A method and system for identifying free-rider attacks based on blockchain in federated learning

Abstract

This invention discloses a blockchain-based method for identifying free-rider attacks in federated learning. It is applied to a federated learning framework comprising multiple clients and multiple edge servers. This method replaces the central server with numerous edge servers. In early rounds of federated learning, the edge servers eliminate anonymous free-riders by verifying the similarity deviation of the WEF matrices uploaded by each client. In later rounds, the edge servers verify the validity of the client gradients uploaded by each client in relation to the global model accuracy, and accordingly prune the global gradients to penalize selfish and partial free-rider behaviors. This invention solves the technical problem that existing RFFL and STD-DAGMM methods cannot simultaneously defend against anonymous free-rider attacks, selfish free-rider attacks, and partial free-rider attacks.

Description

Technical Field

[0001] This invention belongs to the field of federated learning technology, and more specifically, relates to a method and system for identifying free-rider attacks based on blockchain in federated learning. Background Technology

[0002] Federated Learning (FL) is a distributed machine learning paradigm whose core objective is to enable multiple data holders to collaboratively train high-quality artificial intelligence (AI) models without sharing the original data. Through a "data stays put, model moves" model, it breaks down data silos while protecting data privacy and security, resolving the core contradiction between the reliance on data aggregation in traditional centralized machine learning and privacy regulations. However, federated learning also brings significant security challenges, with free-rider attacks becoming one of the main threats. Free-rider attacks are a passive attack pattern where attackers can benefit from a well-trained global model without contributing much of their private datasets and computing resources. In federated learning, free-riders can be categorized into three types: anonymous free-riders, selfish free-riders, and partial free-riders. Anonymous free-riders, lacking local datasets or computing resources, upload forged client gradients to a central server. Secondly, selfish freeloaders possess local datasets and computing resources but are unwilling to invest in federated learning training. They typically only use public datasets in the initial stages of training to evade server detection. Some freeloaders also possess local datasets and computing resources; they selectively contribute some data or participate only in certain stages of the training process to reduce resource investment while still obtaining a well-trained global model. On one hand, freeloaders' goal is not to reduce model accuracy but to obtain a more accurate model. However, their behavior of obtaining global model updates without contributing to global model improvement inevitably degrades the global model's performance. On the other hand, free-rider attacks allow freeloaders to receive rewards disproportionate to their contributions, thus undermining the fairness of federated learning and reducing the participation enthusiasm of legitimate clients. Therefore, designing a secure and fair mechanism to detect freeloaders in federated learning is necessary.

[0003] Existing research has proposed several methods to prevent free-rider attacks in federated learning. These methods are mostly based on two aspects: first, anomaly detection methods for model parameters; and second, contribution-based detection methods. Standard Deviation-Deep Autoencoding Gaussian Mixture Model for Unsupervised Anomaly Detection (STD-DAGMM) is a typical anomaly detection method. It deploys a DAGMM on a server and combines the STD metric of the local gradient update matrix with the deep autoencoding Gaussian mixture model, enabling it to detect free-riders as outliers based on the learned model update parameter features. Robust Fair Federated Learning (RFFL) is a typical contribution-based detection method. It distinguishes free-rider nodes from benign client nodes by calculating the similarity measurement distance between the global update and the client update, thereby evaluating the client's contribution. The authors argue that the local updates of client nodes should be similar to the global update.

[0004] However, both of the above-mentioned methods for defending against free-rider attacks have some significant drawbacks:

[0005] First, existing RFFL and STD-DAGMM methods only focus on anonymous free-rider attacks and are not applicable to selfish free-rider attacks and partial free-rider attacks.

[0006] Second, the existing RFFL and STD-DAGMM methods are not combined with blockchain, so they cannot solve the problems of single point of failure and limited central server resources.

[0007] Third, the existing RFFL method judges and removes free-rider nodes based on the similarity between updates, without considering that selfish free-riders and some free-riders have local datasets and computing resources, thus missing the opportunity to use them to contribute effective data and computing power to federated learning.

[0008] Fourth, the existing STD-DAGMM method has difficulty detecting free riders when the number of free-riding nodes is high. Summary of the Invention

[0009] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a method and system for identifying free-rider attacks in federated learning based on blockchain. Its purpose is to solve the technical problems of existing RFFL and STD-DAGMM methods, which only focus on anonymous free-rider attacks and are not applicable to selfish free-rider attacks or partial free-rider attacks; the technical problems of existing RFFL and STD-DAGMM methods failing to address single points of failure and limited central server resources due to their lack of integration with blockchain; the technical problem of existing RFFL methods missing opportunities to utilize the local datasets and computing resources of selfish free-riders and partial free-riders for contributing effective data and computing power to federated learning because they do not consider these characteristics; and the technical problem of existing STD-DAGMM methods struggling to detect free-riders when the number of free-rider nodes is high.

[0010] To achieve the above objectives, according to one aspect of the present invention, a method for identifying free-rider attacks based on blockchain in federated learning is provided. This method is applied in a federated learning framework that includes multiple clients and multiple edge servers, and includes the following steps:

[0011] (1) Set the training round t=0 for each client;

[0012] (2) Each client determines whether t is greater than the preset total number of training rounds. If so, the process ends; otherwise, proceed to step (3); where the value of T ranges from 60 to 200.

[0013] (3) Each client trains its local model for round t to obtain the client gradient for round t. And the WEF matrix, and the client gradients trained in the t-th round. The WEF matrix is ​​transmitted to the associated edge server;

[0014] (4) Each edge server verifies all clients based on the WEF matrix and client gradients from all clients in round t to obtain the effective client gradients for training in round t. Based on the effective client gradients, it obtains the global gradient that each client should obtain in training in round t and records the global gradient in the candidate block of the edge server in training in round t.

