A method and device for recovering a poisoning model based on forgetting decoupling and accelerated optimization

Abstract

The application relates to the field of distributed deep learning security technology and discloses a poisoning model recovery method and device based on forgetting decoupling and acceleration optimization, which comprises the following steps: a poisoning model recovery process is constructed in stages, gradient data uploaded by a client is used first, security aggregation is carried out based on a poisoning defense strategy, and the gradient increment of a malicious client is identified; then, a forgetting decay function is constructed in combination with training round difference, the influence of malicious gradient on a target model is quantitatively evaluated, the contribution of the malicious gradient is eliminated from the model, and initial recovery weights are obtained. On the premise that a loss function is differentiable, a parameter distance upper limit is introduced, a recovery training optimization objective function with a regular penalty term is constructed, optimization iteration is finally performed by honest clients, and global model continuous updating and stable convergence are realized by using robust aggregation on the server side. The application improves the accuracy and stability of poisoning model recovery.

Description

Technical Field

[0001] This invention relates to the field of distributed deep learning security technology, and more specifically, to a method and apparatus for recovering a poisoned model based on forgetting decoupling and acceleration optimization. Background Technology

[0002] Federated learning is an emerging distributed machine learning framework that allows multiple clients to secretly collaborate in training a shared global model. It is currently widely used in healthcare, financial risk control, and smart manufacturing. However, due to its distributed nature, federated learning is highly vulnerable to various poisoning attacks. Client protection levels are low, allowing attackers to inject or control multiple malicious clients to launch poisoning attacks. Malicious clients can reduce global model performance (non-targeted attacks) or intentionally influence partial model predictions (targeted attacks, also known as backdoor attacks) by sending carefully crafted poisoned model updates to the server. Poisoning attacks can rapidly and continuously affect the federated learning process over several rounds, leading to significant security issues.

[0003] In federated learning, once the system detects that an attacker has breached the poisoning attack detection defense, a poisoning attack recovery algorithm can be used to quickly restore the global model. The goal of this recovery is to achieve the same performance as retraining from scratch.

[0004] Existing technologies like FedEraser recover from poisoning attacks by storing all client model updates and global model weights every fixed number of rounds (default 1), but FedEraser relies entirely on the training of the remaining clients. FedRecover employs a strategy of warm-up, periodic correction, anomaly detection, and final adjustment, also requiring the storage of all client gradient updates and global model weights. Similar to poisoning attack recovery algorithms, Federated Forgetting Learning addresses the malicious client problem by reverting training updates generated by client data to the global model. During forgetting training, existing technologies like Rapid Retraining use the L-BFGS algorithm to quickly build the federated learning model. To reduce the number of users involved in retraining, KNOT technology establishes and solves a linear programming problem to optimize client cluster allocation, confining the forgetting learning process to each cluster. Regarding user contribution removal, FedLU technology, based on cognitive neuroscience theory, removes specific knowledge through backtracking interference and passive decay. RevFRF technology removes all nodes provided by the target client through recursive traversal within a decision tree structure, then reconstructs the decision tree in the remaining clients to restore model performance. VERIFI technology completes training update correction by reducing the contribution ratio of the target user model and increasing the contribution ratio of other user models. Forget-SVGD technology reverses the model training process and uses gradient ascent to achieve federated forgetting learning.

[0005] However, both existing federated poisoning attack recovery algorithms and the valuable federated forgetting learning algorithms still rely on historical gradient updates from all or most honest clients to recover from poisoning attacks. This not only results in poor recovery performance but also incurs significant storage and communication overhead. Furthermore, ensuring training stability is difficult, leading to substantial computational time costs and poor performance. Summary of the Invention

[0006] In view of this, the present invention proposes a method and apparatus for recovering poisoned models based on forgetting decoupling and acceleration optimization, aiming to solve the problem that current federated learning poisoning recovery and forgetting algorithms generally rely on the historical gradient data of all or most clients, resulting in huge storage and communication overhead, poor training stability, low computational efficiency, and difficulty in achieving efficient and stable poisoned model recovery.

[0007] This invention proposes a method for recovering a poisoning model based on forgetting decoupling and relaxed acceleration optimization, comprising: The client generates local gradient updates based on local data and uploads the local gradient updates to the server. The server performs security aggregation based on the poisoning defense strategy. Based on historical gradient updates uploaded by the client, obtain the gradient increment of each malicious client; Based on the difference between the training epoch of the malicious client's gradient and the epoch of the target global model, a forgetting decay function is constructed to evaluate the impact score of the malicious gradient; The malicious gradient impact score after evaluation is removed from the target global model weights to obtain the initial model weights for retraining. Under the assumption that the loss function is differentiable, determine the upper limit of the parameter distance between the recovered initial model and the retrained optimal model; Based on the upper limit of the parameter distance, a penalty term for recovery training is constructed to constrain the optimization path, and a recovery training optimization objective function containing the original loss term and the penalty term is constructed. The honest client performs retraining iterations to optimize the objective function, while the server aggregates the updated gradients and continues to optimize until the model converges or reaches the preset number of rounds.

