Non-IID federated learning backdoor attack defense method and system and medium

Abstract

The invention discloses a Non-IID federated learning backdoor attack defense method and system and a medium, and relates to the field of federated learning and network security. In order to solve the problems that an existing method depends on model parameters and is easy to avoid by a malicious client, and adaptive Non-IID scenes are poor, truncated singular value decomposition is executed through the client to extract first p left singular vectors, and the first p left singular vectors are uploaded to a server; the server constructs a matrix based on left singular vector cosine similarity and performs hierarchical clustering, and calculates a client similarity score and an aggregation weight by using a zoom dot product attention mechanism in combination with a left singular vector of the clean reference data set; the server distributes a global model, the client uploads parameters after local training, and the server weights and aggregates the model parameters in the cluster according to the weight and iteratively optimizes the model parameters. According to the method, the malicious client is identified from the data essential features, the malicious proportion does not need to be preset, the good client contribution and the data privacy are guaranteed while the backdoor attack is inhibited, the method is suitable for a Non-IID scene, and the model robustness and the main task performance are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning and network security, in particular to a method and system for preventing backdoor attacks in a non-independent and identically distributed (Non-IID) scenario by extracting data features, clustering and grouping, and dynamically assigning weights, and a medium. BACKGROUND

[0002] Federated learning is a distributed machine learning paradigm that can build a global model by local training of clients and aggregation of server models without converging the original data of each client, effectively protecting data privacy. However, in real-world applications, client data often exhibits non-independent and identically distributed characteristics, i.e., the data distribution of different clients is significantly different, resulting in slower convergence and lower accuracy of the global model. At the same time, the distributed architecture of federated learning is vulnerable to backdoor attacks: malicious clients can inject harmful trigger conditions into the global model by tampering with local data or model parameters, causing the model to output incorrect results under certain inputs. Such attacks are more difficult to detect in Non-IID (Not identically and independently distributed) scenarios due to the strong heterogeneity of model updates.

[0003] Existing defense methods rely on model update parameters (or gradient directions) for anomaly detection, distinguishing between benign and malicious clients by clustering model parameters. However, malicious clients can evade detection by deliberately mimicking the model update behavior of benign clients, leading to ineffective defense. In addition, some methods preset the proportion of malicious clients or use fixed thresholds for screening, which is difficult to adapt to dynamic changes in data distribution in Non-IID scenarios, and is prone to misjudgment of benign clients, resulting in performance loss of the global model. Therefore, there is an urgent need for a federated learning defense scheme that starts from the essential features of data, adapts to Non-IID environments, and accurately identifies hidden backdoor attacks. SUMMARY

[0004] To solve the above problems, the present application aims to provide a Non-IID federated learning backdoor attack defense method, system and medium, which extracts key features from client data using truncated singular value decomposition (SVD), groups clients with similar data distribution using hierarchical clustering, and assigns aggregated weights to clients using a scaled dot-product attention mechanism, reducing the impact of malicious client updates during model aggregation, improving model robustness while ensuring the training effectiveness of benign clients and data privacy.

[0005] To achieve the above purpose, the technical solution of the present application is as follows: A Non-IID federated learning backdoor attack defense method, comprising the following steps: S1, client feature extraction and uploading: the client performs truncated singular value decomposition on the local dataset, extracts the first p left singular vectors, and uploads them to the server; S2, server clustering grouping: the server calculates the cosine similarity of the left singular vectors between clients, constructs a similarity matrix, and uses hierarchical clustering grouping; S3, server weight allocation: the server performs truncated singular value decomposition on the clean benchmark dataset to obtain benchmark vectors, calculates the similarity score between the client and the benchmark using the scaled dot product attention mechanism, and allocates the aggregation weight; S4, model distribution and local training: the server initializes the global model and randomly selects a client for distribution; the selected client trains with local data and uploads local model parameters; S5, model aggregation and iterative optimization: the server aggregates model parameters within the cluster according to the weight, generates a new global model, and iterates the process until convergence.