[0015] (5) Each edge server uses the Proof-of-Work (PoW) algorithm to update the candidate blocks of the edge server in the tth round of training obtained in step (4) to obtain the updated blocks of the edge server in the tth round of training. Then, it uses the global gradient of the tth round of training contained in the updated blocks to update the global model of the tth round of training to obtain the global model of the (t+1)th round of training.

[0016] (6) Each edge server sends the global gradient that each client should obtain in the t-th round of training obtained in step (4) to all clients associated with it, and the client uses the global gradient to update its local model trained in the t-th round, so as to obtain the local model trained in the t+1-th round, set t=t+1, and return to step (2).

[0017] Preferably, step (3) includes the following sub-steps:

[0018] (3-1) Set the number of iterations n=0;

[0019] (3-2) Each client uses stochastic gradient descent to train its local model for the (n+1)th iteration in round t to obtain the local model after training in round t and the (n+1)th iteration. ;

[0020] Specifically, this step uses the following formula:

[0021] ;

[0022] in The i-th client The local model obtained after training its local model for the nth iteration in the t-th round, where ,in , N is the set of all clients in the federated learning framework. The learning rate used when iteratively training the local model. For the i-th client Using the (n+1)th local sample on its local model in round t The loss function used during the (n+1)th iteration of training;

[0023] (3-3) Set n = n + 1;

[0024] (3-4) Determine if the number of iterations n is less than the size of the dataset used by the client during training. If yes, return to step (3-2); otherwise proceed to process (3-5).

[0025] (3-5) Each client trains its local model based on the obtained n'-th iteration. Obtain the client gradient for the corresponding training round t. ;

[0026] Specifically, this step uses the following formula:

[0027] ;

[0028] (3-6) Determine whether the current federated learning round t is greater than the predetermined round. If yes, proceed to step (3-8); otherwise, proceed to step (3-7); scheduled rounds. The value ranges from 3 to 10, with 5 being the preferred value;

[0029] (3-7) Each client uses the client gradient obtained from (3-5) during the t-th round of training to construct the WEF matrix for the t-th round. ;

[0030] (3-8) Each client will use the WEF matrix obtained in step (3-7) for the t-th round. The client gradient obtained in step (3-5) for the t-th training round It is transmitted to the associated edge server, which then forwards it to all other edge servers in the federated learning framework.

[0031] Preferably, step (3-7) includes the following sub-steps:

[0032] (3-7-1) Each client uses the client gradient obtained in step (3-5) to obtain the threshold for round t. ;

[0033] Specifically, this step uses the following formula:

[0034] ;

[0035] Where i∈N, j∈{1,2,...,H}, k∈{1,2,...,W}, H is the row number of the second-to-last level in the client's local model, and W is the column number of the second-to-last level in the client's local model. Indicates client The client gradient of the t-th round in the j-th row and k-th column of the penultimate layer of its neural network;

[0036] (3-7-2) For each client, use the client gradient obtained in step (3-5) and the threshold obtained in step (3-7-1). Obtain the WEF matrix for the client in round t. ;

[0037] Specifically, this step uses the following formula:

[0038] ;

[0039] in Indicates client WEF matrix of round t The element in the j-th row and k-th column of the array, where It is the size of A matrix consisting entirely of zeros.

[0040] Preferably, step (4) includes the following sub-steps:

[0041] (4-1) Determine whether the number of federated learning rounds t is less than the predetermined number of rounds. If yes, proceed to step (4-3); otherwise, proceed to step (4-2).

[0042] (4-2) Each edge server validates all clients based on the client gradients from all clients in the t-th round of training to obtain multiple valid client gradients. All valid client gradients are aggregated to obtain the global gradient in the t-th round of training. The global gradient is then sparsified to obtain the sparsified global gradient that each client should obtain in the t-th round of training. Then, proceed to step (4-4).

[0043] (4-3) Each edge server validates all clients based on the WEF matrix trained from all clients in round t to eliminate free riders in the federated learning framework (referring to clients that intentionally benefit from a well-trained global model without contributing much or little of their own private datasets and computing resources), obtains multiple updated clients, and aggregates the client gradients of all updated clients to obtain the global gradient that each client should receive in round t of training, and then proceeds to step (4-4).

[0044] (4-4) Each edge server stores the global gradient obtained in step (4-2) and step (4-3) for the t-th round of training and the global gradient that each client should obtain for the t-th round of training into the candidate block for the t-th round of training of the edge server.

[0045] Preferably, step (4-2) includes the following sub-steps:

[0046] (4-2-1) The edge server obtains the accuracy of its global model in the t-th round of training. ;in This indicates the accuracy of the model. Let represent the global model trained in the t-th round;

[0047] (4-2-2) The edge server utilizes the client gradients trained in round t. Update the global model trained in round t to obtain the updated global model trained in round t. And based on the updated global model trained in round t, obtain the global model accuracy after the global model update in round t. ;

[0048] (4-2-3) The edge server obtains the effective value of the client gradient in the t-th training round based on the global model accuracy obtained in step (4-2-1) and the updated global model accuracy obtained in step (4-2-2). :

[0049] ;

[0050] (4-2-4) The edge server uses the effective value of the client gradient obtained in step (4-2-3) to obtain the threshold for the t-th round of training. :

[0051] ;

[0052] in The preferred value is 0.8;

[0053] (4-2-5) Set up the set =N;

[0054] (4-2-6) The edge server determines the effective value of the gradient of the client in the t-th round of training obtained in step (4-2-3). Is it less than the threshold obtained in step (4-2-4) for the t-th round of training? If yes, proceed to step (4-2-7); otherwise, proceed to step (4-2-8).