[0008] Furthermore, when obtaining the gradient increments of each malicious client, the following is included: Obtain the set of all gradients across all clients, and obtain the average gradient of the entire set of gradients; Obtain the malicious client to be evaluated, remove the gradient of the malicious client from the entire gradient set, and obtain the average gradient of the remaining clients, which is denoted as the removed average gradient. Based on the relationship between the overall average gradient and the removed average gradient, the gradient increment of the malicious client to be evaluated is obtained.

[0009] Furthermore, when assessing the impact score of malicious gradients, the following are included: Obtain the generation round corresponding to each malicious gradient increment, and denote it as the first round; Obtain the training epoch of the target global model, denoted as the second epoch; Based on the round difference between the two, the decay degree of each malicious gradient is generated by substituting it into the exponential decay function, where the decay degree decreases exponentially as the round difference increases. Based on the relationship between each malicious gradient increment and its corresponding decay rate, the impact score of the malicious gradient on the target model is obtained, which constitutes the actual malicious impact score.

[0010] Furthermore, when removing the evaluated malicious gradient impact score from the target global model weights to obtain the initial model weights for retraining, the following steps are taken: Obtain the first model weights corresponding to the target global model, and use them as the basic input for restoring the initial training weights; The total malicious impact is obtained by summing the actual gradient impact values ​​of all malicious clients across all rounds. The forgetting decay factor set during the recovery training phase is used as a hyperparameter to control the step size during the optimization process; The effect correction amount is obtained based on the relationship between the forgetting decay factor and the sum of malicious effects; Using the first model weights as a benchmark, the influencing correction amount is removed from these weights to generate the initial model weights for retraining, which are then denoted as the second model weights.

[0011] Furthermore, under the assumption that the loss function is differentiable, determining the upper bound of the parameter distance between the recovered initial model and the retrained optimal model includes: Call the loss function used in the recovery training phase, and obtain the gradient of the loss function at the position corresponding to the weight of the second model to obtain the gradient vector at that point; The gradient vector is subjected to norm calculation to obtain the gradient strength index at the weights of the model. The preset forgetting decay factor is invoked, and the upper limit of the parameter distance between the initial model weights of the restored training and the target optimal model is determined based on the relationship between the gradient strength index and the preset forgetting decay factor.

[0012] Furthermore, when constructing the penalty term for recovery training based on the upper limit of parameter distance, it includes: Obtain the squared norm of the difference between the recovered model weights and the initial model weights; Based on the relationship between the square norm and the preset penalty coefficient, the pass regularization term is obtained and determined as the penalty term for resuming training.

[0013] Furthermore, when constructing the recovery training optimization objective function that includes the original loss term and the penalty term, it includes: Obtain the client's original local loss function; Obtain the Euclidean distance between the current recovery training model weights and the initial recovery model weights, and use the square of this Euclidean distance as the weight penalty term; Set a predetermined penalty item weight coefficient to weight the weight difference; The target loss function for resuming training is constructed by summing the local loss function with the weighted penalty term.

[0014] Furthermore, when using an honest client to perform recovery training iterations on the optimization objective function, it includes: The clients selected to participate in the recovery training should include only honest clients that have not been identified as malicious. Each honest client obtains its local model gradient update by minimizing the recovery training optimization objective function based on its local training data. Upload the local gradient updates of each honest client to the server; The received local gradient updates are aggregated to generate new global model weights, which are then sent to the client. Repeat the above client-side training and server-side aggregation process until the global model's performance on the validation set meets the preset convergence condition or reaches the upper limit of the training rounds.

[0015] Furthermore, the server aggregates the updated gradients and continues to optimize until the model converges or reaches a preset number of rounds, including: Obtain the local model gradient update set uploaded by the honest client and use it as the aggregate input for the current round; Based on a preset aggregation strategy selection mechanism, client gradient updates are merged into new global model gradients or weights. Update the current global model parameters and broadcast the updated model weights to all participating honest clients for training.

[0016] Compared with existing technologies, the advantages of this invention are as follows: By introducing a decoupled malicious client forgetting algorithm in the forgetting stage, and relying only on the historical gradient updates of a small number of malicious clients and the global model update, the actual impact of malicious clients on the global model in each round can be accurately calculated. Simultaneously, referencing the memory decay mechanism in cognitive neuroscience, a forgetting decay function is designed to model the time decay of malicious gradient effects, avoiding the need to store historical data from all clients and significantly reducing the storage and communication overhead of the recovery process. In the optimization stage, the mathematical expression of the upper limit of the parameter distance between the initial model and the retrained optimal model under the assumption of differentiability of the loss function is further explored, thereby constructing an approximate recovery training optimization objective function. This optimization function introduces a weight penalty term to constrain the convergence space of the model training path, effectively suppressing oscillations without sacrificing model performance, and improving the stability and convergence speed of the training process.

