A defense method and system for gan attacks based on false nodes in federated learning

Abstract

The application discloses a defense method for GAN attack based on false nodes in federated learning. Firstly, the local model updating behavior of each client in the federated learning process is monitored in real time to identify potential malicious clients or attacked data. Then, a local forgetting learning operation is performed on the identified malicious client to generate a local forgetting model by maximizing the local loss function and constraining the model parameters within a reasonable range. Then, the server aggregates the gradient updates of all local forgetting models into a global forgetting model. Finally, the global forgetting model is used as the initial point, and a small number of rounds of federated learning are trained between the server and the remaining clients to quickly restore the performance of the model on normal data and completely eliminate the influence of malicious data on the global model. The application can solve the technical problem that the existing defense mechanism based on model update filtering cannot effectively eliminate the influence of the attacker on the global model, resulting in the persistence of the attack effect.

Description

Technical Field

[0001] This invention belongs to the field of computing power network technology, and more specifically, relates to a defense method and system for GAN attacks based on fake nodes in federated learning. Background Technology

[0002] In recent years, with the massive growth of data and the continuous development of computing power, the importance of privacy protection and the difficulty of data sharing have become increasingly prominent limitations on the development of artificial intelligence. The increasing prominence of privacy and efficiency issues in traditional centralized learning frameworks makes them unable to meet the demands for privacy protection, high data sharing, and low-cost transmission. Federated learning, as a distributed machine learning architecture under privacy-preserving conditions, has emerged to address this need. The core idea of ​​federated learning is to keep data locally for training, with local clients and servers sharing training results by transmitting model parameters and avoiding data transmission, thereby achieving privacy protection and data sharing. However, the distributed architecture and open participation characteristics of federated learning also generate some security risks. For example, malicious attackers can use Generative Adversarial Networks (GANs) to generate malicious data for attacks and amplify the attack effect through fake users (i.e., fake nodes), causing the global model to fail on specific tasks. Therefore, there is an urgent need for defense methods against GAN attacks based on fake nodes in federated learning to solve its security problems.

[0003] There are three main existing defense methods against GAN attacks based on fake nodes in federated learning. The first method is a defense mechanism based on model update filtering. This method performs a process detection and filtering on the model parameters (such as gradient updates) uploaded by the client on the server side to resist poisoning attacks and backdoor attacks. The second method is a defense mechanism based on homomorphic encryption (HE). This method protects the gradient updates uploaded by the client through encryption to prevent malicious attackers from obtaining sensitive information. The third method is a defense mechanism based on differential privacy (DP). This method protects privacy by adding noise to the client updates.

[0004] However, the three existing defense methods against GAN attacks based on fake nodes in federated learning all have some significant drawbacks: First, defense mechanisms based on model update filtering mainly focus on identifying and excluding attackers, but cannot effectively eliminate the impact that attackers have already had on the global model, resulting in the continued existence of the attack effect; Second, the defense mechanism based on homomorphic encryption will bring huge computational and communication overhead, making it difficult to deploy in large federated learning systems with many participants. Third, differential privacy-based defense mechanisms introduce noise, reducing the accuracy and convergence speed of the global model and significantly affecting model utility. Summary of the Invention

[0005] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a defense method and system for GAN attacks based on spoofed nodes in federated learning. Its purpose is to solve the technical problems of existing model update filtering-based defense mechanisms, which primarily focus on identifying and excluding attackers but cannot effectively eliminate the impact already caused by attackers on the global model, leading to the continued existence of attack effects; the technical problems of existing homomorphic encryption-based defense mechanisms, which incur huge computational and communication overheads and are difficult to deploy in large-scale federated learning systems with numerous participants; and the technical problems of existing differential privacy-based defense mechanisms, which introduce noise, reduce the accuracy and convergence speed of the global model, and significantly affect model utility.