[0055] (4-2-7) Set up a set Then proceed to step (4-2-8); where &i represents the value pointed to by i;

[0056] (4-2-8) The edge server obtains the global gradient of the t-th training round based on the client gradient obtained in step (3-8) and the effective value of the client gradient obtained in step (4-2-3). :

[0057] ;

[0058] (4-2-9) The edge server uses the effective values ​​of the client gradients obtained in step (4-2-3) to obtain the sparsity ratio of the global gradients that each client should receive in the t-th round of training. :

[0059] ;

[0060] (4-2-10) Based on the global gradient obtained in step (4-2-8) for the t-th training round and the sparsification ratio of the global gradient that each client should obtain in step (4-2-9), the edge server obtains the sparsified global gradient that each client should obtain in the t-th training round. :

[0061] ;

[0062] in This indicates the global gradient. After sorting from largest to smallest, select the top-ranked ones. The sparsification operation is performed by setting all remaining elements to 0 for the elements in the first element; assuming... The gradient at a certain layer of the neural network is: If there are 10 elements, the largest one will be selected. One element is retained, and the remaining elements are set to 0. This sparsification is performed on each layer of the neural network, rather than on the entire neural network.

[0063] Preferably, step (4-3) includes the following sub-steps:

[0064] (4-3-1) Each edge server obtains the Euclidean distance between the WEF matrix of each client trained in round t and the WEF matrix of each other client trained in round t, obtained in step (3-8). :

[0065] ;

[0066] (4-3-2) Each edge server obtains the cosine similarity between the WEF matrix of each client trained in the t-th round obtained in step (3-8) and the WEF matrix of each other client trained in the t-th round. :

[0067] ;

[0068] in represent The L2 norm;

[0069] (4-3-3) Each edge server uses the WEF matrix of each client obtained in step (3-8) to obtain the average frequency of the WEF matrix of that client in the t-th round of training. :

[0070] ;

[0071] (4-3-4) For each edge server, the weighted sum of the Euclidean distance obtained in step (4-3-1), the cosine similarity obtained in step (4-3-2), and the average frequency obtained in step (4-3-3) is calculated to obtain the similarity deviation of the WEF matrix of each client in the t-th round of training. :

[0072] ;

[0073] Where α, β, and γ are all constants, and ), The preferred value is 0.8;

[0074] (4-3-5) Each edge server uses the similarity deviation of the WEF matrix of each client obtained in step (4-3-4) to calculate the similarity deviation threshold of the training in the t-th round. :

[0075] ;

[0076] in It is a constant, and The preferred value is 0.9;

[0077] (4-3-6) Each edge server determines the similarity deviation obtained in step (4-3-4). Is it greater than the similarity deviation threshold obtained in step (4-3-5)? If yes, proceed to step (4-3-7); otherwise, proceed to step (4-3-8).

[0078] (4-3-7) Settings for each edge server Then proceed to step (4-3-8);

[0079] (4-3-8) The client gradient of each edge server obtained in step (3-8) for the t-th round of training. Obtain the global gradient of the t-th training round. :

[0080] ;

[0081] in, For the i-th client The corresponding dataset;

[0082] (4-3-9) Each edge server will use the global gradient obtained in step (4-3-8) , used as the global gradient that each client should obtain in the t-th round of training .

[0083] Preferably, step (5) includes the following sub-steps:

[0084] (5-1) Each edge server uses the PoW algorithm to process the candidate blocks obtained in step (4) in the t-th round of training of the edge server to obtain a consensus node, which refers to the first edge server to find a random value Nonce that meets the conditions and obtain the right to record the block.

[0085] (5-2) The consensus node sets its candidate block from the t-th round of training as the new block and transmits the new block to all edge servers;

[0086] (5-3) Each edge server adds a new block from the consensus node to its local blockchain to obtain the global gradient of the t-th round of training contained in the new block and the global gradient that each client should receive in the t-th round of training;

[0087] (5-4) Each edge server uses the global gradient obtained in step (5-3) to update the global model trained in the t-th round, so as to obtain the updated global model. That is, the global model trained in the (t+1)th round. :

[0088] ;

[0089] Preferably, step (5-1) specifically involves the following steps: First, each edge server constructs a block header for the candidate blocks in the t-th round of training. This header includes a timestamp, the hash value of the previous block in the candidate blocks, the difficulty value, and a random value. , where random values ∈[1, Difficulty level Target represents the hash target threshold, which ranges from 0 to 2. 256 -1, preferably 2 250 Then, each edge server uses the SHA-256 function to hash its corresponding block header to obtain the hash value corresponding to that edge server. Subsequently, each edge server determines its corresponding hash value. If the hash target threshold Target is less than the current time, the edge server is added to the candidate edge server set, and the timestamp in the block header of the edge server is set to the current time. The edge server with the earliest timestamp in the resulting candidate edge server set is used as the consensus node; otherwise, it is set to... = And repeat the above process.

[0090] Preferably, in step (6), the client updates its local model trained in round t using global gradients to obtain the local model trained in round t+1. The calculation formula is:

[0091] ;

[0092] According to another aspect of the present invention, a system for identifying free-rider attacks based on blockchain in federated learning is provided. This system is applied within a federated learning framework comprising multiple clients and multiple edge servers. The system includes:

[0093] The first module, which is set on each client, is used to set the training round t=0;

[0094] The second module, located on each client, is used to determine whether t is greater than the preset total number of training rounds. If yes, the process ends; otherwise, proceed to the third module. The value of T ranges from 60 to 200.

[0095] The third module, set up on each client, is used to train its local model for round t to obtain the client-side gradients for round t. And the WEF matrix, and the client gradients trained in the t-th round. The WEF matrix is ​​transmitted to the associated edge server;

[0096] The fourth module, which is set up on each edge server, is used to validate all clients based on the WEF matrix and client gradients from all clients in round t, to obtain the effective client gradients for training in round t. Based on the effective client gradients, the global gradient that each client should obtain in training in round t is obtained, and the global gradient is recorded in the candidate block for training in round t of the edge server.

