Asynchronous federated backdoor defense method, system and device based on symbol consistency

Abstract

The application discloses a symbol consistency-based asynchronous federated backdoor defense method, system and equipment. The method comprises the following steps: constructing a key parameter dimension set corresponding to each client; calculating a symbol consistency ratio of each layer corresponding to each client based on the key parameter dimension set corresponding to each client; combining the symbol consistency ratios of each client at the same layer in time sequence to construct a symbol consistency ratio sequence; constructing a least square regression equation according to the symbol consistency ratio sequence and a polynomial approximation, wherein the polynomial approximation is constructed based on polynomial fitting coefficients; calculating a fitting error according to the symbol consistency ratio sequence and the polynomial approximation in the process of capturing the evolution of the symbol consistency ratio with time by using the least square regression equation; and identifying and filtering malicious clients based on the polynomial fitting coefficients and the fitting error, so as to realize asynchronous federated backdoor defense. The application can accurately detect malicious clients and improve the backdoor defense effect.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an asynchronous federated backdoor defense method, system and device based on symbolic consistency. Background Technology

[0002] Existing backdoor defense methods are typically tailored for synchronous federated learning (SFL) and are not applicable to asynchronous federated learning (AFL). Synchronous federated learning is generally divided into two types: (1) robust aggregation, which relies on comparing or sorting multiple updates within the same round, and therefore cannot be applied to asynchronous federated learning scenarios where updates are received one by one. (2) model refinement, which cannot completely eliminate backdoor threats from malicious clients. In addition, excessive post-processing of the global model will negatively impact its efficiency, especially in asynchronous settings, where model convergence is already challenging due to client heterogeneity. Since backdoor defense efforts under asynchronous federated learning mainly focus on untargeted poisoning attacks, the defense effect against backdoor attacks is poor. Summary of the Invention

[0003] This application aims to propose an asynchronous federated backdoor defense method, system, and device based on symbolic consistency, which can accurately detect malicious clients, effectively mitigate various backdoor attacks, maintain good task performance, and improve backdoor defense effectiveness.

[0004] In a first aspect, embodiments of this application provide an asynchronous federated backdoor defense method based on symbolic consistency, the method comprising:

[0005] Based on the updated parameter dimensions and sliding window of the model for multiple clients, calculate the average sign consistency for each parameter dimension for each client, and calculate the average update magnitude for each parameter dimension for each client.

[0006] The average update magnitude of each parameter dimension for each client is sorted, and multiple key parameter dimensions for each client are selected based on the sorting results to construct a set of key parameter dimensions for each client.

[0007] Based on the key parameter dimension set corresponding to each client, calculate the symbol consistency ratio for each client at each layer;

[0008] Combine the symbolic consistency ratios of each client at the same layer in chronological order to construct a symbolic consistency ratio sequence;

[0009] Based on the symbol consistency ratio sequence and the polynomial approximation, a least squares regression equation is constructed, wherein the polynomial approximation is constructed based on the polynomial fitting coefficients.

[0010] In the process of capturing the evolution of the sign consistency ratio over time by using the least square regression equation, a fitting error is calculated according to the sequence of the sign consistency ratio and the polynomial approximation;

[0011] Based on the polynomial fitting coefficients and the fitting error, a malicious client is identified and filtered to achieve asynchronous federated backdoor defense.

[0012] Compared with the prior art, the first aspect of the present application has the following beneficial effects:

[0013] The method calculates the average sign consistency of each client corresponding to each parameter dimension according to the parameter dimension of the model updated by the plurality of clients and the sliding window, and calculates the average update amplitude of each client corresponding to each parameter dimension. The average update amplitude of each client corresponding to each parameter dimension is sorted, and a plurality of key parameter dimensions corresponding to each client are selected according to the sorting result to construct a key parameter dimension set corresponding to each client. Based on the key parameter dimension set corresponding to each client, the sign consistency ratio of each layer corresponding to each client is calculated. The sign consistency ratios of the same layer of each client are combined in chronological order to construct a sequence of sign consistency ratios. According to the sequence of the sign consistency ratio and the polynomial approximation, a least square regression equation is constructed, and the polynomial approximation is constructed based on the polynomial fitting coefficients. In the process of capturing the evolution of the sign consistency ratio over time by using the least square regression equation, a fitting error is calculated according to the sequence of the sign consistency ratio and the polynomial approximation. Based on the polynomial fitting coefficients and the fitting error, a malicious client is identified and filtered to achieve asynchronous federated backdoor defense. In this way, by selecting a plurality of key parameter dimensions corresponding to each client according to the sorting result, and then calculating the sign consistency ratio of each layer corresponding to each client based on the key parameter dimension set corresponding to each client, attacks concentrated in a specific layer can be detected, thereby avoiding dilution of the global SCR, and potential abnormal update patterns can be captured. By combining the polynomial fitting coefficients and the fitting error, two key indicators are used to identify and filter malicious clients, which not only captures the long-term directional trend of client updates, but also captures short-term inconsistencies, thereby enhancing the separability between benign and malicious client ports. Therefore, malicious clients can be accurately detected, various backdoor attacks can be effectively mitigated, good task performance can be maintained, and backdoor defense effect can be improved.

[0014] In some embodiments, the calculation of the fitting error according to the sequence of the sign consistency ratio and the polynomial approximation comprises:

[0015] The sign consistency ratio corresponding to each time in the sequence of the sign consistency ratio is subtracted from the polynomial approximation corresponding thereto to obtain a residual corresponding to all times;

[0016] Cumulative all time corresponding to the residual error, get the fitting error.