[0017] On the other hand, this application also provides a poisoning model recovery device based on forgetting decoupling and acceleration optimization, comprising: Memory is used to store computer program instructions; The processor, electrically connected to the memory, is configured to execute instructions from a stored computer program, wherein: The processor is also configured to generate local gradient updates based on local data and upload the local gradient updates to the server, which performs security aggregation based on the poisoning defense strategy. The processor is also configured to update historical gradients based on client uploads, obtain gradient increments for each malicious client, and construct a forgetting decay function based on the difference between the training epoch of the malicious client gradient and the epoch of the target global model to evaluate the impact score of the malicious gradient. The processor is also configured to remove the evaluated malicious gradient impact score from the target global model weights to obtain the initial model weights for retraining. The processor is also configured to determine the upper bound of the parametric distance between the recovered initial model and the retrained optimal model, under the assumption that the loss function is differentiable; The processor is also configured to construct a penalty term for resuming training based on the upper limit of the parameter distance, constrain the optimization path, and construct a resuming training optimization objective function that includes the original loss term and the penalty term; The processor is also configured to use an honest client to perform recovery training iterations on the optimization objective function, and the server aggregates the updated gradients and continues to optimize until the model converges or reaches a preset number of rounds.

[0018] It is understood that the poisoning model recovery method and apparatus based on forgetting decoupling and accelerated optimization in the above embodiments of the present invention have the same beneficial effects, and will not be described in detail here. Attached Figure Description

[0019] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart illustrating a method for recovering a poisoning model based on forgetting decoupling and relaxed acceleration optimization, provided in an embodiment of the present invention; Figure 2 This is a functional block diagram of a poisoning model recovery system based on forgetting decoupling and relaxed acceleration optimization, provided in an embodiment of the present invention. Detailed Implementation

[0020] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, embodiments and features in the embodiments of the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] like Figure 1 As shown, in some embodiments of this application, this embodiment provides a method for recovering a poisoned model based on forgetting decoupling and relaxed acceleration optimization, including: Step S100: The client generates a local gradient update based on local data and uploads the local gradient update to the server. The server performs security aggregation based on the poisoning defense strategy.

[0022] Understandably, within the federated learning framework, clients independently train their models using local private data, generating local gradient updates to avoid uploading raw data and thus protecting privacy. The server, receiving gradient updates from each client, filters and securely aggregates the gradients based on poisoning defense strategies (such as robust aggregation algorithms), effectively resisting poisoning attacks from malicious clients and ensuring the accuracy and robustness of global model updates. This process combines distributed computing with secure aggregation mechanisms, achieving improved model security and stability while protecting data privacy.

[0023] Step S200: Based on the historical gradient updates uploaded by the client, obtain the gradient increment of each malicious client.

[0024] Specifically, when obtaining the gradient increment of each malicious client, the process includes: obtaining the entire gradient set among all clients and obtaining the average gradient of the entire gradient set; obtaining the malicious client to be evaluated, removing the gradient of the malicious client from the entire gradient set, obtaining the average gradient of the remaining clients, denoted as the removed average gradient; and obtaining the gradient increment of the malicious client to be evaluated based on the relationship between the entire average gradient and the removed average gradient.

[0025] Understandably, by comparing the changes in the average gradient caused by whether or not a client participates in global gradient aggregation, the independent impact of each client during training can be quantified. Specifically, firstly, a set of local gradients uploaded by all clients in the current round is constructed, and the average value of this set is calculated as a reference benchmark. Then, for a client to be evaluated, the gradient of that client is removed from the entire set of gradients, and the average gradient of the remaining clients is recalculated, i.e., the removed average value. Furthermore, by comparing the overall average gradient when the client is included with the average gradient after removing the client, the "marginal impact" of that client—that is, the actual degree of influence of its uploaded gradient on the overall aggregation result, i.e., the gradient increment of that client—can be deduced. The core of this method lies in using difference calculation to construct a mechanism that can estimate client contributions without accessing the original training data, relying only on gradient information. This difference-based analysis method not only has strong feasibility but also effectively identifies and quantitatively evaluates the potential interference of malicious clients on model training results within the privacy protection framework of federated learning, thus providing a theoretical basis and input data support for subsequent poisoning recovery and malicious influence removal.

[0026] Step S300: Based on the difference between the training round of the malicious client's gradient and the round of the target global model, construct a forgetting decay function and evaluate the impact score of the malicious gradient.

[0027] Specifically, the evaluation of the impact score of malicious gradients includes: obtaining the generation round corresponding to each malicious gradient increment, denoted as the first round; obtaining the training round of the target global model, denoted as the second round; substituting the round difference between the two into an exponential decay function to generate the decay degree of each malicious gradient, wherein the decay degree decreases exponentially as the round difference increases; and obtaining the impact score of the malicious gradient on the target model based on the relationship between each malicious gradient increment and its corresponding decay degree, thus constituting the actual malicious impact score.