[0006] Further, the client feature extraction and uploading specifically refers to: each client based on the local dataset performs truncated singular value decomposition through SVD: , the dataset is decomposed into left singular vector matrix , singular value matrix and right singular vector matrix , the left singular vector corresponding to the first p largest singular value is retained to obtain the left singular vector matrix , and is uploaded to the central server.

[0007] Further, the server clustering grouping specifically refers to: after the central server receives the left singular vectors of all clients , ,… , it calculates the cosine similarity of the left singular vector matrices and of any two clients and , constructs a similarity matrix S; then the server uses hierarchical clustering method to cluster the clients according to the similarity matrix , and groups the clients satisfying the preset similarity threshold into the same group.

[0008] Further, the server clustering grouping includes the following steps: Step S21: the server calculates the cosine similarity of the left singular vector matrix between each pair of clients and , wherein and Represent the left singular vector matrix respectively A left singular vector is used to obtain the similarity matrix. ,in Indicates the client and Cosine similarity measure between them; Step S22: Using all clients as initial individual clusters, perform bottom-up hierarchical clustering based on the similarity matrix calculated in step S21: continuously merge the two clusters with the highest similarity metrics until the preset minimum inter-cluster similarity threshold β is met or the preset number of clusters M is reached.

[0009] Furthermore, the server weight allocation specifically refers to: the server pre-acquiring a clean benchmark dataset. ,right Performing truncated singular value decomposition yields the reference left singular vector matrix. In each cluster, the server uses a scaled dot product attention mechanism to compute the attention value obtained from step S1 for each client. and The similarity between them is calculated, and the results are used to assign weights to each client.

[0010] Furthermore, the server weight allocation includes the following steps: Step S31: The server uses truncated singular value decomposition. Obtain its left singular vector matrix ; Step S32: The client set in the k-th cluster is The server calculates the i-th client of Compared with benchmark datasets of Attention score between scaling dot products ,in express The dimension is used to scale the dot product result to ensure the stability of the value; Step S33: Within each cluster, calculate the client's attention score based on the scaled dot product attention score obtained in step S32. Weights during aggregation ,in It represents the total number of clients in the current cluster. It is an exponential function, that is .

[0011] Furthermore, the model distribution and local training refer to: the server initializing the global model. In the tth communication round, part of the clients are randomly selected, and the global model is distributed to the selected clients; the selected clients train the model based on the local data set using the stochastic gradient descent algorithm to obtain the local model , and upload it to the server.

[0012] Further, the model aggregation and iterative optimization refers to: the server performs weighted aggregation on the local models of the clients in the cluster based on the aggregation weights obtained in step S33 to obtain a new round of global model in the cluster , wherein represents the set of clients in the kth cluster; the global model is distributed to the clients in the corresponding cluster, and steps S1-S5 are repeated until the model converges or reaches the preset training round.

[0013] In order to achieve the above purpose, the present application also provides a Non-IID federated learning backdoor attack defense system, comprising: A client feature extraction and uploading module: the client performs truncated singular value decomposition on the local data set, extracts the first p left singular vectors, and uploads them to the server; A server clustering grouping module: the server calculates the cosine similarity of the left singular vectors between the clients, constructs a similarity matrix, and groups by hierarchical clustering; A server weight allocation module: the server performs truncated singular value decomposition on the clean benchmark data set to obtain benchmark vectors, calculates the similarity scores of the clients and the benchmark using the scaled dot product attention mechanism, and allocates aggregation weights; A model distribution and local training module: the server initializes the global model, randomly selects clients for distribution; the selected clients train using local data, and upload local model parameters; A model aggregation and iterative optimization module: the server performs weighted aggregation of model parameters in the cluster according to the weights, generates a new global model, and repeats the process until convergence.

[0014] In order to achieve the above purpose, the present application also provides a computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to make the processor execute the Non-IID federated learning backdoor attack defense method as described above.

