Federal learning defense method and system based on hierarchical similarity weighting

Abstract

The invention relates to the technical field of federated learning, in particular to a federated learning defense method and system based on hierarchical similarity weighting, and the method comprises the steps: distributing global models to clients, carrying out local training, and obtaining model updating parameters uploaded by the clients; determining a cosine similarity score of the first client on the first layer of the model according to the model updating parameters uploaded by the first client; determining a user level weight according to the cosine similarity score of the first client in the hierarchy; determining a hierarchical weight according to the cosine similarity score of the first client on the first layer of the model; and updating a global model by utilizing the hierarchical weight, the user-level weight and the model updating parameter of the first client. According to the federal learning defense method, the influence of abnormal gradient updating uploaded by a malicious client on a global model can be detected and weakened, and particularly non-target attacks and LP attacks can be defended.

Description

Technical Field

[0001] This application relates to the field of federated learning technology, and in particular to a federated learning defense method and system based on hierarchical similarity weighting. Background Technology

[0002] In federated learning environments, malicious clients employ model poisoning attacks specifically to manipulate the model update process. The core idea of ​​a model poisoning attack is for the attacker to directly forge or tamper with local model updates, causing the global model to deviate from the correct optimization direction during parameter aggregation, thus affecting its learning performance. Since the server relies solely on gradients uploaded by the client for model updates and cannot verify their authenticity, attackers can influence global model convergence by adjusting local gradients. Depending on the target, model poisoning attacks can be categorized into non-targeted attacks and targeted attacks.

[0003] Non-targeted poisoning attacks are a type of attack that modifies the uploaded gradient, causing the model's optimization direction to shift and resulting in a performance degradation across all classes. Currently, more advanced non-targeted attacks include Min-Max attacks, Min-Sum attacks, and Fang attacks, among others.

[0004] Target layer poisoning attack (LP attack) is an attack method that poisons specific key layers of a federated learning model.

[0005] Traditional defense strategies are usually based on global gradient statistics, while LP attacks only affect a few key layers and therefore do not trigger anomaly detection in defense mechanisms. Currently, there is no effective defense method to limit the impact of LP attacks.

[0006] To detect and mitigate the impact of anomalous gradient updates uploaded by malicious clients on the global model, particularly in defense against non-targeted attacks and LP attacks, this application provides a federated learning defense method based on hierarchical similarity weighting. Summary of the Invention

[0007] To overcome the problems existing in related technologies, this application provides a federated learning defense method based on hierarchical similarity weighting, including: Towards Each client distributes the global model and performs local training on each client, obtaining... The model update parameters uploaded by each client, among which, It is an integer greater than or equal to 1; According to the The model update parameters uploaded by the client determine the first... The client in the model The cosine similarity score of the layers, where, ; According to the cosine similarity score of the first client in the model at the first layer, a layer-level weight is determined; According to the cosine similarity score of the first client in the model at the first layer, a layer-level weight is determined; The global model is updated using the layer-level weight of the first client, the user-level weight, and the model update parameter.

[0008] In an embodiment, the cosine similarity score of the first client in the model at the first layer is determined according to the model update parameter uploaded by the first client, specifically comprising: After receiving the local model update from the first client in each round of training, a cosine similarity matrix of each layer is constructed for the parameters of the layer; The elements of the cosine similarity matrix represent the similarity of the model update parameter of the first layer between the first client and the first client; For each client , a set is selected by selecting the most similar clients of the client at the first layer, and the average value of the corresponding similarity values is taken as the cosine similarity score.

[0009] In an embodiment, the user-level weight is determined according to the cosine similarity score of the first client in the model at the first layer, specifically comprising: The clients whose cosine similarity score at the first layer is greater than a preset score threshold are marked as high-similarity abnormal users and recorded in an abnormal user set ; The abnormal user set at the first layer whose number of clients is greater than a preset number threshold is marked as a layer-constituting high-risk layer set ; The abnormal performance frequency of the clients in the layer-constituting high-risk layer set is evaluated, and the user-level weight of each client is determined according to the abnormal performance frequency.

