A defense method, device and medium for resisting federated learning backdoor attacks

Abstract

The application discloses a defense method, device and medium for resisting federal learning backdoor attack, comprising: a client global model is randomly distributed to a client set and is updated based on client local data training; after model update quantity collection, hierarchical clustering is carried out based on update direction similarity; for each direction cluster obtained in hierarchical clustering, the corresponding L2 norm is extracted as an amplitude feature, the optimal sub-cluster number is determined by using a contour coefficient, and secondary clustering is carried out; the median of the update amplitude of each node after clustering is taken as the clipping threshold value, the scaling ratio of each node is calculated, and the amplitude exceeding the threshold value is scaled; the clipped model update quantity is aggregated, a new generation of global model is generated by weighted average, and the new generation of global model is distributed to the client group for iteration; the above steps are repeated until the model converges or a predetermined training round is reached. The application realizes high-precision identification and isolation of malicious clients.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed machine learning security protection, in particular to a defense method, device and medium for realizing backdoor attack defense of federated learning based on double-index hierarchical clustering. BACKGROUND

[0002] As a distributed machine learning method, federated learning can realize multi-party collaborative modeling under the premise of protecting data privacy, and has been widely applied in medical health, smart home and other fields. However, its open participation mechanism makes it vulnerable to backdoor attacks. Malicious clients induce the global model to output incorrect results under certain trigger conditions by uploading contaminated model updates, which seriously damages the security and reliability of the model.

[0003] Most of the existing defense schemes only rely on single indicators such as update direction or amplitude for detection, which is difficult to deal with attackers escaping monitoring through gradient amplification and other means. To solve this problem, the method based on differential privacy or simple pruning further proposed by the prior art can suppress part of the malicious updates, but often harms the benign clients or damages the model performance.

[0004] Therefore, the present application proposes a defense method for resisting federated learning backdoor attacks, which realizes high-precision identification and isolation of malicious clients by constructing a double-dimensional detection mechanism combining model update direction and amplitude, improves the robustness of the model, and guarantees the training effect of benign clients and data privacy, to solve the above technical problems. SUMMARY

[0005] The main purpose of the present application is to provide a defense method for resisting federated learning backdoor attacks to solve the technical problems proposed in the background art.

[0006] The present application solves the above technical problems by adopting the following technical solutions:

[0007] A defense method for resisting federated learning backdoor attacks, comprising:

[0008] S1. An initialized client global model is distributed to a set of clients by a server, and the model is updated based on the local data of the clients;

[0009] S2. The model update amount is collected by the server and hierarchically clustered based on the update direction similarity to preliminarily isolate the behaviorally abnormal malicious clients (model update amount abnormal);

[0010] S3. For each direction cluster obtained in hierarchical clustering, the L2 norm used in the corresponding client model update is extracted as the amplitude feature, the silhouette coefficient is used to determine the optimal sub-cluster number and secondary clustering is performed to further separate malicious nodes with normal direction but abnormal update amplitude;

[0011] S4. For each sub-cluster obtained after secondary clustering, the median of the update amplitude of multiple groups of model updates is used as the clipping threshold, the scaling ratio of each node is calculated, and the updates with amplitude exceeding the threshold are scaled to limit malicious influence and retain benign updates;

[0012] S5. The server aggregates all clipped model updates, generates a new generation of global model through weighted average, and distributes it to the client group to complete this round of iteration;

[0013] S6. Repeat the above steps S1-S5 until the model converges or reaches the predetermined training round.

[0014] Preferably, the specific operation process in the S1 step comprises:

[0015] At the beginning of the tth round of communication, randomly select a client to participate in this round of training and send the current client global model to the selected client;

[0016] Each selected client uses its local data set to perform local training to obtain a local model ;

[0017] Calculate the model update of the client in this round, which is:

[0018]

[0019] wherein, is the local model, and the global model;

[0020] Upload the update to the server as the model update.