[0028] Understandably, by utilizing time-sensitive modeling techniques and introducing an exponential decay function, a mechanism for attenuating the impact of malicious gradients on the target model is constructed, thereby accurately assessing the actual role of each malicious client gradient in the current global model. This method is based on a key assumption: as the training process progresses, the impact of gradient updates from earlier rounds on the final model gradually weakens, exhibiting a "memory-forgetting" characteristic. Specifically, the generation round (first round) of each malicious gradient increment and the training round (second round) of the current target global model are recorded, and the round difference between the two is calculated. Then, this difference is used as an independent variable input into the exponential decay function, causing the generated decay rate to decrease exponentially with increasing time intervals, simulating the process of information being gradually forgotten in the model. This decay rate can be considered a dynamic weighted average of the historical impact strength of each malicious gradient. Next, each malicious gradient increment is multiplied by its corresponding decay rate in a weighted manner to obtain the "impact score" of that malicious gradient in the target model, i.e., its residual contribution. In this way, not only can the strength of each malicious update's impact on the target model be quantified, but a set of actual malicious impact scores that takes into account both time characteristics and the degree of impact can also be constructed.

[0029] Step S400: Remove the evaluated malicious gradient impact score from the target global model weights to obtain the initial model weights for retraining.

[0030] Specifically, when removing the evaluated malicious gradient impact score from the target global model weights to obtain the initial model weights for retraining, the process includes: obtaining the first model weight corresponding to the target global model as the basic input for the initial weights of retraining; summing the actual gradient impact values ​​of all malicious clients in all rounds to obtain the total malicious impact; calling the forgetting decay factor set in the retraining phase as a hyperparameter for controlling the step size during optimization; obtaining the impact correction amount based on the relationship between the forgetting decay factor and the total malicious impact; and removing the impact correction amount from the first model weight as a benchmark to generate the initial model weights for retraining, which are then recorded as the second model weights.

[0031] Understandably, by quantifying the impact of malicious gradients, their contributions are reversed and removed from the current target global model weights, constructing a purer and more reliable initial model state for initiating the recovery training process. This technique, based on the cumulative effect of gradients on model weight updates and combined with the time decay assessment of residual effects, implements a refined model "rollback" strategy. Specifically, firstly, the parameters of the target global model (i.e., the first model weights) are used as the basic input for recovery training. Then, based on the actual impact scores of each malicious gradient as evaluated above, the residual impact values ​​of all malicious clients in all rounds are summed to obtain an overall "sum of malicious effects," used to uniformly measure the overall interference of the attack behavior on the model. Next, the system calls the forgetting decay factor set in the recovery training, which is used as a hyperparameter to control the magnitude of weight updates in gradient descent optimization. Based on this, the forgetting decay factor is multiplied by the sum of malicious effects to obtain the impact correction amount, representing the amount of harmful parameter offset that should be removed from the current global model. Finally, based on the current first model weights, this impact correction amount is subtracted to obtain the new model parameters that have been freed from the malicious historical impact, denoted as the second model weights. This parameter state serves as the initial weight for resuming training, ensuring that subsequent model training proceeds on the basis of being as realistic and uncontaminated as possible.

[0032] Step S500: Under the assumption that the loss function is differentiable, determine the upper limit of the parameter distance between the recovered initial model and the retrained optimal model.

[0033] Specifically, under the assumption that the loss function satisfies differentiability, determining the upper limit of the parameter distance between the restored initial model and the retrained optimal model includes: calling the loss function used in the restoration training phase, and obtaining the gradient of the loss function at the position corresponding to the weight of the second model to obtain the gradient vector at that point; calculating the norm of the gradient vector to obtain the gradient strength index at the weight of the model; calling the preset forgetting decay factor, and determining the upper limit of the parameter distance between the weight of the restored initial model and the target retrained optimal model based on the relationship between the gradient strength index and the preset forgetting decay factor.

[0034] Under the assumption that the loss function is differentiable, the upper bound of the parameter space distance between the initial model in the recovery training and the ideal model in the retraining can be derived based on the relationship between gradient information and the learning rate. This provides a quantitative basis for evaluating the rationality of the recovery path and constructing the optimization objective. Specifically, firstly, the loss function used in the recovery training phase is called, and the weights of the second model corresponding to the initial recovery model are substituted into the function to calculate the gradient vector at that point. Since the loss function is differentiable, the gradient of the model at that point can be accurately obtained, reflecting the sensitivity of the current weights to the loss. Subsequently, a norm operation is performed on the gradient vector, usually using the L2 norm, to quantify the gradient strength at the current point, that is, the optimization pressure of the model at the current position. This gradient strength serves as an indirect indicator of the distance between the model and the convergent optimal state. Next, the forgetting decay factor set during the recovery training is called as a hyperparameter to control the magnitude of the model weight update. Multiplying the gradient strength by the learning rate yields a dimensional upper bound estimate, which is used to approximately represent the furthest possible parameter distance between the current initial recovery model and the ideal retrained model.

[0035] Step S600: Construct a penalty term for recovery training based on the upper limit of parameter distance, constrain the optimization path, and construct a recovery training optimization objective function that includes the original loss term and the penalty term.

[0036] Specifically, when constructing the penalty term for resuming training based on the upper limit of parameter distance, the process includes: obtaining the square norm of the difference between the weights of the resuming model and the weights of the initial model; obtaining the pass regularization term based on the relationship between the square norm and the preset penalty coefficient, and determining the pass regularization term as the penalty term for resuming training.