[0010] In an embodiment, the cosine similarity score of the i-th client in the j-th layer of the model determines the hierarchical weight, specifically comprising: determining the malicious update limit and the benign update limit of the current layer through the abnormal user set of the j-th layer, specifically comprising: The malicious update limit of the current layer is the minimum cosine similarity score of the high-similarity abnormal user set of the current layer, indicating the closest normal update in the malicious client. The benign update limit of the current layer is the set of potentially benign clients ranked in the top 50% of the user-level weight. The average of the cosine similarity scores of the current layer; The hierarchical weight of the i-th client in the j-th layer of the model is determined according to the malicious update limit and the benign update limit of the current layer. In an embodiment, the malicious update limit and the benign update limit of the current layer through the abnormal user set of the j-th layer specifically comprise: The calculation formula of the malicious update limit is:

[0011] The calculation formula of the benign update limit is:

[0012] wherein, is the malicious update limit, is the cosine similarity score of the i-th client in the j-th layer of the model.

[0013] In an embodiment, the malicious update limit and the benign update limit of the current layer through the abnormal user set of the j-th layer specifically comprise: The calculation formula of the benign update limit is:

[0014] wherein, is the benign update limit, is the set of potentially benign clients ranked in the top 50% of the user-level weight among all clients.​​​​​​​​​​​​​​​​​​​​​​

[0015] In one implementation, the boundary is updated based on malicious intent. and benign renewal boundaries Determine the first The client in the model The layer hierarchy weights specifically include: The formula for calculating hierarchical weights is:

[0016] in, For the first The client in the model Layer hierarchy weights.

[0017] In one implementation, the use of the first The updating of the global model using the client-level weights, user-level weights, and model update parameters specifically includes: The global update formula is:

[0018] in, For global aggregation updates of the global model, The total number of layers in the model. Total number of clients For the client User-level weight, For the client In the Layer hierarchy weights For the client In the The local model update of the layer uses normalized coefficients in the denominator to ensure numerical stability.

[0019] The second aspect of this application provides a layered similarity-weighted federated learning defense system for performing the steps in the federated learning defense method described in the first aspect of this application.

[0020] The technical solution provided in this application may include the following beneficial effects: The traditional federated learning security defense technology usually only focuses on single granularity or overall anomaly detection when dealing with layer selection poisoning attack (LP attack) and advanced non-target attack, and it is difficult to simultaneously consider precise identification of malicious clients and fine-grained control of the attack influence of local levels. In the detection stage, the present application realizes more fine-grained abnormal gradient detection by introducing a level cosine similarity score, and accurately identifies local attack behavior. By constructing a high-similarity abnormal user set and using an adaptive threshold adjustment strategy, the ability to capture potential abnormal gradient patterns is improved. In the defense stage, the user-level weight dynamic assignment mechanism proposed by the present application effectively weakens the influence of overall abnormal clients on the model, and at the same time, by calculating the level weight based on the level boundary, the malicious update of a specific level is accurately suppressed. The present application can more accurately detect and defend LP attack and advanced non-target attack in the actual federated learning environment, effectively avoid the misjudgment and misjudgment problems in the traditional method, and significantly enhance the security, robustness and generalization performance of the federated learning model.

[0021] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present application. BRIEF DESCRIPTION OF DRAWINGS

[0022] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which like reference characters refer to like parts throughout the figures, and in which:

[0023] Figure 1 A flowchart of a federated learning defense method shown in an embodiment of the present application; Figure 2 An architecture diagram of a federated learning defense system shown in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The preferred embodiments of the present application will be described herein below with reference to the accompanying drawings. Although the preferred embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0025] The terms used in the present application are merely for the purpose of describing specific embodiments and are not intended to limit the present application. The singular forms "a", "an" and "the" used in the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein means and includes any or all possible combinations of one or more associated listed items.

[0026] It should be understood that although the terms "first", "second", "third", etc. can be used in this application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information without departing from the scope of the application. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more features. In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0027] The existing federated learning defense method is difficult to cope with advanced non-target attacks and LP attacks. In order to reduce the risk of model poisoning attack faced by the federated learning system, the embodiment of the present application proposes a federated learning defense method based on hierarchical similarity weighting, which can effectively resist the poisoning behavior of malicious clients.

[0028] Figure 1 The flowchart of the federated learning defense method shown in the embodiment of the present application.

[0029] As shown in Figure 1 , the federated learning defense method of the embodiment of the present application includes the following steps in combination with Figure 1 Specifically, it includes steps 101 to 105.

