Federal learning control method and device, medium and computer program product
By combining multi-server multiplication secret sharing and clustering algorithms, the vulnerability of federated learning to backdoor attacks is solved, and the security of data transmission and the accuracy of model training are improved.
Patent Information
- Application Number
- CN202511339610.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-17
- Publication Date
- 2025-11-18
AI Technical Summary
Federated learning is vulnerable to backdoor attacks, and existing encrypted transmission methods have limited protection capabilities, making it difficult to effectively resist attacks.
Multiple servers receive secretly shared data from client devices, use an agreed-upon key for encrypted interaction, calculate local data through multiplication-based secret sharing, combine clustering algorithms for anomaly detection, remove abnormal data, and update global model parameters.
It significantly improves the security of data transmission and anomaly detection capabilities, enhances the ability of federated learning to resist backdoor attacks, and maintains the accuracy and efficiency of model training.
Smart Images
Figure CN120979656A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a federated learning control method, device, medium, and computer program product. Background Technology
[0002] Federated learning is a distributed machine learning paradigm that doesn't require data to leave the local client, offering some protection for data privacy. However, due to its distributed nature, federated learning is vulnerable to backdoor attacks. Attackers can tamper with the gradients or model parameters of one or more clients in the system, sending the modified data to the server for aggregation to implant a backdoor. Simply encrypting the data during transmission provides limited protection and is easily cracked.
[0003] How to improve the ability of federated learning to resist backdoor attacks is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention
[0004] This invention provides a federated learning control method, device, medium, and computer program product to at least solve the problem of poor backdoor attack resistance in related technologies.
[0005] This invention provides a federated learning control method applied to a server, comprising: Receive first secret shared data sent by multiple client devices; After encrypting the first secret shared data using the first key agreed upon with other servers, the system interacts with other servers to calculate the local first data. The first data is exchanged with other servers in a secret sharing manner to obtain the data to be detected. The global model parameters obtained from the previous round of iteration training are used as the cluster center. Anomaly detection is performed on the data to be detected. The cluster center is updated using the anomaly detection results. Anomaly detection is continued until the first iteration end condition is met. The first secret shared data that is classified as abnormal data is removed. Update the global model parameters using the remaining first secret shared data; The sum of the first data corresponding to multiple servers is equal to the product of the first secret shared data received by the multiple servers.
[0006] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described federated learning control methods when executing the computer program.
[0007] The present invention also provides a non-volatile storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described federated learning control methods.
[0008] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described federated learning control methods.
[0009] This invention employs multiple servers to receive first secret shared data sent by multiple client devices. Each server encrypts the first secret shared data using a first key agreed upon with other servers before interacting with them to calculate local first data. The sum of the first data received by multiple servers equals the product of the first secret shared data received by each server. This allows multiple servers to obtain the share of model update parameters for client devices using a multiplicative secret sharing method, significantly improving transmission security compared to traditional encryption or additive secret sharing schemes. Furthermore, multiple servers interact with their local first data using a secret sharing method to obtain data to be detected. An iterative method is used, with global model parameters as cluster centers, to perform anomaly detection on the data to be detected. The cluster centers are updated based on the anomaly detection results until the first iteration termination condition is met, thus eliminating abnormal client data. The remaining first secret shared data is then used to update the global model parameters. This significantly improves the ability of federated learning to resist backdoor attacks from both the data transmission and anomaly detection stages.
[0010] This invention also provides a method for achieving multiplication secret sharing through pre-generated information. Two servers use an asymmetric key and locally generated random numbers to interactively generate a first parameter, a second parameter, a third parameter, and a fourth parameter as the first key for the two servers. This enables data to be transmitted between the two servers using the first key in a multiplication secret sharing manner, thereby improving the security of communication between the servers.
[0011] This invention also provides a specific implementation method for detecting abnormal client data through clustering algorithms. Based on improving the security of federated learning by utilizing multiplicative secret sharing, it adopts a more computationally efficient clustering algorithm, thereby achieving a balance between the security and efficiency of federated learning.
[0012] The present invention also provides a method for generating noise based on the incremental model data of the client device to encrypt the share of model update parameters. While improving the security of federated learning by using multiplication secret sharing, the noise is controlled within a small range, thereby achieving both the security of federated learning and the accuracy of model training. Attached Figure Description
[0013] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0014] Figure 1 An architecture diagram of a federated learning control system provided in an embodiment of the present invention; Figure 2 A flowchart of a federated learning control method provided in an embodiment of the present invention. Detailed Implementation
[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.
[0016] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.
[0017] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0018] Figure 1 This is an architecture diagram of a federated learning control system provided in an embodiment of the present invention.
[0019] The specific application environment architecture or specific hardware architecture on which the execution of the federated learning control method depends is described here.
[0020] like Figure 1As shown, the federated learning control system provided in this embodiment of the invention may include multiple client devices (client device 1, client device 2, ...) and multiple servers (server 1, server 2, ...). The servers initialize global model parameters and provide them to the client devices. The client devices use their local datasets to train based on the global model parameters, obtaining model update parameters, and send these parameters to the servers to update the global model parameters until the federated learning iterative training termination condition is met. To defend against backdoor attacks, this embodiment of the invention provides a method for sending model update parameters using a multiplicative secret sharing approach. The client devices divide their local model update parameters into multiple parts and send them to multiple servers in a secure multi-party manner. Each server receives its first share of the secret sharing data (i.e., the share of the model update parameters) and interacts with other servers using secret sharing to obtain the data to be detected corresponding to the client device. A clustering algorithm is then used to detect anomalies in the data to be detected, identifying abnormal clients.
