Symbol consistency-based asynchronous federated backdoor defense method, system and equipment

Abstract

The invention discloses an asynchronous federated backdoor defense method, system and device based on symbol consistency. The method comprises the following steps: constructing a key parameter dimension set corresponding to each client; calculating a symbol consistency ratio of each layer corresponding to each client based on the key parameter dimension set corresponding to each client; combining the symbol consistency ratios of the same layer of each client according to a time sequence, and constructing a symbol consistency ratio sequence; according to the symbol consistency ratio sequence and polynomial approximation, a least square regression equation is constructed, and the polynomial approximation is constructed based on a polynomial fitting coefficient; calculating a fitting error according to a symbol consistency ratio sequence and polynomial approximation in the evolution process of capturing the symbol consistency ratio along with time by adopting a least square regression equation; and based on the polynomial fitting coefficient and the fitting error, identifying and filtering malicious clients to realize asynchronous federated backdoor defense. The malicious client can be accurately detected, and the backdoor defense effect is improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an asynchronous federated backdoor defense method, system and device based on symbolic consistency. Background Technology

[0002] Existing backdoor defense methods are typically tailored for synchronous federated learning (SFL) and are not applicable to asynchronous federated learning (AFL). Synchronous federated learning is generally divided into two types: (1) robust aggregation, which relies on comparing or sorting multiple updates within the same round, and therefore cannot be applied to asynchronous federated learning scenarios where updates are received one by one. (2) model refinement, which cannot completely eliminate backdoor threats from malicious clients. In addition, excessive post-processing of the global model will negatively impact its efficiency, especially in asynchronous settings, where model convergence is already challenging due to client heterogeneity. Since backdoor defense efforts under asynchronous federated learning mainly focus on untargeted poisoning attacks, the defense effect against backdoor attacks is poor. Summary of the Invention

[0003] This application aims to propose an asynchronous federated backdoor defense method, system, and device based on symbolic consistency, which can accurately detect malicious clients, effectively mitigate various backdoor attacks, maintain good task performance, and improve backdoor defense effectiveness.

[0004] In a first aspect, embodiments of this application provide an asynchronous federated backdoor defense method based on symbolic consistency, the method comprising: Based on the updated parameter dimensions and sliding window of the model for multiple clients, calculate the average sign consistency for each parameter dimension for each client, and calculate the average update magnitude for each parameter dimension for each client. The average update magnitude of each parameter dimension for each client is sorted, and multiple key parameter dimensions for each client are selected based on the sorting results to construct a set of key parameter dimensions for each client. Based on the key parameter dimension set corresponding to each client, calculate the symbol consistency ratio for each client at each layer; Combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence; Based on the symbol consistency ratio sequence and the polynomial approximation, a least squares regression equation is constructed, wherein the polynomial approximation is constructed based on the polynomial fitting coefficients. In the process of capturing the evolution of the sign consistency ratio over time using the least squares regression equation, the fitting error is calculated based on the sign consistency ratio sequence and the polynomial approximation. Based on the polynomial fitting coefficients and the fitting error, malicious clients are identified and filtered to achieve asynchronous federated backdoor defense.

[0005] Compared with the prior art, the first aspect of this application has the following beneficial effects: This method calculates the average signed consistency (SSI) for each parameter dimension of each client based on the updated parameter dimensions and sliding window of multiple clients, and also calculates the average update magnitude for each parameter dimension of each client. The average update magnitudes for each parameter dimension of each client are sorted, and multiple key parameter dimensions corresponding to each client are selected based on the sorting results to construct a key parameter dimension set for each client. Based on the key parameter dimension set for each client, the SSI ratio for each layer of each client is calculated. The SSI ratios for the same layer of each client are combined in chronological order to construct a SSI ratio sequence. A least-squares regression equation is constructed based on the SSI ratio sequence and a polynomial approximation, where the polynomial approximation is based on polynomial fitting coefficients. While using the least-squares regression equation to capture the evolution of the SSI ratio over time, the fitting error is calculated based on the SSI ratio sequence and the polynomial approximation. Based on the polynomial fitting coefficients and the fitting error, malicious clients are identified and filtered to achieve asynchronous federated backdoor defense. Thus, by selecting multiple key parameter dimensions corresponding to each client based on the ranking results, and then calculating the symbol consistency ratio (SCR) for each layer of each client based on the set of key parameter dimensions corresponding to each client, attacks concentrated at specific layers can be detected, thereby avoiding the dilution of the global SCR and capturing potential abnormal update patterns. By combining the two key indicators of polynomial fitting coefficient and fitting error to identify and filter malicious clients, not only can the long-term directional trend of client updates be captured, but also short-term inconsistencies can be captured, thereby enhancing the separability between benign and malicious client ports. Therefore, malicious clients can be accurately detected, effectively mitigating various backdoor attacks, maintaining good task performance, and improving backdoor defense effectiveness.

[0006] In some implementations, calculating the fitting error based on the sign consistency ratio sequence and the polynomial approximation includes: The residuals for all times are obtained by subtracting the sign consistency ratio corresponding to each time in the sign consistency ratio sequence from its corresponding polynomial. The fitting error is obtained by summing the residuals at all times.