[0030] 101, distribute the global model to the client and respectively perform local training to obtain the model update parameters uploaded by the client.

[0031] Wherein, is an integer greater than or equal to 1.

[0032] 102, determine the cosine similarity score of the th client in the model layer according to the model update parameters uploaded by the th client.

[0033] Wherein, .

[0034] In step 102, after receiving the local model update from the client in each round of training, the cosine similarity matrix of each layer will be constructed for the parameters of the layer; the element of the cosine similarity matrix represents the th client and the th client between the Model update parameter similarity of a layer.

[0035] Specifically, after receiving the model update parameters from clients in each round of training, the server constructs a cosine similarity matrix of each layer for the parameters of the layer, which is used to measure the consistency of the gradient direction among the clients. The cosine similarity calculation formula is as follows:

[0036] wherein, denotes the inner product of vectors, denotes the norm, is the cosine similarity of the l-th layer of the i-th client and the j-th client, is the model update parameter of the i-th client in the l-th layer, is the model update parameter of the j-th client in the l-th layer. In the embodiments of the present application, the similarity measure can effectively characterize the consistency of the update behavior of each client at a specific layer. Since malicious clients usually perform attack tasks in the BC layer in coordination, their gradient directions tend to be consistent, and therefore they will exhibit significantly higher similarity than normal clients on these layers. To further refine the layer similarity features of individual clients, we calculate the cosine similarity score of each layer, i.e., LCSS, based on the similarity matrix

[0037]

[0038] Specifically, for each client , we select the most similar clients in the layer to form a set

[0039] , and then take the average of their corresponding similarity values as the LCSS score:

[0040] The LCSS score reflects whether the behavior of the client on the l-th layer is highly consistent, thereby revealing whether it is likely to form a coordinated attack pattern with other malicious clients. Compared with traditional global indicators, LCSS provides more discernible layer anomaly features, which can effectively identify local anomalies even when the overall update is still disguised as relatively normal.

[0041] ​​​​​​​​​In addition, LCSS as a modular and scalable metric, not only suitable for LP attacks, but also shows strong detection ability for more covert and collaborative non-target attacks such as Fang Attack, Min-Sum, etc.

[0042] The specific process is as follows: after completing the LCSS calculation of all clients at each layer, the server will screen out clients with LCSS values significantly higher than the average level from each layer, that is, judge that their update behavior is highly similar to other clients, and there is a risk of malicious collusion. For this purpose, we set an initial similarity threshold = 0.95, and use an adaptive descending strategy to gradually adjust the threshold value to ensure that potential anomalies can be effectively captured under different attack strengths and different data distributions.

[0043] In the first layer, for each client , judge whether the cosine similarity score meets the following conditions:

[0044] Wherein, is the preset score threshold.

[0045] If yes, mark it as a high-similarity abnormal user, and record it together with the corresponding LCSS value in the abnormal user set of this layer, defined as follows:

[0046] Wherein, represents the abnormal user set of the l-th layer, represents the cosine similarity score of client i in the l-th layer.

[0047] However, in some extreme cases, if no client meets the current threshold , in order to ensure the coverage and flexibility of the screening mechanism, the system will introduce a fixed step , and the threshold will be lowered until one of the following two conditions is met: 1. At least one client is identified and included in the set ; 2. The threshold is lowered to the lower limit value 0.

[0048] This dynamic adaptive screening mechanism maintains the stability and adaptability of detection under different attack intensities and data distribution scenarios, preventing potential threat clients from being missed due to improper static threshold settings. Through this method, the system can construct a more targeted and confident set of highly similar anomalous users, providing crucial decision-making support for subsequent weight adjustments and model aggregation processes, effectively mitigating the aggregation impact of anomalous gradients.

[0049] 103. According to the first A client in The cosine similarity scores at each level determine the user-level weights.

[0050] Furthermore, step 103 includes: 201. The first Clients whose cosine similarity scores in the layer are greater than a preset score threshold are marked as high-similarity abnormal users and recorded in the abnormal user set. middle; 202. The number of clients exceeding a preset threshold... abnormal user set of the layer The layers marked as high-risk layers constitute a set of high-risk layers. ; 203. The assessment layer constitutes a high-risk layer set. The frequency of abnormal behavior of the client is used to determine the user level weight of each client.