[0021] The embodiments of the present invention provide a federated learning control method. The method is described in detail below in conjunction with the execution flow of the federated learning control method.
[0022] Figure 2 A flowchart of a federated learning control method provided in an embodiment of the present invention.
[0023] like Figure 2 As shown, when applied to a server, the federated learning control method provided in this embodiment of the invention may include: S201: receiving first secret shared data sent by multiple client devices.
[0024] S202: After encrypting the first secret shared data using the first key agreed upon with other servers, interact with other servers to calculate the local first data.
[0025] S203: Use secret sharing to interact with other servers to obtain the data to be detected. Use the global model parameters obtained from the previous iteration training as the cluster center, perform anomaly detection on the data to be detected, update the cluster center using the anomaly detection results, and continue anomaly detection until the end condition of the first iteration is met, and remove the first secret shared data that is classified as anomaly data.
[0026] S204: Update global model parameters using the remaining first secret shared data.
[0027] In this case, the sum of the first data corresponding to multiple servers is equal to the product of the first secret shared data received by the multiple servers.
[0028] In some optional embodiments of the present invention, "applied to server" refers to being applied to... Figure 1 The server cluster shown refers to all servers in the cluster; in some alternative embodiments of the present invention, "applied to servers" means applied to Figure 1 This shows a portion of the servers in the server cluster.
[0029] In some optional embodiments of the present invention, the number of servers can be two.
[0030] For S201, one or more servers can initialize global model parameters and send them to each client device, allowing the client devices to train using both the global model parameters and their local datasets. Then, the client devices secretly share the updated model parameters they have trained with the multiple servers.
[0031] In this embodiment of the invention, the client device can split the model update parameters obtained locally in this round of iterative training into multiple parts according to the number of servers, and send them to each server respectively.
[0032] In this embodiment of the invention, to improve the security of data sent from the client device to the server, the client device can employ a differential privacy scheme to add noise to the data to be sent. Therefore, in this embodiment, the first secret shared data can be the result of the client device dividing the model update parameters obtained from the current iteration of training into multiple parts according to the number of servers, and adding noise to the model update parameters of the corresponding servers. Dividing the model update parameters into multiple parts can be achieved by splitting the model update parameters into the sum of several parts and sending each part to a different server.
[0033] In differential privacy schemes of related technologies, the client device adds noise based on the clipping boundary, resulting in excessive noise and significant loss of training accuracy in the noisy model. In this embodiment of the invention, noise can be added based on the client device's own model update parameters, thus obtaining less noise. Therefore, in this embodiment, the noise is determined based on the increment of the client device's model update parameters compared to the global model parameters obtained in the previous round.
[0034] In this embodiment of the invention, the client device determines the noise based on the increment of the model update parameters compared to the global model parameters obtained in the previous round, which can be calculated according to the following formula: ; in, The variance of the Gaussian noise; These are preset coefficients, which are related to system characteristics; This represents the parameter increment of the trimmed model; The modulus represents the increment of the model parameters after clipping; This refers to the number of global models on the client device. This refers to the number of client devices.
[0035] For S202 and S203, multiple servers use a secure multi-party computation technique based on secret sharing to process the received first secret-shared data in order to cluster the model update parameters of the client devices and remove the model update parameters that deviate too much.
[0036] For S204, the server uses the remaining model update parameters (determined based on the remaining first secret shared data) to update the global model parameters and complete this round of iterative training.
[0037] Repeat the above model parameter and aggregation process until the iteration termination condition of federated learning is met. To distinguish it from the iteration process of clustering, the iteration termination condition of federated learning is denoted as the second iteration termination condition. The second iteration termination condition can be reaching a preset number of training iterations or the model learning loss value meeting a preset loss requirement.
[0038] The federated learning control method provided in this invention employs multiple servers to receive first secret shared data sent by multiple client devices. Each server encrypts the first secret shared data using a first key agreed upon with other servers and interacts with them to calculate local first data. The sum of the first data received by multiple servers equals the product of the first secret shared data received by each server. This allows multiple servers to obtain the share of model update parameters for client devices using a multiplicative secret sharing method, significantly improving transmission security compared to traditional encryption or additive secret sharing schemes. Furthermore, multiple servers interact with their local first data using a secret sharing method to obtain data to be detected. An iterative method is used, with global model parameters as cluster centers, to perform anomaly detection on the data to be detected. The cluster centers are updated based on the anomaly detection results until the first iteration termination condition is met, thus eliminating abnormal client data. The remaining first secret shared data is then used to update the global model parameters. This significantly improves the ability of federated learning to resist backdoor attacks from both the data transmission and anomaly detection stages.
[0039] Based on the above embodiments, this invention introduces a secret sharing method.