[0021] Preferably, the specific operation process of hierarchical clustering of model updates in the S2 step comprises:

[0022] Calculate the cosine similarity between the model updates obtained by any two groups of clients and to quantify the consistency of the update direction of different model updates, and the calculation formula is:

[0023]

[0024] in, and These are respectively represented as clients. and Output model update amount, Indicates the amount of model update and Perform vector dot product operation. and These represent the model update amounts, respectively. and The L2 norm during the model update process;

[0025] Using the model update amount of all clients as the initial individual cluster, and based on the cosine similarity matrix calculated above, perform bottom-up hierarchical clustering;

[0026] The two clusters with the highest cosine similarity are continuously merged until the preset minimum similarity threshold between clusters is met or the preset number of clusters is reached.

[0027] Preferably, the specific operation procedure for secondary clustering in step S3 includes:

[0028] For clusters obtained by clustering in each direction in hierarchical clustering Perform intra-cluster refinement analysis;

[0029] Calculate the L2 norm of the update amount of each client model within the cluster as the magnitude feature. The calculation formula is as follows:

[0030]

[0031] in, and Clients respectively and Model update volume;

[0032] In each cluster Internally, based on amplitude characteristics Obtain the updated magnitude vector To identify clients with similar directions but abnormal amplitudes;

[0033] Using contour coefficients Adaptively determine the optimal number of clusters and update the magnitude vector. Secondary clustering is performed to further separate clients with abnormal amplitudes.

[0034] Preferably, the mathematical expression of the contour coefficient is as follows:

[0035]

[0036] wherein, is the point is the average distance to all other points in the same cluster, is the point is the average distance to all points in the nearest neighbor cluster, is used to select the larger value between and , ensuring that the silhouette coefficient is in the range [-1, 1], thus more stably evaluating the cluster density and separation.

[0037] Preferably, the specific operation process of the S4 step includes:

[0038] For each sub-cluster obtained after the secondary clustering , the median of the update amplitude of all clients in the sub-cluster is calculated , and the calculation formula is: , , wherein

[0039] The median is selected instead of the mean to avoid the interference of abnormal values (i.e., maliciously amplified gradients);

[0040] For each client in the sub-cluster , if the L2 norm of the model update parameter of the client is greater than the pruning threshold , the model update parameter of the client is scaled to be consistent with the pruning threshold .

[0041] Preferably, the specific operation process of the client for scaling the model update parameter includes:

[0042] The scaling factor for scaling the model update parameter is calculated , and the calculation formula is: ;

[0043] When , the model update parameter is scaled in proportion, and the scaling formula is: , otherwise, it remains unchanged, and the scaling formula is: , wherein, and are the model update parameters before and after pruning, respectively.

[0044] Preferably, the specific operation process in the S5 step includes:

[0045] ​The effective update amount of all the clients after clipping The weighted average aggregation (such as the FedAvg algorithm) is performed to obtain a new round of global model The calculation formula of the weighted average aggregation is:

[0046]

[0047] wherein, is the global model of the last round, is the number of clients participating in aggregation;

[0048] The updated global model is distributed to the clients for starting the next round (round) of training.

[0049] In another aspect, the application further discloses a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to make the processor execute the steps of the above method.

[0050] In still another aspect, the application further discloses a computer device, which comprises a memory and a processor, and the memory stores a computer program, and the computer program is executed by the processor to make the processor execute the steps of the above method.

[0051] From the above technical solution, the application provides a defense method for resisting federated learning backdoor attacks. Compared with the prior art, the application has the following advantages:

[0052] 1. The application breaks through the limitation of the traditional method which only relies on a single index such as model update direction or model amplitude, and constructs a double-index detection mechanism which can capture the abnormality of update direction and amplitude at the same time, so as to accurately identify diversified attacks, and at the same time, can maximize the retention of benign client contribution while efficiently filtering malicious updates, and guarantee the model accuracy.

[0053] 2. The application effectively overcomes the blind area of the traditional single-index detection mechanism under complex attacks by simultaneously analyzing the direction and amplitude of model updates, maximizes the retention of benign client contribution, realizes high-precision identification and isolation of malicious clients, and can improve the robustness of the model while guaranteeing the training effect and data privacy of benign clients.