[0007] In some implementations, the step of identifying and filtering malicious clients based on the polynomial fitting coefficients and the fitting error to achieve asynchronous federated backdoor defense includes: Based on the polynomial fitting coefficients, the z-score is calculated, and malicious clients are identified based on the z-score to obtain the first identification result; Based on the fitting error, a fitting error vector is constructed, and a malicious client is identified based on the fitting error vector to obtain a second identification result; Based on the first and second identification results, malicious clients are filtered to achieve asynchronous federated backdoor defense.

[0008] In some implementations, the step of calculating the z-score based on the polynomial fitting coefficients and identifying the malicious client based on the z-score to obtain a first identification result includes: Obtain the set of polynomial fitting coefficients for each layer of all clients; Calculate the mean and standard deviation of the fitting coefficients based on the set of polynomial fitting coefficients for each layer of all clients. Based on the mean of the fitting coefficients and the standard deviation of the fitting coefficients, calculate the z-score for each client. If the z-score corresponding to each client is greater than a predefined threshold, it is identified as a malicious client. This process continues until the z-scores corresponding to all clients are identified, and the first identification result is obtained.

[0009] In some implementations, the step of identifying malicious clients based on the fitting error vector to obtain a second identification result includes: Based on the fitting error vector, an isolated forest is used to identify malicious clients, resulting in a second identification result.

[0010] In some implementations, calculating the average symbolic consistency for each parameter dimension for each client based on the updated parameter dimensions and sliding window for multiple clients includes: ; in, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions Indicates a sliding window. This indicates the current total number of communication rounds. Indicates an indicator function, Represents a symbolic function. Indicates the first The client in the first The first under the wheel One parameter dimension, Indicates the first The client in the first The first under the wheel One parameter dimension, and Take a positive integer.

[0011] In some implementations, calculating the symbolic consistency ratio for each client at each layer based on the key parameter dimension set corresponding to each client includes: ; in, Indicates the first The client in the first The first under the wheel Layer symbol consistency ratio, Indicates the first The client corresponding to the first The key parameter dimension set of the layer Indicates an indicator function, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions , and Take a positive integer.

[0012] Secondly, embodiments of this application also provide an asynchronous federated backdoor defense system based on symbolic consistency, the system comprising: The first calculation unit is used to calculate the average sign consistency for each parameter dimension of each client and the average update magnitude for each parameter dimension of each client, based on the updated parameter dimensions and sliding window of the models of multiple clients. The first construction unit is used to sort the average update magnitude of each parameter dimension corresponding to each client, and select multiple key parameter dimensions corresponding to each client according to the sorting result to construct a set of key parameter dimensions corresponding to each client. The second calculation unit is used to calculate the symbol consistency ratio of each client for each layer based on the key parameter dimension set corresponding to each client. The second building unit is used to combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence. The third construction unit is used to construct a least squares regression equation based on the symbol consistency ratio sequence and the polynomial approximation, wherein the polynomial approximation is constructed based on the polynomial fitting coefficients. The third calculation unit is used to calculate the fitting error based on the sign consistency ratio sequence and the polynomial approximation during the process of capturing the evolution of the sign consistency ratio over time using the least squares regression equation. The backdoor defense unit is used to identify and filter malicious clients based on the polynomial fitting coefficients and the fitting error, so as to achieve asynchronous federated backdoor defense.

[0013] Thirdly, embodiments of this application also provide an electronic device, including at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, the instructions being executed by the at least one control processor to enable the at least one control processor to perform an asynchronous federated backdoor defense method based on symbol consistency as described above.

[0014] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to execute an asynchronous federated backdoor defense method based on symbolic consistency as described above.

[0015] It is understood that the beneficial effects of the second to fourth aspects compared with the related technologies are the same as the beneficial effects of the first aspect compared with the related technologies. Please refer to the relevant description in the first aspect above, which will not be repeated here. Attached Figure Description

[0016] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a flowchart illustrating an embodiment of the asynchronous federated backdoor defense method based on symbolic consistency provided in this application; Figure 2 This is a schematic diagram of the overall process of the asynchronous federated backdoor defense method in the best embodiment of the symbolic consistency-based asynchronous federated backdoor defense method provided in this application; Figure 3 This is a schematic diagram comparing the task accuracy of backdoor defense performance under different levels of non-iid data distribution in the best embodiment of the asynchronous federated backdoor defense method based on symbolic consistency provided in this application; Figure 4 This is a schematic diagram comparing the attacker success rate of backdoor defense performance under different levels of non-iid data distribution in the best embodiment of the asynchronous federated backdoor defense method based on symbolic consistency provided in this application; Figure 5 This is a schematic diagram of the structure of an embodiment of the asynchronous federated backdoor defense system based on symbolic consistency provided in this application; Figure 6 This is a schematic diagram of the structure of an embodiment of the electronic device provided in this application. Detailed Implementation

[0017] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0018] In the description of this application, the use of terms such as "first," "second," etc., is for the purpose of distinguishing technical features only and should not be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated or the order of the technical features indicated.

[0019] In the description of this application, it should be understood that the orientation descriptions, such as up, down, etc., are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0020] In the description of this application, it should be noted that, unless otherwise explicitly defined, terms such as "setup," "installation," and "connection" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this application in conjunction with the specific content of the technical solution.