[0040] Symbolic representation: express The least common multiple of, express The greatest common divisor, if say and Mutual elements. Represents a set . Represents a set Zhongyu A set of coprime elements. Read as mold ,express Divide by The remainder, express Divide by The remainders are the same. If ,express yes mold The multiplicative inverse is denoted as ,at this time Too mold The multiplicative inverse. If For sets ,definition functions on for Lowercase letters are generally used (e.g., ...). ) represents a scalar, and is used to represent a scalar. Vectors are represented in the form of uppercase letters (e.g., ...). () represents a matrix or dataset. The meaning of more symbols will be explained in detail when used.
[0041] Homomorphic encryption is a method frequently used in secure multi-party computation. The Paillier algorithm is an encryption method that satisfies additive homomorphism, and its contents are as follows: (1) Key generation: select two large prime numbers. ,make , They satisfy .choose Make it satisfy ,Will As a public key, As a private key.
[0042] (2) Encryption: for any Select random number The ciphertext is .
[0043] (3) Decryption: For any The plain text is .
[0044] This algorithm satisfies additive homomorphism.
[0045] Note that in the above decryption algorithm, dividing by It means multiplying it by the modulus. The reverse in meaning.
[0046] Regarding extending this algorithm to the integer range, select sufficiently large integers. This ensures that the absolute value of the sum of the data will not exceed [a certain value]. Next, add a '+' to the data that is less than 0. Convert all data into natural numbers and encrypt them directly using the Paillier algorithm described above. After decryption using the Paillier algorithm, if the data is greater than... Subtract it If the data is less than If the result is not obtained, no further processing is needed, and the final decryption result can be obtained. Based on the additive homomorphism of the Paillier algorithm, it is easy to verify that the algorithm generalized to the integer range still satisfies the additive homomorphism.
[0047] use and This represents encryption and decryption algorithms generalized to the integer range. It can be obtained if... and Therefore, there are .
[0048] Additionally, it can be verified that... ,and If it is an integer, then .
[0049] Secret sharing is an important technique in secure multi-party computation. Due to its relative simplicity, it is widely used in the field of privacy protection. This invention primarily utilizes two-party addition secret sharing and two-party multiplication secret sharing techniques.
[0050] In the secret sharing of addition between the two parties, the participating parties are recorded. Having data Participants Having data The following process can be used to achieve secret sharing in addition: Participating parties Generate random numbers And calculate Then Send to participants Participants Generate random numbers And calculate Then Send to participants Participants Calculated The second server calculated .
[0051] At this point, we need to calculate... and The sum, just need to and The data is aggregated to the demand side, where the demand side calculates... That's it. It can be seen that no data was leaked during this process. and This effectively protects data privacy.
[0052] In this embodiment of the invention, if there are two servers, the first secret shared data is exchanged between the two servers using a multiplicative secret sharing method to further improve data security.
[0053] In this embodiment of the invention, the server includes a first server and a second server. The first key held by the first server includes a first parameter and a third parameter, and the first key held by the second server includes a second parameter and a fourth parameter. The sum of the first parameter and the second parameter is equal to the product of the third parameter and the fourth parameter.
[0054] In this embodiment of the invention, S202, after encrypting the first secret shared data using a first key agreed upon with other servers and interacting with other servers to calculate the local first data, may include: the first server calculating the local first secret shared data minus a first parameter to obtain a first intermediate result, and sending the first intermediate result to the second server; the second server calculating the local first secret shared data minus a second parameter to obtain a second intermediate result, and sending the second intermediate result to the first server; the first server calculating the product of the first parameter and the second intermediate result and adding it to a third parameter to obtain the local first data; and the second server calculating the product of the local first secret shared data and the first intermediate result and adding it to a fourth parameter to obtain the local first data.
[0055] Common multiplication secret sharing techniques require a lot of interaction between users. This invention provides a method for pre-generating information to improve the efficiency of multiplication secret sharing.
[0056] In this embodiment of the invention, the step of generating the first key may include: a first server generating a set of asymmetric keys and sending the first public key of the asymmetric keys to a second server; the first server encrypting a first random value using the first private key of the asymmetric keys to obtain a first encryption result, and sending the first encryption result to the second server; the second server encrypting a second random value using the first public key to obtain a second encryption result, and calculating a third encryption result based on the first encryption result, the third random value, and the second encryption result, and sending the third encryption result to the first server; the first server decrypting the third encryption result using the first private key to obtain a fourth random value; the first server obtaining a fifth random value agreed upon with the second server, calculating a first parameter based on the fifth random value and the first random value, and calculating a third parameter based on the fifth random value and the fourth random value; the second server calculating a second parameter based on the fifth random value and the third random value, and calculating a fourth parameter based on the fifth random value and the second random value.
[0057] In this embodiment of the invention, the first server is assumed to possess the first secret shared data. The second server possesses the second secret shared data. After multiplication and secret sharing, it is necessary to ensure that the first server possesses the first data. The second server possesses the first data. And they satisfy The specific implementation steps may include: pre-generating an array. ,in, As the first parameter, For the second parameter, As the third parameter, As the fourth parameter, satisfying The first server has The second server has Using pre-generated arrays accomplish The secret sharing.
[0058] During the pre-generation of the array, the first server can establish an asymmetric key and send the public key (denoted as the first public key) to the second server.