[0097] The fifth module, which is set up on each edge server, is used to update the candidate blocks of the edge server in the t-th round of training obtained by the fourth module using the Proof-of-Work (PoW) algorithm, so as to obtain the updated blocks of the edge server in the t-th round of training. Then, the global model of the t-th round of training is updated using the global gradient of the t-th round of training contained in the updated blocks, so as to obtain the global model of the (t+1)-th round of training.

[0098] The sixth module, which is set up on each edge server, is used to send the global gradient that each client should obtain in the t-th round of training obtained by the fourth module to all clients associated with it, and the client uses the global gradient to update its local model trained in the t-th round to obtain the local model trained in the (t+1)-th round, set t=t+1, and return to the second module.

[0099] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects:

[0100] First, because the present invention takes steps (3) to (4), the preceding The training round eliminates anonymous free-riders, and subsequent rounds punish both private and partial free-rider attacks. Therefore, it can solve the technical problem that existing RFFL and STD-DAGMM methods, which only focus on anonymous free-riders, cannot be applied to selfish and partial free-rider attacks.

[0101] Second, because the present invention takes steps (4) to (5), it replaces the central server with multiple edge servers with strong computing power and combines them with the blockchain. Therefore, it can solve the technical problems of the existing RFFL method and STD-DAGMM method, which cannot solve the single point of failure and the limited central server resources due to the lack of combination with the blockchain.

[0102] Third, because the present invention takes step (4-2), in subsequent rounds only the global gradient that selfish free-riders and some free-riders should obtain is sparsified, rather than directly eliminating selfish free-riders and some free-riders, it can solve the technical problem that the characteristics of selfish free-riders and some free-riders having local datasets and computing resources are not taken into account, resulting in the loss of the opportunity to use them to contribute effective data and computing power to federated learning.

[0103] Fourth, by taking steps (4-3-1) to (4-3-4), this invention comprehensively considers the Euclidean distance, cosine similarity, and average frequency of the model weight evolution matrix (WEF matrix) of each client. The Euclidean distance can capture the absolute numerical difference of the WEF matrix, the cosine similarity can identify the directional consistency of the weight evolution pattern, and the average frequency can reflect the overall activity of weight evolution. The three form a complementary detection mechanism from the three dimensions of numerical value, pattern, and activity. Therefore, it can solve the problem that it is difficult to detect free riders when the number of free rider nodes is high. Attached Figure Description

[0104] Figure 1 This is a flowchart of a blockchain-based method for identifying free-rider attacks in federated learning, as described in this invention. Detailed Implementation

[0105] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0106] The basic idea of ​​this invention is to replace the central server with many edge servers. In the early rounds of federated learning, the edge servers eliminate anonymous free riders by verifying the similarity deviation of the WEF matrices uploaded by each client. In the later rounds of federated learning, the edge servers verify the effective value of the client gradients uploaded by each client to the global model accuracy, and accordingly prune the global gradient to punish selfish free riders and some free riders' free-riding behavior.

[0107] like Figure 1 As shown, this invention provides a method for identifying free-rider attacks based on blockchain in federated learning. This method is applied in a federated learning framework that includes multiple clients and multiple edge servers. The method includes the following steps:

[0108] (1) Set the training round t=0 for each client;

[0109] (2) Each client determines whether t is greater than the preset total number of training rounds. If yes, the process ends; otherwise, proceed to step (3).

[0110] The value of T ranges from 60 to 200, with the preferred value depending on the client's dataset. For example, if the MNIST dataset is used in this solution, T is preferably 100.

[0111] (3) Each client trains its local model for round t to obtain the client gradient for round t. And the WEF matrix, and the client gradients trained in the t-th round. The WEF matrix is ​​transmitted to the associated edge server;

[0112] Step (3) specifically includes the following sub-steps:

[0113] (3-1) Set the number of iterations n=0;

[0114] (3-2) Each client uses stochastic gradient descent to train its local model for the (n+1)th iteration in round t to obtain the local model after training in round t and the (n+1)th iteration. ;

[0115] Specifically, this step uses the following formula:

[0116] ;

[0117] in The i-th client The local model obtained after training its local model for the nth iteration in the t-th round, where ,in , N is the set of all clients in the federated learning framework. The learning rate used when iteratively training the local model. For the i-th client Using the (n+1)th local sample on its local model in round t The loss function used during the (n+1)th iteration of training.

[0118] (3-3) Set n = n + 1;

[0119] (3-4) Determine if the number of iterations n is less than the size of the dataset used by the client during training. If yes, return to step (3-2); otherwise proceed to process (3-5).

[0120] (3-5) Each client trains its local model based on the obtained n'-th iteration. Obtain the client gradient for the corresponding training round t. .

[0121] Specifically, this step uses the following formula:

[0122] ;

[0123] (3-6) Determine whether the current federated learning round t is greater than the predetermined round. If yes, proceed to step (3-8); otherwise, proceed to step (3-7).

[0124] The predetermined rounds in this step The value ranges from 3 to 10, with 5 being the preferred value;

[0125] (3-7) Each client uses the client gradient obtained from (3-5) during the t-th round of training to construct the WEF matrix for the t-th round. ;

[0126] Steps (3-7) specifically include the following sub-steps:

[0127] (3-7-1) Each client uses the client gradient obtained in step (3-5) to obtain the threshold for round t. ;

[0128] Specifically, this step uses the following formula:

[0129] ;

[0130] Where i∈N, j∈{1,2,...,H}, k∈{1,2,...,W}, H is the row number of the second-to-last level in the client's local model, and W is the column number of the second-to-last level in the client's local model. Indicates the client The client gradient in the second-to-last layer of its local model in round t, at row j and column k.