[0021] First, let's analyze some of the terms used in this application: Backdoor attack: A targeted poisoning attack in which the attacker intends to make the model make incorrect judgments about data with certain specific characteristics, but the model does not affect the main task.

[0022] Federated Learning (FL): Federated learning is a collaborative modeling approach that leverages data held by various nodes to improve model performance, while ensuring data privacy, security, and legal compliance.

[0023] Synchronous Federated Learning (SFL) is a classic federated learning paradigm in which multiple clients collaborate in each iteration to train the model. In this model, all participants must adhere to a unified schedule, waiting for each client to complete its local computation and return the results to the central server before each global update.

[0024] Asynchronous Federated Learning (AFL): In AFL, the central server updates the global model immediately upon receiving an update from any client, without waiting for all clients to complete training.

[0025] Non-independent and identically distributed (non-IID): This refers to a situation where the local data held by the various clients (devices or organizations) participating in federated learning exhibits significant differences in statistical distribution. This heterogeneity in data distribution directly affects the convergence and performance of the global model.

[0026] FedAsync aggregation rule: A model aggregation rule for asynchronous federated learning, specifically designed to handle dynamic client participation and asynchronous updates. Its core idea is that the server immediately aggregates updates upon receiving local model updates from any client, without waiting for all clients to complete training, thus solving the "slow client" problem in synchronous federated learning.

[0027] Attacker Success Rate (Main Task Accuracy, ASR): ASR evaluates the effectiveness of an attacker implanting a backdoor in the global model, representing the accuracy of the global model in handling backdoor tasks. The lower the ASR, the better the defense performance.

[0028] Attack Success Rate (ACC): ACC measures the overall accuracy of the model on the main task. It represents the proportion of correctly classified instances in the dataset and reflects the overall performance of the model on the main task.

[0029] Sign Consistency Ratio (SCR): This is a fine-grained metric that captures anomalous update patterns on the most influential parameters.

[0030] Existing backdoor defense methods are typically tailored for synchronous federated learning (SFL) and are not applicable to asynchronous federated learning (AFL). Synchronous federated learning is generally divided into two types: (1) robust aggregation, which relies on comparing or sorting multiple updates within the same round, and therefore cannot be applied to asynchronous federated learning scenarios where updates are received one by one. (2) model refinement, which cannot completely eliminate backdoor threats from malicious clients. In addition, excessive post-processing of the global model will negatively impact its efficiency, especially in asynchronous settings, where model convergence is already challenging due to client heterogeneity. Since backdoor defense efforts under asynchronous federated learning mainly focus on untargeted poisoning attacks, the defense effect against backdoor attacks is poor.

[0031] To address the problems existing in the prior art, this application proposes an asynchronous federated backdoor defense method, system, and device based on symbolic consistency.

[0032] Reference Figure 1 This application provides a flowchart illustrating an asynchronous federated backdoor defense method based on symbolic consistency. This method is applied to electronic devices, such as servers or mobile terminals. Figure 1 As shown, this asynchronous federated backdoor defense method based on symbolic consistency may include the following steps: Step S101: Based on the updated parameter dimensions and sliding window of the model for multiple clients, calculate the average sign consistency for each parameter dimension for each client, and calculate the average update magnitude for each parameter dimension for each client. Step S102: Sort the average update magnitude of each parameter dimension for each client, and select multiple key parameter dimensions for each client according to the sorting results to construct a set of key parameter dimensions for each client. Step S103: Based on the key parameter dimension set corresponding to each client, calculate the symbol consistency ratio for each layer corresponding to each client; Step S104: Combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence; Step S105: Construct the least squares regression equation based on the sign consistency ratio sequence and the polynomial approximation. The polynomial approximation is constructed based on the polynomial fitting coefficients. Step S106: In the process of capturing the evolution of the sign consistency ratio over time using the least squares regression equation, calculate the fitting error based on the sign consistency ratio sequence and the polynomial approximation. Step S107: Based on the polynomial fitting coefficients and fitting error, identify and filter malicious clients to achieve asynchronous federated backdoor defense.

[0033] In this embodiment, the average symbolic consistency for each client under each parameter dimension is calculated based on the updated parameter dimensions and sliding window of multiple clients, and the average update magnitude for each client under each parameter dimension is also calculated. The average update magnitude for each client under each parameter dimension is sorted, and multiple key parameter dimensions for each client are selected according to the sorting results to construct a set of key parameter dimensions for each client. Based on the set of key parameter dimensions for each client, the symbolic consistency ratio for each layer for each client is calculated. The symbolic consistency ratios for the same layer of each client are combined in chronological order to construct a symbolic consistency ratio sequence. A least squares regression equation is constructed based on the symbolic consistency ratio sequence and a polynomial approximation, where the polynomial approximation is based on polynomial fitting coefficients. In the process of capturing the evolution of the symbolic consistency ratio over time using the least squares regression equation, the fitting error is calculated based on the symbolic consistency ratio sequence and the polynomial approximation. Based on the polynomial fitting coefficients and the fitting error, malicious clients are identified and filtered to achieve asynchronous federated backdoor defense. Thus, by selecting multiple key parameter dimensions corresponding to each client based on the ranking results, and then calculating the symbol consistency ratio (SCR) for each layer of each client based on the set of key parameter dimensions corresponding to each client, attacks concentrated at specific layers can be detected, thereby avoiding the dilution of the global SCR and capturing potential abnormal update patterns. By combining the two key indicators of polynomial fitting coefficient and fitting error to identify and filter malicious clients, not only can the long-term directional trend of client updates be captured, but also short-term inconsistencies can be captured, thereby enhancing the separability between benign and malicious client ports. Therefore, malicious clients can be accurately detected, effectively mitigating various backdoor attacks, maintaining good task performance, and improving backdoor defense effectiveness.