[0015] ​​​Beneficial Effects: This invention significantly enhances the ability of federated learning to resist backdoor attacks in non-independent and identically distributed environments by introducing a data distribution feature extraction and attention weight dynamic allocation mechanism based on left singular vectors. On the one hand, by extracting the essential features of client data through truncated singular value decomposition, it can accurately identify data distribution anomalies caused by backdoor data and effectively distinguish between malicious and benign clients. On the other hand, by combining hierarchical clustering and scaled dot product attention mechanisms, it can adaptively allocate appropriate aggregation weights to different clients while preserving data distribution similarity information, thus suppressing malicious updates while maximizing the preservation of contributions from benign clients. Attached Figure Description

[0016] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of the Non-IID federated learning backdoor attack defense method described in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the interaction process between the client and server in the Non-IID federated learning backdoor attack defense method described in this embodiment of the invention; it includes steps such as client feature extraction, server clustering, weight calculation, model distribution and aggregation; Figure 3 This is a 3DPCA visualization comparison chart of the left singular vectors extracted from the original data and the backdoor data in an embodiment of the present invention; wherein, Figure 3 (a) shows a significant reverse alignment difference between the left singular vectors of some client-side raw data and backdoor data. Figure 3 (b) shows that when the differences between a few client vector pairs are small, the set of left singular vectors can still be used as a distinguishing criterion; Figure 4 This is a schematic diagram of the Non-IID federated learning backdoor attack defense system according to an embodiment of the present invention. Detailed Implementation

[0017] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0018] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] Example 1 See Figures 1-3 A method for defending against backdoor attacks using Non-IID federated learning includes the following steps: S1. Client-side feature extraction and upload: The client performs truncated singular value decomposition (truncatedSVD) on the local dataset, extracts the first p left singular vectors, and uploads them to the server. It should be noted that each client does not send the raw data, but only sends the "key tags" that represent the core characteristics of its own data to the server; in order to protect the privacy of the raw data and not disclose specific information, and to grasp the essential characteristics of the data in advance, laying the foundation for subsequent identification of malicious data.

[0020] S2. Server Clustering Grouping: The server calculates the cosine similarity of the left singular vectors among the clients, constructs a similarity matrix, and uses hierarchical clustering grouping. It should be noted that the server determines which clients have similar data characteristics based on "key tags" and groups similar clients together. This can be understood as grouping clients with similar data distributions together to avoid different types of data from interfering with the judgment and to facilitate targeted filtering later.

[0021] S3. Server weight allocation: The server uses a clean benchmark dataset to perform truncated singular value decomposition to obtain the benchmark vector, uses a scaled dot product attention mechanism to calculate the similarity score between the client and the benchmark, and allocates aggregate weights. In this embodiment, the server uses a "no abnormal data template" as a standard to score the clients in each group: the more similar they are to the template, the higher the score and the greater the weight; this achieves accurate differentiation between benign (like the template) and malicious (not like the template) clients; in addition, it avoids guessing malicious clients based on a fixed proportion, making it more flexible and accurate.

[0022] S4. Model Distribution and Local Training: The server initializes the global model and randomly selects clients for distribution; the selected clients train the model using local data (SGD algorithm) and upload the local model parameters. In this embodiment, the server first initializes the global model framework, randomly selects some clients and distributes the global model; the selected clients train the model based on their local dataset, and after training, they upload the local model parameters to the server; the basic loop of model training is completed through the above process, enabling each client to achieve local model optimization based on its own data; S5. Model Aggregation and Iterative Optimization: The server aggregates model parameters in clusters according to weights, generates a new global model, and distributes it. The process is repeated until convergence.

[0023] In this embodiment, the server assigns greater influence to high-weight (benign) client models and less influence to low-weight (malicious) models within each group. The server then aggregates the best models and sends them back to the clients, repeatedly optimizing them until the models are stable. This process minimizes the damage caused by malicious clients and preserves the effective contributions of benign clients, ensuring the overall performance of the model.

