Defense method and system for federated learning backdoor attack

Abstract

The invention relates to the technical field of network security, in particular to a defense method and system for federated learning backdoor attacks, a server initializes a federated learning global model, and identifies at least one key layer easy to implant a backdoor in the global model; distributing the current global model parameters to a plurality of clients, receiving model update information uploaded by each client, extracting a multi-dimensional gradient feature vector of each client based on gradient information of each client in a key layer, calculating a mahalanobis distance anomaly score of each client relative to the gradient distribution of the whole client, and calculating the mahalanobis distance anomaly score of each client according to the mahalanobis distance anomaly score; and screening and rejecting the clients which are judged to be abnormal, aggregating model updates uploaded by the clients which are judged to be benign, and generating a new global model. Malicious updating is effectively isolated while the performance of the main task is ensured, and the robustness and safety of a global model are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a defense method and system against federated learning backdoor attacks. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In traditional centralized training, participants need to upload local data to a central server. This not only brings huge data transmission costs, but also raises serious risks of user privacy leaks, especially when the data contains sensitive information.

[0004] To address this challenge, Federated Learning (FL), a typical privacy-preserving distributed collaborative learning framework, is widely used. This method allows multiple clients to collaboratively train a global model without sharing their local raw data, simply by exchanging model parameters or gradient updates. The basic process is as follows: a central server iteratively distributes the current global model to each participating client; the clients train using their local data and upload their updates; and the server ultimately aggregates these updates to generate a new generation of the global model.

[0005] While federated learning offers significant advantages in privacy protection and distributed modeling, its open client participation and parameter exchange mechanisms also introduce new security threats. Among these, backdoor attacks have garnered significant attention due to their high degree of stealth and destructiveness. In such attacks, malicious attackers control one or more participating clients to implant poisoned samples with specific triggers into the local training data, or directly tamper with the training process and model parameters. These clients then upload the backdoor-laden model updates to the server. After multiple rounds of aggregation, the backdoor is injected into the global model, causing it to produce erroneous outputs pre-set by the attacker when encountering inputs with specific triggers, while behaving indistinguishably from a benign model when processing normal inputs, making it extremely difficult to detect. Such attacks severely compromise the robustness and reliability of the model and can have serious consequences in real-world deployments.

[0006] To address the backdoor attack problem in federated learning, academia and industry have proposed various defense schemes, which can be mainly divided into two categories: active defense and passive detection.

[0007] Proactive defense strategies, such as adding noise or employing differential privacy mechanisms, aim to limit the impact of any single client (including malicious clients) on the global model from the source. However, these methods often suffer from a trade-off between defense effectiveness and model utility: too weak an interference will fail to provide effective defense, while too strong an interference will significantly reduce the final performance of the global model.

[0008] Passive detection strategies typically identify anomalous behavior in model parameters or gradient updates uploaded by clients before server-side aggregation. Common methods include analysis based on statistical features (such as norm, mean, and variance), gradient grouping based on clustering algorithms (such as K-Means), and contribution metrics based on model impact assessment. However, these methods have limited ability to detect highly covert attacks (such as model replacement attacks and distributed backdoor attacks). More importantly, in the inherently non-independent and identically distributed (Non-IID) data environment of federated learning, the differences in data distribution among benign clients can lead to divergent or even seemingly "abnormal" model updates. This makes traditional anomaly detection algorithms prone to misjudgment (removing benign clients) or missed detection (failing to identify malicious clients), severely impacting the accuracy and practicality of the defense mechanism.

[0009] In addition, existing defense solutions generally suffer from the following three prominent problems:

[0010] First, the computational efficiency is low: most solutions require monitoring and analyzing all parameters of the global model, which causes the computational and communication overhead to increase linearly with the depth and complexity of the model, making it difficult to deploy in edge device scenarios with limited computing resources.

[0011] Secondly, the defense chain is broken: most existing strategies focus on "pre-training warning" or "pre-aggregation detection" in isolation, failing to build a complete defense loop that covers key layer identification, dynamic monitoring, accurate evaluation and real-time intervention, making it difficult to effectively block the spread and accumulation of backdoors between training rounds.