[0131] (3-7-2) For each client, use the client gradient obtained in step (3-5) and the threshold obtained in step (3-7-1). Obtain the WEF matrix for the client in round t. ;

[0132] Specifically, this step uses the following formula:

[0133]

[0134] in Indicates the client WEF matrix of round t The element in the j-th row and k-th column of the array, where It is the size of A matrix consisting entirely of zeros.

[0135] (3-8) Each client will use the WEF matrix obtained in step (3-7) for the t-th round. The client gradient obtained in step (3-5) for the t-th training round It is transmitted to the associated edge server, which then forwards it to all other edge servers in the federated learning framework.

[0136] (4) Each edge server verifies all clients based on the WEF matrix and client gradients from all clients in round t to obtain the effective client gradients for training in round t. Based on the effective client gradients, it obtains the global gradient that each client should obtain in training in round t and records the global gradient in the candidate blocks of the edge server in training in round t.

[0137] The advantage of steps (3) to (4) above is that the former The training round eliminates anonymous free-riders, and subsequent rounds punish both private and partial free-rider attacks. This solves the problem of focusing only on anonymous free-riders while rarely considering anonymous free-riders, selfish free-riders, and partial free-riders simultaneously.

[0138] Step (4) includes the following sub-steps:

[0139] (4-1) Determine whether the federated learning round t is less than or equal to the predetermined round. If yes, proceed to step (4-3); otherwise, proceed to step (4-2).

[0140] (4-2) Each edge server validates all clients based on the client gradients from all clients in the t-th round of training to obtain multiple valid client gradients. All valid client gradients are aggregated to obtain the global gradient in the t-th round of training. The global gradient is then sparsified to obtain the sparsified global gradient that each client should obtain in the t-th round of training. Then, proceed to step (4-4).

[0141] The advantage of the above step (4-2) is that in subsequent rounds, only the global gradient that selfish free-riders and some free-riders should receive is sparsified, rather than directly eliminating selfish free-riders and some free-riders. This solves the problem of failing to retain selfish free-riders and some free-riders to contribute to federated learning.

[0142] Step (4-2) specifically includes the following sub-steps:

[0143] (4-2-1) The edge server obtains the accuracy of its global model in the t-th round of training. ;in This indicates the accuracy of the model. Let represent the global model trained in the t-th round;

[0144] (4-2-2) The edge server utilizes the client gradients trained in round t. Update the global model trained in round t to obtain the updated global model trained in round t. And based on the updated global model trained in round t, obtain the global model accuracy after the global model update in round t. ;

[0145] (4-2-3) The edge server obtains the effective value of the client gradient in the t-th training round based on the global model accuracy obtained in step (4-2-1) and the updated global model accuracy obtained in step (4-2-2). ;

[0146] Specifically, this step uses the following formula:

[0147] ;

[0148] (4-2-4) The edge server uses the effective value of the client gradient obtained in step (4-2-3) to obtain the threshold for the t-th round of training. ;

[0149] Specifically, this step uses the following formula:

[0150] ;

[0151] in The preferred value is 0.8.

[0152] (4-2-5) Set up the set =N;

[0153] (4-2-6) The edge server determines the effective value of the gradient of the client in the t-th round of training obtained in step (4-2-3). Is it less than the threshold obtained in step (4-2-4) for the t-th round of training? If yes, proceed to step (4-2-7); otherwise, proceed to step (4-2-8).

[0154] (4-2-7) Set up a set Then proceed to step (4-2-8); where &i represents the value pointed to by i;

[0155] (4-2-8) The edge server obtains the global gradient of the t-th training round based on the client gradient obtained in step (3-8) and the effective value of the client gradient obtained in step (4-2-3). ;

[0156] Specifically, this step uses the following formula:

[0157] ;

[0158] (4-2-9) The edge server uses the effective values ​​of the client gradients obtained in step (4-2-3) to obtain the sparsity ratio of the global gradients that each client should receive in the t-th round of training. ;

[0159] Specifically, this step uses the following formula:

[0160] ;

[0161] (4-2-10) Based on the global gradient obtained in step (4-2-8) for the t-th training round and the sparsification ratio of the global gradient that each client should obtain in step (4-2-9), the edge server obtains the sparsified global gradient that each client should obtain in the t-th training round. ;

[0162] Specifically, this step uses the following formula:

[0163] ;

[0164] in This indicates the global gradient. After sorting from largest to smallest, select the top-ranked ones. The element is sparsed by setting all remaining elements to 0; assuming the global gradient of the t-th training round is... On a certain floor If there are 10 elements, then the largest element in that layer will be selected. One element is retained, and the remaining elements are set to 0. This sparsification is performed separately in each layer of the global gradient, rather than in the entire global gradient.

[0165] (4-3) Each edge server validates all clients based on the WEF matrix trained from all clients in round t to eliminate free riders in the federated learning framework (referring to clients that intentionally benefit from a well-trained global model without contributing much or little of their own private datasets and computing resources), obtains multiple updated clients, and aggregates the client gradients of all updated clients to obtain the global gradient that each client should receive in round t of training, and then proceeds to step (4-4).

[0166] Step (4-3) includes the following sub-steps:

[0167] (4-3-1) Each edge server obtains the Euclidean distance between the WEF matrix of each client trained in round t and the WEF matrix of each other client trained in round t, obtained in step (3-8). ;

[0168] Specifically, this step uses the following formula:

[0169] ;

[0170] (4-3-2) Each edge server obtains the cosine similarity between the WEF matrix of each client trained in the t-th round obtained in step (3-8) and the WEF matrix of each other client trained in the t-th round. ;

[0171] Specifically, this step uses the following formula:

[0172] ;

[0173] in represent The L2 norm.