[0006] To achieve the above objectives, according to one aspect of the present invention, a defense method against GAN attacks based on fake nodes in federated learning is provided. This method is applied in a federated learning system comprising multiple clients and servers, and includes the following steps: (1) The i-th client obtains the local dataset , where i∈[1,n], and n represents the total number of clients in the federated learning system; (2) The server obtains the initial model The initial model Set as the current global model And set the round counter t=0; (3) The server determines whether t is greater than the preset loop iteration threshold T. If it is, it proceeds to step (7); otherwise, it sets t=t+1 and then proceeds to step (4). The preset loop iteration threshold T is in the range of 200 to 1000, preferably 500. (4) The server will display the current global model. The round counter t is sent to each client, and the current global model is also sent. Set to the old global model ; (5) The i-th client uses its local dataset The current global model from the server, which serves as the local model trained in round t. Training is performed to obtain the local model obtained from the client's t-th training round. and its gradient update data And update the gradient data of the local model obtained from the t-th training round. Send to the server; (6) The server obtains the gradient update data set of the local model obtained from the training of the t-th round, which is composed of the gradient update data of the local model obtained from the training of the t-th round sent by all clients. and use the gradient to update the dataset. For the old global model Perform an update to obtain the updated global model as the current global model. Then return to step (3); (7) The server updates the dataset based on the gradient obtained in step (6) for the t-th training round. Obtain the malicious client set U; (8) The server obtains the set of non-malicious clients G based on the set of malicious clients U obtained in step (7), and aggregates the gradient update data of the local model obtained by all clients in the set of non-malicious clients G in the t-th round of training to obtain the reference model. and the reference model Send to each client in the malicious client set U obtained in step (7); (9) The b-th malicious client in the malicious client set U obtains the reference model from the server. As a local model, the local model is trained according to the local loss function of the malicious client and the forgetting learning method to obtain the local forgetting model of the malicious client and its gradient update data, and the gradient update data of the local forgetting model of the malicious client is sent to the server, where b∈[1,u]; (10) The server aggregates the gradient update data of all local forgetting models from all malicious clients to obtain the global forgetting model; (11) The server, in collaboration with a non-malicious client G, applies the global forgetting model obtained in step (10). Federated learning is then performed to train the model and obtain the final global model.

[0007] Preferably, step (5) uses the following formula: in Represents gradient update of the data set The i-th element represents the gradient update data of the local model obtained by the i-th client in the t-th round of training. .

[0008] Preferably, step (6) uses the following formula: in Represents gradient update of the data set The i-th element represents the gradient update data of the local model obtained by the i-th client in the t-th round of training. This formula means that the global model is updated using the mean of the gradient update data from all clients, in order to update the global model using the local datasets from all clients.

[0009] Preferably, step (7) includes the following sub-steps: (7-1) The server obtains the gradient update data of the t-th training round obtained in step (6). ; (7-2) The set of gradient update data for the t-th training round obtained by the server from step (7-1) The gradient update data of the local model obtained by the i-th client in the t-th round of training is obtained. The cosine similarity between the gradient update data of the local model obtained by the i-th client in the t-th round of training and the gradient update data of the local model obtained by each of the other clients, i.e., the j-th client in the t-th round of training, is calculated. The sum of all cosine similarities is taken as the difference value corresponding to the i-th client in the t-th round of training. ; This step specifically uses the following formula: ; Where i∈[1,n], j∈[1,n] and i j, <,> indicates the inner product; (7-3) The server will use the difference values ​​obtained in step (7-2) for all T rounds of training for the i-th client. The summation is performed to obtain the sum of the differences for the i-th client across all rounds. ; (7-4) The server sorts the sum of the difference values ​​of all clients obtained in step (7-3) in all rounds in descending order, and selects the clients corresponding to the sum of the first u difference values ​​from the sorting results as the malicious client set U; where the value of u ranges from 1% to 40% of the total number of clients n, preferably 10%.

[0010] Preferably, step (8) includes the following sub-steps: (8-1) The server uses the malicious client set U obtained in step (7) to obtain the non-malicious client set G, which is the set of all clients in the federated learning system except for the malicious client set U; (8-2) The server obtains the gradient update data set consisting of the gradient update data of all non-malicious clients in the non-malicious client set G obtained in step (8-1). , where m represents the total number of clients in the set of non-malicious clients G; (8-3) The server uses the gradient obtained in step (8-2) to update the data set. For the old global model Update to obtain the reference model and the reference model Send to each client in the malicious client set U; This step specifically uses the following formula: Where h∈[1, ], Represents gradient update of the data set The h-th gradient update data .

