Privacy and robust federated learning method and system based on dimension screening
By employing a federated learning approach that incorporates gradient pruning, noise addition, and dimension filtering, the issues of privacy protection and Byzantine attacks in federated learning are addressed, thereby improving model accuracy and communication efficiency.
Patent Information
- Application Number
- CN202510998466.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-21
- Publication Date
- 2025-11-18
AI Technical Summary
Existing federated learning methods suffer from low accuracy, high communication overhead, and slow model convergence when protecting data privacy and resisting Byzantine attacks, and lack systematic solutions.
By employing gradient pruning and noise addition, combined with dimensionality filtering and similarity detection, trusted clients are selected for model aggregation, achieving differential privacy and robustness while optimizing communication overhead.
This approach achieves improved model accuracy and robustness, reduced communication costs, and increased training efficiency while protecting user data privacy.
Smart Images
Figure CN120979693A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of federated learning technology, and in particular to a privacy-preserving and robust federated learning method and system based on dimensional filtering. Background Technology
[0002] In recent years, Federated Learning (FL), as a novel distributed machine learning framework, has gradually attracted widespread attention from academia and industry. Unlike traditional centralized machine learning methods, federated learning allows data to remain local to the client, training a global model collaboratively across multiple clients, thus avoiding the privacy risks associated with data centralization. This technology is widely used in finance, healthcare, and the Internet of Things (IoT), demonstrating enormous potential, especially in scenarios with extremely high data privacy and security requirements.
[0003] Despite the significant achievements of federated learning in protecting data privacy, its practical application still faces two major challenges:
[0004] 1. Differential privacy (DP), as a theoretical privacy protection framework, has been widely applied in federated learning to protect user data from external inference attacks. However, directly introducing differential privacy into federated learning is not easy. The main challenge lies in the interaction between aggregation rules and noise, leading to a decrease in accuracy. Common algorithms include DP-FedAvg, DP-FedNova, DP-FedAdam, and DP-SGD. These algorithms aim to protect against noise added to client gradients during local updates or aggregation results, as this noise can negatively impact model accuracy.
[0005] 2. Robust Aggregation / Byzantine Defense: If a Byzantine client is involved in the aggregation process, defending against Byzantine attacks often requires using aggregation methods resistant to Byzantine clients, such as Krum, Median, Trimmed Mean, and Bulyan. When using differential privacy mechanisms and robust aggregation methods simultaneously, noise can make it difficult for aggregation rules to identify genuine malicious updates. Balancing accuracy and robustness at the central server aggregation end is a significant challenge. To address these issues, researchers have proposed federated learning algorithms such as Brave, BVDFed, and TernaryVote, which combine differential privacy and Byzantine robustness. However, these methods currently perform poorly when client training data is not independently and identically distributed (e.g., slow model convergence and low accuracy). Current solutions often address either privacy protection or Byzantine robustness individually, lacking a systematic framework that simultaneously solves both problems. Furthermore, performance optimization of existing methods in terms of communication overhead and model convergence efficiency still requires further improvement. Summary of the Invention
[0006] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide a privacy-preserving and robust federated learning method and system based on dimensional filtering.
[0007] To achieve the above objectives, the present invention provides the following solution:
[0008] A privacy-preserving and robust federated learning method based on dimensionality filtering includes:
[0009] Step 1: Extract the gradients corresponding to the current model parameters from the clients participating in federated learning;
[0010] Step 2: Trim and add noise to the gradient to obtain a gradient with added noise;
[0011] Step 3: Update the model parameters using the gradient with added noise and obtain the accumulated gradient;
[0012] Step 4: Filter the accumulated gradients by dimension and upload the filtered gradients to the central server;
[0013] Step 5: Calculate the similarity between the uploaded gradient distribution and the standard normal distribution;
[0014] Step 6: Filter out trustworthy clients based on similarity;
[0015] Step 7: Aggregate the model parameters of trusted clients to obtain global model parameters;
[0016] Step 8: Update the global model using global model parameters until the global model training is complete.