[0174] (4-3-3) Each edge server uses the WEF matrix of each client obtained in step (3-8) to obtain the average frequency of the WEF matrix of that client in the t-th round of training. ;

[0175] Specifically, this step uses the following formula:

[0176] ;

[0177] (4-3-4) For each edge server, the weighted sum of the Euclidean distance obtained in step (4-3-1), the cosine similarity obtained in step (4-3-2), and the average frequency obtained in step (4-3-3) is calculated to obtain the similarity deviation of the WEF matrix of each client in the t-th round of training. ;

[0178] Specifically, this step uses the following formula:

[0179] ;

[0180] Where α, β, and γ are all constants, and In this plan The preferred value is 0.8;

[0181] The advantage of steps (4-3-1) to (4-3-4) above is that it comprehensively considers the Euclidean distance between WEF matrices, cosine similarity, and average frequency of WEF matrices, thus solving the problem that it is difficult to detect free riders when the number of free-riding nodes is high.

[0182] (4-3-5) Each edge server uses the similarity deviation of the WEF matrix of each client obtained in step (4-3-4) to calculate the similarity deviation threshold of the training in the t-th round. ;

[0183] Specifically, this step uses the following formula:

[0184] ;

[0185] in It is a constant, and The preferred value is 0.9.

[0186] (4-3-6) Each edge server determines the similarity deviation obtained in step (4-3-4). Is it greater than the similarity deviation threshold obtained in step (4-3-5)? If yes, proceed to step (4-3-7); otherwise, proceed to step (4-3-8).

[0187] (4-3-7) Settings for each edge server Then proceed to step (4-3-8);

[0188] (4-3-8) The client gradient of each edge server obtained in step (3-8) for the t-th round of training. , obtain the global gradient of the t-th training round;

[0189] Specifically, this step uses the following formula:

[0190] ;

[0191] in, For the i-th client The corresponding dataset;

[0192] (4-3-9) Each edge server will use the global gradient obtained in step (4-3-8) , used as the global gradient that each client should obtain in the t-th round of training ;

[0193] (4-4) Each edge server stores the global gradient obtained in step (4-2) and step (4-3) for the t-th round of training and the global gradient that each client should obtain for the t-th round of training into the candidate block for the t-th round of training of the edge server;

[0194] (5) Each edge server uses the ProveofWork (PoW) algorithm to update the candidate blocks of the edge server in the tth round of training obtained in step (4) to obtain the updated blocks of the edge server in the tth round of training. Then, it uses the global gradient of the tth round of training contained in the updated blocks to update the global model of the tth round of training to obtain the global model of the (t+1)th round of training.

[0195] The advantage of steps (4) to (5) above is that the central server is replaced by multiple edge servers with strong computing power and combined with blockchain, which solves the problem of single point of failure and limited central server resources.

[0196] Step (5) specifically includes the following sub-steps:

[0197] (5-1) Each edge server uses the PoW algorithm to process the candidate blocks obtained in step (4) in the t-th round of training of the edge server to obtain a consensus node (which refers to the first edge server to find a random value Nonce that meets the conditions and obtain the right to record the block).

[0198] Specifically, this step involves each edge server first constructing a block header for the candidate blocks in the t-th round of training. This header includes a timestamp (the current time), the hash value of the previous block in the candidate blocks, the difficulty value, and a random value. , where random values ∈[1, Difficulty level Target represents the hash target threshold, which ranges from 0 to 2. 256 -1, preferably 2 250 Then, each edge server uses the SHA-256 function to hash its corresponding block header to obtain the hash value corresponding to that edge server. Subsequently, each edge server determines its corresponding hash value. If the hash target threshold Target is less than the current time, the edge server is added to the candidate edge server set, and the timestamp in the block header of the edge server is set to the current time. The edge server with the earliest timestamp in the resulting candidate edge server set is used as the consensus node; otherwise, it is set to... = And repeat the above process;

[0199] (5-2) The consensus node sets its candidate block from the t-th round of training as the new block and transmits the new block to all edge servers;

[0200] (5-3) Each edge server adds a new block from the consensus node to its local blockchain to obtain the global gradient of the t-th round of training contained in the new block and the global gradient that each client should receive in the t-th round of training;

[0201] (5-4) Each edge server uses the global gradient obtained in step (5-3) to update the global model trained in the t-th round, so as to obtain the updated global model. That is, the global model trained in the (t+1)th round;

[0202] Specifically, this step uses the following formula:

[0203] ;

[0204] (6) Each edge server sends the global gradient that each client should obtain in the t-th round of training obtained in step (4) to all clients associated with it, and the client uses the global gradient to update its local model trained in the t-th round to obtain the local model trained in the (t+1)-th round. Set t=t+1 and return to step (2).

[0205] Specifically, in this step, the client updates its local model trained in round t using global gradients to obtain the local model trained in round t+1. The calculation formula is:

[0206] ;