[0037] Specifically, when constructing the objective function for recovery training optimization, which includes the original loss term and the penalty term, the following steps are taken: obtaining the original local loss function of the client; obtaining the Euclidean distance between the current recovery training model weights and the initial recovery model weights, and using the square of the Euclidean distance as the weight penalty term; setting a predetermined penalty term weight coefficient to weight the weight difference; and summing the local loss function and the weighted penalty term to construct the objective loss function for recovery training.

[0038] Understandably, by introducing parameter distance upper bound constraints and a penalty term mechanism, the initial model weights are restored as the reference center in the optimization process. A target function containing regularization control is constructed during restoration training, guiding the model to optimize within the reliable parameter space and improving the convergence stability and anti-interference ability of the training. Specifically, the parameter difference between the model weights in the current restoration training round and the initial restored model (second model weights) is obtained, and the square norm of this difference is calculated to measure the deviation of the current training path from the initial model. This norm value serves as the basis for penalizing the model offset. Combined with preset penalty term weight coefficients, a regularization term is generated to suppress excessive divergence of the model in the optimization objective. This regularization term is the penalty term for restoration training, designed to limit the model's convergence region to the neighborhood of the initial restored model, thereby controlling path offset during training and avoiding performance degradation or oscillations due to instability in the optimization process. Next, the client-side native original loss function is called to measure the fitting error of the current model on the local data. Then, the local loss function is weighted and summed with the aforementioned penalty term to construct a comprehensive optimization objective function that includes both model error and path constraint terms. This optimization objective function has two guiding functions: on the one hand, it drives the model to improve accuracy on local data; on the other hand, it shrinks the search space and controls the update magnitude through the penalty term, preventing the training path from deviating from the expected trajectory and enhancing robustness and convergence efficiency.

[0039] Step S700: Use the honest client to perform recovery training iterations on the optimization objective function. The server summarizes the updated gradients and continues to optimize until the model converges or reaches the preset number of rounds.

[0040] Specifically, when using honest clients to perform recovery training iterations on the optimization objective function, the process includes: selecting clients to participate in recovery training, including only honest clients that have not been identified as malicious; each honest client minimizing the recovery training optimization objective function based on local training data and obtaining its local model gradient update; uploading the local gradient updates of each honest client to the server; aggregating the received local gradient updates to generate new global model weights and sending them to the clients; repeating the above client training and server aggregation process until the global model's performance on the validation set meets the preset convergence condition or reaches the upper limit of the training rounds.

[0041] Specifically, the server aggregates the updated gradients and continuously optimizes them until the model converges or reaches a preset number of rounds. This includes: obtaining the set of local model gradient updates uploaded by honest clients as the aggregation input for the current round; merging the client gradient updates into new global model gradients or weights based on a preset aggregation strategy selection mechanism; updating the current global model parameters and broadcasting the updated model weights to all participating honest clients for training.

[0042] Understandably, during the recovery process of the poisoned model, a stable, efficient, and controllable federated optimization iterative framework is constructed based on the optimization objective function, using trusted clients to participate in recovery training, and coupled with a robust aggregation mechanism. This framework gradually improves the recovery performance of the global model and ensures its convergence stability. Specifically, by implementing a client screening mechanism, only honest clients that are not identified as malicious are selected to participate in recovery training, eliminating the risk of secondary pollution to the model from the source. Each honest client, based on its local data, minimizes the recovery training optimization objective function that incorporates loss and regularization terms, outputting its local gradient update as trusted training feedback. Subsequently, all honest clients upload their locally trained gradient updates to the server. After receiving these gradients, the server merges the gradients from each client based on a preset aggregation strategy to generate new global model weights for the next round of recovery iteration. This aggregation process not only supports the standard mean-based FedAvg algorithm but also allows for the selection of robust strategies to resist attacks, including median-based aggregation, Trimmed Mean strategy, and Krum voting aggregation method. This effectively filters out extreme or off-target values, enhancing the global model's resilience against malicious perturbations. After each round of aggregation, the server broadcasts the updated global model weights to all participating honest clients, continuing the next round of local training and aggregation updates. This training-aggregation process continues until the model's performance on the validation set reaches the set convergence criterion, or the preset number of iterations is reached.

[0043] In some embodiments of this application, a second embodiment provides a method for recovering a poisoning model based on forgetting decoupling and relaxed acceleration optimization, comprising the following processes: Step 1: Normal Federation Training with Poisoning Defense: Three Clients (of which...) It is an honest client. (This is a malicious client) obtains local gradient updates through training on local data. And send to the server ,server Gradient fusion is completed using a secure aggregation algorithm with a poisoning attack defense strategy, and the global model is resent to the three clients in sequence until training converges or reaches the predetermined number of rounds.

[0044] Step 2, Malicious Client Gradient Increment Calculation: Under three clients, the client... gradient update Increment Equivalent to adding a client Subtracting the average gradient update after removing the gradient update The average gradient is updated afterward. Gradient increment. It can be represented as: Step 3: Assessment of the actual impact of gradient increments: Design a model forgetting decay process to measure the actual impact of malicious gradient updates on the optimal model. in, It is the forgetting decay factor. It is the round in which the best global model is located. It is the round in which malicious gradient updates occur. This is malicious gradient update The impact on the actual gradient increments produced by federated training results.