[0059] In this embodiment of the invention, the first server can use the Paillier algorithm to establish an asymmetric key. and the public key Send to the second server. The key contains... If it is large enough, for example, has 1024 bits, then in general the result of data operation will be in a certain range. Within the range.
[0060] The first server selects a random integer. Let be the first random value, and encrypt it using the private key (denoted as the first private key) in the asymmetric key to obtain the result. And send it to the second server.
[0061] The second server selects a random integer. and ,remember The second random value, For the third random value, then... Encryption yields a second encryption result Then, the third encryption result is calculated. And send it to the first server.
[0062] The first server encrypts the third result. Decryption .
[0063] The first and second servers agree on a random decimal number. Let this be the fifth random value. Then, the first server can calculate the first and third parameters using the following formula: ; .
[0064] The second server can calculate the second and fourth parameters using the following formula: ; .
[0065] Through the above steps, the first server holds the first parameter. and the third parameter The second server holds the second parameter as the first key locally. and the fourth parameter As the primary key in the local system.
[0066] Therefore, the two servers can use a locally held first key to achieve secret sharing of the first secret shared data locally. Specifically, this may include: the first server calculating a first intermediate result. It is then sent to the second server, which calculates the second intermediate result. And send it to the first server. The first server calculates and obtains the first data locally. The second server calculates the first data locally. .
[0067] Based on the above embodiments, in this embodiment of the invention, in S203, the interaction of first data with other servers in the form of secret sharing to obtain the data to be detected may include: calculating a local fourth encryption result based on the local first secret sharing data and the local first data, and sending the fourth encryption result to other servers; calculating the model parameter features corresponding to the client device based on the local fourth encryption result and the fourth encryption results sent by other servers; and calculating the local data to be detected based on the model parameter features and the local first secret sharing data.
[0068] In this embodiment of the invention, multiple servers use a secret sharing method to calculate the model parameter features of the model update parameters of each client device, so as to calculate the local data to be detected based on the model parameter features and the local first secret shared data.
[0069] Multiple servers can calculate the local first data according to the multiplication secret sharing method described in the above embodiments.
[0070] In this embodiment of the invention, calculating the local fourth encryption result based on the local first secret shared data and the local first data may include: for a client device, calculating the sum of the first calculation results corresponding to multiple pieces of the first secret shared data corresponding to the client device to obtain the local fourth encryption result; wherein, the first calculation result is the sum of twice the first data corresponding to the first secret shared data and the square of the first secret shared data.
[0071] Based on the local fourth encryption result and the fourth encryption result sent by other servers, the model parameter features corresponding to the client device are calculated. This may include: for a given client device, taking the square root of the sum of the local fourth encryption result and the fourth encryption result sent by other servers to obtain the model parameter features corresponding to the client device.
[0072] The data to be detected is calculated based on the model parameter features and the local first secret shared data. This can include: for a client device, multiplying the local first secret shared data by the number of first secret shared data entries and dividing by the model parameter features to obtain the local data to be detected.
[0073] Based on the above embodiments, in this embodiment of the invention, S203 uses the global model parameters obtained from the previous iteration training as cluster centers, performs anomaly detection on the data to be detected, updates the cluster centers using the anomaly detection results, and continues anomaly detection until the first iteration end condition is met. This includes: using the global model parameters obtained from the previous iteration training as cluster centers, calculating a first distance between the client device's model update parameters and the cluster centers based on the local data to be detected and the data to be detected sent by other servers; calculating a penalty value based on the first distance and the anomaly detection results from the previous round of anomaly detection; identifying abnormal clients based on the first distance and the penalty value; sending the abnormal client information to other servers to remove the first secret shared data corresponding to the abnormal client from the other servers, and then updating the cluster centers using the remaining first secret shared data; calculating a clustering target value based on the abnormal client information, the first distances corresponding to multiple client devices, and the penalty value; if the clustering target value meets the first iteration end condition, ending the anomaly detection; if the clustering target value does not meet the first iteration end condition, then using the updated cluster centers to proceed to the step of calculating the first distance between the client device's model update parameters and the cluster centers.
[0074] In this embodiment of the invention, the data to be detected can be the result of scaling the first secret shared data using the modulus of the first secret shared data; then, based on the local data to be detected and the data to be detected sent by other servers, calculating the first distance between the model update parameters of the client device and the cluster center can include: accumulating the products of the data to be detected corresponding to multiple pieces of the first secret shared data corresponding to the client device and the corresponding cluster center to obtain the first distance parameter; calculating the sum of the local first distance parameter and the first distance parameter sent by other servers, dividing it by the number of pieces of the first secret shared data and the modulus of the cluster center to obtain the first ratio; and calculating 1 minus the first ratio to obtain the first distance.
[0075] Identifying abnormal clients based on the first distance and the penalty value may include: obtaining an abnormal number threshold; arranging the first distances corresponding to client devices in descending order; if among the first abnormal number threshold client devices in the arrangement, there is a client device with a first distance greater than the penalty value, then the client device is determined to be an abnormal client.