[0034] The updated parameter dimensions of the models from the aforementioned clients can be directly received by the server from the updated parameter dimensions of the models from the clients, without the need for calculation.

[0035] The above calculation of the average update magnitude for each parameter dimension for each client can be achieved by summing the absolute values ​​of the parameter dimension updates under the same dimension across multiple communication rounds, and then averaging the summation results to obtain the average update magnitude for each parameter dimension for each client.

[0036] The above sorting of the average update magnitude for each parameter dimension for each client can be done by sorting the average update magnitude for each parameter dimension for each client in descending order.

[0037] The above method of selecting multiple key parameter dimensions for each client based on the sorting results can be achieved by selecting the top K% of the largest key parameter dimensions based on the sorting results to obtain multiple key parameter dimensions for each client.

[0038] In some implementations, the fitting error is calculated based on the sign consistency ratio sequence and the polynomial approximation, including: The residuals for all times are obtained by subtracting the sign consistency ratio corresponding to each time in the sign consistency ratio sequence from its corresponding polynomial. The fitting error is obtained by summing the residuals at all times.

[0039] In this embodiment, the fitting error is obtained by accumulating the residuals corresponding to all times, which can lay a good data foundation for accurate detection of malicious clients in the later stage.

[0040] The above time can be a timestamp recorded for each client throughout the entire communication process, and the timestamps can be converted into time.

[0041] In some implementations, malicious clients are identified and filtered based on polynomial fitting coefficients and fitting errors to achieve asynchronous federated backdoor defense, including: The z-score is calculated based on the polynomial fitting coefficients, and the malicious client is identified based on the z-score to obtain the first identification result; Based on the fitting error, a fitting error vector is constructed, and malicious clients are identified based on the fitting error vector to obtain a second identification result; Based on the first and second identification results, malicious clients are filtered to achieve asynchronous federated backdoor defense.

[0042] In this embodiment, by combining two key indicators, the polynomial fitting coefficient and the fitting error, malicious clients are identified and filtered. This not only captures the long-term directional trend of client updates but also captures short-term inconsistencies, thereby enhancing the separability between benign and malicious client ports.

[0043] The above-mentioned filtering of malicious clients based on the first identification result and the second identification result can be achieved by filtering the malicious clients identified in the first identification result and the malicious clients identified in the second identification result.

[0044] In some implementations, a z-score is calculated based on the polynomial fitting coefficients, and a malicious client is identified based on the z-score to obtain a first identification result, including: Obtain the set of polynomial fitting coefficients for each layer of all clients; Calculate the mean and standard deviation of the fitting coefficients based on the set of polynomial fitting coefficients for each layer of all clients. Calculate the z-score for each client based on the mean and standard deviation of the fitting coefficients; If the z-score of each client is greater than a predefined threshold, it is identified as a malicious client. This process continues until the z-scores of all clients have been identified, at which point the first identification result is obtained.

[0045] In this embodiment, if the z-score corresponding to each client is greater than a predefined threshold, it indicates a significant deviation from the trend of the sign consistency ratio, thereby identifying malicious clients and improving the accuracy of malicious client detection.

[0046] The z-score mentioned above, also called the standard score, is the difference between a number and the mean, divided by the standard deviation.

[0047] The aforementioned predefined threshold can be a manually set threshold. In this embodiment, the value is 2, but other values ​​can also be used. This embodiment does not impose any specific limitations.

[0048] In some implementations, a second identification result is obtained by identifying malicious clients based on the fitting error vector, including: Based on the fitting error vector, an isolated forest is used to identify malicious clients, resulting in a second identification result.

[0049] In this embodiment, based on the fitting error vector, an isolated forest is used to identify malicious clients. This can identify clients whose updates lack trend stability and classify them as malicious clients, thereby improving the accuracy of malicious client detection.

[0050] The aforementioned isolated forest can be an anomaly detection method that starts from anomaly points, divides the area according to specified rules, and makes judgments based on the number of divisions.

[0051] In some implementations, the average signed consistency for each parameter dimension for each client is calculated based on the updated parameter dimensions and sliding window for multiple clients, including: ; in, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions Indicates a sliding window. This indicates the current total number of communication rounds. Indicates an indicator function, Represents a symbolic function. Indicates the first The client in the first The first under the wheel One parameter dimension, Indicates the first The client in the first The first under the wheel One parameter dimension, and Take a positive integer.

[0052] In this embodiment, by calculating the average symbolic consistency of each client under each parameter dimension, it is possible to obtain the different sensitivities of different layers to global performance and backdoor activation, thereby laying a good data foundation for accurately detecting malicious clients.