[0017] In some embodiments, the based on the polynomial fitting coefficients and the fitting error, identify and filter malicious clients to achieve asynchronous federal backdoor defense, comprising:

[0018] According to the polynomial fitting coefficients, calculate the z-score, and identify the malicious client based on the z-score to obtain the first identification result;

[0019] According to the fitting error, construct a fitting error vector, and identify the malicious client based on the fitting error vector to obtain the second identification result;

[0020] Based on the first identification result and the second identification result, filter the malicious client to achieve asynchronous federal backdoor defense.

[0021] In some embodiments, the according to the polynomial fitting coefficients, calculate the z-score, and identify the malicious client based on the z-score to obtain the first identification result, comprising:

[0022] Get the set of polynomial fitting coefficients of each layer of all clients;

[0023] According to the set of polynomial fitting coefficients of each layer of all clients, calculate the fitting coefficient mean and the fitting coefficient standard deviation;

[0024] Based on the fitting coefficient mean and the fitting coefficient standard deviation, calculate the z-score corresponding to each client;

[0025] If the z-score corresponding to each client is greater than a predefined threshold, it is judged as a malicious client, until the z-score corresponding to all clients is judged to obtain the first identification result.

[0026] In some embodiments, the based on the fitting error vector, identify the malicious client to obtain the second identification result, comprising:

[0027] Based on the fitting error vector, use isolation forest to identify the malicious client to obtain the second identification result.

[0028] In some embodiments, the according to the model updated parameter dimension of multiple clients and the sliding window, calculate the average sign consistency of each client corresponding to each parameter dimension, comprising:

[0029] ;

[0030] Wherein, The average sign consistency of the i-th client corresponding to the j-th parameter dimension is represented as ​​ denotes a sliding window, denotes a current total communication round, denotes an indicator function, denotes a sign function, denotes the th parameter dimension of the th client in the th round, denotes the th parameter dimension of the th client in the th round, and is a positive integer.

[0031] In some embodiments, the calculating, based on the set of key parameter dimensions corresponding to each client, of a sign consistency ratio of each client corresponding to each layer, comprises:

[0032]

[0033] wherein, denotes a sign consistency ratio of the th layer of the th client in the th round, denotes a set of key parameter dimensions of the th layer corresponding to the th client, denotes an indicator function, denotes an average sign consistency of the th parameter dimension corresponding to the th client, and is a positive integer.

[0034] In a second aspect, the embodiments of the present application further provide an asynchronous federated backdoor defense system based on sign consistency, comprising:

[0035] a first calculation unit configured to calculate an average sign consistency of each parameter dimension corresponding to each client based on parameter dimensions of model updates of a plurality of clients and a sliding window, and calculate an average update amplitude of each parameter dimension corresponding to each client;

[0036] a first construction unit configured to sort the average update amplitude of each parameter dimension corresponding to each client, and select a plurality of key parameter dimensions corresponding to each client according to a sorting result to construct a set of key parameter dimensions corresponding to each client;

[0037] ​​a second calculation unit, configured to calculate a symbol consistency ratio of each client corresponding to each layer based on the key parameter dimension set corresponding to the client;

[0038] a second construction unit, configured to combine the symbol consistency ratios of each client corresponding to the same layer in time sequence to construct a symbol consistency ratio sequence;

[0039] a third construction unit, configured to construct a least square regression equation according to the symbol consistency ratio sequence and a polynomial approximation, the polynomial approximation being constructed based on polynomial fitting coefficients;

[0040] a third calculation unit, configured to calculate a fitting error according to the symbol consistency ratio sequence and the polynomial approximation in capturing the evolution process of the symbol consistency ratio over time by using the least square regression equation;

[0041] a backdoor defense unit, configured to identify and filter malicious clients based on the polynomial fitting coefficients and the fitting error to implement asynchronous federated backdoor defense.

[0042] In a third aspect, an embodiment of the present application further provides an electronic device, including at least one control processor and a memory connected with the at least one control processor in communication; the memory stores instructions executable by the at least one control processor, and the instructions are executed by the at least one control processor to enable the at least one control processor to execute the symbol consistency-based asynchronous federated backdoor defense method.

[0043] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium, which stores computer executable instructions for enabling a computer to execute the symbol consistency-based asynchronous federated backdoor defense method.

[0044] It can be understood that the beneficial effects of the second aspect to the fourth aspect compared with the related art are the same as the beneficial effects of the first aspect compared with the related art, and reference can be made to the related description in the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0045] The above and / or additional aspects and advantages of the present application will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0046] Figure 1 is a flowchart of an embodiment of the symbol consistency-based asynchronous federated backdoor defense method provided by the present application;

[0047] Figure 2is a schematic diagram of the overall flow of an asynchronous federated backdoor defense method in the best embodiment of the asynchronous federated backdoor defense method based on symbol consistency provided by the present application;

[0048] Figure 3 is a task accuracy comparison schematic diagram of backdoor defense performance under different levels of non-iid data distribution in the best embodiment of the asynchronous federated backdoor defense method based on symbol consistency provided by the present application;

[0049] Figure 4 is an attacker success rate comparison schematic diagram of backdoor defense performance under different levels of non-iid data distribution in the best embodiment of the asynchronous federated backdoor defense method based on symbol consistency provided by the present application;

[0050] Figure 5 is a structural schematic diagram of an embodiment of the asynchronous federated backdoor defense system based on symbol consistency provided by the present application;

[0051] Figure 6 is a structural schematic diagram of an embodiment of the electronic device provided by the present application. DETAILED DESCRIPTION

[0052] The embodiments of the present application are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0053] In the description of the present application, if the first, second, etc. are described, it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features or the sequence of the indicated technical features.