[0017] Preferably, step 2: trimming and adding noise to the gradient to obtain a noise-added gradient includes:
[0018] The gradient is clipped by applying norm clipping; the clipped gradient is:
[0019]
[0020] in, Let C be the gradient after clipping, and C be the clipping threshold. This is the original gradient;
[0021] Gaussian noise is added to the clipped gradient to obtain the noise-added gradient; where the noise-added gradient is:
[0022]
[0023] in, Let I be Gaussian noise, and let I be the identity matrix. σ dp ε is the standard deviation of Gaussian noise, ε is the differential privacy budget, q is the client sampling ratio per round, and T is the standard deviation of Gaussian noise. train δ is the total number of training rounds, and δ is the privacy parameter.
[0024] Preferably, step 3: updating the model parameters using the gradient with added noise and obtaining the accumulated gradient includes:
[0025] Formula used:
[0026]
[0027] Obtain the accumulated gradient; where, It is the cumulative gradient of the current round. It is the cumulative gradient of the previous round, and α is the momentum coefficient.
[0028] Preferably, step 4: performing dimensional filtering on the accumulated gradients and uploading the filtered gradients to the central server includes:
[0029] When d > 8000, an exponential mechanism is used for selection, and the probability of the k-th dimension being selected is:
[0030]
[0031] Where, ∈ sel It is a local privacy budget for dimensional filtering. Let d be the gradient value of the i-th client in the j-th dimension during the t-th round of training. Dimensions is the gradient value of the i-th client in the k-th dimension during the t-th round of training;
[0032] When d ≤ 1000, the perturbation coding mechanism is used for screening, and the probability that the k-th dimension is selected is:
[0033]
[0034]
[0035] where u k is the noise term of uniform distribution perturbation, m is the intensity of the uniform distribution perturbation noise term, ξ k is the noise term of Gaussian distribution, is the original gradient value of the i-th client in the k-th dimension during the t-th round of training, is the gradient value after perturbation of the k-th dimension, ∈ is the perturbation coefficient, is the gradient value after perturbation of the j-th dimension;
[0036] When 1000 < d ≤ 8000, the perturbation sampling mechanism is selected for screening, and the probability that the k-th dimension is selected is:
[0037]
[0038] where Δ k is the uniform perturbation term in the perturbation sampling mechanism, and Δ j is the parameter that controls the noise amplitude in the perturbation sampling mechanism.
[0039] Preferably, step 5: calculating the similarity between the uploaded gradient distribution and the standard normal distribution includes:
[0040] Using the KS test to evaluate the similarity between the gradient distribution uploaded by each client and the standard normal distribution;
[0041] D i = sup z |F i (z) - F0(z)|, S i = 1 - D i
[0042] where F i (z) is the empirical distribution, F_0(z) is the standard normal, and S i is the similarity, and D i is the KS distance statistic.
[0043] Preferably, step 6: screening out trustworthy clients according to the similarity includes:
[0044] Clients with similarity scores greater than or equal to the KS detection threshold are considered trusted clients; the set of trusted clients is represented as follows:
[0045]
[0046] Among them, T ks It is the KS detection threshold. This represents a set of trusted clients.
[0047] Preferably, step 7: aggregating the model parameters of the trusted client to obtain global model parameters includes:
[0048] The model parameters of trusted clients are aggregated using a weighted average to obtain global model parameters; where the global model parameters are:
[0049]
[0050] Where, θ t+1 Let n be the global model parameter vector for round t+1. i Let n be the number of local samples for the i-th client. k This represents the total number of samples from all clients in the currently selected client set participating in the aggregation. This is the model parameter vector updated locally by the i-th client.
[0051] This invention also provides a privacy-preserving and robust federated learning system based on dimensional filtering, comprising:
[0052] The gradient acquisition module is used to extract the gradients corresponding to the current model parameters from the clients participating in federated learning.
[0053] The gradient processing module is used to trim and add noise to the gradient to obtain a gradient with added noise.
[0054] The gradient update module is used to update the model parameters using a gradient with added noise and to obtain the accumulated gradient.
[0055] The dimension filtering module is used to filter the accumulated gradients by dimension and upload the filtered gradients to the central server.
[0056] The similarity calculation module is used to calculate the similarity between the uploaded gradient distribution and the standard normal distribution;
[0057] The client filtering module is used to filter out trustworthy clients based on similarity.