[0076] Sending information about abnormal clients to other servers, and then using the remaining first secret shared data to update the cluster centers after removing the first secret shared data corresponding to the abnormal clients from the other servers, can include: calculating second secret shared data based on the remaining first secret shared data locally, and sending the second secret shared data to other servers; and calculating the updated cluster centers based on the local second secret shared data and the second secret shared data sent by other servers.
[0077] Based on the above embodiments, taking two servers as an example, the specific implementation of the federated learning control method provided by the present invention will be introduced.
[0078] Select two servers that will not collude with each other (denoted as...). and ), (Note: There are a total of ) in the Federated Learning System Each client device has local training data, and the number of malicious clients will not exceed [number missing]. .
[0079] Then it can be done by the server Establish global model parameters (in yes (dimensional vector), and send it to One client device (and server) ).
[0080] Client devices Using local data, Train the model using the initial values to obtain local model update parameters. Then the client device Split the data into two parts and sum Next, respectively Secretly sent to the server and The method of secret transmission can choose encryption algorithms such as Advanced Encryption Standard (AES) and Triple Data Encryption Algorithm (3DES). Assuming... as well as .
[0081] Then, the server and The model update parameters for each client device are calculated using a secret sharing technique, and the model update parameters for all client devices are scaled to a modulus of the same size (e.g., the size of the modulus is set equal to the dimension of the model update parameters). ). (with the first) Taking the model update parameters of a client device as an example, they can specifically include:
[0082] server and Using the above-mentioned multiplication secret sharing calculation That is to say, and Each as a part of the above-mentioned multiplication secret sharing and ,server and The first data obtained and Corresponding to and .
[0083] In this embodiment of the invention, the security of federated learning is improved by employing secure multi-party and secret sharing methods, effectively reducing tampering during data transmission from client devices to the server. In this case, a clustering algorithm with only one normal data class and one abnormal data class can be selected to simplify clustering calculations. Specifically, before clustering, the model update parameters are scaled to a modulus of the same size to serve as the data to be detected, facilitating the calculation of cluster centers during clustering. The cosine distance can be used to represent the first distance between the client device's data to be detected and the cluster center. Therefore, the clustering objective value can be expressed as: ; Limited by ; in, It is a size of The matrix whose elements Either satisfy That is, the first These points are normal points; or they satisfy... That is, the first These points are outliers. It is the cluster center. Representing data points with cluster center The cosine distance between them. In this embodiment of the invention, it can be taken as... It limits the maximum number of outliers.
[0084] The penalty value for clustering can be expressed as: ; in, It is a parameter (which can be taken as...) ), it and Together, we control the number of outliers. The rule for judging outliers is: if a data point... Cluster center Cosine distance between Belongs to the largest one, and If so, then that point is set as an outlier.
[0085] Based on this, the server Calculate the first calculation result and send to the server .server Calculate the first calculation result and send .
[0086] server and server The modulus of the model update parameters was calculated respectively. As the first Model feature parameters for each client device.
[0087] server and server The local first secret shared data is scaled to obtain the scaled secret shared values of the model update parameters. and ,but For server The data to be detected For server The data to be detected. Assuming the obtained... and .
[0088] Note that this step requires preserving the original client device's model update parameters and the first secret shared data.
[0089] server and server Implement secure multi-party computation based on secret sharing to achieve the [missing information]. One client device Clustering the data to be detected to remove data from abnormal clients can specifically include: Update parameters of the global model As a cluster center ,set up .
[0090] Set the initial values of the membership matrix. ,in .
[0091] Calculate the cosine distance between the updated model parameters of each client device and the cluster centers. (The last part is incomplete and likely refers to a different context.) Taking the parameter update of a client device model as an example, the specific parameters include: server The first distance parameter is calculated locally. ,server The first distance parameter is calculated locally. and send to the server .
[0092] server Calculation yields the first The first distance between the model update parameters of each client device and the cluster center The cosine distance can be used, expressed as: .
[0093] server calculate Then take The largest Individual and Comparison. If... At the largest Within, and Then set That is, set this point as an outlier, otherwise set... And will The value is sent to the server .
[0094] server Updating cluster centers can include: servers Calculate the secret shared value of cluster centers And send to the server ,server calculate And send to the server .server ,server The updated cluster centers were obtained respectively. .
[0095] server Calculate the target value .
[0096] At this point, the termination condition for the first iteration can be two. If the absolute value of the difference is less than a given threshold, and the first iteration termination condition is met, then clustering is stopped; otherwise, the steps described above for calculating the first distance between the model update parameters corresponding to the client device and the cluster centers are returned with the updated cluster centers.
[0097] use This represents the clustering process described above. It is the client device model index required after clustering.
[0098] Then, the server calculates the pruning bound of the model update parameter increments and prunes the model update parameters, which may include: server ,server The secret shared value of the model update parameter increment for each client device is calculated. and With the first Taking the parameter increment of a model update as an example, the server calculate ,server calculate .
[0099] server ,server The modulus of the parameter update increment for each client device model is calculated. With the first Taking the incremental update of model parameters as an example, the method described above, where the server uses a multiplication secret sharing method to calculate the local first data and obtain the modulus of the model update parameters, can be used. and As in the above process and The result obtained is (corresponding to the process above) ).
[0100] server ,server Set cropping boundaries .in It means to take of the median.