[0011] Preferably, step (9) includes the following sub-steps: (9-1) The b-th malicious client obtains the reference model from the server. As its local model : ; (9-2) The b-th malicious client uses its local model Build Optimization problem with norm sphere constraints: in , The local model for the b-th malicious client The local loss function, This represents the reference model, where δ is the constraint radius. The local model for the b-th malicious client The parameter has all possible values ​​within its range; (9-3) The b-th malicious client will use its local dataset Data divided into multiple batches and use this data The result obtained in step (9-2) The optimization problem constrained by the norm sphere is solved locally to update the local model of the malicious client; The local model is updated in this step using the following formula: ; in, For learning rate, For the local dataset of the b-th malicious client Given a batch of data, where z∈[1, y], and P is the projection operator. Represents the gradient operator, Representation Model In the dataset The above uses a loss function The gradient obtained during training; (9-4) The bth malicious client updates the local model in step (9-3). As a model of local forgetting And this local forgetting model Gradient update data Send to the server.

[0012] Preferably, step (10) specifically includes the following steps: (10-1) The server obtains a gradient update data set consisting of gradient update data from all malicious clients' local forgetting models. ; (10-2) The server updates the dataset using the gradient obtained in step (10-1). For the reference model Update to obtain a global forgetting model. ; Specifically, this step uses the following formula: Preferably, step (11) specifically includes the following sub-steps: (11-1) The server uses the global forgetting model obtained in step (9) As the current global model of the server : (11-2) The server sends the current global model obtained in step (11-1) to the h-th client in the set of non-malicious clients G obtained in step (7) as the local model: Where h∈[1,m], For the h-th non-malicious client's local model; (11-3) The h-th client in the set of non-malicious clients G uses its local dataset to train the local model from the server to obtain the local model after training by the non-malicious client and its gradient update data, and uploads the gradient update data to the server. (11-4) The server updates its current global model using gradient data from the h-th client. Perform an update to obtain the updated global model as the current global model; (11-5) Repeat the federated learning training process of steps (11-2), (11-3) and (11-4) for num rounds to obtain the final global model; where the value of num is less than or equal to 10.

[0013] According to another aspect of the present invention, a defense method against GAN attacks based on fake nodes in federated learning is provided. This method is applied in a federated learning system comprising multiple clients and servers, and the defense system includes the following modules: The first module, located on the i-th client, is used to obtain the local dataset. , where i∈[1,n], and n represents the total number of clients in the federated learning system; The second module, located on the server, is used to obtain the initial model. The initial model Set as the current global model And set the round counter t=0; The third module, located on the server, is used to determine whether t is greater than the preset iteration threshold T. If it is, the process proceeds to the seventh module; otherwise, t is set to t+1, and the process proceeds to the fourth module. The preset iteration threshold T ranges from 200 to 1000, preferably 500. The fourth module, located on the server, is used to set up the current global model. The round counter t is sent to each client, and the current global model is also sent. Set to the old global model ; The fifth module, located on the i-th client, is used to utilize its local dataset. The current global model from the server, which serves as the local model trained in round t. Training is performed to obtain the local model obtained from the client's t-th training round. and its gradient update data And update the gradient data of the local model obtained from the t-th training round. Send to the server; The sixth module, located on the server, is used to obtain the gradient update data set for the t-th training round, which consists of the gradient update data of the local model obtained from the t-th training round sent by all clients. and use the gradient to update the dataset. For the old global model Perform an update to obtain the updated global model as the current global model. Then return to the third module; The seventh module, located on the server, is used to update the dataset based on the gradients obtained from the t-th training round obtained from the sixth module. Obtain the malicious client set U; The eighth module, located on the server, is used to obtain a set of non-malicious clients G based on the set of malicious clients U obtained from the seventh module, and to aggregate the gradient update data of the local model obtained by all clients in the t-th round of training in this set of non-malicious clients G to obtain a reference model. and the reference model Send to each client in the malicious client set U obtained from the seventh module; The ninth module, located on the b-th malicious client in the malicious client set U, is used to obtain the reference model from the server. As a local model, the local model is trained according to the local loss function of the malicious client and the forgetting learning method to obtain the local forgetting model of the malicious client and its gradient update data, and the gradient update data of the local forgetting model of the malicious client is sent to the server, where b∈[1,u]; The tenth module, located on the server, is used to aggregate gradient update data from all local forgetting models from all malicious clients to obtain a global forgetting model. The eleventh module, located on the server, is used to coordinate with the non-malicious client G on the global forgetting model obtained from the tenth module. Federated learning is then performed to train the model and obtain the final global model.