[0054] In the description of the present application, it should be understood that the orientation description, such as the orientation or position relationship indicated by up, down, etc. is based on the orientation or position relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the indicated device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present application.

[0055] In the description of the present application, it should be noted that, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and those skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.

[0056] First, the several terms involved in the present application are analyzed:

[0057] Backdoor Attack: A targeted poisoning attack where the attacker intends to make the model make incorrect judgments on data with certain specific characteristics, but the model does not affect the main task.

[0058] Federated Learning (FL): Federated learning is a method of building a model together by using data from multiple nodes while ensuring data privacy and legal compliance, to improve model performance.

[0059] Synchronous Federated Learning (SFL): A classic federated learning paradigm where multiple clients work together in each iteration to complete the training process of the model. In this mode, all participants must follow a unified schedule and wait for each client to complete local computation and return the result to the central server before each global update.

[0060] Asynchronous Federated Learning (AFL): In AFL, the central server updates the global model immediately after receiving updates from any client without waiting for all clients to complete training.

[0061] Non-independent and identically distributed (non-IID): Refers to the statistical distribution of local data held by each client (device or organization) participating in federated learning. This heterogeneity of data distribution directly affects the convergence and performance of the global model.

[0062] FedAsync aggregation rule: An aggregation rule for asynchronous federated learning designed to handle dynamic client participation and non-synchronous updates. The core idea is that the server aggregates local model updates from any client immediately after receiving them, without waiting for all clients to complete training, thus solving the "slow client" problem in synchronous federated learning.

[0063] Attacker success rate (ASR): ASR evaluates the effectiveness of the attacker in implanting a backdoor in the global model, representing the accuracy of the global model on the backdoor task. The lower the ASR, the better the defense performance.

[0064] Task accuracy (ACC): ACC measures the test accuracy of the global model on the main task, representing the proportion of correctly classified instances in the data set, reflecting the overall performance of the model on the main task.

[0065] Sign Consistency Ratio (SCR): This is a fine-grained metric that can capture abnormal update patterns on the most influential parameters.

[0066] Existing backdoor defense methods are usually tailored for synchronous federated learning (SFL) and are not applicable in asynchronous federated learning (AFL). SFL is usually divided into two types: (1) Robust aggregation, which relies on comparing or sorting multiple updates within the same round, so it cannot be applied to the asynchronous federated learning scenario where updates are received one by one. (2) Model refinement, which cannot completely eliminate the backdoor threat from malicious clients, and in addition, excessive post-processing of the global model has a negative impact on its efficiency, especially in asynchronous settings, where model convergence is already challenging due to client heterogeneity. Since backdoor defense in asynchronous federated learning mainly focuses on untargeted poisoning attacks, the defense effect against backdoor attacks is poor.

[0067] To solve the problems existing in the prior art, the present application provides an asynchronous federated backdoor defense method based on sign consistency, a system and a device.

[0068] Reference Figure 1 The flowchart of the asynchronous federated backdoor defense method based on sign consistency provided by the embodiments of the present application. The asynchronous federated backdoor defense method based on sign consistency is applied to an electronic device, which can be a server or a mobile terminal, etc. As shown in Figure 1 The asynchronous federated backdoor defense method based on sign consistency can include the following steps:

[0069] Step S101, according to the model update parameter dimension of each client and the sliding window, calculate the average sign consistency of each client corresponding to each parameter dimension, and calculate the average update amplitude of each client corresponding to each parameter dimension;

[0070] Step S102, sort the average update amplitude of each client corresponding to each parameter dimension, and select a plurality of key parameter dimensions corresponding to each client according to the sorting result, and construct a key parameter dimension set corresponding to each client;

[0071] Step S103, based on the key parameter dimension set corresponding to each client, calculate the sign consistency ratio of each client corresponding to each layer;

[0072] Step S104, combine the sign consistency ratios of each client in the same layer in chronological order to construct a sign consistency ratio sequence;

[0073] In step S105, a least square regression equation is constructed according to the symbol consistency ratio sequence and the polynomial approximation, and the polynomial approximation is constructed based on the polynomial fitting coefficients.

[0074] In step S106, a fitting error is calculated according to the symbol consistency ratio sequence and the polynomial approximation in the process of capturing the evolution of the symbol consistency ratio over time by using the least square regression equation.

[0075] In step S107, a malicious client is identified and filtered based on the polynomial fitting coefficients and the fitting error, so as to realize asynchronous federated backdoor defense.

[0076] In the embodiment, the average symbol consistency of each client corresponding to each parameter dimension is calculated according to the model updated parameter dimensions of the plurality of clients and the sliding window, and the average update amplitude of each client corresponding to each parameter dimension is calculated. The average update amplitude of each client corresponding to each parameter dimension is sorted, and a plurality of key parameter dimensions corresponding to each client are selected according to the sorting result to construct a key parameter dimension set corresponding to each client. The symbol consistency ratio of each client corresponding to each layer is calculated based on the key parameter dimension set corresponding to each client. The symbol consistency ratios of each client corresponding to the same layer are combined in chronological order to construct a symbol consistency ratio sequence. A least square regression equation is constructed according to the symbol consistency ratio sequence and the polynomial approximation, and the polynomial approximation is constructed based on the polynomial fitting coefficients. In the process of capturing the evolution of the symbol consistency ratio over time by using the least square regression equation, a fitting error is calculated according to the symbol consistency ratio sequence and the polynomial approximation. A malicious client is identified and filtered based on the polynomial fitting coefficients and the fitting error, so as to realize asynchronous federated backdoor defense. In this way, by selecting a plurality of key parameter dimensions corresponding to each client according to the sorting result, and then calculating the symbol consistency ratio of each client corresponding to each layer based on the key parameter dimension set corresponding to each client, an attack concentrated in a specific layer can be detected, so as to avoid dilution of the global SCR, and a potential abnormal update mode can be captured. By combining the polynomial fitting coefficients and the fitting error, two key indicators are used to identify and filter a malicious client, which can not only capture the long-term directional trend of client updates, but also capture short-term inconsistency, thereby enhancing the separability between benign and malicious client ports. Therefore, the malicious client can be accurately detected, various backdoor attacks can be effectively mitigated, good task performance can be maintained, and the backdoor defense effect can be improved.

