurately identifies the benign updates that are most consistent with the normal training process, thereby effectively resisting deviation attacks launched in the later stages of training.

[0130] In this system, the clustering voting module is the first processing unit of the defense system. Its core function is to perform preliminary screening and generate voting records for model updates uploaded by clients. After receiving model updates from each client, this module first calculates the Euclidean distance of each model update to all other model updates to measure the numerical differences between updates. Then, it performs L-2 normalization on each model update to extract its directional features and capture the trend consistency of the updates. Next, each model update independently runs the K-means clustering algorithm, setting itself as the first initial cluster center and selecting several model updates with the greatest Euclidean distance from itself as the remaining initial centers. After completing the clustering based on directional features, it votes on model updates within the same cluster. This voting process is executed independently for each layer of the network, and finally, it generates detailed records containing the voting tendencies of each model update.

[0131] The community detection module receives the output from the clustering voting module and is responsible for dividing model updates into communities with internal consistency. This module constructs a consensus graph based on the voting records generated by the clustering voting module, where nodes represent model updates from various clients, and edge weights are determined by the mutual voting support between model updates—if two model updates mutually support each other, the edge weight increases accordingly, and vice versa. Subsequently, the Louvain community detection algorithm is applied to analyze the consensus graph. This algorithm adaptively divides model updates into multiple communities by optimizing the modularity index, ensuring high consensus within each community and laying the foundation for subsequent fine-grained processing.

[0132] The community cleaning module performs internal optimization for each divided community to eliminate possible abnormal model updates. Its operation logic is based on cosine similarity: First, calculate the cosine similarity between each model update in the community and all other model updates, obtain the average cosine similarity of each model update within the community, and use this to measure the degree of fit between the update and the overall trend of the community; then perform max-min normalization on these average cosine similarities, map the values to the [0,1] interval to eliminate the dimension difference; finally, set a preset threshold (which can be dynamically adjusted according to the training scenario, usually initially set to 0.3 - 0.5), and eliminate the model updates with an average cosine similarity lower than this threshold after normalization, thereby purifying the effective data within the community and enhancing the community representativeness.

[0133] The role of the computing community update module is to aggregate the model updates within the cleaned community into a single representative update. For each community processed by the community cleaning module, this module uses weighted average to aggregate the model updates of all internal clients - the weights can be dynamically assigned according to factors such as client data volume and historical performance, and if not specified otherwise, equal-weight average is used by default. Through aggregation, each community generates a community model update, which condenses the consensus trend of most clients within the community, retains key information, and simplifies the subsequent global model update calculation.

[0134] The key parameter analysis module mainly plays a role in the initial stage of training. For example, when there is no reliable historical information, it is used to identify benign community updates. When the number of training rounds is small (such as the number of rounds ≤ T1, and T1 is usually set to 10 - 20 rounds), this module first calculates the parameter importance of each community update, which can be measured by indicators such as gradient contribution and parameter sensitivity, extracts key parameters and constructs a reference set of benign parameters. When the number of rounds is in the range of T1 < T ≤ T2 (T2 is usually 2 - 3 times of T1), calculate the Jaccard similarity between the key parameters of each community update and the reference set of benign parameters as the score, and select the community update with the highest score as the candidate for this round. When the number of rounds is in the range of T2 < T ≤ T3 (T3 is the transition stage before training stability), switch to a comprehensive scoring system that combines Jaccard similarity, correlation coefficient, and cosine similarity to more comprehensively evaluate the consistency between the community update and the benign trend, ensuring that poisoning attacks can be effectively resisted in the initial stage of training.

[0135] After training enters a stable phase, the historical information prediction module takes over from the key parameter analysis module, accurately identifying benign updates based on historical data. When the training epochs are ≥T3, the system determines that the model evolution trajectory has stabilized. At this point, this module uses the previous round's global model update as the historical benchmark. By calculating the comprehensive similarity (including historical Jaccard similarity, long-term correlation coefficient, and cumulative cosine similarity) between the current community updates and the historical benchmark in terms of parameter change trends and key feature distribution, it predicts which community update best fits the normal training process. Finally, the community update with the highest comprehensive score is selected as the benign update for the current round, used to aggregate the new global model. This effectively resists potential poisoning attacks that exploit historical information biases in the later stages of training, ensuring the stable convergence of the global model.

[0136] As described above, this invention proposes a novel framework for defending against poisoning attacks using a federated learning model. This framework integrates an adaptive community partitioning mechanism based on client-to-client voting with a benign update identification mechanism based on a two-stage evaluation (key parameter analysis and historical information prediction), achieving effective isolation and accurate identification of malicious updates without relying on server-side verification data.

[0137] Compared to traditional defense methods based on distance or statistical characteristics, the method of this invention can maintain strong defense capabilities even in complex scenarios with a high proportion of malicious clients and highly non-independent and identically distributed data. It has significant advantages such as strong robustness, high security, and no sacrifice in privacy protection.