[0014] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: First, because the present invention employs steps (9) and (10), it applies forgetting learning to attack defense. By performing local forgetting operations on malicious clients, it effectively eliminates the impact of malicious data on the model. Therefore, it can solve the technical problem that the existing defense mechanism based on model update filtering mainly focuses on identifying and excluding attackers, but cannot effectively eliminate the impact that attackers have already caused on the global model, resulting in the continued existence of the attack effect.

[0015] Second, because the present invention adopts step (11), it can quickly restore the model performance through a small number of federated learning rounds, avoid complex encryption calculations, and significantly reduce communication and computing costs. Therefore, it can solve the technical problem that the existing defense mechanism based on homomorphic encryption will bring huge computing and communication overheads and is difficult to deploy in large federated learning systems with many participants. Third, because the present invention adopts step (9-2), it ensures that the previous learning process is carried out within a reasonable parameter range through norm sphere constraint optimization, and eliminates the impact of attacks through precise local forgetting rather than global noise addition. Therefore, it can solve the technical problem that existing defense mechanisms based on differential privacy introduce noise, reduce the accuracy and convergence speed of the global model, and significantly affect the effectiveness of the model. Fourth, this invention employs a complete defense process from attack detection to model repair. By comprehensively utilizing gradient update monitoring, malicious client identification, and model forgetting learning, it is particularly suitable for dealing with GAN combined attacks based on fake nodes, thus solving the technical problem that the above three defense methods are insufficient in defending against combined attacks. Attached Figure Description

[0016] Figure 1 This is a flowchart of a defense method against GAN attacks based on fake nodes in federated learning according to the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0018] The basic idea of ​​this invention is as follows: First, by monitoring the local model update behavior of each client in real time during the federated learning process, potential malicious clients or attacked data are identified. Then, a local forgetting learning operation is performed on the identified malicious clients. By maximizing their local loss function and constraining the model parameters within a reasonable range, a local forgetting model is generated. Next, the server aggregates the gradient updates of all local forgetting models into a global forgetting model. Finally, using the global forgetting model as the starting point, a small number of rounds of federated learning are performed between the server and the remaining clients for retraining, which quickly restores the model's performance on normal data and completely eliminates the impact of malicious data on the global model.

[0019] like Figure 1 As shown, this invention provides a defense method against GAN attacks based on fake nodes in federated learning, which is applied in a federated learning system including multiple clients and servers. The defense method includes the following steps: (1) The i-th client obtains the local dataset , where i∈[1,n], and n represents the total number of clients in the federated learning system; It should be noted that the local datasets of all clients in this invention are not completely identical.

[0020] (2) The server obtains the initial model The initial model Set as the current global model And set the round counter t=0; Specifically, the initial model obtained in this step is a deep learning model, such as a convolutional neural network (CNN) or ResNet.

[0021] (3) The server determines whether t is greater than the preset loop iteration threshold T. If it is, it proceeds to step (7); otherwise, it sets t=t+1 and then proceeds to step (4). Specifically, the preset iteration threshold T ranges from 200 to 1000, preferably 500.

[0022] (4) The server will display the current global model. The round counter t is sent to each client, and the current global model is also sent. Set to the old global model .

[0023] (5) The i-th client uses its local dataset The current global model from the server, which serves as the local model trained in round t. Training is performed to obtain the local model obtained from the client's t-th training round. and its gradient update data And update the gradient data of the local model obtained from the t-th training round. Send to the server.

[0024] (6) The server obtains the gradient update data set of the local model obtained from the training of the t-th round, which is composed of the gradient update data of the local model obtained from the training of the t-th round sent by all clients. and use the gradient to update the dataset. For the old global model Perform an update to obtain the updated global model as the current global model. Then return to step (3).