[0077] The model updated parameter dimensions of the plurality of clients can be directly received by the server from the clients without calculation.

[0078] The average update amplitude of each parameter dimension corresponding to each client can be obtained by cumulatively summing the absolute values of the parameter dimension updates in the same dimension corresponding to multiple communication rounds, and then averaging the cumulative sum result.

[0079] The average update amplitude of each parameter dimension corresponding to each client can be sorted in descending order.

[0080] The multiple key parameter dimensions corresponding to each client can be selected according to the sorting result, that is, the top K% key parameter dimensions with the largest average update amplitude are selected to obtain the multiple key parameter dimensions corresponding to each client.

[0081] In some embodiments, the fitting error is calculated according to the symbol consistency ratio sequence and the polynomial approximation, including:

[0082] The residual error corresponding to each time in the symbol consistency ratio sequence is obtained by subtracting the polynomial approximation corresponding to the symbol consistency ratio.

[0083] The residual errors corresponding to all times are cumulatively obtained to obtain the fitting error.

[0084] In this embodiment, the fitting error is obtained by cumulatively accumulating the residual errors corresponding to all times, which can lay a good data foundation for later accurate detection of malicious clients.

[0085] The time can be a timestamp of each client recorded in the entire communication process, and the timestamp is converted into time.

[0086] In some embodiments, based on the polynomial fitting coefficient and the fitting error, the malicious client is identified and filtered to achieve asynchronous federated backdoor defense, including:

[0087] According to the polynomial fitting coefficient, the z-score is calculated, and the malicious client is identified based on the z-score to obtain a first identification result.

[0088] According to the fitting error, a fitting error vector is constructed, and the malicious client is identified based on the fitting error vector to obtain a second identification result.

[0089] Based on the first identification result and the second identification result, the malicious client is filtered to achieve asynchronous federated backdoor defense.

[0090] In the embodiment, the two key indicators of the polynomial fitting coefficient and the fitting error are combined to identify and filter the malicious clients, so that not only the long-term directional trend of the client update can be captured, but also the short-term inconsistency can be captured, thereby enhancing the separability between the benign and malicious client ports.

[0091] The filtering of the malicious clients based on the first identification result and the second identification result can be filtering the malicious clients identified in the first identification result and the malicious clients identified in the second identification result.

[0092] In some embodiments, a z-score is calculated according to the polynomial fitting coefficient, and the malicious clients are identified based on the z-score to obtain the first identification result, including:

[0093] A set of polynomial fitting coefficients of each layer of all clients is obtained.

[0094] The mean of the fitting coefficients and the standard deviation of the fitting coefficients are calculated according to the set of polynomial fitting coefficients of each layer of all clients.

[0095] A z-score corresponding to each client is calculated based on the mean of the fitting coefficients and the standard deviation of the fitting coefficients.

[0096] If the z-score corresponding to each client is greater than a predefined threshold, the client is determined to be a malicious client, until the z-score corresponding to all clients is determined to obtain the first identification result.

[0097] In the embodiment, if the z-score corresponding to each client is greater than the predefined threshold, it indicates that there is a significant deviation from the trend of the sign consistency ratio, thereby identifying the malicious client, and the accuracy of the detection of the malicious client can be improved.

[0098] The z-score is also called a standard score, which is a process of dividing the difference between a number and an average by a standard deviation.

[0099] The predefined threshold can be a threshold set by a person, and in the embodiment, the value is 2, or other numerical values can be taken, which is not specifically limited in the embodiment.

[0100] In some embodiments, the malicious clients are identified based on the fitting error vector to obtain the second identification result, including:

[0101] The isolation forest is used to identify the malicious clients based on the fitting error vector to obtain the second identification result.

[0102] In the embodiment, the isolation forest is used to identify the malicious clients based on the fitting error vector, which can identify the clients that lack trend stability in the update and regard the clients as malicious clients, thereby improving the accuracy of the detection of the malicious clients.

[0103] The aforementioned isolated forest can be an anomaly detection method that starts from anomaly points, divides the area according to specified rules, and makes judgments based on the number of divisions.

[0104] In some implementations, the average signed consistency for each parameter dimension for each client is calculated based on the updated parameter dimensions and sliding window for multiple clients, including:

[0105] ;

[0106] in, Indicates the first The client corresponds to the first Average sign consistency across all parameter dimensions Indicates a sliding window. This indicates the current total number of communication rounds. Indicates an indicator function, Represents a symbolic function. Indicates the first The client in the first The first under the wheel One parameter dimension, Indicates the first The client in the first The first under the wheel One parameter dimension, and Take a positive integer.

[0107] In this embodiment, by calculating the average symbolic consistency of each client under each parameter dimension, it is possible to obtain the different sensitivities of different layers to global performance and backdoor activation, thereby laying a good data foundation for accurately detecting malicious clients.