[0207] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying free-rider attacks based on a blockchain in federated learning, applied in a federated learning framework comprising a plurality of clients and a plurality of edge servers, characterized in that, The method includes the following steps: (1) Set the training round t=0 for each client; (2) Each client determines whether t is greater than the preset total number of training rounds. If so, the process ends; otherwise, proceed to step (3); where the value of T ranges from 60 to 200. (3) each client performs t-th round of training on its local model to obtain t-th round of trained client gradient and WEF matrix, and transmits the t-th round of trained client gradient and WEF matrix to the edge server associated therewith; (4) Each edge server verifies all clients based on the WEF matrix and client gradients from all clients in round t to obtain the effective client gradients for training in round t. Based on the effective client gradients, it obtains the global gradient that each client should obtain in training in round t and records the global gradient in the candidate block of the edge server in training in round t. (5) Each edge server uses the Proof-of-Work (PoW) algorithm to update the candidate blocks obtained in step (4) for the t-th round of training, so as to obtain the updated blocks for the t-th round of training. Then, it uses the global gradients from the t-th round of training contained in the updated blocks to update the global model for the t-th round of training, so as to obtain the global model for the (t+1)-th round of training. Step (5) includes the following sub-steps: (5-1) Each edge server uses the PoW algorithm to process the candidate blocks obtained in step (4) in the t-th round of training of the edge server to obtain a consensus node, which refers to the first edge server to find a random value Nonce that meets the conditions and obtain the right to record the block. (5-2) The consensus node sets its candidate block from the t-th round of training as the new block and transmits the new block to all edge servers; (5-3) Each edge server adds a new block from the consensus node to its local blockchain to obtain the global gradient of the t-th round of training contained in the new block and the global gradient that each client should receive in the t-th round of training; (5-4) Each edge server updates the global model of the tth training round using the global gradient of the tth training round obtained in step (5-3) to obtain an updated global model , i.e., the global model of the (t+1)th training round : ； wherein denotes the global model of the t-th round of training, denotes the global gradient of the t-th round of training; (6) Each edge server sends the global gradient that each client should obtain in the t-th round of training obtained in step (4) to all clients associated with it, and the client uses the global gradient to update its local model trained in the t-th round, so as to obtain the local model trained in the t+1-th round, set t=t+1, and return to step (2).

2. The method for identifying free-rider attack based on blockchain in federated learning according to claim 1, characterized in that, Step (3) includes the following sub-steps: (3-1) Set the number of iterations n=0; (3-2) Each client uses the random gradient descent method to perform the n+1th iteration training on the local model thereof in the tth round to obtain the local model after the n+1th iteration training in the tth round : ； in The i-th client The local model obtained after training its local model for the nth iteration in the t-th round, where ,in , N is the set of all clients in the federated learning framework. The learning rate used when iteratively training the local model. For the i-th client Using the (n+1)th local sample on its local model in round t The loss function used during the (n+1)th iteration of training; (3-3) Set n = n + 1; (3-4) Determine if the number of iterations n is less than the size of the dataset used by the client during training. If yes, return to step (3-2); otherwise proceed to process (3-5). (3-5) Each client updates its local model based on the obtained client gradient obtaining the client gradient corresponding to the t-th round of training : ； (3-6) determining whether the current federated learning round t is greater than a predetermined round , if yes, go to step (3-8), otherwise go to step (3-7); the value range of the predetermined round is 3 to 10; (3-7) Each client constructs the WEF matrix of the t-th round using the client gradient of the t-th round training obtained in (3-5) ; (3-8) Each client will use the WEF matrix obtained in step (3-7) for the t-th round. The client gradient obtained in step (3-5) for the t-th training round It is transmitted to the associated edge server, which then forwards it to all other edge servers in the federated learning framework.

3. The method for identifying free-rider attacks based on blockchain in federated learning according to claim 2, characterized in that, Steps (3-7) include the following sub-steps: (3-7-1) Each client uses the client gradient obtained in step (3-5) to obtain the threshold for round t. : ； Where i∈N, j∈{1,2,...,H}, k∈{1,2,...,W}, H is the row number of the second-to-last level in the client's local model, and W is the column number of the second-to-last level in the client's local model. Indicates the client The client gradient of the t-th round in the j-th row and k-th column of the penultimate layer of its neural network; (3-7-2) For each client, use the client gradient obtained in step (3-5) and the threshold obtained in step (3-7-1). Obtain the WEF matrix for the client in round t. : ； in Indicates the client WEF matrix of round t The element in the j-th row and k-th column of the array, where It is the size of A matrix consisting entirely of zeros.

4. The method for identifying free-rider attacks based on blockchain in federated learning according to claim 3, characterized in that, Step (4) includes the following sub-steps: (4-1) Determine whether the number of federated learning rounds t is less than the predetermined number of rounds. If yes, proceed to step (4-3); otherwise, proceed to step (4-2). (4-2) Each edge server validates all clients based on the client gradients from all clients in the t-th round of training to obtain multiple valid client gradients. All valid client gradients are aggregated to obtain the global gradient in the t-th round of training. The global gradient is then sparsified to obtain the sparsified global gradient that each client should obtain in the t-th round of training. Then, proceed to step (4-4). (4-3) Each edge server validates all clients based on the WEF matrix trained from all clients in round t to eliminate free riders in the federated learning framework, obtains multiple updated clients, and aggregates the client gradients of all updated clients to obtain the global gradient that each client should obtain in round t training, and then proceeds to step (4-4). (4-4) Each edge server stores the global gradient obtained in step (4-2) and step (4-3) for the t-th round of training and the global gradient that each client should obtain for the t-th round of training into the candidate block for the t-th round of training of the edge server.