[0054] 3. The application introduces adaptive clustering and median clipping strategies based on contour coefficients, without presetting fixed thresholds, which can dynamically adapt to different data distributions and attack strengths.

[0055] ​4. The application can effectively avoid the performance loss of benign client updates and maximize the retention of effective model information by setting a median clipping mechanism while filtering malicious updates.

[0056] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the application, nor is it intended to limit the scope of the application. Other features of the application will become apparent from the following description. Of course, any product implementing the application does not necessarily need to achieve all the advantages mentioned above. BRIEF DESCRIPTION OF DRAWINGS

[0057] The drawings accompanying this specification are included to provide a further understanding of the application. The illustrative embodiments of the application and its description serve to explain the application. They do not, however, limit the application. In the drawings:

[0058] Figure 1 is a schematic diagram of the overall operation process of the application;

[0059] Figure 2 is a schematic diagram of the system model data processing process of the application;

[0060] Figure 3 is a schematic diagram of the user average precision comparison of different methods in the first attack scenario of the IMU and FMNIST data sets in the embodiments of the application;

[0061] Figure 4 is a schematic diagram of the user average precision comparison of different methods in the second attack scenario of the IMU and FMNIST data sets in the embodiments of the application. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the application will be described in detail below with reference to the drawings accompanying the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. The embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0063] In the embodiments, see Figures 1 to 4 .

[0064] As shown in Figure 1 and Figure 2 , the defense method for resisting federated learning backdoor attack proposed in the embodiments of the application constructs a defense framework for federated learning backdoor attack based on double-index hierarchical clustering, which can systematically integrate multi-stage detection and protection mechanisms,

[0065] By uploading the client local training and model, the client is divided into benign (Benign Training) and malicious (Malicious Training) two categories, and the malicious client tries to destroy the global model by abnormal update. After receiving the model update uploaded by each client, the server first performs direction-based clustering based on model update, and distinguishes the consistency of the direction by cosine similarity, and preliminarily isolates the malicious nodes deviating from the optimization direction of the group. Subsequently, further clustering is performed based on the model update magnitude in the direction consistent cluster, and those clients with similar direction but abnormal amplification of magnitude (such as malicious scaling gradient) are identified and separated. Finally, the system introduces an adaptive clipping mechanism, taking the median of the update magnitude of each cluster as the threshold, to scale the abnormal model update, so as to effectively weaken the malicious contribution in the aggregation stage and ensure the robust update of the global model.

[0066] The technology adopted in the present application mainly includes: double-index malicious behavior detection based on model update direction and magnitude, adaptive hierarchical clustering by fusing contour coefficients, and gradient clipping and safe aggregation with median threshold. In the use process, after the server initializes the global model, the following steps are performed:

[0067] S1. Randomly select a set of clients based on the global model, complete model distribution; each client trains and calculates the model update based on the local data, and then uploads the model update to the server, the specific operation process is:

[0068] S11. At the beginning of the tth round of communication, the server randomly selects a part of all clients to participate in the training in this round and downloads the current global model To the selected clients;

[0069] S12. Each selected client k uses its local data set To perform local training (such as through the SGD algorithm), and obtain the local model ;

[0070] S13. Each client calculates its model update In this round, where is the local model, is the global model, and the update vector is uploaded to the server.

[0071] S2. The server calculates the cosine similarity between the model update amounts obtained by updating all client models, and accordingly performs hierarchical clustering to classify clients with similar update directions into the same class, thereby preliminarily identifying and isolating malicious clients with behavior anomalies in terms of direction. The specific operation process is as follows:

[0072] S21. After receiving the model updates of all clients, the server calculates the cosine similarity between the model update vectors of each two clients i and j and , aiming to quantify the consistency of the update directions of different clients;

[0073] S22. Taking all clients as initial individual clusters, based on the cosine similarity matrix calculated in the above S21 step, perform bottom-up hierarchical clustering;

[0074] S23. Continuously merge the two clusters with the highest cosine similarity until the preset minimum similarity threshold between clusters is met or the preset number of clusters is reached.