[0108] In some implementations, the symbolic consistency ratio for each layer is calculated based on the set of key parameter dimensions corresponding to each client, including:

[0109] ;

[0110] in, Indicates the first The client in the first The first under the wheel The sign consistency ratio of the layer, Indicates the first The client corresponding to the first The key parameter dimension set of the layer Indicates an indicator function, Indicates the first The client corresponds to the first average sign consistency in a parameter dimension, 、 and is a positive integer.

[0111] In this embodiment, by calculating the sign consistency ratio of each client corresponding to each layer based on the key parameter dimension set corresponding to each client, attacks concentrated in a specific layer can be detected, thereby avoiding dilution of the global SCR, and potential abnormal update patterns can be captured.

[0112] To facilitate the understanding of those skilled in the art, a set of preferred embodiments is provided below:

[0113] The embodiment proposes an asynchronous federated backdoor defense method based on sign consistency, introduces Top-K sign consistency ratio (Top-K SCR) to capture abnormal update patterns of malicious clients on key parameters, and then models the SCR time series based on polynomial fitting and extracts polynomial fitting coefficients and fitting errors to capture long-term abnormal behavior patterns of malicious clients. Based on the above indicators, the embodiment designs two types of client filtering mechanisms that are sensitive to fitting coefficients and fitting errors, respectively. A large number of experiments show that the method of the embodiment can effectively defend against various backdoor attacks in asynchronous federated learning, and also shows good robustness in synchronous federated learning settings, non-independent and identically distributed (Non-IID) data scenarios, and adaptive attack environments.

[0114] With reference to Figure 2 , the backdoor defense of the embodiment includes two key steps:

[0115] (1) Top-K SCR calculation: for each client (one client corresponds to one client), the embodiment selects the Top-K most influential parameter dimensions and calculates their SCR (i.e., the Top-K most influential parameter dimensions) to capture potential abnormal update patterns.

[0116] (2) Client filtering based on time Top-K SCR: the embodiment constructs a time series of Top-K SCR values and applies trend modeling to capture their global evolution over time, thereby being able to detect clients that always deviate from normal behavior patterns.

[0117] The technical solution of the embodiment specifically includes the following contents:

[0118] 1. Top-K SCR calculation.

[0119] After receiving the model updates from each client, the embodiment first computes the average sign consistency of its model updates and across model dimensions within a sliding window. By merging the window, the embodiment can mitigate the short-term fluctuations caused by stochastic optimization and heterogeneous data, and reliably capture the directional trends of the clients' long-term updates. Formally, let denote the update of the th parameter dimension of the th client in the th round. Let denote the average sign consistency of the parameter dimensions of the th client in the th round, which is defined as

[0120] (1).

[0121] where denotes the current total communication round (i.e., in federated learning, the server sends a model to the clients once, the clients train a model once, and submit the client-trained model parameter updates to the server once, which is one communication round, and then a cumulative is made for the current communication round to obtain the current total communication round), denotes the sign function, denotes the update of the th parameter dimension of the th client in the th round, denotes the length of the sliding window, is an indicator function that takes the value 1 when the signs are consistent and 0 otherwise. By measuring the stability of the parameter signs in the recent rounds, provides a method to capture abnormal update patterns that can only become apparent over an extended training period. In the high-dimensional parameter space of deep models, the importance of the update direction varies across dimensions. To better focus on the most critical changing areas, the embodiment further computes the average update magnitude of each parameter dimension in the recent rounds, defined as . Based on the average update magnitude , following the Top-K strategy, the embodiment selects the top K% of the most critical parameter dimensions (i.e., the parameter dimensions corresponding to the top K% of the average update magnitude maxima) to form the critical parameter dimension set . This step allows the defense mechanism to focus on the most influential parameters, where abnormal patterns introduced by malicious clients are more likely to manifest. Based on , for each layer , the embodiment computes its Top-K SCR as:

[0122] (2);

[0123] wherein, denotes a client In the first round of the Top-K Symbol Consistency Ratio (i.e., Top-K SCR) of the layer, denotes an indicator function, is the set of key parameter dimensions of the client In the first layer. The motivation of hierarchical computation is that different layers exhibit different sensitivity to global performance and backdoor activation. Generally, shallow layers mainly affect feature extraction, while deep layers are more directly linked to task decision-making. By computing the SCR of each layer, attacks concentrated in a particular layer can be detected, thus avoiding dilution of the global SCR.

[0124] In Equation (2), the embodiment determines two extreme symbol behaviors: (1) high-frequency flipping ( ), where the symbol frequently changes between adjacent rounds, possibly indicating local perturbation or adversarial interference; (2) complete stability ( ), where the symbol remains unchanged in all rounds, which may correspond to a fixed backdoor feature or lack of normal updates.

[0125] 2. Time-based Top-K SCR client filtering.

[0126] The Top-K SCR metric quantifies client update consistency over key parameter dimensions. However, the SCR values of malicious and benign clients may overlap within a round, making short-term thresholds prone to false negatives and false positives. To address this issue, the embodiment simulates the temporal evolution of Top-K SCR values, capturing patterns exhibited by long-term abnormal malicious clients, such as sustained increases, decreases, or periodic fluctuation trends. Such behavior is rarely observed in benign clients. The proposed time-based Top-K SCR client filtering extends single-round detection to temporal behavior analysis, enabling the exclusion of clients that consistently deviate from normal patterns from aggregation. Specifically, stable long-term behavior curves are fitted, and the joint analysis of fitting coefficients and residuals significantly improves the separability of malicious clients.