[0024] It should be noted that, considering that traditional methods rely on model parameter updates (or gradient directions) for clustering, and addressing the issue of detection failure due to malicious clients deliberately mimicking benign behavior, this embodiment innovatively moves the defense and identification stage forward to the level of essential data features. The core of the method includes: extracting the set of left singular vectors from the client's local data based on truncated singular value decomposition; performing hierarchical clustering based on the principal angle similarity between left singular vectors; and introducing a scaled dot product attention mechanism to achieve dynamic weight allocation and secure aggregation.

[0025] The key finding and advantage of this embodiment is that even if a malicious client is difficult to distinguish from some benign clients in the gradient space, its features in the data subspace can still be effectively identified through the left singular vector. For example... Figure 3 As shown, by extracting left singular vectors from the original client data and the backdoor data and visually comparing them, it was found that at least one pair of left singular vectors in most clients showed significant differences. Figure 3 (a) thus amplifying the essential differences between covert malicious clients and benign clients from a multidimensional perspective; even if the differences between a few client vector pairs are small ( Figure 3 (b) The set of left singular vectors can still serve as a stable and effective distinguishing criterion. This embodiment overcomes the detection challenges of strong heterogeneity in model updates and concealed malicious behavior in Non-IID scenarios by directly analyzing the essential characteristics of data distribution, achieving efficient and accurate defense against backdoor attacks, and maintaining the data privacy of benign clients while ensuring the performance of the main task.

[0026] In a specific example, the client feature extraction and uploading specifically refers to: each client Based on local dataset Perform truncated singular value decomposition (SVD) using SVD: , the dataset Decomposed into a left singular vector matrix Singular value matrix and right singular vector matrix The left singular vector matrix is ​​obtained by retaining the left singular vectors corresponding to the first p largest singular values. and will Uploaded to the central server.

[0027] In the specific implementation, each client (benign / malicious) performs truncated singular value decomposition (SVD) on the local CIFAR-10 dataset: via the formula , local dataset matrix (The dimension can be "number of samples × 3072") Decomposed into a left singular vector matrix Singular value matrix Right singular vector matrix ; reserve The left singular vectors corresponding to the first 50 largest singular values ​​are obtained. (Dimensions are 3072×50), only The data is uploaded to the central server in encrypted form, without transmitting the original image data, thus protecting data privacy. Key effect: Malicious clients contain backdoor data locally, and their... With benign clients There are essential differences ( Figure 3 Visual verification lays the foundation for subsequent identification.

[0028] In a specific instance, the server clustering grouping specifically refers to: the central server receiving all client { , ,… After calculating the left singular vector of}, compute any two clients and Left singular vector matrix and The cosine similarity is used to construct a similarity matrix S; then the server uses the similarity matrix... Hierarchical clustering is used to cluster clients, grouping clients with high similarity into the same group; the server clustering grouping includes the following steps: Step S21: The server calculates for each client pair and The left singular vector matrix between cosine similarity ,in and Represent the left singular vector matrix respectively A left singular vector is used to obtain the similarity matrix. ,in Indicates the client and Cosine similarity measure between them.

[0029] Step S22: Using all clients as initial individual clusters, perform bottom-up hierarchical clustering based on the similarity matrix calculated in step S21: continuously merge the two clusters with the highest similarity metrics until the preset minimum similarity threshold β between clusters is met or the preset number of clusters M is reached.

[0030] In the specific implementation, the similarity matrix is ​​constructed as follows: the server receives data from 100 clients. Then, through the formula Calculate the cosine similarity of the left singular vectors of any two clients and construct a 100×100 similarity matrix S; Calculation logic: The similarity of the "least similar vector pair" among the two sets of left singular vectors is taken as the overall similarity of the client to avoid misjudgment caused by a single vector anomaly; Hierarchical clustering is performed as follows: each client is the initial individual cluster, and the two clusters with the highest similarity are merged from bottom to top until the similarity between clusters is <0.6, resulting in 8 clusters (each cluster contains 12-13 clients). Clustering results: 20 malicious clients were identified due to... With similar characteristics, they mainly cluster in two clusters. Benign clients are clustered in the remaining six clusters according to data distribution type (such as "animals" and "transportation vehicles"), thus achieving "grouping of similar data clients".