[0138] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0139] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A defense method against poisoning attacks using a federated learning model, characterized in that, This includes the following steps performed by the computer hardware system: For each model update uploaded by a client, a voting method based on K-means clustering is used; A consensus graph is constructed based on the voting records of each model update. The Louvain algorithm is applied to the consensus graph to perform community detection and divide the model update into multiple communities. Within each community, a cosine similarity-based filtering method is used to screen model updates; Each of the divided communities is aggregated to generate a representative community model update; In the early stages of training, community updates are evaluated based on key parameters. Once stable, historical information is used for prediction, and the highest evaluation is taken as the benign update for the current round to aggregate the new global model. Within each community, the method of filtering model updates using a cosine similarity-based filtering approach includes: For each community, calculate the average cosine similarity of each client model update within that community; Max-min normalize the average cosine similarity of each client model update in the community, and remove client model updates from the community whose normalized average cosine similarity is less than a preset threshold. The process of aggregating each of the divided communities to generate a representative community model update includes: For each community Aggregate model updates from all its internal clients to generate community model updates. ; The initial training phase evaluates community updates based on key parameters. Once stable, historical information is used for prediction, and the highest-rated update is selected as the benign update for the current round to aggregate a new global model. When training round t=1, for each community update Calculate the importance of its parameters to obtain the key parameters. Calculate the benign parameter reference set However, it does not update the global model; When training round t=2, calculate the Jaccard similarity between the key parameters updated by each community and the benign parameter reference set as its score, and select the community model update with the highest score as the global model update for this round. When training rounds When the previous round of global update is used as the benchmark, a comprehensive score based on Jaccard similarity, correlation coefficient and cosine similarity is used to evaluate the community update, and the community model update with the highest score is selected as the global model update for this round. When training rounds When the time comes, switch to a prediction method based on historical information to identify benign community updates, and select the community model update with the highest score as the global model update for this round.

2. The defense method against poisoning attacks using a federated learning model according to claim 1, characterized in that, The process of voting on model updates uploaded by each client using a K-means clustering-based method includes: For each client model update, calculate its distance from other client model updates; For each client model update, L-2 normalization is performed, and its directional features are calculated. Each client-side model update runs K-means independently to guide the voting.

3. The defense method against poisoning attacks using a federated learning model according to claim 2, characterized in that, The calculation of the distance between each client model update and other client model updates includes: The server received Client model update ; For each client model update Calculate its Euclidean distance to updates from other client models. .

4. The defense method against poisoning attacks using a federated learning model according to claim 3, characterized in that, The step of performing L-2 normalization on each client model update and calculating its directional features includes: For each client model update Calculate its directional characteristics .

5. The defense method against poisoning attacks using a federated learning model according to claim 4, characterized in that, Each client-side model update will independently run K-means to guide the voting process, including: Each model update Based on the obtained Euclidean distance, K cluster centers are initialized for the voting process. Use itself as the first initial center, and choose to... The K-1 client models with the furthest Euclidean distance are updated as the initial center points for the rest; After determining the cluster centers, the obtained directional features Clustering is performed using the data for clustering. The model update of each client is completed by voting on the model update that belongs to the same cluster; for a network with an L layer, L-fold voting is performed layer by layer.

6. The defense method against poisoning attacks using a federated learning model according to claim 1, characterized in that, A consensus graph is constructed based on the voting records of each model update. The Louvain algorithm is applied to the consensus graph to perform community detection, dividing the model updates into multiple communities, including: Construct a consensus graph based on the updated voting records of each client model. ;in, This represents the set of vertices in the consensus graph. Represents the set of edges in the consensus graph; The Louvain community detection algorithm is applied to the constructed consensus graph G to divide the model update into multiple communities.

7. A defense system against poisoning attacks using a federated learning model that implements the method of any one of claims 1-6, characterized in that, It includes the following components: The clustering voting module receives model updates uploaded by each client and uses a K-means clustering method to vote on each model update to generate voting records. The community detection module constructs a consensus graph based on the voting records generated by the clustering voting module, and applies the Louvain algorithm to perform community detection on the consensus graph, thereby adaptively dividing the model into multiple communities. The community cleaning module uses a cosine similarity-based filtering method within each community to screen model updates and remove outlier model updates within the community. The community update module is responsible for aggregating each cleaned community, merging the model updates from multiple clients within the community into a single, representative community model update. The key parameter analysis module selects the positive update of the current round by identifying the community model update that is most similar to the consensus key parameter set when there is no reliable historical information. The historical information prediction module uses the stable model evolution trajectory as reliable prior knowledge. By measuring the similarity with the historical benchmark, it accurately identifies the benign updates that are most consistent with the normal training process, thereby effectively resisting deviation attacks launched in the later stages of training.

Images