[0053] In some implementations, the symbolic consistency ratio for each layer is calculated based on the set of key parameter dimensions corresponding to each client, including: ; in, Indicates the first The client in the first The first under the wheel Layer symbol consistency ratio, Indicates the first The client corresponding to the first The key parameter dimension set of the layer Indicates an indicator function, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions , and Take a positive integer.

[0054] In this embodiment, by calculating the symbol consistency ratio (SCR) of each client for each layer based on the key parameter dimension set corresponding to each client, attacks concentrated in specific layers can be detected, thereby avoiding the dilution of the global SCR and capturing potential abnormal update patterns.

[0055] To facilitate understanding by those skilled in the art, a set of preferred embodiments is provided below: This embodiment proposes an asynchronous federated backdoor defense method based on symbolic consistency. It introduces the Top-K Symbolic Consistency Ratio (Top-K SCR) to capture anomalous update patterns exhibited by malicious clients on key parameters. Then, it models the SCR time series based on multinomial fitting and extracts the multinomial fitting coefficients and fitting error to capture long-term anomalous behavior patterns exhibited by malicious clients. Based on these metrics, this embodiment designs two types of client filtering mechanisms: one sensitive to fitting coefficients and the other sensitive to fitting errors. Extensive experiments show that the method in this embodiment can effectively defend against various backdoor attacks in asynchronous federated learning, and also exhibits good robustness in synchronous federated learning settings, non-independent and identically distributed (Non-IID) data scenarios, and adaptive attack environments.

[0056] Reference Figure 2 The backdoor defense in this embodiment includes two key steps: (1) Top-K SCR calculation: For each customer (one customer corresponds to one client), this embodiment selects the most influential parameter dimension of Top-K and calculates their (i.e., the most influential parameter dimension of Top-K) SCR to capture potential abnormal update patterns.

[0057] (2) Customer filtering based on time-based Top-K SCR: This embodiment constructs a time series of Top-K SCR values ​​and applies trend modeling to capture their global evolution over time, thereby enabling the detection of customers who consistently deviate from normal behavioral patterns.

[0058] The technical solution of this embodiment specifically includes the following contents: 1. Top-K SCR calculation.

[0059] Upon receiving model updates from each client, this embodiment first calculates the average signed consistency across model dimensions within the sliding window. By merging this window, this embodiment can mitigate short-term fluctuations caused by stochastic optimization and heterogeneous data, and reliably capture the directional trends of long-term client updates. Formally, it sets... Indicates client In the The first under the wheel Update each parameter dimension. Client Parameter dimensions The average symbolic consistency is defined as : (1); in, This represents the current total number of communication rounds (i.e., in federated learning, the server sends the model to the client once, the client trains the model once, and submits the updated model parameters back to the server once; this process is one communication round. Then, the current number of communication rounds is accumulated to obtain the current total number of communication rounds). Represents a symbolic function. Indicates client In the The first under the wheel Update of each parameter dimension Indicates the length of the sliding window. It is an indicator function that takes the value 1 when the signs are the same and 0 when the signs are different. The stability of the parameter signs is measured over recent rounds. A method is provided to capture anomalous update patterns that may only become apparent over extended training periods. In the high-dimensional parameter space of deep models, the importance of update direction varies across different dimensions. To better focus on the most critical regions of change, this embodiment further calculates the most recent... The average update magnitude for each parameter dimension in the round is defined as Based on average update magnitude Following the Top-K strategy, this embodiment selects the top K% of key parameter dimensions with the largest values ​​(i.e., the top K% average update magnitudes). (Parameter dimension corresponding to the maximum value) to form a set of key parameter dimensions. This step allows the defense mechanism to focus on the most influential parameters, where anomalous patterns introduced by malicious clients are more likely to manifest. Based on For each layer In this embodiment, the Top-K SCR is calculated as follows: (2); in, Indicates client In the The next round Top-K symbol consistency ratio (i.e., Top-KSCR) of a layer. Indicates an indicator function, It is a client In the The key parameter dimension set of each layer. The motivation for layered computation lies in the fact that different layers exhibit varying sensitivities to global performance and backdoor activation. Generally, shallow layers primarily affect feature extraction, while deeper layers are more directly linked to task decisions. By computing the SCR of each layer, attacks concentrated on specific layers can be detected, thus avoiding dilution of the global SCR.

[0060] In equation (2), this embodiment identifies two extreme sign behaviors: (1) high-frequency flipping ( (2) Complete stability ( ), where frequent changes in sign between adjacent rounds may indicate local perturbations or adversarial interference; The symbol remains unchanged across all rounds, which may correspond to a fixed backdoor feature or a lack of normal updates.

[0061] 2. Customer filtering based on time-based Top-K SCR.

[0062] Top-K SCR metrics quantify client update consistency across key parameter dimensions. However, SCR values ​​for malicious and benign clients may overlap within a single round, making short-term thresholds prone to missed detections and false positives. To address this issue, this embodiment simulates the temporal evolution of Top-K SCR values, capturing patterns exhibited by long-term anomalous malicious clients, such as continuous increases, decreases, or periodic fluctuations. Such behavior is rarely observed in benign clients. The proposed temporal Top-KSCR client filtering extends single-round detection to temporal behavioral analysis, thereby excluding clients that consistently deviate from normal patterns from aggregation. Specifically, it uses stable long-term behavioral curves and performs joint analysis of fitting coefficients and residuals, significantly improving the separability of malicious clients.