[0075] S3. For each cluster obtained by direction clustering, extract the L2 norm of the model update of each client in the cluster as the amplitude feature, determine the optimal number of sub-clusters using the silhouette coefficient, and perform secondary clustering to further separate malicious nodes with normal direction but abnormal update amplitude. The specific operation process is as follows:

[0076] S31. For each cluster obtained in step S2 , perform intra-cluster refinement analysis. Calculate the L2 norm (i.e., amplitude) of the update vector of each client in the cluster , where and are the model update vectors of clients i and j, respectively and ;

[0077] S32. To identify clients with similar directions but abnormal amplitudes (for example, attackers enhance the impact of malicious backdoors by amplifying gradients), within each cluster , perform secondary clustering based on the update amplitude vector ;

[0078] S33. Use the silhouette coefficient to adaptively determine the optimal number of clusters, perform secondary clustering, and further separate clients with abnormal amplitudes, where is the average distance of point i to all other points in the same cluster, is the average distance of point i to all points in the nearest neighbor cluster, and max(·) is used to select the larger value between and , ensuring that ​The value ranges from [-1, 1], thus providing a more stable assessment of cluster density and separation.

[0079] By simultaneously analyzing the direction and magnitude of model updates, the blind spots of traditional single-index detection mechanisms under complex attacks are effectively overcome, and the contributions of benign clients are preserved to the maximum extent. This achieves high-precision identification and isolation of malicious clients, which can improve the robustness of the model while ensuring the training effect and data privacy of benign clients.

[0080] S4. For each sub-cluster obtained after secondary clustering, the median of the client model update magnitude is used as the pruning threshold. The scaling ratio of each node is calculated, and updates with magnitudes exceeding the threshold are scaled to limit malicious impact and retain benign updates. The specific operation process is as follows:

[0081] S41. For each final sub-cluster obtained after step three... Calculate the update magnitude of all clients within this sub-cluster. the median of , This is expressed as calculating the median. The median, rather than the mean, is chosen to avoid interference from outliers (i.e., maliciously amplified gradients).

[0082] S42. Pair Clusters Each client within If the L2 norm of its model update parameters Greater than the pruning threshold Then scale its model update parameters to make them consistent with... Consistent. Scaling factor The calculation formula is: .when At that time, the model update parameters are scaled proportionally: Otherwise, remain unchanged. .in, and These are the model update parameters before and after pruning.

[0083] By implementing a median pruning mechanism while efficiently filtering malicious updates, this approach effectively avoids performance loss for benign client updates and preserves valid model information to the maximum extent.

[0084] In summary, the introduction of an adaptive clustering and median pruning strategy based on silhouette coefficients at this point eliminates the need for preset fixed thresholds and allows for dynamic adaptation to different data distributions and attack intensities.

[0085] S5. The server aggregates all trimmed client model updates, generates a new generation of global model through a weighted average, and distributes it to the client group to complete this iteration. The specific operation process is as follows:

[0086] S51. The server aggregates all the client's effective updates after clipping to get the new round of global model by weighted average aggregation (such as FedAvg algorithm) : where, is the global model of the last round, is the number of clients participating in aggregation;

[0087] S52. The server distributes the updated global model to the client to start the next round (t+1 round) of training.

[0088] Repeat the above S1-S5 steps until the model converges or reaches the predetermined training round.

[0089] Further, at this time, the method adopted by the application can also be evaluated on the IMU dataset (7 clients, small scale) and the Fashion-MNIST (FMNIST, 500 clients, large scale) to evaluate its effectiveness on different federated learning scales, which specifically includes:

[0090] 50 rounds of communication were carried out on the IMU dataset, and 500 rounds of communication were carried out on the FMNIST dataset to evaluate the defense mechanism, and non-independent and identically distributed data partitioning with different client participation and sample distribution was used to simulate real data heterogeneity, and the final results are shown in Figure 3 and Figure 4 .