[0051] The specific process is as follows: After completing the collection of highly similar abnormal users at each layer... After construction, the number of clients in the set is counted and used as a criterion for determining whether that layer is an attack target. This application's embodiment sets the following criteria: If the number of clients marked as highly similar abnormal users in a certain layer meets the following condition... Then it is considered that the layer The high-risk layer, among which This is the number of most similar neighbors selected by each client in the LCSS calculation. The rationale for this setting is that if there are more than [number missing] similar neighbors in the same layer... If two clients are highly similar to each other, then that similarity is likely not accidental, but rather stems from coordinated attack behavior.

[0052] All layers that meet the conditions constitute a set of high-risk layers. The definition is as follows:

[0053] After identifying high-risk clusters Next, the system further evaluates the frequency of abnormal behavior of each client in these high-risk layers. We define a high-risk layer participation counter for each client to count how many high-risk layers it is identified as an abnormal user. Let the client... exist If a high-risk layer is marked as abnormal, its user-level weight will be... The calculation is as follows:

[0054] In this embodiment of the application, if the client The more frequently a phenomenon appears in a high-risk layer, the higher its correlation with potential attack behaviors, the lower its credibility, and its global aggregation weight should be significantly weakened. Conversely, if the client... The fact that it appears very infrequently or not at all in high-risk layers indicates that its update behavior is closer to the normal state, and its dominant role in the global model should be retained.

[0055] In complex non-IID data environments, this approach can significantly enhance the tolerance and stability of federated learning systems to anomalous behavior, providing a reliable behavioral benchmark for subsequent hierarchical weight adjustments and global aggregation.

[0056] 104. According to the first The client in the model The cosine similarity score of the layer determines the layer weight.

[0057] Furthermore, step 104 includes: 301. Through the first abnormal user set of the layer Determine the malicious update limit of the current layer and benign renewal boundaries .

[0058] Specifically, maliciously updating boundaries The calculation formula is:

[0059] in, To maliciously update boundaries, For the first The client in the model The cosine similarity score of the layer.

[0060] Benign renewal boundaries The calculation formula is:

[0061] in, To positively update boundaries, This represents the set of potentially benign clients that rank in the bottom 50% by user-level weight across all clients.

[0062] 302. Based on malicious boundary updates and benign renewal boundaries Determine the first The client in the model Layer hierarchy weights.

[0063] In step 302, the formula for calculating the hierarchical weights is:

[0064] in, For the first The client in the model Layer hierarchy weights.

[0065] For a certain layer Maliciously updating boundaries The set of users with abnormal similarity at this layer height The minimum similarity value in the matrix represents the closest update from a malicious client to a normal one, i.e.:

[0066] Benign renewal boundaries : By filtering the bottom 50% of all clients by user-level weight, a set of potentially beneficial clients is formed. Calculate the average LCSS value at that layer as the typical similarity range for benign behavior.

[0067]

[0068] The logic behind setting these two boundaries is that attackers often need to maintain a high degree of update similarity to improve the effectiveness of their attacks, while benign clients exhibit more natural fluctuations in the similarity they show during updates. Therefore, there is a statistical difference between the two in the LCSS distribution. Based on this, the boundary between benign and malicious updates can be clearly defined.

[0069] After obtaining these two boundaries, the system further dynamically weights the client's update behavior at this layer. We designed the following linear interpolation mechanism to calculate the similarity score of the client at this layer. Assign hierarchical weights to it :

[0070] The core idea of ​​the hierarchical weight allocation strategy is: When the similarity of client updates exceeds the malicious update threshold, its behavior is highly similar to the identified abnormal patterns and should be given the least weight. When its similarity is below the benign update threshold, its behavior is consistent with that of a normal client and should be given the highest weight. For updates falling between these two extremes, their weights are calculated smoothly using linear interpolation based on their degree of "close to malicious" or "close to benign" to ensure the continuity and robustness of weight adjustments.

[0071] This method allows the system to perform fine-grained measurement of the credibility of client updates at each layer, enabling a locally sensitive defense strategy. The influence of malicious clients at their key attack layers is precisely weakened, while their normal updates at unpoisoned layers are preserved; normal clients remain unaffected, ensuring a good balance between security and performance in the model.