[0127] To implement SCR trend detection, the embodiment first records the timestamps (which can be converted to time using techniques known to those skilled in the art) and corresponding SCR values of each client throughout the entire communication process, thereby constructing an ordered time series and wherein denotes the time converted from the timestamp, denotes the symbol consistency ratio of the client In the layer at time denotes the symbol consistency ratio sequence. In AFL, the participation frequency and starting time of clients vary, leading to inconsistent time scales when directly comparing original SCR curves. To address this issue, this embodiment normalizes the time series to eliminate differences caused by non-uniform communication intervals, ensuring the comparability of client trends. The normalized time series is defined as where and denote the mean and standard deviation of the original time series , respectively. Normalization preserves the chronological order while eliminating translation and scale differences, thereby placing client trends in a comparable space. The corresponding normalized time series , together with constitute the basis data for modeling client behavior trends. To capture the global trend of SCR over time, this embodiment uses least squares regression:

[0128] (3);

[0129] where denotes the symbol consistency ratio of the client in the layer at time , denotes the th polynomial approximation of the normalized time index , defined as:

[0130] (4);

[0131] where denotes the polynomial fitting coefficient set of the client and layer , denotes the th normalized time index . The polynomial fitting coefficients can characterize the temporal evolution of client consistency behavior, capturing patterns such as steady growth, gradual decay, or periodic fluctuations. For each time , this embodiment defines the residual as:

[0132] (5);

[0133] where denotes the residual, denotes the time the Top-K symbol consistency ratio, the normalized time index the th polynomial approximation.

[0134] the overall fitting error can be quantified as:

[0135] (6).

[0136] The fitting error measures the deviation of the fitted polynomial from the observed SCR sequence and reflects the degree of consistency between the fitted trend and the actual observations. In this regression process, the present embodiment focuses on the polynomial fitting coefficients and the fitting error . Since malicious clients usually adopt non-standard update strategies and targets, the distribution of their fitting coefficients often deviates significantly from the overall mean, or their fitting errors often exhibit obvious outlier characteristics. By jointly analyzing these two key indicators, the present embodiment captures both the long-term directional trend of client updates and short-term inconsistency, thereby enhancing the separability between benign and malicious client ports. Based on the polynomial fitting coefficients and the fitting error, the present embodiment proposes the following two complementary client filtering methods:

[0137] (1) Coefficient-aware client filtering based on z-score: the present embodiment analyzes the distribution of the polynomial fitting coefficients across all clients and calculates their corresponding z-scores. Specifically, for the th polynomial fitting coefficient of the th layer from client , the z-score is defined as , where denotes the th polynomial fitting coefficient of the th layer from client , denotes the set of corresponding polynomial fitting coefficients from all clients, and denote the mean (i.e., fitting coefficient mean) and standard deviation (i.e., fitting coefficient standard deviation) of the set, respectively. When the z-score of a client exceeds a pre-defined threshold (e.g., ) for any polynomial fitting coefficient, this indicates a significant deviation from the trend of the symbol consistency ratio, thereby identifying malicious clients, resulting in a first identification result. This deviation reflects systematic changes in the update direction, which usually corresponds to attempts by malicious clients to inject persistent backdoors during training.

[0138] (2) Isolation Forest based error-aware client filtering: This embodiment analyzes the fitting error distribution of all clients. Benign clients are expected to show a relatively stable update trend, and the fitting error remains within a reasonable range. In contrast, a highly volatile fitting error indicates that the client's updates contain excessive randomness or deliberately induced noise. Formally, let the client The polynomial fitting error on the first layer is denoted as . Then, this embodiment constructs the fitting error vector of the first layer on all clients as , where denotes the total number of clients. To detect anomalies, this embodiment applies Isolation Forest to the fitting error vector of all layers, thereby identifying clients whose updates lack trend stability (i.e., identifying malicious clients, obtaining a second identification result). Such anomalies usually reflect malicious manipulation that is inconsistent with the global training objective.

[0139] This embodiment proposes an asynchronous federated backdoor defense method based on symbol consistency, which only uses the symbols of model updates to capture abnormal update patterns in key parameter dimensions. By modeling the time evolution of SCR using polynomial fitting, and using the fitting coefficients and fitting errors, a Top-K SCR based time-type client filtering strategy is designed, which can accurately detect malicious clients. This embodiment effectively mitigates various backdoor attacks, maintains good task performance, and shows strong resilience under SFL and non-iid settings, even against adaptive attacks.

[0140] To better illustrate, this embodiment conducts some experiments, and the experimental results are as follows:

[0141] As shown in Figure 3 and Figure 4 , the abscissa of Figure 3 and Figure 4 represents the parameter of Dirichlet distribution sampling, used to control the non-iid degree, and the ordinate ACC of represents the task accuracy; Figure 3 the ordinate ASR of Figure 4 represents the attacker success rate, where MR, PGD, Neurotoxin, and LFBA are all backdoor attack methods in the prior art, and No Defense, Kardam, AFLGuard, and Zeno are all backdoor sample defense mechanisms in the prior art, which are not specifically described in this embodiment. Among all attack methods and backdoor samples, the method of this embodiment (i.e. Figure 3 and Figure 4Compared with other defense methods (such as Kardam, AFLGuard and Zeno), the method of the embodiment realizes the lowest ASR while maintaining a high ACC, showing strong resilience to backdoor attacks and minimal impact on model utility. Moreover, the embodiment is not limited to AFL, but also seamlessly integrates with SFL, providing strong and stable defense performance in different FL paradigms, and showing good versatility and applicability in actual federated learning deployment.