[0025] Specifically, this step uses the following formula: in Represents gradient update of the data set The i-th element represents the gradient update data of the local model obtained by the i-th client in the t-th round of training. This formula means that the global model is updated using the mean of the gradient update data from all clients, in order to update the global model using the local datasets from all clients.

[0026] (7) The server updates the dataset based on the gradient obtained in step (6) for the t-th training round. Obtain the malicious client set U; Specifically, this step includes the following sub-steps: (7-1) The server obtains the gradient update data of the t-th training round obtained in step (6). .

[0027] (7-2) The set of gradient update data for the t-th training round obtained by the server from step (7-1) The gradient update data of the local model trained by the i-th client in round t is obtained, and the cosine similarity between the gradient update data of the local model trained by the i-th client in round t and the gradient update data of the local model trained by each of the remaining clients (i.e., the j-th client) in round t is calculated. The sum of all cosine similarities is taken as the difference value corresponding to the training round t of the i-th client. ; This step specifically uses the following formula: ; Where i∈[1,n], j∈[1,n] and i j, <,> indicates the inner product.

[0028] The advantage of this step is that using cosine similarity as the calculation method for the difference in gradient update data between clients can better distinguish the vector direction difference of gradient update data between malicious and non-malicious clients, while avoiding misjudging non-malicious clients with different gradient update data sizes.

[0029] (7-3) The server will use the difference values ​​obtained in step (7-2) for all T rounds of training for the i-th client. The summation is performed to obtain the sum of the differences for the i-th client across all rounds. ; (7-4) The server sorts the sum of the difference values ​​of all clients obtained in step (7-3) in all rounds in descending order, and selects the clients corresponding to the sum of the first u difference values ​​from the sorting results as the malicious client set U; Specifically, the value of u ranges from 1% to 40% of the total number of clients n, with 10% being preferred.

[0030] (8) The server obtains the set of non-malicious clients G based on the set of malicious clients U obtained in step (7), and aggregates the gradient update data of the local model obtained by all clients in the set of non-malicious clients G in the t-th round of training to obtain the reference model. (It excludes the influence of malicious clients in the t-th round of training) and uses this reference model Send to each client in the malicious client set U obtained in step (7); Specifically, this step includes the following sub-steps: (8-1) The server uses the malicious client set U obtained in step (7) to obtain the non-malicious client set G, which is the set of all clients in the federated learning system except for the malicious client set U; (8-2) The server obtains the gradient update data set consisting of the gradient update data of all non-malicious clients in the non-malicious client set G obtained in step (8-1). , where m represents the total number of clients in the set of non-malicious clients G; (8-3) The server uses the gradient obtained in step (8-2) to update the data set. For the old global model Update to obtain the reference model and the reference model Send to each client in the malicious client set U; This step specifically uses the following formula: Where h∈[1, ], Represents gradient update of the data set The h-th gradient update data The obtained reference model It represents the average state of the non-malicious client model after excluding malicious clients in the current round, and serves as the constraint center for forgetting learning.

[0031] (9) The b-th malicious client in the malicious client set U obtains the reference model from the server. As a local model, the local model is trained according to the local loss function of the malicious client and the forgetting learning method to obtain the local forgetting model of the malicious client and its gradient update data, and the gradient update data of the local forgetting model of the malicious client is sent to the server, where b∈[1,u]; Specifically, this step includes the following sub-steps: (9-1) The b-th malicious client obtains the reference model from the server. As its local model : ; (9-2) The b-th malicious client uses its local model Build Optimization problem with norm sphere constraints (with model updates within a reasonable range using constraint-based forgetting learning): in , The local model for the b-th malicious client The local loss function, The reference model is represented by δ, which is the constraint radius used to control the local model of the b-th malicious client. The deviation range of parameter updates is usually determined through experimental tuning, for example, by using a reference model. One-third of the Euclidean distance between the model and the model with the same structure and random parameters. The local model for the b-th malicious client The parameter has all possible values.