[0031] In a specific instance, the server weight allocation specifically refers to: the server pre-acquiring a clean benchmark dataset. ,right Performing truncated singular value decomposition yields the reference left singular vector matrix. Within each cluster, the server uses a scaled dot product attention mechanism to compute the attention value obtained from step 1 for each client. and The similarity between the servers is used to assign weights to each client based on the calculated results; the server weight assignment includes the following steps: Step S31: The server uses truncated singular value decomposition. Obtain its left singular vector matrix ; Step S32: The client set in the k-th cluster is The server calculates the i-th client of Compared with benchmark datasets of Scaling dot product attention score ,in express The dimension is used to scale the dot product result to ensure the stability of the value; Step S33: Within each cluster, calculate the client's attention score based on the scaled dot product attention score obtained in step S32. Weights during aggregation ,in It is the total number of clients in the current cluster. It is an exponential function, that is .

[0032] In the specific implementation, benchmark vector extraction: the server extracts a clean benchmark dataset. Execute truncated SVD The reference left singular vector matrix is ​​obtained. (Dimensions 3072×50); Attention score calculation: For the k-th cluster (e.g., containing 13 clients), the score is calculated using the formula... ( =3072 is (dimensions), calculate each client and Scaling dot product attention score; Scoring differences: Benign clients scored between 0.7 and 0.9 (high similarity to the clean baseline), while malicious clients scored between 0.2 and 0.4 (significant difference from the clean baseline). Aggregate weight calculation: via formula The weights are calculated, with benign clients having a weight of 0.08-0.12 and malicious clients having a weight of 0.01-0.03, achieving a dynamic allocation of "high weight for benign clients and low weight for malicious clients".

[0033] In a specific example, the model distribution and local training refer to: the server initializing the global model. During the t-th round of communication, a portion of clients are randomly selected, and the global model is... The data is distributed to the selected clients; the selected clients train the model using the stochastic gradient descent (SGD) algorithm based on their local datasets to obtain the local model. and will Uploaded to the server.

[0034] In the specific implementation, the server initializes ResNet-18 as a global model. In the t-th round of communication, 40 clients are randomly selected (5 from each cluster). Send to the selected client; The selected client was based on a local dataset (clean data for benign clients, and data containing backdoors for malicious clients). A local model was trained using the SGD algorithm, and the results were obtained after 8 epochs. and will Uploaded to the server in encrypted form; Training safeguards: The client uses only local data for training and does not interact with other clients to avoid data leakage.

[0035] In a specific example, the model aggregation and iterative optimization refers to: within each cluster, the server, based on the aggregation weights obtained in step S33, Local model of the client within this cluster We perform weighted aggregation to obtain a new global model within each cluster. ,in Represents the set of clients in the k-th cluster; Send the data to the client corresponding to the cluster and repeat steps S1-S5 until the model converges or reaches the preset training rounds.

[0036] In practical implementation, weighted aggregation within clusters: the server, within each cluster, uses a formula... ( (For the client set of the k-th cluster), aggregate the local model according to the weights obtained in step S3 to generate a new global model within the cluster; Aggregation effect: Due to the extremely low weight (0.01-0.03), the impact of the malicious client's backdoor updates on the global model is greatly suppressed; Model distribution and iteration: The server will Send the data to the client corresponding to the cluster, update the training round t=t+1, and repeat steps S1-S5 until the training ends after 100 rounds.