[0045] Step 4: Overall Malicious Client Oblivion: Optimal Global Model Remove malicious client The actual gradient increments across all rounds achieve the goal of forgetting the malicious client in the poisoning attack recovery algorithm, thus obtaining the initial model weights for subsequent recovery training. : in, It is the optimal global model weight. It refers to all rounds before obtaining the optimal global model. It is a collection of malicious clients. It is the learning rate.

[0046] Step 5: Approximating the upper bound of the distance between the initial training model and the retrained model (only once): After the overall malicious client forgets, the forgetting result obtained by subtracting the malicious influence from the poisoning model often shows over-forgetting. To alleviate the poor model performance caused by over-forgetting, under the relaxed assumption that only the differentiability of the loss function is required, this invention mathematically approximates and infers the weights of the initial training model. and optimal retrained model weights Maximum distance between them: Step Six: Constructing the Penalty Term for Accelerated Optimization: Since there is still a certain gap between the target retraining path and the gradient update obtained after malicious gradient forgetting, this invention, in order to quickly train and search for the optimal solution, is based on... Designing a penalty term to assist in resuming training optimization can constrain model weights to a smaller reliable convergence space, thereby accelerating resuming training. Penalty term Designed as follows: in, These are the weighting coefficients for controlling the penalty terms. Model weights The number of parameters.

[0047] Step 7: Overall Recovery Training Optimization Goal Design: The ultimate goal of recovery training optimization includes the original federated training loss term. and penalty items These two parts: Step 8: Restore Training Iterations: Under the obtained final restoration optimization objective, the remaining two honest clients... and Train using local data and send gradient updates to the server. ,server After performing a simple aggregation operation, a new round of global updates is sent, and this process is repeated until convergence or the preset number of rounds is reached.

[0048] Experimental setup: Datasets include MNIST, Fashion-MNIST (handwriting / clothing classification), CIFAR-10 (object recognition), and AGnews (news classification). Attack methods include backdoor attacks I / II (pixel triggers or text injection) and pruning attacks (parameter clipping or noise replacement), with a default of 25% of clients executing the attack. Recovery algorithms include Retrain, FedEraser (historical gradient-based correction), FedRecover (warm-up + anomaly detection), and Crab (storage-optimized version of FedEraser). Evaluation metrics include ACC (accuracy), ASR (attack success rate), MISR (member inference success rate), CO (computational cost), SO (storage cost), and CC (communication cost). The federated learning setup employs FedAvg aggregation, a CNN / Transformer model, and robust aggregation algorithms (TrimmedMean, Median, Krum). Non-IID data is constructed using a Dirichlet distribution. Default training parameters include a learning rate of 0.005, 40 rounds of global training, 5 rounds of local training, a batch size of 256, 20 clients, a forgetting decay factor of 0.5, and a penalty term coefficient of 1. For simplicity, the method in this invention is referred to as DFRAO in the experiments.

[0049] Experimental results: (1) Overall performance evaluation: As shown in Table 1. Retrain achieves the best performance through complete retraining. FedEraser and Crab have higher MISR due to retaining malicious client information, and Crab only selects a small number of honest clients, so its overall performance is lower than FedEraser. FedRecover uses warm-up and correction strategies to reduce ASR and MISR, but it relies on poisoned gradients, resulting in lower ACC. DFRAO decouples forgetting and recovery, improving ACC while reducing ASR and MISR. DFRAO outperforms FedEraser, FedRecover and Crab, and is closest to Retrain. On average, compared with the baseline algorithm, DFRAO improves ACC by 11.04%, reduces ASR by 18.92%, and reduces MISR by 12.62%.

[0050] Table 1. Overall performance evaluation of each method under different datasets and attack strategies.

[0051] (2) Comparison of computational costs: As shown in Table 2. FedEraser's computational cost per round is even higher than Retrain's due to the deviation of its historical gradient correction strategy from the optimal path. FedRecover uses L-BFGS to calculate the Hessian matrix, resulting in the highest computational cost. Crab reduces its cost by selecting storage rounds and client gradients, achieving a cost 0.57% lower than Retrain, but in some scenarios, resuming training is more difficult and time-consuming. DFRAO employs an approximation-style relaxed acceleration optimization algorithm, efficiently approaching the optimal results of Retrain. Meanwhile, DFRAO's computational cost is significantly lower than Retrain, decreasing by 14.56%.

[0052] Table 2. Comparison of computational costs of different methods under different datasets and attack strategies

[0053] (3) Storage overhead: As shown in Table 3, Retrain and FedRecover store the gradients of all clients for all rounds, with a storage overhead of FedEraser every One round of storage, reduced to Crab further filters rounds and clients, reducing storage overhead to... However, it still stores a large number of gradients from honest clients. DFRAO only stores gradients from all rounds of all malicious clients, when... At that time, storage overhead In a 25% malicious client experiment, DFRAO's storage overhead was 10.94% lower than Crab and 23.25% lower than Retrain.