5. The method for identifying free-rider attacks based on blockchain in federated learning according to claim 4, characterized in that, Step (4-2) includes the following sub-steps: (4-2-1) The edge server obtains the accuracy of its global model in the t-th round of training. ;in This indicates the accuracy of the model. Let represent the global model trained in the t-th round; (4-2-2) The edge server utilizes the client gradients trained in round t. Update the global model trained in round t to obtain the updated global model trained in round t. And based on the updated global model trained in round t, obtain the global model accuracy after the global model update in round t. ; (4-2-3) The edge server obtains the effective value of the client gradient in the t-th training round based on the global model accuracy obtained in step (4-2-1) and the updated global model accuracy obtained in step (4-2-2). : ； (4-2-4) The edge server uses the effective value of the client gradient obtained in step (4-2-3) to obtain the threshold for the t-th round of training. : ； in ; (4-2-5) Set up the set =N; (4-2-6) The edge server determines the effective value of the gradient of the client in the t-th round of training obtained in step (4-2-3). Is it less than the threshold obtained in step (4-2-4) for the t-th round of training? If yes, proceed to step (4-2-7); otherwise, proceed to step (4-2-8). (4-2-7) Set up a set Then proceed to step (4-2-8); where &i represents the value pointed to by i; (4-2-8) The edge server obtains the global gradient of the t-th training round based on the client gradient obtained in step (3-8) and the effective value of the client gradient obtained in step (4-2-3). : ； (4-2-9) The edge server uses the effective values ​​of the client gradients obtained in step (4-2-3) to obtain the sparsity ratio of the global gradients that each client should receive in the t-th round of training. : ； (4-2-10) Based on the global gradient obtained in step (4-2-8) for the t-th training round and the sparsification ratio of the global gradient that each client should obtain in step (4-2-9), the edge server obtains the sparsified global gradient that each client should obtain in the t-th training round. : ； in This indicates the global gradient. After sorting from largest to smallest, select the top-ranked ones. A sparsification operation that sets all remaining elements to 0, given the element that is already in the settling condition; assuming... The gradient at a certain layer of the neural network is: If there are 10 elements, the largest one will be selected. One element is retained, and the remaining elements are set to 0. This sparsification is performed on each layer of the neural network, rather than on the entire neural network.

6. The method for identifying free-rider attacks based on blockchain in federated learning according to claim 5, characterized in that, Step (4-3) includes the following sub-steps: (4-3-1) Each edge server obtains the Euclidean distance between the WEF matrix of each client trained in round t and the WEF matrix of each other client trained in round t, obtained in step (3-8). : ； (4-3-2) Each edge server obtains the cosine similarity between the WEF matrix of each client trained in the t-th round obtained in step (3-8) and the WEF matrix of each other client trained in the t-th round. : ； in represent The L2 norm; (4-3-3) Each edge server uses the WEF matrix of each client obtained in step (3-8) to obtain the average frequency of the WEF matrix of that client in the t-th round of training. : ； (4-3-4) For each edge server, the weighted sum of the Euclidean distance obtained in step (4-3-1), the cosine similarity obtained in step (4-3-2), and the average frequency obtained in step (4-3-3) is calculated to obtain the similarity deviation of the WEF matrix of each client in the t-th round of training. : ； Where α, β, and γ are all constants, and ); (4-3-5) Each edge server uses the similarity deviation of the WEF matrix of each client obtained in step (4-3-4) to calculate the similarity deviation threshold of the training in the t-th round. : ； in It is a constant, and ; (4-3-6) Each edge server determines the similarity deviation obtained in step (4-3-4). Is it greater than the similarity deviation threshold obtained in step (4-3-5)? If yes, proceed to step (4-3-7); otherwise, proceed to step (4-3-8). (4-3-7) Settings for each edge server Then proceed to step (4-3-8); (4-3-8) The client gradient of each edge server obtained in step (3-8) for the t-th round of training. Obtain the global gradient of the t-th training round. : ； in, For the i-th client The corresponding dataset; (4-3-9) Each edge server will use the global gradient obtained in step (4-3-8) , used as the global gradient that each client should obtain in the t-th round of training .

7. The method for identifying free-rider attacks based on blockchain in federated learning according to claim 6, characterized in that, Step (5-1) specifically involves the following steps: First, each edge server constructs a block header for the candidate blocks in the t-th round of training. This header includes a timestamp, the hash value of the previous block in the candidate blocks, the difficulty value, and a random value. , where random values ∈[1, Difficulty level Target represents the hash target threshold, which ranges from 0 to 2. 256 -1; Then, each edge server uses the SHA-256 function to hash its corresponding block header to obtain the hash value corresponding to that edge server. Subsequently, each edge server determines its corresponding hash value. If the hash target threshold Target is less than the current time, the edge server is added to the candidate edge server set, and the timestamp in the block header of the edge server is set to the current time. The edge server with the earliest timestamp in the resulting candidate edge server set is used as the consensus node; otherwise, it is set to... = And repeat the above process.

8. The method for identifying free-rider attacks based on blockchain in federated learning according to claim 7, characterized in that, In step (6), the client updates its local model trained in round t using global gradients to obtain the local model trained in round t+1. The calculation formula is: ； 9. A system for identifying free-rider attacks based on blockchain in federated learning, applied in a federated learning framework including multiple clients and multiple edge servers, and implemented based on the method for identifying free-rider attacks based on blockchain in federated learning as described in claim 1, characterized in that... The system includes: The first module, which is set on each client, is used to set the training round t=0; The second module, located on each client, is used to determine whether t is greater than the preset total number of training rounds. If yes, the process ends; otherwise, proceed to the third module. The value of T ranges from 60 to 200. The third module, set up on each client, is used to train its local model for round t to obtain the client-side gradients for round t. And the WEF matrix, and the client gradients trained in the t-th round. The WEF matrix is ​​transmitted to the associated edge server; The fourth module, which is set up on each edge server, is used to validate all clients based on the WEF matrix and client gradients from all clients in round t, to obtain the effective client gradients for training in round t. Based on the effective client gradients, the global gradient that each client should obtain in training in round t is obtained, and the global gradient is recorded in the candidate block for training in round t of the edge server. The fifth module, which is set up on each edge server, is used to update the candidate blocks of the edge server in the t-th round of training obtained by the fourth module using the Proof-of-Work (PoW) algorithm, so as to obtain the updated blocks of the edge server in the t-th round of training. Then, the global model of the t-th round of training is updated using the global gradient of the t-th round of training contained in the updated blocks, so as to obtain the global model of the (t+1)-th round of training. The sixth module, which is set up on each edge server, is used to send the global gradient that each client should obtain in the t-th round of training obtained by the fourth module to all clients associated with it, and the client uses the global gradient to update its local model trained in the t-th round to obtain the local model trained in the (t+1)-th round, set t=t+1, and return to the second module.

Images