[0063] To achieve SCR trend detection, this embodiment first records the timestamp (which can be converted to time using techniques known to those skilled in the art) and the corresponding SCR value of each client throughout the communication process, thereby constructing an ordered time series. and ,in Indicates the first The time converted from a timestamp Indicates client exist The next time Layer symbol consistency ratio, This represents the symbol consistency ratio sequence. In AFL, the participation frequency and start time of clients vary, leading to inconsistencies in the time scale when directly comparing the original SCR curves. To address this issue, this embodiment normalizes the time series to eliminate differences caused by uneven communication intervals, thereby ensuring the comparability of client trends. The normalized time series is defined as... ,in and Representing the original time series The mean and standard deviation. Normalization preserves the time order while eliminating shifts and scale differences, thus placing client trends in a comparable space. The corresponding standardized time series. ,and Together, these constitute the foundational data for customer behavior trend modeling. To capture global trends in SCR over time, this embodiment uses least squares regression: (3); in, Indicates client exist The next time Layer symbol consistency ratio, Standardized time index of The degree polynomial approximation is defined as: (4); in, Indicates client and layers The set of polynomial fitting coefficients, Indicates the first Substandardized time index Polynomial fitting coefficients It can characterize the temporal evolution of consistent customer behavior, capturing patterns such as steady growth, gradual decline, or cyclical fluctuations. For each time period... In this embodiment, the residual is defined as: (5); in, Represents the residual. Indicates time Top-K symbol consistency ratio Standardized time index The Polynomial approximation.

[0064] Overall fitting error It can be quantified as: (6); The fitting error measures the deviation between the fitted polynomial and the observed SCR sequence, reflecting the degree of agreement between the fitting trend and the actual observed values. In this regression process, this embodiment focuses on the polynomial fitting coefficients. and fitting error Because malicious clients typically employ non-standard update strategies and targets, their fitting coefficients often deviate significantly from the overall mean, or their fitting errors often exhibit obvious outlier characteristics. By jointly analyzing these two key indicators, this embodiment captures both the long-term directional trend of client updates and short-term inconsistencies, thereby enhancing the separability between benign and malicious client interfaces. Based on polynomial fitting coefficients and fitting errors, this embodiment proposes the following two complementary client filtering methods: (1) Coefficient-aware client filtering based on z-score: This embodiment analyzes the distribution of polynomial fitting coefficients across all clients and calculates their corresponding z-scores. Specifically, for clients... The The first layer The order polynomial fitting coefficients, z-score is defined as follows: ,in Indicates client In the The first layer Polynomial fitting coefficients of order 1 This represents the set of corresponding polynomial fit coefficients from all clients. and These represent the mean (i.e., the mean of the fit coefficients) and standard deviation (i.e., the standard deviation of the fit coefficients) of the set, respectively. When the client's z-score exceeds a predefined threshold in any polynomial fit coefficient (e.g., ...), When this occurs, it indicates a significant deviation from the trend of the symbol consistency ratio, thus identifying a malicious client and obtaining the first identification result. This deviation reflects a systematic change in the update direction, typically corresponding to a malicious client attempting to inject a persistent backdoor during training.

[0065] (2) Error-aware client filtering based on isolated forest: This embodiment analyzes the fitting error distribution of all clients. Benign clients are expected to exhibit a relatively stable update trend, with fitting errors remaining within a reasonable range. Conversely, highly fluctuating fitting errors indicate excessive randomness or deliberately induced noise in the client's updates. Formally, let the client... In the The polynomial fitting error on the layer is denoted as Then, this embodiment constructs the first on all clients. The fitting error vector of the layer is ,in This represents the total number of clients. To detect anomalies, this embodiment calculates the fitting error vector for all layers. Isolation forests are applied to identify clients whose updates lack trend stability (i.e., malicious clients are identified, resulting in a secondary identification result). This anomaly typically reflects malicious manipulation inconsistent with the global training objective.

[0066] This embodiment proposes an asynchronous federated backdoor defense method based on symbolic consistency, which uses only the symbol of model updates to capture anomalous update patterns in key parameter dimensions. By modeling the temporal evolution of the Signed Response Code (SCR) through multinomial fitting, and utilizing the fitting coefficients and fitting error, a time-based client filtering strategy based on Top-K SCR is designed, capable of accurately detecting malicious clients. This embodiment effectively mitigates various backdoor attacks, maintains good task performance, and demonstrates strong resilience under SFL and non-iid settings, even resisting adaptive attacks.