[0058] The aggregation module is used to aggregate the model parameters of trusted clients to obtain global model parameters;
[0059] The parameter update module is used to update the global model with the global model parameters until the global model training is complete.
[0060] Compared with existing technologies, the privacy-preserving and robust federated learning method and system based on dimensional filtering provided by this invention have the following technical advantages:
[0061] 1. Privacy protection: By adding noise, federated learning is ensured to be carried out without leaking user data, while meeting differential privacy requirements.
[0062] 2. Byzantine robustness: Through dimensional filtering and robust aggregation algorithms, it effectively resists attacks from malicious clients and ensures the accuracy of the global model.
[0063] 3. Communication overhead optimization: By selectively uploading important gradient dimensions to achieve sparse activation-based dimensionality reduction, communication costs are reduced and algorithm efficiency is improved. Since each dimension carries an index and a floating-point value, the total communication overhead is: even considering the constant overhead added by index transmission, the overall overhead still maintains linear growth, which is much smaller than the traditional full-upload method. Attached Figure Description
[0064] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0065] Figure 1 This is a flowchart of a privacy-preserving and robust federated learning method based on dimensional filtering provided by the present invention;
[0066] Figure 2 This is a schematic diagram of the dimension filtering principle provided by the present invention. Detailed Implementation
[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0068] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments.
[0069] The terms "first," "second," "third," and "fourth," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, including a series of steps, processes, methods, etc., is not limited to the steps listed, but may optionally include steps not listed, or may optionally include other steps inherent to these processes, methods, products, or devices.
[0070] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0071] Please see Figure 1-2 A privacy-preserving and robust federated learning method based on dimensionality filtering includes:
[0072] Step 1: Extract the gradients corresponding to the current model parameters from the clients participating in federated learning;
[0073] In this embodiment of the invention, it is assumed that there are n clients participating in federated learning, and the dataset of the i-th client is represented as follows: Where (x) ij ,y ij Let n represent the j-th sample owned by the i-th client, and n represent the n-th sample owned by the i-th client. i It is the number of samples owned by the i-th client. Let d be the input feature of the j-th sample from the i-th client, where d is the dimension of the feature vector. It is x ij The corresponding tags.
[0074] In the i-th client, the training steps are as follows:
[0075] Step 1.1: Data Preprocessing. Before training begins, the client standardizes or normalizes the data to ensure consistent scaling of data features. A common method is to calculate the mean and standard deviation, adjusting the data to a zero-mean, unit-variance form.
[0076] Note: Vector division here refers to element-wise division.
[0077] Where x' ij It is a standardized feature vector. μ is the sample mean (vector) of this feature dimension on client i, and σ is the standard deviation of the data.
[0078] Step 1.2: Batch Construction. In each training round, the client divides the local data into several mini-batches to support small-step iterations and a more stable optimization process.
[0079]
[0080] Where B is the size of the mini-batch, and for the t-th training round, selecting a mini-batch is represented as:
[0081]
[0082] in, Let be the set of mini-batch sample indices obtained from the i-th client in the t-th round of sampling.
[0083] Step 1.3: Model forward propagation. The client in batch Perform forward propagation on the samples to obtain the predicted output:
[0084]
[0085] in, It is the model's predicted output, f(·) represents the forward mapping function of the currently used model, and θ t These are the model parameters for round t.
[0086] Step 1.4: Calculate the loss. Based on the model predictions... and the true value y ij Calculate the loss function Mean squared error (MSE) is used to measure the performance of the current model.
[0087]
[0088] Step 1.5: Calculate the gradient. Using the back-propagation algorithm, the gradient corresponding to the current model parameters is calculated based on the back propagation of the error, and used to update the model.
[0089]
[0090] in, It is the gradient of the loss function with respect to the parameter θ.
[0091] Step 2: Trim and add noise to the gradient to obtain a gradient with added noise;
[0092] To control the sensitivity of the gradient (to satisfy differential privacy constraints), the original gradient is norm-clipping, limiting its maximum value to C:
[0093]
[0094] in, Let be the gradient after clipping, and C be the clipping threshold.