[0091] Take Figure 3 as an example for illustration, the method of the application is compared with five baselines (FedAvg, Krum, Ditto, FedCHAR, Flame), and the malicious nodes of IMU and FMNIST are attacked by 20% and 50% under model replacement and PGD attack, respectively.

[0092] For model replacement attack with 20% malicious nodes, it can be seen from Figure 3 that the method of the application reaches 89.3% (IMU) and 91.67% (FMNIST), which is better than all baselines, and can maintain the performance (91% (IMU) / 87.3% (FMNIST)) even on 50% malicious nodes.

[0093] For PGD attack, the method reaches an accuracy of 87.3% (IMU) and 90.6% (FMNIST) on 20% malicious nodes, and 88.67% on 50% of the two datasets.

[0094] Therefore, it can be seen that the double metric method of the application can effectively defend against various backdoor attacks, while maintaining accuracy on the independent and identically distributed, and even in the extreme scenario where the proportion of malicious clients is as high as 50%, the application can still maintain excellent model performance.

[0095] In summary, the application breaks through the limitation of traditional methods relying on only a single indicator such as model update direction or model amplitude, and constructs a double indicator detection mechanism that can capture both update direction and amplitude anomalies, to accurately identify diversified attacks, while efficiently filtering malicious updates and maximizing the retention of benign client contributions, ensuring that model accuracy is not affected.

[0096] In another aspect, the application also discloses a computer readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the above method.

[0097] In another aspect, the application also discloses a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the computer program, when executed by the processor, causes the processor to perform the steps of the above method.

[0098] In another embodiment provided by the application, a computer program product containing instructions is also provided, which, when running on a computer, causes the computer to execute any of the above-mentioned defense methods against federated learning backdoor attacks.

[0099] It can be understood that the system provided by the embodiments of the application corresponds to the method provided by the embodiments of the application, and the explanation, examples and benefits of related content can be referred to the corresponding parts in the above method.

[0100] The application also provides an electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus,

[0101] The memory is used to store a computer program.

[0102] The processor is used to execute the program stored on the memory to implement the above-mentioned defense method against federated learning backdoor attacks.

[0103] The communication bus mentioned in the above electronic device can be a peripheral component interconnect bus or an extended industry standard architecture bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0104] The communication interface is used for communication between the above-mentioned electronic device and other devices.

[0105] The memory can include a random access memory and can also include a nonvolatile memory such as at least one disk memory. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0106] The aforementioned processor can be a general-purpose processor including a central processing unit, a network processor, etc., and can also be a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component.

[0107] It should also be noted that the electronic device also includes a terminal device, which can also be referred to as a terminal, a user equipment, a mobile station, a mobile terminal, etc. The terminal device can be a mobile phone, a smart television, a wearable device, a tablet computer, a computer with wireless transceiver function, a virtual reality terminal device, an augmented reality terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in remote surgery, a wireless terminal in smart power grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The embodiments of the present application do not limit the specific technology and specific device form of the terminal device.

[0108] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired or wireless means. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media, optical media or semiconductor media, etc.

[0109] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0110] In addition, it needs to be explained that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement condition, etc. between components in a certain posture, and if the certain posture changes, the directional indications will also change accordingly.

[0111] In addition, if the embodiments of the present application involve descriptions such as "first", "second", etc., the descriptions of "first", "second", etc. are only for description purposes and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing throughout the text includes three parallel schemes. Taking "A and / or B" as an example, it includes A scheme, or B scheme, or A and B scheme. In addition, in the embodiments of the present application, "a plurality of" means two or more. In addition, the technical solutions of each embodiment can be combined with each other, but it must be based on the realization of the ordinary skilled in the art, when the combination of technical solutions appears contradictory or cannot be realized, it should be considered that the combination of technical solutions does not exist, nor is it within the scope of protection required by the present application.