[0032] (9-3) The b-th malicious client will use its local dataset Data divided into multiple batches and use this data The result obtained in step (9-2) The optimization problem constrained by the norm sphere is solved locally to update the local model of the malicious client; The local model is updated in this step using the following formula: ; in, For learning rate, For the local dataset of the b-th malicious client Given a batch of data where z∈[1, y], and P is the projection operator, ensure that the parameters of the updated local model always fall within [1, y]. Within the norm sphere; during the iteration process, if the local model If the Euclidean distance between the local model updated in the previous round and the b malicious clients is less than a preset threshold τ (this threshold is a hyperparameter that needs to be determined through experimental tuning; its value ranges from 2 to 6, with 3 being the preferred value), then the iteration is stopped early to improve efficiency. Represents the gradient operator, Representation Model In the dataset The above uses a loss function The gradient obtained during training.

[0033] (9-4) The bth malicious client updates the local model in step (9-3). As a model of local forgetting And this local forgetting model Gradient update data Send to the server; The advantage of this step is that, after iterative optimization, the resulting local forgetting model shows a significant decrease in performance on malicious client data, while maintaining reasonable performance on normal data.

[0034] (10) The server aggregates the gradient update data of all local forgetting models from all malicious clients to obtain the global forgetting model.

[0035] This step specifically includes the following steps: (10-1) The server obtains a gradient update data set consisting of gradient update data from all malicious clients' local forgetting models. ; (10-2) The server updates the dataset using the gradient obtained in step (10-1). For the reference model Update to obtain a global forgetting model. ; Specifically, this step uses the following formula: ; This global forgetting model represents the average state after forgetting all malicious client effects on the reference model.

[0036] (11) The server, in collaboration with a non-malicious client G, applies the global forgetting model obtained in step (10). Federated learning is then performed to train the model and obtain the final global model.

[0037] This step specifically includes the following sub-steps: (11-1) The server uses the global forgetting model obtained in step (9) As the current global model of the server : (11-2) The server sends the current global model obtained in step (11-1) to the h-th client in the set of non-malicious clients G obtained in step (7) as the local model: h∈[1,m], This is the local model for the h-th non-malicious client.

[0038] (11-3) The h-th client in the set of non-malicious clients G uses its local dataset to train the local model from the server to obtain the local model after training by the non-malicious client and its gradient update data, and uploads the gradient update data to the server.

[0039] (11-4) The server updates its current global model using gradient data from the h-th client. Perform an update to obtain the updated global model as the current global model.

[0040] (11-5) Repeat the federated learning training process of steps (11-2), (11-3) and (11-4) for num rounds to obtain the final global model.

[0041] Preferably, the value of num is less than or equal to 10, and more preferably 1 to 5, so as to significantly reduce communication and computing costs.

[0042] The advantage of this step is that it can quickly restore the performance of the global model on normal data and eliminate the impact of malicious data on the global model.