[0142] The embodiment proposes an asynchronous federated backdoor defense method based on symbol consistency, and introduces a symbol consistency ratio Top-K SCR. Based on polynomial fitting, the time evolution of the Top-K SCR value is modeled, which can capture the long-term abnormal model exhibited by the malicious client, such as increasing, continuously decreasing or periodic fluctuation trend. The embodiment scheme design can meet the following key goals:

[0143] (1) Mitigate backdoor threats: effectively identify and filter malicious model updates from compromised clients to prevent the aggregated global model from exhibiting backdoor behavior, effectively mitigating various backdoor attacks. The defense should be robust to various backdoor samples and strategies, so that it does not need any modification.

[0144] (2) Maintain main task performance: maintain high accuracy on clean data and minimize any degradation of main task performance to ensure that the defense does not undermine the overall learning goal, maintaining good task performance.

[0145] (3) Universal applicability: compatible with SFL settings to ensure effective defense against backdoor attacks in different FL paradigms.

[0146] Reference Figure 5 The embodiment of the application also provides an asynchronous federated backdoor defense system based on symbol consistency, which comprises a first computing unit 501, a first constructing unit 502, a second computing unit 503, a second constructing unit 504, a third constructing unit 505, a third computing unit 506 and a backdoor defense unit 507, wherein:

[0147] The first computing unit 501 is configured to calculate the average symbol consistency of each parameter dimension corresponding to each client according to the parameter dimension of the model update of the plurality of clients and the sliding window, and calculate the average update amplitude of each parameter dimension corresponding to each client.

[0148] The first constructing unit 502 is configured to sort the average update amplitude of each parameter dimension corresponding to each client, and select a plurality of key parameter dimensions corresponding to each client according to the sorting result, and construct a key parameter dimension set corresponding to each client.

[0149] The second computing unit 503 is configured to calculate a symbol consistency ratio of each layer corresponding to each client based on the key parameter dimension set corresponding to each client.

[0150] The second constructing unit 504 is configured to combine the symbol consistency ratios of the same layer of each client in time sequence to construct a symbol consistency ratio sequence.

[0151] The third constructing unit 505 is configured to construct a least square regression equation according to the symbol consistency ratio sequence and a polynomial approximation, wherein the polynomial approximation is constructed based on polynomial fitting coefficients.

[0152] The third computing unit 506 is configured to calculate a fitting error according to the symbol consistency ratio sequence and the polynomial approximation in the process of capturing the evolution of the symbol consistency ratio over time by using the least square regression equation.

[0153] The backdoor defense unit 507 is configured to identify and filter malicious clients based on the polynomial fitting coefficients and the fitting error, so as to achieve asynchronous federated backdoor defense.

[0154] It should be noted that, since the asynchronous federated backdoor defense system based on symbol consistency in the embodiment and the asynchronous federated backdoor defense method based on symbol consistency described above are based on the same inventive concept, the corresponding contents in the method embodiment are also applicable to the system embodiment, and will not be described in detail here.

[0155] With reference to Figure 6 The embodiment of the present application also provides an electronic device, and the electronic device comprises:

[0156] at least one memory;

[0157] at least one processor;

[0158] at least one program;

[0159] The program is stored in the memory, and the processor executes the at least one program to implement the asynchronous federated backdoor defense method based on symbol consistency described above.

[0160] The electronic device can be any intelligent terminal, such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a vehicle-mounted computer, etc.

[0161] The electronic device of the embodiment of the present application will be described in detail below.

[0162] The processor 1600 can be implemented in a manner of a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute related programs to implement the technical solutions provided by the embodiments of the present disclosure.

[0163] The memory 1700 can be implemented in a manner of a read only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1700 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present disclosure are implemented by software or firmware, the related program codes are stored in the memory 1700 and are called and executed by the processor 1600 to implement the symbol consistency-based asynchronous federated backdoor defense method of the embodiments of the present disclosure.

[0164] The input / output interface 1800 is configured to implement information input and output.

[0165] The communication interface 1900 is configured to implement the communication interaction between the device and other devices, and can realize the communication in a wired manner (for example, a USB, a network cable, etc.) or in a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0166] The bus 2000 is configured to transmit information between various components (for example, the processor 1600, the memory 1700, the input / output interface 1800, and the communication interface 1900) of the device.

[0167] The processor 1600, the memory 1700, the input / output interface 1800, and the communication interface 1900 are connected to each other in the device through the bus 2000.

[0168] The embodiments of the present disclosure further provide a storage medium, which is a computer readable storage medium and stores computer executable instructions for causing a computer to execute the above-mentioned symbol consistency-based asynchronous federated backdoor defense method.

[0169] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include a high-speed random access memory and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory that is remotely disposed relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] The embodiments described in the embodiments of the present disclosure are used to more clearly illustrate the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art can know that, as technology evolves and new application scenarios appear, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0171] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present disclosure, and can include more or fewer steps than the figures shown, or combine certain steps, or different steps.

[0172] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, that is, can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present disclosure.

[0173] Those skilled in the art can understand that all or some of the steps in the above disclosed method, the functional modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0174] The terms "first", "second", "third", "fourth" and the like used in the specification of the present application and the above-described drawings, if any, are used to distinguish similar objects, and do not necessarily have to describe a particular order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0175] It should be understood that, in the application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b and c can be single or multiple.

[0176] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0177] The units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on multiple network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0178] In addition, the functional units in each embodiment of the application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0179] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes multiple instructions for causing an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and various program storage media. The above embodiments of the present application are described in detail in combination with the drawings, but the present application is not limited to the above embodiments, and various changes can be made within the knowledge range of ordinary skilled persons in the art without departing from the purpose of the present application.