[0072] Furthermore, since the hierarchical weighting mechanism is designed to be independent of user-level weights, the two can work synergistically during the aggregation process, forming a double-layered defense. This structure possesses excellent compatibility and modularity, maintaining high robustness against non-targeted attacks while effectively defending against more covert LP attacks, providing a unified and robust security guarantee for federated learning in diverse attack environments.

[0073] 105. Utilizing the first The hierarchical weights of each client, the user-level weights, and the model update parameters are used to update the global model.

[0074] Furthermore, in step 105, the global update formula is:

[0075] in, For global aggregation updates of the global model, The total number of layers in the model. Total number of clients For the client User-level weight, For the client In the Layer hierarchy weights For the client In the The local model update of the layer uses normalized coefficients in the denominator to ensure numerical stability.

[0076] By employing this joint weighted aggregation method, this invention can not only precisely weaken the local malicious updates of LP attacks at critical levels, but also effectively address the overall model perturbation caused by advanced non-targeted attacks, thereby significantly improving the overall robustness and generalization performance of the federated learning system in complex attack environments.

[0077] Based on the above-described federated learning defense method, this application embodiment also provides a federated learning defense system for executing the specific steps of the federated learning defense method described in this application embodiment.

[0078] like Figure 2 As shown, the federated learning defense system includes a server and K distributed clients. After each round of training begins, the server distributes the model to the clients, which then train the model locally and upload the updated model.

[0079] Specifically, the client trains a local model on its own device (such as a mobile terminal, IoT device, or personal computer) using its own data, generating local model parameter updates. After local training is complete, each client uploads the local model update data to the federated learning server via a secure network communication protocol (such as HTTPS).

[0080] After each round of training, the server receives model update parameters uploaded by each client and determines the user-level weights and hierarchical weights of each client according to the federated learning defense method described in the embodiments of this application. The server then performs weighted aggregation on the model update parameters based on the user-level weights and hierarchical weights.

[0081] The specific steps executed by the server are as follows: For each model layer of data uploaded by all clients, the server calculates the cosine similarity score between each client to identify abnormal update behavior of the clients.

[0082] The server analyzes the distribution of abnormal clients across different model layers based on the abnormal user set generated by the previous module. If the number of abnormal users in a certain model layer exceeds the system's set security threshold, that layer is marked as a high-risk layer.

[0083] The server counts the number of times each client is marked as an abnormal user in the high-risk layer, and uses this count to calculate the user-level weight. The more times a client appears in the high-risk layer, the higher the degree of abnormality, and therefore the lower the user-level weight; conversely, the fewer times a client appears in the high-risk layer, the higher the user-level weight.

[0084] The server determines the boundaries between benign and malicious updates for each model layer. First, it determines the similarity of the abnormal user in the set of high-similarity abnormal users that is closest to the normal update as the boundary for malicious updates. Then, it selects the bottom 50% of clients with higher user-level weights and calculates their average similarity as the boundary for benign updates.

[0085] The server assigns layer weights to clients at each layer based on their similarity level within the boundary between malicious and benign behavior. Weights are assigned by linear interpolation. The lower the client's update at a given layer, and the closer it is to the benign boundary, the higher its layer weight.

[0086] The server combines user-level weights and hierarchical weights to perform joint weighted aggregation of client updates. The server calculates the joint weighted average of all client updates for each model layer, and then aggregates the update data of each model layer to obtain the final global model update data, forming the final model update.

[0087] After aggregation is complete, the server pushes the updated global model parameters to each client for the next round of local training.

[0088] The solution of this application has been described in detail above with reference to the accompanying drawings. In the above embodiments, the descriptions of each embodiment have different emphases; parts not described in detail in a certain embodiment can be referred to in the relevant descriptions of other embodiments. Those skilled in the art should also understand that the actions and modules involved in the specification are not necessarily essential to this application. Furthermore, it is understood that the steps in the method of this application embodiment can be adjusted, combined, and deleted according to actual needs, and the modules in the device of this application embodiment can be combined, divided, and deleted according to actual needs.

[0089] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.