[0095] Gaussian noise is added to the clipped gradient to achieve local differential privacy protection and prevent the model from inferring information from the original samples. The private gradient with added noise is:
[0096]
[0097] Noise intensity and privacy budget are related as follows:
[0098]
[0099] Where σ is the standard deviation of Gaussian noise, ε is the differential privacy budget, q is the client sampling ratio per round, and T train δ is the total number of training rounds, and δ is the privacy parameter.
[0100] Step 3: Update the model parameters using the gradient with added noise and obtain the accumulated gradient;
[0101] In step 3, the model parameters for gradient update after adding noise are:
[0102]
[0103] Where η is the learning rate.
[0104] The gradient after accumulation is:
[0105]
[0106] in, It is the cumulative gradient of the current round. It is the cumulative gradient of the previous round, and α is the momentum coefficient.
[0107] Step 4: Filter the accumulated gradients by dimension and upload the filtered gradients to the central server;
[0108] In step 4, the following method is used: Perform dimensional filtering. The top k elements of the filtering for the i-th client in the current round. i Each dimension.
[0109] 1) When d > 8000, the exponential mechanism (EXP) is used for selection. The exponential function amplifies the importance of the gradient, prioritizing key dimensions, which is suitable for high-dimensional data scenarios. In the exponential mechanism, the probability of the k-th dimension being selected is:
[0110]
[0111] Among them, ∈ sel is the local privacy budget for dimensionality screening.
[0112] 2) When d ≤ 1000, the perturbation encoding mechanism (PE) is adopted because in the low-dimensional scenario, the effect of adding noise is more stable and the privacy protection is stronger. In the perturbation encoding mechanism, the probability that the k-th dimension is selected is:
[0113]
[0114]
[0115] Among them, u k is the noise term of uniform distribution perturbation, m is the intensity of the noise term of uniform distribution perturbation, and ξ k is the noise term of Gaussian distribution.
[0116] 3) When 1000 < d ≤ 8000, it is suitable to choose the perturbation sampling mechanism (PS) because the perturbation sampling mechanism has high computational efficiency and is more suitable for medium-scale dimensions. In the perturbation sampling mechanism, the probability that the k-th dimension is selected is:
[0117]
[0118] Among them, Δ k is the uniform perturbation term in the perturbation sampling mechanism, and Δ j is the parameter controlling the noise amplitude in the perturbation sampling mechanism.
[0119] For further dimensionality reduction and reducing the communication load, the present invention adopts a sparse upload strategy when the client uploads the gradient. The client i only selects the first k i scores p i,k with the largest dimensions The indices of these dimensions in the gradient of the client i are Integrate them into index-value pairs instead of a complete d-dimensional vector. Each uploaded gradient is encoded as a set of index-value pairs:
[0120]
[0121] Step 5: Calculate the similarity between the uploaded gradient distribution and the standard normal distribution;
[0122] Use the central server to receive the gradients uploaded by the clients. Organize the received sparse gradient pairs into a d-dimensional vector. At the position, fill in the dimension and set the remaining blank positions to zero;
[0123] This invention introduces Kolmogorov-Smirnov (KS) detection to evaluate the similarity between the gradient distribution uploaded by each client and the standard normal distribution. This method can eliminate malicious gradients that do not conform to the expected distribution, ensuring the robustness of the global model. The deviation of the gradient distribution uploaded by each client from the standard normal distribution is evaluated:
[0124] D i =sup z |F i (z)-F0(z)|,S i =1-D i
[0125] Where F i (z) represents the empirical distribution of the gradient values in each dimension uploaded by the client, F0(z) is the standard normal distribution, and S i It's a similarity score, D i It is the KS distance statistic.
[0126] Step 6: Filter out trustworthy clients based on similarity;
[0127] Clients with similarity scores greater than or equal to the KS detection threshold are considered trusted clients; the set of trusted clients is represented as follows:
[0128]
[0129] Among them, T ks It is the KS detection threshold. This represents a set of trusted clients.