[0067] To better illustrate this point, some experiments were conducted in this embodiment, and the results are as follows: like Figure 3 and Figure 4 As shown, Figure 3 and Figure 4 x-coordinate The parameters representing the sampling from the Dirichlet distribution are used to control the degree of non-iid. Figure 3 The ordinate ACC represents the task accuracy. Figure 4 The vertical axis, ASR, represents the attacker's success rate. MR, PGD, Neurotoxin, and LFBA are all existing backdoor attack methods. No Defense, Kardam, AFLGuard, and Zeno are existing backdoor sample defense mechanisms, which will not be specifically described in this embodiment. Among all attack methods and backdoor samples, the method in this embodiment (i.e....) Figure 3 and Figure 4 Compared to other defense methods (such as Kardam, AFLGuard, and Zeno), the method in this embodiment achieves the lowest ASR while maintaining a high ACC, demonstrating strong resilience against backdoor attacks and minimal impact on model utility. Furthermore, this embodiment is not limited to AFL; it also integrates seamlessly with SFL, providing robust and stable defense performance across different FL paradigms, and exhibiting excellent versatility and applicability in practical federated learning deployments.

[0068] This embodiment proposes an asynchronous federated backdoor defense method based on symbolic consistency, introducing the Top-K Symbolic Consistency Ratio (SCR). By modeling the temporal evolution of the Top-K SCR value using polynomial fitting, it can capture long-term anomalous patterns exhibited by malicious clients, such as increasing, continuously decreasing, or periodic fluctuations. The design of this embodiment achieves the following key objectives: (1) Mitigating backdoor threats: Effectively identify and filter malicious model updates from compromised clients to prevent aggregated global models from exhibiting backdoor behavior, effectively mitigating various backdoor attacks. The defense should be robust to various backdoor samples and strategies, thus requiring no modifications.

[0069] (2) Maintain main task performance: Maintain high accuracy on clean data and minimize any degradation of main task performance to ensure that the defense does not compromise the overall learning objective and maintain good task performance.

[0070] (3) Universal applicability: It is compatible with SFL settings to ensure effective defense against backdoor attacks under different FL paradigms.

[0071] Reference Figure 5 This application also provides an asynchronous federated backdoor defense system based on symbolic consistency. The system includes a first computing unit 501, a first construction unit 502, a second computing unit 503, a second construction unit 504, a third construction unit 505, a third computing unit 506, and a backdoor defense unit 507, wherein: The first calculation unit 501 is used to calculate the average sign consistency of each client for each parameter dimension and the average update magnitude of each client for each parameter dimension based on the updated parameter dimensions and sliding window of the models of multiple clients. The first construction unit 502 is used to sort the average update magnitude of each parameter dimension corresponding to each client, and select multiple key parameter dimensions corresponding to each client according to the sorting result to construct a set of key parameter dimensions corresponding to each client. The second calculation unit 503 is used to calculate the symbol consistency ratio of each client for each layer based on the key parameter dimension set corresponding to each client. The second building unit 504 is used to combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence. The third building unit 505 is used to construct the least squares regression equation based on the sign consistency ratio sequence and the polynomial approximation. The polynomial approximation is constructed based on the polynomial fitting coefficients. The third calculation unit 506 is used to calculate the fitting error based on the sign consistency ratio sequence and polynomial approximation during the process of capturing the evolution of the sign consistency ratio over time using the least squares regression equation. Backdoor defense unit 507 is used to identify and filter malicious clients based on polynomial fitting coefficients and fitting errors to achieve asynchronous federated backdoor defense.

[0072] It should be noted that since the asynchronous federated backdoor defense system based on symbolic consistency in this embodiment is based on the same inventive concept as the asynchronous federated backdoor defense method based on symbolic consistency described above, the corresponding content in the method embodiment is also applicable to this system embodiment, and will not be described in detail here.

[0073] Reference Figure 6 This application also provides an electronic device, which includes: At least one memory; At least one processor; At least one program; The program is stored in memory, and the processor executes at least one program to implement the above-described symbolic consistency-based asynchronous federated backdoor defense method of this disclosure.

[0074] This electronic device can be any smart terminal, including mobile phones, tablets, personal digital assistants (PDAs), and in-vehicle computers.

[0075] The electronic devices according to embodiments of this application will now be described in detail.

[0076] The processor 1600 can be implemented using a general-purpose central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this disclosure. The memory 1700 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1700 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1700 and is called and executed by the processor 1600 to execute the symbolic consistency-based asynchronous federated backdoor defense method of the embodiments of this disclosure.

[0077] The input / output interface 1800 is used to implement information input and output. The communication interface 1900 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 2000 transmits information between various components of the device (e.g., processor 1600, memory 1700, input / output interface 1800, and communication interface 1900); The processor 1600, memory 1700, input / output interface 1800 and communication interface 1900 are connected to each other within the device via bus 2000.

[0078] This disclosure also provides a storage medium, which is a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the above-described symbolic consistency-based asynchronous federated backdoor defense method.

[0079] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0080] The embodiments described in this disclosure are for the purpose of more clearly illustrating the technical solutions of this disclosure and do not constitute a limitation on the technical solutions provided by this disclosure. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by this disclosure are also applicable to similar technical problems.

[0081] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this disclosure, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0082] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0083] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0084] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0085] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0086] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0087] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0088] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0089] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. The embodiments of this application have been described in detail above with reference to the accompanying drawings, but this application is not limited to the above embodiments. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of this application.

[0090] The embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of this application.