[0037] Implementation effect verification:

[0038] In summary, the defense process of this invention begins with local data processing and feature extraction on the client side. Each client (including benign and malicious clients) first performs truncated singular value decomposition on its local dataset, extracting the left singular vectors corresponding to the top p largest singular values, and uploading them to the server as data distribution features. After collecting the left singular vectors of all clients, the server performs hierarchical clustering based on cosine similarity, dividing the clients into different cluster groups according to the similarity of their data distribution. Subsequently, within each cluster group, the server uses the benchmark left singular vector extracted from a clean benchmark dataset to calculate the similarity score between each client and the benchmark through a scaled dot product attention mechanism, and dynamically assigns corresponding aggregation weights. Finally, the server performs weighted aggregation of the client models within each cluster based on the obtained weights, generating an updated global model, thereby effectively suppressing the influence of malicious clients while maintaining the high performance of the global model on the main task.

[0039] Compared with the prior art, this embodiment has the following advantages: (1) By projecting client data onto a multi-dimensional feature space spanned by left singular vectors, the data distribution is examined from the perspective of multiple principal components, thereby significantly enhancing the contrast between hidden malicious clients and benign clients and achieving accurate identification.

[0040] (2) The introduction of hierarchical clustering and scaling dot product attention mechanism provides dual protection, which not only achieves reasonable grouping of clients with similar data distribution, but also dynamically adjusts the aggregation weight without the need to preset a fixed proportion of malicious clients.

[0041] (3) While effectively suppressing backdoor attacks, the attention-weighted aggregation mechanism retains the model contribution of benign clients to the maximum extent, significantly reducing the model performance degradation caused by the simple removal of suspected malicious clients in traditional methods.

[0042] (4) Even in complex non-independent and identically distributed data environments and scenarios where backdoor attacks coexist, the present invention can still maintain excellent model performance.

[0043] Example 2 To achieve the above objectives, see Figure 4 This embodiment also provides a Non-IID federated learning backdoor attack defense system, including: Client-side feature extraction and upload module: Performs truncated singular value decomposition on the local dataset through the client, extracts the first p left singular vectors and uploads them to the server; Server clustering and grouping module: The server calculates the cosine similarity of the left singular vectors between clients, constructs a similarity matrix, and groups them using hierarchical clustering; Server weight allocation module: The server uses a clean benchmark dataset to perform truncated singular value decomposition to obtain the benchmark vector, calculates the similarity score between the client and the benchmark using a scaled dot product attention mechanism, and assigns aggregate weights. Model distribution and local training module: Initializes the global model through the server, randomly selects clients for distribution; selects clients to train with local data and uploads local model parameters; Model aggregation and iterative optimization module: The server aggregates model parameters in clusters according to weights, generates a new global model, and distributes it. The process is repeated until convergence.

[0044] The Non-IID federated learning backdoor attack defense system in this embodiment has the same advantages over the prior art as the above-described Non-IID federated learning backdoor attack defense method, and will not be repeated here.

[0045] Example 3 To achieve the above objectives, this embodiment also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the Non-IID federated learning backdoor attack defense method as described above.

[0046] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for defending against backdoor attacks using Non-IID federated learning, characterized in that, Includes the following steps: S1. Client-side feature extraction and upload: The client performs truncated singular value decomposition on the local dataset, extracts the first p left singular vectors and uploads them to the server. S2. Server Clustering and Grouping: The server calculates the cosine similarity of the left singular vectors among the clients, constructs a similarity matrix, and uses hierarchical clustering and grouping. S3. Server weight allocation: The server uses a clean benchmark dataset to perform truncated singular value decomposition to obtain the benchmark vector, and uses a scaled dot product attention mechanism to calculate the similarity score between the client and the benchmark, and allocates aggregate weights. S4. Model Distribution and Local Training: The server initializes the global model and randomly selects clients for distribution; the selected clients train using local data and upload local model parameters. S5. Model Aggregation and Iterative Optimization: The server aggregates model parameters in clusters according to weights, generates a new global model, and distributes it. The process is repeated until convergence.

2. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 1, characterized in that, The client feature extraction and uploading specifically refers to: each client Based on local dataset Perform truncated singular value decomposition via SVD: , the dataset Decomposed into a left singular vector matrix Singular value matrix and right singular vector matrix The left singular vector matrix is ​​obtained by retaining the left singular vectors corresponding to the first p largest singular values. and will Uploaded to the central server.

3. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 2, characterized in that, The server clustering grouping specifically refers to: the central server receiving all client { , ,… After calculating the left singular vector of}, compute any two clients and Left singular vector matrix and The cosine similarity is used to construct a similarity matrix S; Then the server uses the similarity matrix Hierarchical clustering is used to cluster clients, grouping those that meet a preset similarity threshold into the same group.

4. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 3, characterized in that, The server clustering grouping includes the following steps: Step S21: The server calculates for each pair of clients and The left singular vector matrix between and cosine similarity ,in and Represent the left singular vector matrix respectively A left singular vector is used to obtain the similarity matrix. ,in Indicates the client and Cosine similarity measure between them; Step S22: Using all clients as initial individual clusters, perform bottom-up hierarchical clustering based on the similarity matrix calculated in step S21: continuously merge the two clusters with the highest similarity metrics until the preset minimum inter-cluster similarity threshold β is met or the preset number of clusters M is reached.

5. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 2, characterized in that, The server weight allocation specifically refers to: the server pre-acquiring a clean benchmark dataset. ,right Performing truncated singular value decomposition yields the reference left singular vector matrix. In each cluster, the server uses a scaled dot product attention mechanism to compute the attention value obtained from step S1 for each client. and The similarity between them is calculated, and the results are used to assign weights to each client.

6. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 5, characterized in that, The server weight allocation includes the following steps: Step S31: The server uses truncated singular value decomposition. Obtain its left singular vector matrix ; Step S32: The client set in the k-th cluster is The server calculates the i-th client of Compared with benchmark datasets of Scaling dot product attention score ,in express The dimension is used to scale the dot product result to ensure the stability of the value; Step S33: Within each cluster, calculate the client's attention score based on the scaled dot product attention score obtained in step S32. Weights during aggregation ,in It represents the total number of clients in the current cluster. It is an exponential function, that is .

7. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 6, characterized in that, The model distribution and local training refer to: server initialization of the global model. During the t-th round of communication, a portion of clients are randomly selected, and the global model is... The data is distributed to the selected clients; the selected clients train the model using the stochastic gradient descent algorithm based on their local datasets to obtain the local model. and will Uploaded to the server.

8. The Non-IID Federated Learning Backdoor Attack Defense Method according to claim 7, characterized in that, The model aggregation and iterative optimization refer to: within each cluster, the server, based on the aggregation weights obtained in step S33, optimizes the model aggregation and iterative optimization. Local model of the client within this cluster We perform weighted aggregation to obtain a new global model within each cluster. ,in Represents the set of clients in the k-th cluster; Send the data to the client corresponding to the cluster and repeat steps S1-S5 until the model converges or reaches the preset training rounds.

9. A Non-IID federated learning backdoor attack defense system, characterized in that, include: Client-side feature extraction and upload module: Performs truncated singular value decomposition on the local dataset through the client, extracts the first p left singular vectors and uploads them to the server; Server clustering and grouping module: The server calculates the cosine similarity of the left singular vectors between clients, constructs a similarity matrix, and groups them using hierarchical clustering; Server weight allocation module: The server uses a clean benchmark dataset to perform truncated singular value decomposition to obtain the benchmark vector, calculates the similarity score between the client and the benchmark using a scaled dot product attention mechanism, and assigns aggregate weights. Model distribution and local training module: Initializes the global model through the server, randomly selects clients for distribution; selects clients to train with local data and uploads local model parameters; Model aggregation and iterative optimization module: The server aggregates model parameters in clusters according to weights, generates a new global model, and distributes it. The process is repeated until convergence.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, the processor performs the Non-IID federated learning backdoor attack defense method as described in any one of claims 1 to 8.

Images