[0101] server ,server The remaining first secret shared data from the clustering is pruned to obtain the secret shared values of the model update parameters after pruning. and ,in .
[0102] server ,server Aggregating the locally cropped first secret shared data and adding adaptive noise may include: if the model updates the parameter increment of the model... ,set up ,in .
[0103] server ,server The secret shared values of the parameters for the next round of global model update are obtained by aggregating and adding noise separately. and .in, This indicates that the mean is 0 and the variance is... Gaussian distribution, and ,as well as , These are differential privacy parameters. They are useful for image classification tasks, network intrusion detection systems, and natural language processing tasks. The reference values are 3705, 395 and 4196 respectively, and the corresponding values are... The reference values can be 0.001, 0.01, and 0.001.
[0104] server Send the secret shared value of the new round of global model update parameters to the server. By server The parameters for the next round of global model updates are calculated and sent to each client device (and the server). ).server Will Send to server After that, the server The parameters for the new round of global model update are calculated. Then Send to each client device (and server) The second iteration of federated learning can be terminated when a preset number of training iterations is reached. If the current iteration meets the second iteration termination condition, training stops, and the global model update parameters are output. Otherwise, return the steps for the client device to train using the received global model parameters and the local dataset.
[0105] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.
[0106] Embodiments of the present invention also provide a federated learning control device applied to a server, which may include: a receiving unit for receiving first secret shared data sent by multiple client devices; a detection unit for encrypting the first secret shared data using a first key agreed upon with other servers and interacting with other servers to calculate local first data; interacting with other servers using the first data in a secret sharing manner to obtain data to be detected, using the global model parameters obtained from the previous iteration training as cluster centers, performing anomaly detection on the data to be detected, updating the cluster centers using the anomaly detection results, continuing anomaly detection until the first iteration termination condition is met, and removing the first secret shared data classified as anomaly data; and an updating unit for updating the global model parameters using the remaining first secret shared data; wherein the sum of the first data corresponding to multiple servers is equal to the product of the first secret shared data received by multiple servers.
[0107] In this embodiment of the invention, the server may include a first server and a second server. The first key held by the first server includes a first parameter and a third parameter, and the first key held by the second server includes a second parameter and a fourth parameter. The sum of the first parameter and the second parameter is equal to the product of the third parameter and the fourth parameter. The detection unit uses the first key agreed upon with other servers to encrypt the first secret shared data and then interacts with other servers to calculate the local first data. This may include: the first server calculating the local first secret shared data minus the first parameter to obtain a first intermediate result, and sending the first intermediate result to the second server; the second server calculating the local first secret shared data minus the second parameter to obtain a second intermediate result, and sending the second intermediate result to the first server; the first server calculating the product of the first parameter and the second intermediate result and adding it to the third parameter to obtain the local first data; and the second server calculating the product of the local first secret shared data and the first intermediate result and adding it to the fourth parameter to obtain the local first data.
[0108] In this embodiment of the invention, the step of generating the first key may include: a first server generating a set of asymmetric keys and sending the first public key of the asymmetric keys to a second server; the first server encrypting a first random value using the first private key of the asymmetric keys to obtain a first encryption result, and sending the first encryption result to the second server; the second server encrypting a second random value using the first public key to obtain a second encryption result, and calculating a third encryption result based on the first encryption result, the third random value, and the second encryption result, and sending the third encryption result to the first server; the first server decrypting the third encryption result using the first private key to obtain a fourth random value; the first server obtaining a fifth random value agreed upon with the second server, calculating a first parameter based on the fifth random value and the first random value, and calculating a third parameter based on the fifth random value and the fourth random value; the second server calculating a second parameter based on the fifth random value and the third random value, and calculating a fourth parameter based on the fifth random value and the second random value.
[0109] In this embodiment of the invention, the detection unit interacts with other servers using a secret sharing method to obtain the data to be detected. This may include: calculating a local fourth encryption result based on the local first secret sharing data and the local first data, and sending the fourth encryption result to other servers; calculating the model parameter features corresponding to the client device based on the local fourth encryption result and the fourth encryption results sent by other servers; and calculating the local data to be detected based on the model parameter features and the local first secret sharing data.
[0110] In this embodiment of the invention, the detection unit calculates a local fourth encryption result based on the local first secret shared data and the local first data. This may include: for a client device, calculating the sum of the first calculation results corresponding to multiple pieces of the first secret shared data corresponding to the client device to obtain the local fourth encryption result; wherein, the first calculation result is the sum of twice the first data corresponding to the first secret shared data and the square of the first secret shared data.
[0111] In this embodiment of the invention, the detection unit calculates the model parameter features corresponding to the client device based on the local fourth encryption result and the fourth encryption results sent by other servers. This may include: for a client device, performing a square root operation on the sum of the local fourth encryption result and the fourth encryption results sent by other servers to obtain the model parameter features corresponding to the client device.
[0112] In this embodiment of the invention, the detection unit calculates the data to be detected based on the model parameter features and the local first secret shared data, which may include: for a client device, multiplying the local first secret shared data by the number of first secret shared data entries and dividing by the model parameter features to obtain the local data to be detected.