Claims

1. An asynchronous federated backdoor defense method based on symbolic consistency, characterized in that, The method includes: Based on the updated parameter dimensions and sliding window of the model for multiple clients, calculate the average sign consistency for each parameter dimension for each client, and calculate the average update magnitude for each parameter dimension for each client. The average update magnitude of each parameter dimension for each client is sorted, and multiple key parameter dimensions for each client are selected based on the sorting results to construct a set of key parameter dimensions for each client. Based on the key parameter dimension set corresponding to each client, calculate the symbol consistency ratio for each client at each layer; Combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence; Based on the symbol consistency ratio sequence and the polynomial approximation, a least squares regression equation is constructed, wherein the polynomial approximation is constructed based on the polynomial fitting coefficients. In the process of capturing the evolution of the sign consistency ratio over time using the least squares regression equation, the fitting error is calculated based on the sign consistency ratio sequence and the polynomial approximation. Based on the polynomial fitting coefficients and the fitting error, malicious clients are identified and filtered to achieve asynchronous federated backdoor defense.

2. The asynchronous federated backdoor defense method based on symbolic consistency according to claim 1, characterized in that, The step of calculating the fitting error based on the sign consistency ratio sequence and the polynomial approximation includes: The residuals for all times are obtained by subtracting the sign consistency ratio corresponding to each time in the sign consistency ratio sequence from its corresponding polynomial. The fitting error is obtained by summing the residuals at all times.

3. The asynchronous federated backdoor defense method based on symbolic consistency according to claim 1, characterized in that, The method of identifying and filtering malicious clients based on the polynomial fitting coefficients and the fitting error to achieve asynchronous federated backdoor defense includes: Based on the polynomial fitting coefficients, the z-score is calculated, and malicious clients are identified based on the z-score to obtain the first identification result; Based on the fitting error, a fitting error vector is constructed, and a malicious client is identified based on the fitting error vector to obtain a second identification result; Based on the first and second identification results, malicious clients are filtered to achieve asynchronous federated backdoor defense.

4. The asynchronous federated backdoor defense method based on symbolic consistency according to claim 3, characterized in that, The step of calculating the z-score based on the polynomial fitting coefficients and identifying malicious clients based on the z-score to obtain a first identification result includes: Obtain the set of polynomial fitting coefficients for each layer of all clients; Calculate the mean and standard deviation of the fitting coefficients based on the set of polynomial fitting coefficients for each layer of all clients. Based on the mean of the fitting coefficients and the standard deviation of the fitting coefficients, calculate the z-score for each client. If the z-score corresponding to each client is greater than a predefined threshold, it is identified as a malicious client. This process continues until the z-scores corresponding to all clients are identified, and the first identification result is obtained.

5. The asynchronous federated backdoor defense method based on symbolic consistency according to claim 3, characterized in that, The process of identifying malicious clients based on the fitted error vector to obtain a second identification result includes: Based on the fitting error vector, an isolated forest is used to identify malicious clients, resulting in a second identification result.

6. The asynchronous federated backdoor defense method based on symbolic consistency according to claim 1, characterized in that, The step of calculating the average sign consistency for each parameter dimension for each client based on the updated parameter dimensions and sliding window of the model from multiple clients includes: ； in, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions Indicates a sliding window. This indicates the current total number of communication rounds. Indicates an indicator function, Represents a symbolic function. Indicates the first The client in the first The first under the wheel One parameter dimension, Indicates the first The client in the first The first under the wheel One parameter dimension, and Take a positive integer.

7. The asynchronous federated backdoor defense method based on symbolic consistency according to claim 1, characterized in that, The calculation of the symbolic consistency ratio for each client at each layer, based on the key parameter dimension set corresponding to each client, includes: ； in, Indicates the first The client in the first The first under the wheel Layer symbol consistency ratio, Indicates the first The client corresponding to the first The key parameter dimension set of the layer Indicates an indicator function, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions , and Take a positive integer.

8. An asynchronous federated backdoor defense system based on symbolic consistency, characterized in that, The system includes: The first calculation unit is used to calculate the average sign consistency for each parameter dimension of each client and the average update magnitude for each parameter dimension of each client, based on the updated parameter dimensions and sliding window of the models of multiple clients. The first construction unit is used to sort the average update magnitude of each parameter dimension corresponding to each client, and select multiple key parameter dimensions corresponding to each client according to the sorting result to construct a set of key parameter dimensions corresponding to each client. The second calculation unit is used to calculate the symbol consistency ratio of each client for each layer based on the key parameter dimension set corresponding to each client. The second building unit is used to combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence. The third construction unit is used to construct a least squares regression equation based on the symbol consistency ratio sequence and the polynomial approximation, wherein the polynomial approximation is constructed based on the polynomial fitting coefficients. The third calculation unit is used to calculate the fitting error based on the sign consistency ratio sequence and the polynomial approximation during the process of capturing the evolution of the sign consistency ratio over time using the least squares regression equation. The backdoor defense unit is used to identify and filter malicious clients based on the polynomial fitting coefficients and the fitting error, so as to achieve asynchronous federated backdoor defense.

9. An electronic device, characterized in that, It includes at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, which, when executed by the at least one control processor, enable the at least one control processor to perform the symbolic consistency-based asynchronous federated backdoor defense method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to perform the symbolic consistency-based asynchronous federated backdoor defense method as described in any one of claims 1 to 7.

Images