[0090] Alternatively, this application may be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing executable code (or computer program, or computer instruction code) thereon, which, when executed by a processor of an electronic device (or electronic device, server, etc.), causes the processor to perform part or all of the steps of the methods described above according to this application.

[0091] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in connection with the present application can be implemented as electronic hardware, computer software, or a combination of both.

[0092] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems and methods according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0093] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A federated learning defense method based on hierarchical similarity weighting, characterized in that, include: Towards Each client distributes the global model and performs local training on each client, obtaining... The model update parameters uploaded by each client, among which, It is an integer greater than or equal to 1; According to the The model update parameters uploaded by the client determine the first... The client in the model The cosine similarity score of the layers, where, ; According to the A client in The cosine similarity score in each level determines the user-level weight; According to the The client in the model The cosine similarity score of the layer determines the layer weight; Using the first The hierarchical weights of each client, the user-level weights, and the model update parameters are used to update the global model.

2. The federated learning defense method based on hierarchical similarity weighting according to claim 1, characterized in that, According to the first The model update parameters uploaded by the client determine the first... The client in the model The cosine similarity score of the layers specifically includes: Received from each round of training After the local model of each client is updated, it will be applied to each layer. The parameters are used to construct the cosine similarity matrix of this layer. The elements of the cosine similarity matrix Indicates the first The client and the first The first client The model updates the parameter similarity of the layers; For each client Select it in the first The most similar layer A set of clients Then, the average of the corresponding similarity values ​​is taken as the cosine similarity score.

3. The federated learning defense method based on hierarchical similarity weighting according to claim 2, characterized in that, According to the first A client in The cosine similarity scores at each level determine the user-level weights, specifically including: The first Clients whose cosine similarity scores in the layer are greater than a preset score threshold are marked as high-similarity abnormal users and recorded in the abnormal user set. middle; The number of clients exceeding the preset threshold abnormal user set of the layer The layers marked as high-risk layers constitute a set of high-risk layers. ; The assessment layer constitutes a high-risk layer set. The frequency of abnormal behavior of the client is used to determine the user level weight of each client.

4. The federated learning defense method based on hierarchical similarity weighting according to claim 3, characterized in that, According to the first The client in the model The cosine similarity score of the layer determines the layer weight, specifically including: Through the first abnormal user set of the layer Determine the malicious update limit of the current layer and benign renewal boundaries The malicious update boundary Set of users with abnormal current floor height similarity The least cosine similarity score represents the closest update to a normal update from a malicious client; the benign update boundary... A collection of potentially beneficial clients ranked in the bottom 50% by user-level weight. The average cosine similarity score at the current layer; According to malicious boundary updates and benign renewal boundaries Determine the first The client in the model Layer hierarchy weights.

5. A federated learning defense method based on hierarchical similarity weighting as described in claim 4, characterized in that, The passage through the first abnormal user set of the layer Determine the malicious update limit of the current layer and benign renewal boundaries Specifically, it includes: Maliciously updating boundaries The calculation formula is: in, To maliciously update boundaries, For the first The client in the model The cosine similarity score of the layer.

6. A federated learning defense method based on hierarchical similarity weighting as described in claim 5, characterized in that, The passage through the first abnormal user set of the layer Determine the malicious update limit of the current layer and benign renewal boundaries Specifically, it includes: Benign renewal boundary The calculation formula is: in, To positively update boundaries, This represents the set of potentially benign clients that rank in the bottom 50% by user-level weight across all clients.

7. A federated learning defense method based on hierarchical similarity weighting as described in claim 6, characterized in that, The claim based on maliciously updated boundaries and benign renewal boundaries Determine the first The client in the model The layer hierarchy weights specifically include: The formula for calculating hierarchical weights is: in, For the first The client in the model Layer hierarchy weights.

8. A federated learning defense method based on hierarchical similarity weighting according to claim 7, characterized in that, The use of the first The updating of the global model using the client-level weights, user-level weights, and model update parameters specifically includes: The global update formula is: in, For global aggregation updates of the global model, The total number of layers in the model. Total number of clients For the client User-level weight, For the client In the Layer hierarchy weights For the client In the The local model is updated in the layer, with the normalized coefficient in the denominator to ensure numerical stability.

9. A federated learning defense system based on hierarchical similarity weighting, for performing the steps in the federated learning defense method according to any one of claims 1 to 8.

Images