[0113] In this embodiment of the invention, the detection unit uses the global model parameters obtained from the previous iteration training as cluster centers, performs anomaly detection on the data to be detected, updates the cluster centers using the anomaly detection results, and continues anomaly detection until the first iteration termination condition is met. This process may include: using the global model parameters obtained from the previous iteration training as cluster centers, calculating a first distance between the client device's model update parameters and the cluster centers based on the local data to be detected and the data to be detected sent by other servers; calculating a penalty value based on the first distance and the anomaly detection results from the previous round; identifying abnormal clients based on the first distance and the penalty value; sending the abnormal client information to other servers to remove the first secret shared data corresponding to the abnormal client from the other servers, and then updating the cluster centers using the remaining first secret shared data; calculating a clustering target value based on the abnormal client information, the first distances corresponding to multiple client devices, and the penalty value; ending anomaly detection if the clustering target value meets the first iteration termination condition; and resuming the step of calculating the first distance between the client device's model update parameters and the cluster centers using the updated cluster centers if the clustering target value does not meet the first iteration termination condition.
[0114] In this embodiment of the invention, the data to be detected can be the result of scaling the first secret shared data using the modulus of the first secret shared data; the detection unit calculates the first distance between the model update parameters of the client device and the cluster center based on the local data to be detected and the data to be detected sent by other servers, which may include: accumulating the products of the data to be detected corresponding to multiple model update parameters of the client device and the corresponding cluster centers to obtain the first distance parameter; calculating the sum of the local first distance parameter and the first distance parameter sent by other servers and dividing it by the number of first secret shared data and the modulus of the cluster centers to obtain the first ratio; calculating 1 minus the first ratio to obtain the first distance.
[0115] In this embodiment of the invention, the detection unit determines the abnormal client based on the first distance and the penalty value, which may include: obtaining an abnormal number threshold; arranging the first distances corresponding to the client devices in descending order; if there is a client device with a first distance greater than the penalty value among the first abnormal number threshold client devices in the arrangement, then the client device is determined to be an abnormal client.
[0116] In this embodiment of the invention, the detection unit sends the information of the abnormal client to other servers so that after the first secret shared data corresponding to the abnormal client is removed by other servers, the cluster center is updated using the remaining first secret shared data. This may include: calculating the second secret shared data based on the remaining first secret shared data locally and sending the second secret shared data to other servers; calculating the updated cluster center based on the local second secret shared data and the second secret shared data sent by other servers.
[0117] In this embodiment of the invention, the first secret shared data can be the result of the client device dividing the model update parameters obtained in the current iteration of training into multiple parts according to the number of servers, and adding noise to the model update parameters of the corresponding servers; the noise can be determined based on the increment of the client device's model update parameters compared to the global model parameters obtained in the previous round.
[0118] For a description of the features in the embodiment corresponding to the federated learning control device, please refer to the relevant description of the embodiment corresponding to the federated learning control method, which will not be repeated here.
[0119] Embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the federated learning control method.
[0120] Embodiments of the present invention also provide a non-volatile storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described embodiments of the federated learning control method at runtime.
[0121] In one exemplary embodiment, the aforementioned non-volatile storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.
[0122] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described embodiments of the federated learning control method.
[0123] Embodiments of the present invention also provide another computer program product, including a non-volatile storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described embodiments of the federated learning control method.
[0124] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0125] The foregoing has provided a detailed description of the federated learning control method, device, medium, and computer program product provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only intended to aid in understanding the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of this invention.
Claims
1. A federated learning control method, characterized in that, Applied to servers, including: Receive first secret shared data sent by multiple client devices; After encrypting the first secret shared data using the first key agreed upon with other servers, the system interacts with other servers to calculate the local first data. The first data is exchanged with other servers in a secret sharing manner to obtain the data to be detected. The global model parameters obtained from the previous round of iteration training are used as the cluster center. Anomaly detection is performed on the data to be detected. The cluster center is updated using the anomaly detection results. Anomaly detection is continued until the first iteration end condition is met. The first secret shared data that is classified as abnormal data is removed. Update the global model parameters using the remaining first secret shared data; The sum of the first data corresponding to multiple servers is equal to the product of the first secret shared data received by the multiple servers.
2. The federated learning control method according to claim 1, characterized in that, The server includes a first server and a second server. The first key held by the first server includes a first parameter and a third parameter. The first key held by the second server includes a second parameter and a fourth parameter. The sum of the first parameter and the second parameter is equal to the product of the third parameter and the fourth parameter. After encrypting the first secret-shared data using a first key agreed upon with other servers, the system interacts with other servers to calculate and obtain local first data, including: The first server calculates the first secret shared data locally and subtracts the first parameter to obtain a first intermediate result, and sends the first intermediate result to the second server; The second server calculates the first secret shared data locally and subtracts the second parameter to obtain a second intermediate result, and then sends the second intermediate result to the first server; The first server calculates the product of the first parameter and the second intermediate result and adds it to the third parameter to obtain the local first data; The second server calculates the product of the first secret shared data and the first intermediate result locally and adds it to the fourth parameter to obtain the first data locally.