[0043] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A defense method against GAN attacks based on fake nodes in federated learning, applied in a federated learning system comprising multiple clients and servers, characterized in that... The defense method includes the following steps: (1) The i-th client obtains the local dataset , where i∈[1,n], and n represents the total number of clients in the federated learning system; (2) The server obtains the initial model The initial model Set as the current global model And set the round counter t=0; (3) The server determines whether t is greater than the preset loop iteration threshold T. If it is, it proceeds to step (7); otherwise, it sets t=t+1 and then proceeds to step (4). The preset loop iteration threshold T ranges from 200 to 1000. (4) The server will display the current global model. The round counter t is sent to each client, and the current global model is also sent. Set to the old global model ; (5) The i-th client uses its local dataset The current global model from the server, which serves as the local model trained in round t. Training is performed to obtain the local model obtained from the client's t-th training round. and its gradient update data And update the gradient data of the local model obtained from the t-th training round. Send to the server; (6) The server obtains the gradient update data set of the local model obtained from the training of the t-th round, which is composed of the gradient update data of the local model obtained from the training of the t-th round sent by all clients. and use the gradient to update the dataset. For the old global model Perform an update to obtain the updated global model as the current global model. Then return to step (3); (7) The server updates the dataset based on the gradient obtained in step (6) for the t-th training round. Obtain the malicious client set U; (8) The server obtains the set of non-malicious clients G based on the set of malicious clients U obtained in step (7), and aggregates the gradient update data of the local model obtained by all clients in the set of non-malicious clients G in the t-th round of training to obtain the reference model. and the reference model Send to each client in the malicious client set U obtained in step (7); (9) The b-th malicious client in the malicious client set U obtains the reference model from the server. As a local model, the local model is trained based on the local loss function of the malicious client and using a forgetting learning method to obtain the local forgetting model of the malicious client and its gradient update data, and the gradient update data of the local forgetting model of the malicious client is sent to the server, where b∈[1,u]; step (9) includes the following sub-steps: (9-1) The b-th malicious client obtains the reference model from the server. As its local model : ； (9-2) The b-th malicious client uses its local model Build Optimization problem with norm sphere constraints: ； in , The local model for the b-th malicious client The local loss function, This represents the reference model, where δ is the constraint radius. The local model for the b-th malicious client The parameter has all possible values ​​within its range; (9-3) The b-th malicious client will use its local dataset Data divided into multiple batches and use this data The result obtained in step (9-2) The optimization problem constrained by the norm sphere is solved locally to update the local model of the malicious client; The local model is updated in this step using the following formula: ； in, For learning rate, For the local dataset of the b-th malicious client Given a batch of data, where z∈[1, y], and P is the projection operator. Represents the gradient operator. Representation Model In the dataset The above uses a loss function The gradient obtained during training; (9-4) The bth malicious client updates the local model in step (9-3). As a model of local forgetting and this local forgetting model Gradient update data Send to the server; (10) The server aggregates the gradient update data of all local forgetting models from all malicious clients to obtain the global forgetting model; (11) The server, in collaboration with a non-malicious client G, applies the global forgetting model obtained in step (10). Federated learning is then performed to train the model and obtain the final global model.

2. The defense method against GAN attacks based on fake nodes in federated learning according to claim 1, characterized in that, Step (5) uses the following formula: ； in Represents gradient update of the data set The i-th element represents the gradient update data of the local model obtained by the i-th client in the t-th round of training. .

3. The defense method against GAN attacks based on fake nodes in federated learning according to claim 1 or 2, characterized in that, Step (6) uses the following formula: ； in Represents gradient update of the data set The i-th element represents the gradient update data of the local model obtained by the i-th client in the t-th round of training. This formula means that the global model is updated using the mean of the gradient update data from all clients, in order to update the global model using the local datasets from all clients.

4. The defense method against GAN attacks based on fake nodes in federated learning according to claim 3, characterized in that, Step (7) includes the following sub-steps: (7-1) The server obtains the gradient update data of the t-th training round obtained in step (6). ; (7-2) The set of gradient update data for the t-th training round obtained by the server from step (7-1) The algorithm retrieves the gradient update data of the local model trained by the i-th client in round t, calculates the cosine similarity between the gradient update data of the local model trained by the i-th client in round t and the gradient update data of the local model trained by each of the remaining clients, i.e., the j-th client in round t, and obtains the sum of all cosine similarities as the difference value corresponding to the training round t of the i-th client. ; This step specifically uses the following formula: ； Where i∈[1,n], j∈[1,n] and i j, <,> indicates the inner product; (7-3) The server will use the difference values ​​obtained in step (7-2) for all T rounds of training for the i-th client. The summation is performed to obtain the sum of the differences for the i-th client across all rounds. ; (7-4) The server sorts the sum of the difference values ​​of all clients obtained in step (7-3) in all rounds in descending order, and selects the clients corresponding to the sum of the top u difference values ​​from the sorting results as the malicious client set U; where the value of u ranges from 1% to 40% of the total number of clients n.

5. The defense method against GAN attacks based on fake nodes in federated learning according to claim 4, characterized in that, Step (8) includes the following sub-steps: (8-1) The server uses the malicious client set U obtained in step (7) to obtain the non-malicious client set G, which is the set of all clients in the federated learning system except for the malicious client set U; (8-2) The server obtains the gradient update data set consisting of the gradient update data of all non-malicious clients in the non-malicious client set G obtained in step (8-1). , where m represents the total number of clients in the set of non-malicious clients G; (8-3) The server uses the gradient obtained in step (8-2) to update the data set. For the old global model Update to obtain the reference model and the reference model Send to each client in the malicious client set U; This step specifically uses the following formula: ； Where h∈[1, ], Represents gradient update of the data set The h-th gradient update data .