[0130] Step 7: Aggregate the model parameters of trusted clients to obtain global model parameters;
[0131] The model parameters of trusted clients are aggregated using a weighted average to obtain global model parameters; where the global model parameters are:
[0132]
[0133] Where, θ t+1 Let n be the global model parameter vector of the central server during the (t+1)th training round. i Let n be the number of local samples for the i-th client. k The set of clients currently selected to participate in the aggregation. The total number of samples from the k-th client. This is the model parameter vector updated locally by the i-th client.
[0134] Step 8: Update the global model using global model parameters until the global model training is complete.
[0135] In step 8, the present invention needs to adjust the number of dimensions for the i-th client in the next round based on the KS detection results:
[0136]
[0137] Where, k max It is the maximum value preset in the experiment.
[0138] Use the central server to update k i It is published to each client until the global model training is complete.
[0139] According to the embodiments provided by the present invention, the following technical effects are disclosed:
[0140] 1. Privacy protection: By adding noise, federated learning is ensured to be carried out without leaking user data, while meeting differential privacy requirements.
[0141] 2. Byzantine robustness: Through dimensional filtering and robust aggregation algorithms, it effectively resists attacks from malicious clients and ensures the accuracy of the global model.
[0142] 3. Communication overhead optimization: Sparse activation-based dimensionality reduction is achieved by selectively uploading important gradient dimensions, reducing communication costs and improving algorithm efficiency. Since each dimension carries an index and a floating-point value, the total communication overhead is O(k... i Even considering the constant overhead added by index transmission, the overall growth remains linear, far less than the traditional O(d) full upload method.
[0143] This invention also provides a privacy-preserving and robust federated learning system based on dimensional filtering, comprising:
[0144] The gradient acquisition module is used to extract the gradients corresponding to the current model parameters from the clients participating in federated learning.
[0145] The gradient processing module is used to trim and add noise to the gradient to obtain a gradient with added noise.
[0146] The gradient update module is used to update the model parameters using a gradient with added noise and to obtain the accumulated gradient.
[0147] The dimension filtering module is used to filter the accumulated gradients by dimension and upload the filtered gradients to the central server.
[0148] The similarity calculation module is used to calculate the similarity between the uploaded gradient distribution and the standard normal distribution;
[0149] The client filtering module is used to filter out trustworthy clients based on similarity.
[0150] The aggregation module is used to aggregate the model parameters of trusted clients to obtain global model parameters;
[0151] The parameter update module is used to update the global model with the global model parameters until the global model training is complete.
[0152] Compared with the prior art, the beneficial effects of the privacy-preserving and robust federated learning system based on dimension filtering provided by the present invention are the same as those of the privacy-preserving and robust federated learning method based on dimension filtering described in the above technical solutions, and will not be repeated here.
[0153] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Regarding the methods disclosed in the embodiments, since they correspond to the systems disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the system section description.
[0154] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A privacy-preserving and robust federated learning method based on dimensionality filtering, characterized in that, Including: Step 1: Extract the gradient corresponding to the current model parameters in the clients participating in federated learning; Step 2: Perform clipping and noise addition processing on the gradient to obtain the gradient with added noise; Step 3: Update the model parameters using the gradient with added noise and obtain the accumulated gradient; Step 4: Perform dimension screening on the accumulated gradient and upload the screened gradient to the central server; Step 5: Calculate the similarity between the uploaded gradient distribution and the standard normal distribution; Step 6: Screen out the trustworthy clients according to the similarity; Step 7: Aggregate the model parameters of the trustworthy clients to obtain the global model parameters; Step 8: Update the global model using the global model parameters until the global model training is completed.
2. The privacy-preserving and robust federated learning method based on dimensional filtering according to claim 1, characterized in that, The said Step 2: Perform clipping and noise addition processing on the gradient to obtain the gradient with added noise, including: Perform norm clipping on the gradient to obtain the clipped gradient; where the clipped gradient is: in, Let C be the gradient after clipping, and C be the clipping threshold. This is the original gradient; Add Gaussian noise to the clipped gradient to obtain the gradient with added noise; where the gradient with added noise is: in, Let I be Gaussian noise, and let I be the identity matrix. σ dp ε is the standard deviation of Gaussian noise, ε is the differential privacy budget, q is the client sampling ratio per round, and T is the standard deviation of Gaussian noise. train δ is the total number of training rounds, and δ is the privacy parameter.