[0054] Table 3. Comparison of storage overhead for each method. It is the total number of clients. It is the size of the gradient update. It is the total number of rounds. and It involves selecting the storage rounds and the ratio of clients. and These represent the number of malicious and honest clients, respectively.

[0055] (4) Communication cost: Retrain, FedRecover, and Crab need to transmit all gradient updates stored on the server to the client, resulting in high communication costs. In contrast, DFRAO performs the forgetting process entirely on the server side, with no additional communication overhead except for recovering gradient updates from training.

[0056] (5) Stability: FedEraser and Crab rely on historical gradient updates for correction, and the optimization path bias leads to training oscillations. FedRecover adopts a training strategy similar to Retrain, which makes some rounds smooth, but the prediction bias of L-BFGS in calculating the Hessian matrix still causes oscillations. DFRAO calculates the upper bound of the distance to the optimal solution of Retrain and optimizes the recovery training with a loss penalty term, achieving fast convergence and improving stability.

[0057] (6) Scalability: Although DFRAO decouples malicious client forgetting, residual pollution may still exist, making it difficult to completely match Retrain. However, DFRAO can provide new initial models for recovery training for other recovery algorithms and achieve optimizations that approximate Retrain based on their original recovery training. When FedEraser, FedRecover, and Crab are combined with DFRAO, ACC is improved, ASR and MISR are reduced, and the overall performance is better.

[0058] In the above embodiments, a decoupled malicious client forgetting algorithm is introduced during the forgetting phase. By relying only on the historical gradient updates of a small number of malicious clients and the global model updates, the actual impact of malicious clients on the global model in each round is accurately calculated. Simultaneously, referencing the memory decay mechanism in cognitive neuroscience, a forgetting decay function is designed to model the time decay of malicious gradient effects, avoiding the need to store historical data from all clients and significantly reducing the storage and communication overhead of the recovery process. In the optimization phase, the mathematical expression of the upper limit of the parameter distance between the initial model and the retrained optimal model is further explored under the assumption of differentiability of the loss function, thereby constructing an approximate recovery training optimization objective function. This optimization function introduces a weight penalty term to constrain the convergence space of the model training path, effectively suppressing oscillations without sacrificing model performance, and improving the stability and convergence speed of the training process.

[0059] In another preferred embodiment based on the above embodiments, such as Figure 2 As shown, this embodiment provides a poisoning model recovery device based on forgetting decoupling and acceleration optimization, including: a memory and a processor.

[0060] Specifically, the memory stores computer program instructions; the processor is electrically connected to the memory and is configured to execute the stored computer program instructions, wherein: the processor is further configured to generate local gradient updates based on local data and upload the local gradient updates to the server, whereby the server performs security aggregation based on a poisoning defense strategy; the processor is further configured to obtain the gradient increments of each malicious client based on historical gradient updates uploaded by the client and construct a forgetting decay function based on the difference between the training epoch of the malicious client's gradient and the epoch of the target global model, and evaluate the impact score of the malicious gradient; the processor is further configured to remove the evaluated malicious gradient impact score from the target global model weights to obtain the initial model weights for retraining; the processor is further configured to determine the upper limit of the parameter distance between the retrained initial model and the retrained optimal model under the assumption that the loss function satisfies differentiability; the processor is further configured to construct a penalty term for retraining based on the upper limit of the parameter distance, constrain the optimization path, and construct a retraining optimization objective function containing the original loss term and the penalty term; the processor is further configured to use honest clients to perform retraining iterations on the optimization objective function, and the server summarizes the updated gradients and continues to optimize until the model converges or reaches a preset number of epochs.

[0061] It is understood that the poisoning model recovery method and apparatus based on forgetting decoupling and accelerated optimization in the above embodiments of the present invention have the same beneficial effects, and will not be described in detail here.