Claims

1. A defense method against federated learning backdoor attacks, characterized in that, include: S1. The server initializes the global model for the client and randomly distributes it to the client set, and then trains and updates the model based on the client's local data; S2. After the model update data is collected by the server, hierarchical clustering is performed based on the similarity of the update direction. S3. For each cluster obtained by clustering in the hierarchical clustering, extract the L2 norm used by the corresponding client model update as the amplitude feature, use the silhouette coefficient to determine the optimal number of sub-clusters and perform secondary clustering; S4. For each sub-cluster obtained after secondary clustering, use the median of the update magnitude of multiple model update amounts as the pruning threshold, calculate the scaling ratio of each node, and scale the updates whose magnitude exceeds the threshold. S5. The server aggregates all the trimmed model updates, generates a new generation of global model by weighted averaging, and distributes it to the client group to complete this round of iteration; S6. Repeat steps S1-S5 above until the model converges or reaches the predetermined number of training rounds; The specific operation procedure for secondary clustering in step S3 includes: For clusters obtained by clustering in each direction in hierarchical clustering Perform intra-cluster refinement analysis; The L2 norm of the update amount of each client model within the cluster is used as the magnitude feature, and the calculation formula is as follows: in, and Clients respectively and Model update volume; In each cluster Internally, based on amplitude features, the updated amplitude vector is obtained. ; Using contour coefficients Adaptively determine the optimal number of clusters and update the magnitude vector. Perform secondary clustering; The mathematical expression for the contour coefficient is as follows: in, For point The average distance to all other points within the same cluster. It is a point The average distance to all points in the nearest neighbor cluster. Used to select distance and The larger value in the middle ensures the profile coefficient The value of is in the range of [-1, 1].

2. The defense method for resisting federated learning backdoor attacks as described in claim 1, characterized in that, The specific operation process in step S1 includes: At the start of the t-th round of communication, a client is randomly selected to participate in this round of training, and the current client's global model is... Send to the selected clients; Each selected client Use its local dataset Perform local training to obtain a local model ; Computing Client Model update volume in this round ,have: in, For local models, For global models; This update volume Uploaded to the server as model update data.

3. The defense method for resisting federated learning backdoor attacks as described in claim 1, characterized in that, The specific operation process for hierarchical clustering of the model update amount in step S2 includes: Calculate any two groups of clients and Cosine similarity between the obtained model update values To quantify the consistency of update directions across different models, the calculation formula is as follows: in, and These are respectively represented as clients. and Output model update amount, Indicates the amount of model update and Perform vector dot product operation. and These represent the model update amounts respectively. and The L2 norm during the model update process; Using the model update amount of all clients as the initial individual cluster, and based on the cosine similarity matrix calculated above, perform bottom-up hierarchical clustering; The two clusters with the highest cosine similarity are continuously merged until the preset minimum similarity threshold between clusters is met or the preset number of clusters is reached.

4. The defense method for resisting federated learning backdoor attacks as described in claim 1, characterized in that, The specific operation process of step S4 includes: For each sub-cluster obtained after secondary clustering Calculate the update magnitude of all clients within this sub-cluster. the median of The calculation formula is as follows: , This is expressed as calculating the median; Pair clusters Each client within If the L2 norm of its model update parameters is greater than Then scale its model update parameters to make them consistent with... Consistent.

5. The defense method for resisting federated learning backdoor attacks as described in claim 4, characterized in that, The client The specific operational procedures for model update parameter scaling include: Scaling factor for calculating the scaling factor of the model update parameters The calculation formula is as follows: ; when When updating the model parameters, the scaling factor is adjusted proportionally, and the scaling formula is as follows: Otherwise, remain unchanged, where, and These are the model update parameters before and after pruning.

6. The defense method for resisting federated learning backdoor attacks as described in claim 1, characterized in that, The specific operational procedures in step S5 include: Effective update volume for all clients after trimming A new global model is obtained by performing weighted average aggregation. The formula for calculating the weighted average aggregation is: in, This is the global model from the previous round. The number of clients participating in the aggregation; Updated global model Send to the client to enable Rotational training.

7. A computer-readable storage medium, characterized in that, The system stores a computer program that, when executed by a processor, causes the processor to perform the steps of the method as described in any one of claims 1 to 6.

8. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program that, when executed by the processor, causes the processor to perform the steps of the method as described in any one of claims 1 to 6.

Images