3. The privacy-preserving and robust federated learning method based on dimensional filtering according to claim 2, characterized in that, The said Step 3: Update the model parameters using the gradient with added noise and obtain the accumulated gradient, including: Adopt the formula: Obtain the accumulated gradient; where, It is the cumulative gradient of the current round. It is the cumulative gradient of the previous round, and α is the momentum coefficient.
4. The privacy-preserving and robust federated learning method based on dimensional filtering according to claim 3, characterized in that, The said Step 4: Perform dimension screening on the accumulated gradient and upload the screened gradient to the central server, including: When d > 8000, adopt the exponential mechanism for screening, and the probability that the k-th dimension is selected is: Where, ∈ sel It is a local privacy budget for dimensional filtering. Let d be the gradient value of the j-th dimension for the i-th client in the t-th round of training. Dimensions It is the gradient value of the k-th dimension for the i-th client in the t-th round of training; When d ≤ 1000, adopt the perturbation coding mechanism for screening, and the probability that the k-th dimension is selected is: Among them, u k ξ is the noise term of a uniformly distributed disturbance, m is the intensity of the uniformly distributed disturbance noise term, and ξ is the noise term. k It is a Gaussian-distributed noise term. It represents the original gradient value of the k-th dimension for client i during the t-th round of training. is the perturbation gradient value in the k-th dimension, and ∈ is the perturbation coefficient. It is the gradient value after perturbation in the j-th dimension; When 1000 < d ≤ 8000, select the perturbation sampling mechanism for screening, and the probability that the k-th dimension is selected is: Where, Δ k It is the uniform perturbation term in the perturbation sampling mechanism, Δ j It is a parameter used in the perturbation sampling mechanism to control the noise amplitude.
5. The privacy-preserving and robust federated learning method based on dimensional filtering according to claim 4, characterized in that, The said Step 5: Calculate the similarity between the uploaded gradient distribution and the standard normal distribution, including: Use the KS test to evaluate the similarity between the gradient distribution uploaded by each client and the standard normal distribution; D i =vulture z |F i (z)-F0(z)|,S i =1-D i Among them, F i (z) is the empirical distribution, F0(z) is the standard normal distribution, and S i It's similarity, D i It is the KS distance statistic, sup z The maximum value among all z represents the maximum difference between the empirical distribution and the standard normal distribution, i.e., the maximum degree of deviation.
6. The privacy-preserving and robust federated learning method based on dimensional filtering according to claim 5, characterized in that, The said Step 6: Screen out the trustworthy clients according to the similarity, including: Take the clients corresponding to the similarity greater than or equal to the KS test threshold as the trustworthy clients; where the set of trustworthy clients is expressed as: Among them, T ks It is the KS detection threshold. This represents a set of trusted clients.
7. A privacy-preserving and robust federated learning method based on dimensional selection according to claim 6, characterized in that, The said Step 7: Aggregate the model parameters of the trustworthy clients to obtain the global model parameters, including: Use weighted averaging to aggregate the model parameters of the trustworthy clients to obtain the global model parameters; where the global model parameters are: Where, θ t+1 Let n be the global model parameter vector for round t+1. i Let n be the number of local samples for the i-th client. k This represents the total number of samples from all clients in the currently selected client set participating in the aggregation. This is the model parameter vector updated locally by the i-th client.
8. A privacy-preserving and robust federated learning system based on dimensional filtering, characterized in that, Including: Gradient acquisition module, used to extract the gradient corresponding to the current model parameters in the clients participating in federated learning; Gradient processing module, used to perform clipping and noise addition processing on the gradient to obtain the gradient with added noise; Gradient update module, used to update the model parameters using the gradient with added noise and obtain the accumulated gradient; Dimension screening module, used to perform dimension screening on the accumulated gradient and upload the screened gradient to the central server; Similarity calculation module, used to calculate the similarity between the uploaded gradient distribution and the standard normal distribution; Client screening module, used to screen out the trustworthy clients according to the similarity; Aggregation module, used to aggregate the model parameters of the trustworthy clients to obtain the global model parameters; Parameter update module, used to update the global model using the global model parameters until the global model training is completed.