3. The federated learning control method according to claim 2, characterized in that, The steps for generating the first key include: The first server generates a set of asymmetric keys and sends the first public key of the asymmetric keys to the second server; The first server uses the first private key in the asymmetric key to encrypt the first random value, obtains the first encryption result, and sends the first encryption result to the second server; The second server uses the first public key to encrypt the second random value to obtain a second encryption result, and calculates a third encryption result based on the first encryption result, the third random value, and the second encryption result, and sends the third encryption result to the first server. The first server uses the first private key to decrypt the third encryption result to obtain a fourth random value; The first server obtains a fifth random value agreed upon with the second server, calculates the first parameter based on the fifth random value and the first random value, and calculates the third parameter based on the fifth random value and the fourth random value; The second server calculates the second parameter based on the fifth random value and the third random value, and calculates the fourth parameter based on the fifth random value and the second random value.
4. The federated learning control method according to claim 1, characterized in that, The first data is exchanged with other servers using a secret sharing method to obtain the data to be detected, including: Based on the first secret shared data and the first data in the local area, calculate the fourth encryption result in the local area, and send the fourth encryption result to other servers; Based on the local fourth encryption result and the fourth encryption result sent by other servers, the model parameter features corresponding to the client device are calculated. The local data to be detected is calculated based on the model parameter features and the local first secret shared data.
5. The federated learning control method according to claim 4, characterized in that, Based on the first secret-shared data and the first data locally, a fourth encryption result is calculated locally, including: For each client device, the sum of the first calculation results corresponding to multiple first secret shared data corresponding to the client device is calculated to obtain the local fourth encryption result; Wherein, the first calculation result is the sum of twice the first data corresponding to the first secret shared data and the square of the first secret shared data.
6. The federated learning control method according to claim 5, characterized in that, Based on the local fourth encryption result and the fourth encryption results sent by other servers, the model parameter features corresponding to the client device are calculated, including: For each client device, the sum of the local fourth encryption result and the fourth encryption results from other servers is taken as the square root to obtain the model parameter features corresponding to the client device.
7. The federated learning control method according to claim 6, characterized in that, The data to be detected is calculated based on the model parameter features and the first secret shared data locally, including: For each client device, the local first secret shared data is calculated by multiplying the number of first secret shared data entries by the model parameter features to obtain the local data to be detected.
8. The federated learning control method according to claim 1, characterized in that, Using the global model parameters obtained from the previous iteration as cluster centers, anomaly detection is performed on the data to be detected. The cluster centers are updated using the anomaly detection results. Anomaly detection continues until the first iteration termination condition is met, including: The global model parameters obtained from the previous round of iterative training are used as the cluster center. Based on the local data to be detected and the data to be detected sent by other servers, the first distance between the model update parameters of the client device and the cluster center is calculated. The penalty value is calculated based on the first distance and the anomaly detection results of the previous round of anomaly detection; Based on the first distance and the penalty value, an abnormal client is identified; The information of the abnormal client is sent to other servers so that the first secret shared data corresponding to the abnormal client can be removed by other servers, and the cluster center can be updated using the remaining first secret shared data. Based on the information of the abnormal client, the first distance corresponding to the multiple client devices, and the penalty value, calculate the clustering target value; If the clustering target value satisfies the first iteration termination condition, then the anomaly detection ends; If the clustering target value does not meet the first iteration termination condition, then the updated cluster center is used to proceed to the step of calculating the first distance between the model update parameters of the client device and the cluster center.
9. The federated learning control method according to claim 8, characterized in that, The data to be detected is the result of scaling the first secret shared data using the modulus of the first secret shared data; Based on the local data to be detected and the data to be detected sent by other servers, calculate the first distance between the model update parameters of the client device and the cluster center, including: The first distance parameter is obtained by summing the products of the data to be detected corresponding to the multiple model update parameters corresponding to the client device and the corresponding cluster centers. The sum of the first distance parameter locally and the first distance parameter sent by other servers is divided by the number of the first secret shared data entries and the modulus of the cluster center to obtain the first ratio. Calculate 1 and subtract the first ratio to obtain the first distance.
10. The federated learning control method according to claim 8, characterized in that, Based on the first distance and the penalty value, abnormal clients are identified, including: Get the threshold for the number of anomalies; Arrange the client devices corresponding to the first distance in descending order. If there is a client device whose first distance is greater than the penalty value among the first abnormal number threshold client devices in the arrangement, then the client device is determined to be the abnormal client.
11. The federated learning control method according to claim 8, characterized in that, Sending the information of the abnormal client to other servers, and after removing the first secret shared data corresponding to the abnormal client from the other servers, updating the cluster center using the remaining first secret shared data, includes: The second secret shared data is calculated based on the remaining first secret shared data locally, and the second secret shared data is sent to other servers; The updated cluster centers are calculated based on the second secret shared data locally and the second secret shared data sent by other servers.
12. The federated learning control method according to claim 1, characterized in that, The first secret shared data is the result of the client device dividing the model update parameters obtained in this round of iterative training into multiple parts according to the number of servers, and adding noise to the model update parameters of the corresponding servers; The noise is determined based on the increment of the model update parameters of the client device compared to the global model parameters obtained in the previous round.
13. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for implementing the steps of the federated learning control method as described in any one of claims 1 to 12 when executing the computer program.
14. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the federated learning control method as described in any one of claims 1 to 12.
15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the federated learning control method as described in any one of claims 1 to 12.