6. The defense method against GAN attacks based on fake nodes in federated learning according to claim 1, characterized in that, Step (10) specifically includes the following steps: (10-1) The server obtains a gradient update data set consisting of gradient update data from all malicious clients' local forgetting models. ; (10-2) The server updates the dataset using the gradient obtained in step (10-1). For reference model Update to obtain a global forgetting model. ; Specifically, this step uses the following formula: 。 7. The defense method against GAN attacks based on fake nodes in federated learning according to claim 1, characterized in that, Step (11) specifically includes the following sub-steps: (11-1) The server uses the global forgetting model obtained in step (9) As the current global model of the server : ； (11-2) The server sends the current global model obtained in step (11-1) to the h-th client in the set of non-malicious clients G obtained in step (7) as the local model: ； Where h∈[1,m], For the h-th non-malicious client's local model; (11-3) The h-th client in the set of non-malicious clients G uses its local dataset to train the local model from the server to obtain the local model after training by the non-malicious client and its gradient update data, and uploads the gradient update data to the server. (11-4) The server updates its current global model using gradient data from the h-th client. Perform an update to obtain the updated global model as the current global model; (11-5) Repeat the federated learning training process of steps (11-2), (11-3) and (11-4) for num rounds to obtain the final global model; where the value of num is less than or equal to 10.

8. A defense system against GAN attacks based on fake nodes in federated learning, applied in a federated learning system including multiple clients and servers, and implemented based on the defense method against GAN attacks based on fake nodes in federated learning as described in claim 1, characterized in that... The defense system includes the following modules: The first module, located on the i-th client, is used to obtain the local dataset. , where i∈[1,n], and n represents the total number of clients in the federated learning system; The second module, located on the server, is used to obtain the initial model. The initial model Set as the current global model And set the round counter t=0; The third module, which is set on the server, is used to determine whether t is greater than the preset loop iteration threshold T. If it is, it will proceed to the seventh module; otherwise, it will set t=t+1 and then proceed to the fourth module. The preset iteration threshold T ranges from 200 to 1000. The fourth module, located on the server, is used to set up the current global model. The round counter t is sent to each client, and the current global model is also sent. Set to the old global model ; The fifth module, located on the i-th client, is used to utilize its local dataset. The current global model from the server, which serves as the local model trained in round t. Training is performed to obtain the local model obtained from the client's t-th training round. and its gradient update data And update the gradient data of the local model obtained from the t-th training round. Send to the server; The sixth module, located on the server, is used to obtain the gradient update data set for the t-th training round, which consists of the gradient update data of the local model obtained from the t-th training round sent by all clients. and use the gradient to update the dataset. For the old global model Perform an update to obtain the updated global model as the current global model. Then return to the third module; The seventh module, located on the server, is used to update the dataset based on the gradients obtained from the t-th training round obtained from the sixth module. Obtain the malicious client set U; The eighth module, located on the server, is used to obtain a set of non-malicious clients G based on the set of malicious clients U obtained from the seventh module, and to aggregate the gradient update data of the local model obtained by all clients in the t-th round of training in this set of non-malicious clients G to obtain a reference model. and the reference model Send to each client in the malicious client set U obtained from the seventh module; The ninth module, located on the b-th malicious client in the malicious client set U, is used to obtain the reference model from the server. As a local model, the local model is trained according to the local loss function of the malicious client and the forgetting learning method to obtain the local forgetting model of the malicious client and its gradient update data, and the gradient update data of the local forgetting model of the malicious client is sent to the server, where b∈[1,u]; The tenth module, located on the server, is used to aggregate gradient update data from all local forgetting models from all malicious clients to obtain a global forgetting model. The eleventh module, located on the server, is used to coordinate with the non-malicious client G on the global forgetting model obtained from the tenth module. Federated learning is then performed to train the model and obtain the final global model.

Images