[0062] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program goods. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program goods embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0063] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program goods according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0064] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0065] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for recovering a poisoning model based on forgetting decoupling and relaxed acceleration optimization, characterized in that, include: The client generates local gradient updates based on local data and uploads the local gradient updates to the server. The server performs security aggregation based on the poisoning defense strategy. Based on historical gradient updates uploaded by the client, obtain the gradient increment of each malicious client; Based on the difference between the training epoch of the malicious client's gradient and the epoch of the target global model, a forgetting decay function is constructed to evaluate the impact score of the malicious gradient; The malicious gradient impact score after evaluation is removed from the target global model weights to obtain the initial model weights for retraining. Under the assumption that the loss function is differentiable, determine the upper limit of the parameter distance between the initial model after retraining and the optimal model after retraining; Based on the upper limit of the parameter distance, a penalty term for recovery training is constructed to constrain the optimization path, and a recovery training optimization objective function containing the original loss term and the penalty term is constructed. The honest client performs recovery training iterations to optimize the objective function, while the server aggregates the updated gradients and continues to optimize until the model converges or reaches the preset number of rounds. When obtaining the gradient increments for each malicious client, the following is included: Obtain the set of all gradients across all clients, and obtain the average gradient of the entire set of gradients; Obtain the malicious client to be evaluated, remove the gradient of the malicious client from the entire gradient set, and obtain the average gradient of the remaining clients, which is denoted as the removed average gradient. Based on the relationship between the overall average gradient and the removed average gradient, obtain the gradient increment of the malicious client to be evaluated; The evaluation of the impact score of malicious gradients includes: obtaining the generation round corresponding to each malicious gradient increment, denoted as the first round; obtaining the training round of the target global model, denoted as the second round; substituting the round difference between the two into an exponential decay function to generate the decay degree of each malicious gradient, wherein the decay degree decreases exponentially as the round difference increases; and obtaining the impact score of the malicious gradient on the target global model based on the relationship between each malicious gradient increment and its corresponding decay degree, thus constituting the actual malicious impact score. When removing the evaluated malicious gradient impact score from the target global model weights to obtain the restored initial model weights, the following steps are included: Obtain the first model weight corresponding to the target global model as the basic input for the initial model weight of the recovery training; sum the gradient influence scores of all malicious clients in all rounds to obtain the total malicious influence; call the forgetting decay factor set in the recovery training phase as a hyperparameter to control the step size during the optimization process; obtain the influence correction amount according to the relationship between the forgetting decay factor and the total malicious influence; take the first model weight as the benchmark, remove the influence correction amount from the weight to generate the initial model weight of the recovery training, and record it as the second model weight; Under the assumption that the loss function is differentiable, determining the upper bound of the parameter distance between the initial retrained model and the optimal retrained model includes: Call the loss function used in the recovery training phase, and obtain the gradient of the loss function at the position corresponding to the weight of the second model to obtain the gradient vector at the corresponding position; The gradient vector is subjected to norm calculation to obtain the gradient strength index at the weights of the model. The preset forgetting decay factor is invoked, and the upper limit of the parameter distance between the initial model weights of the restored training and the target optimal model for retraining is determined based on the relationship between the gradient strength index and the preset forgetting decay factor. When constructing the penalty term for retraining based on the upper limit of parameter distance, the process includes: obtaining the square norm of the difference between the current retraining model weights and the initial retraining model weights; obtaining the regularization term based on the relationship between the square norm and the preset penalty coefficient, and determining the regularization term as the penalty term for retraining.

2. The poisoning model recovery method based on forgetting decoupling and relaxed acceleration optimization as described in claim 1, characterized in that, When constructing the objective function for recovery training that includes the original loss term and the penalty term, the process includes: obtaining the original local loss function of the client; obtaining the Euclidean distance between the current recovery training model weights and the initial recovery training model weights, and using the square of the Euclidean distance as the weight penalty term; setting a predetermined penalty term weight coefficient to weight the weight penalty term; and summing the local loss function and the weighted penalty term to construct the objective loss function for recovery training.

3. The poisoning model recovery method based on forgetting decoupling and relaxed acceleration optimization as described in claim 2, characterized in that, When using honest clients to perform recovery training iterations on the optimization objective function, the following steps are taken: selecting clients to participate in recovery training, including only honest clients that have not been identified as malicious; Each honest client obtains its local model gradient update by minimizing the recovery training optimization objective function based on its local training data. Upload the local gradient updates of each honest client to the server; The received local gradient updates are aggregated to generate new global model weights, which are then sent to the client. Repeat the above client-side training and server-side aggregation process until the global model's performance on the validation set meets the preset convergence condition or reaches the upper limit of the training rounds.

4. The poisoning model recovery method based on forgetting decoupling and relaxed acceleration optimization as described in claim 3, characterized in that, The server aggregates and continuously optimizes the updated gradients until the model converges or reaches a preset number of rounds. This includes: obtaining the set of local model gradient updates uploaded by honest clients as the aggregation input for the current round; merging the client gradient updates into new global model gradients or weights based on a preset aggregation strategy selection mechanism; updating the current global model parameters and broadcasting the updated model weights to all participating honest clients for training.

5. A poisoning model recovery device based on forgetting decoupling and accelerated optimization, applicable to the poisoning model recovery method based on forgetting decoupling and relaxed accelerated optimization as described in any one of claims 1-4, characterized in that, include: Memory is used to store computer program instructions; The processor, electrically connected to the memory, is configured to execute instructions from a stored computer program, wherein: The processor is also configured to generate local gradient updates based on local data and upload the local gradient updates to the server, which performs security aggregation based on the poisoning defense strategy. The processor is also configured to update historical gradients based on client uploads, obtain gradient increments for each malicious client, and construct a forgetting decay function based on the difference between the training epoch of the malicious client gradient and the epoch of the target global model to evaluate the impact score of the malicious gradient. The processor is also configured to remove the evaluated malicious gradient impact score from the target global model weights to obtain the restored initial model weights; The processor is also configured to determine the upper bound of the parametric distance between the initial model after retraining and the optimal model after retraining, under the assumption that the loss function is differentiable; The processor is also configured to construct a penalty term for resuming training based on the upper limit of the parameter distance, constrain the optimization path, and construct a resuming training optimization objective function that includes the original loss term and the penalty term; The processor is also configured to use an honest client to perform recovery training iterations on the optimization objective function, and the server aggregates the updated gradients and continues to optimize until the model converges or reaches a preset number of rounds.

Images