[0180] The above embodiments of the present application are described in detail in combination with the drawings, but the present application is not limited to the above embodiments, and various changes can be made within the knowledge range of ordinary skilled persons in the art without departing from the purpose of the present application.

Claims

1. A method for asynchronous federated backdoor defense based on symbol consistency, characterized in that, The method comprises: According to the model updated parameter dimension and the sliding window of the plurality of clients, the average sign consistency of each client corresponding to each parameter dimension is calculated, and the average update amplitude of each client corresponding to each parameter dimension is calculated; The average update amplitude of each client corresponding to each parameter dimension is sorted, and a plurality of key parameter dimensions corresponding to each client are selected according to the sorting result to construct a key parameter dimension set corresponding to each client; Based on the key parameter dimension set corresponding to each client, the sign consistency ratio of each client corresponding to each layer is calculated; The sign consistency ratios of each client of the same layer are combined in chronological order to construct a sign consistency ratio sequence; According to the sign consistency ratio sequence and a polynomial approximation, a least squares regression equation is constructed, and the polynomial approximation is constructed based on polynomial fitting coefficients; In the process of capturing the evolution of the sign consistency ratio over time by using the least squares regression equation, a fitting error is calculated according to the sign consistency ratio sequence and the polynomial approximation, including: The sign consistency ratio corresponding to each time in the sign consistency ratio sequence is subtracted from the polynomial approximation corresponding thereto to obtain a residual corresponding to all times; The residuals corresponding to all times are accumulated to obtain a fitting error; Based on the polynomial fitting coefficients and the fitting error, a malicious client is identified and filtered to achieve asynchronous federated backdoor defense, including: According to the polynomial fitting coefficients, a z-score is calculated, and a malicious client is identified based on the z-score to obtain a first identification result; According to the fitting error, a fitting error vector is constructed, and a malicious client is identified based on the fitting error vector to obtain a second identification result; Based on the first identification result and the second identification result, a malicious client is filtered to achieve asynchronous federated backdoor defense.

2. The symbol consistency-based asynchronous federated backdoor defense method according to claim 1, characterized in that, The method comprises: Obtaining a set of polynomial fitting coefficients of each layer of all clients; According to the set of polynomial fitting coefficients of each layer of all clients, the mean and standard deviation of the fitting coefficients are calculated; Based on the mean and standard deviation of the fitting coefficients, the z-score corresponding to each client is calculated; If the z-score corresponding to each client is greater than a predefined threshold, it is determined to be a malicious client, until the z-score corresponding to all clients is determined to obtain the first identification result.

3. The symbol consistency-based asynchronous federated backdoor defense method according to claim 1, characterized in that, The method comprises: Based on the fitting error vector, an isolation forest is used to identify a malicious client to obtain the second identification result.

4. The symbol consistency-based asynchronous federated backdoor defense method according to claim 1, characterized in that, The method comprises: ； wherein, denotes the average symbol consistency of the th client under the th parameter dimension, denotes the sliding window, denotes the current total communication round, denotes the indicator function, denotes the sign function, denotes the th parameter dimension of the th client in the th round, denotes the th parameter dimension of the th client in the th round, and is a positive integer.

5. The symbol consistency-based asynchronous federated backdoor defense method according to claim 1, characterized in that, The method comprises: ； wherein, denotes the symbol consistency ratio of the layer of the th client in the th round, denotes the key parameter dimension set of the layer corresponding to the th client, denotes an indicator function, denotes the average symbol consistency of the th parameter dimension corresponding to the th client, , and are positive integers.

6. A symbol consistency based asynchronous federated backdoor defense system, characterized in that, ​ The first computing unit is configured to calculate the average sign consistency of each client corresponding to each parameter dimension according to the model updated parameter dimension of each client and the sliding window, and calculate the average update amplitude of each client corresponding to each parameter dimension. The first constructing unit is configured to sort the average update amplitude of each client corresponding to each parameter dimension, and select a plurality of key parameter dimensions corresponding to each client according to the sorting result to construct a key parameter dimension set corresponding to each client. The second computing unit is configured to calculate the sign consistency ratio of each client corresponding to each layer based on the key parameter dimension set corresponding to each client. The second constructing unit is configured to combine the sign consistency ratios of each client of the same layer in chronological order to construct a sign consistency ratio sequence. The third constructing unit is configured to construct a least squares regression equation according to the sign consistency ratio sequence and a polynomial approximation, the polynomial approximation being constructed based on polynomial fitting coefficients. The third computing unit is configured to calculate a fitting error in capturing the evolution process of the sign consistency ratio over time by using the least squares regression equation, according to the sign consistency ratio sequence and the polynomial approximation, including: Subtracting the sign consistency ratio corresponding to each time in the sign consistency ratio sequence from the polynomial approximation corresponding thereto to obtain residuals corresponding to all times. Accumulating the residuals corresponding to all times to obtain the fitting error. The backdoor defense unit is configured to identify and filter malicious clients based on the polynomial fitting coefficients and the fitting error to implement asynchronous federated backdoor defense, including: Calculating a z-score according to the polynomial fitting coefficients, and identifying malicious clients based on the z-score to obtain a first identification result. Constructing a fitting error vector according to the fitting error, and identifying malicious clients based on the fitting error vector to obtain a second identification result. Filtering malicious clients based on the first identification result and the second identification result to implement asynchronous federated backdoor defense.

7. An electronic device, comprising: The computer readable storage medium stores computer executable instructions for causing a computer to execute the sign consistency based asynchronous federated backdoor defense method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions for causing a computer to execute the sign consistency based asynchronous federated backdoor defense method of any one of claims 1 to 5.

Images