[0012] Third, insufficient feature characterization capability: In highly non-IID environments, detection methods that rely on single, static metrics such as Euclidean distance are unable to coordinate the scale differences and statistical correlations between different feature dimensions, resulting in incomplete characterization of abnormal updates, normalization imbalance, and poor robustness. Summary of the Invention

[0013] To address the technical problems mentioned above, this invention provides a defense method and system against backdoor attacks in federated learning. By analyzing the model's response to specific test samples, it proactively identifies the key network layers most vulnerable to backdoor implantation, narrowing the defense scope and significantly reducing computational overhead. Subsequently, in the passive detection stage before aggregation, it extracts the gradient updates of clients at key layers and uses cosine similarity and dual-coefficient Minkowski distance to jointly construct multi-scale feature vectors to comprehensively characterize update behavior. Finally, it uses Mahalanobis distance to calculate the abnormal score of each client in the whitened feature space and uses a dynamic threshold to select benign clients for aggregation, thereby effectively isolating malicious updates while ensuring the performance of the main task, improving the robustness and security of the global model.

[0014] To achieve the above objectives, the present invention adopts the following technical solution:

[0015] The first aspect of the present invention provides a defense method against federated learning backdoor attacks, comprising the following steps:

[0016] The server initializes the federated learning global model and identifies at least one key layer in the global model that is easy to implant a backdoor.

[0017] The server distributes the current global model parameters to multiple clients and receives model update information uploaded by each client. The model update information includes at least gradient information related to the key layers.

[0018] Based on the gradient information of each client at the key layer, a multi-dimensional gradient feature vector is extracted for each client. The multi-dimensional gradient feature vector is composed of features calculated by different metric scales.

[0019] Based on the multi-dimensional gradient feature vectors of all clients, calculate the Mahalanobis distance anomaly score of each client relative to the overall client gradient distribution;

[0020] Based on the Mahalanobis distance anomaly score, each client is filtered out, clients judged as abnormal are removed, and model updates uploaded by clients judged as benign are aggregated to generate a new global model.

[0021] Furthermore, identify at least one key layer in the global model that is easily implanted with backdoors, specifically including:

[0022] The server constructs an auxiliary test sample set, which includes noisy images, randomly perturbed samples, or unlabeled samples generated by a generative adversarial network.

[0023] Input auxiliary test samples into the global model to obtain the response strength of each network layer of the model to the test samples;

[0024] The networks are sorted based on their response intensity, and the top p% of the network layers with the most active response or the highest degree of anomaly are selected as the key layer set, where p is an integer between 10 and 20; the index information of the key layers is stored.

[0025] Furthermore, the multi-dimensional gradient feature vector of each client is extracted, specifically as follows:

[0026] For each client, calculate the cosine similarity angle component between its key layer gradient and the reference gradient vector;

[0027] Calculate the first Minkowski distance with coefficient p=1 between the gradient of its key layer and the reference gradient vector;

[0028] Calculate the second Minkowski distance with coefficient p=2 between the key layer gradient and the reference gradient vector;

[0029] The cosine similarity angle component, the first Minkowski distance, and the second Minkowski distance are combined to form the client's multi-dimensional gradient feature vector.

[0030] Furthermore, the reference gradient vector is the average gradient of the key layer corresponding to the global model in the previous training round, the historical average gradient, or the predefined standard gradient.

[0031] Furthermore, the Mahalanobis distance anomaly score for each client is calculated, specifically including:

[0032] Calculate the global feature covariance matrix based on the multi-dimensional gradient feature vectors of all clients;

[0033] The gradient feature vector of each client is whitened to eliminate correlation between features and unify variance. The formula is as follows:

[0034] ;

[0035] in, This represents the whitening score of the i-th client gradient; It is the gradient feature vector of the i-th client, calculated based on the distance metric defined above (including...). (Difference information) This represents the mean of the gradient feature vectors of all clients in this round. It is the inverse of the covariance matrix of these vectors. The centering term. To ensure this metric aligns with the standard Mahalanobis distance definition, it effectively quantifies the deviation of each client feature from the global distribution. The threshold selection is determined through a combination of statistical theory and experimental verification: since the gradient feature vector is 3-dimensional, the centered Mahalanobis distance... It approximately follows a chi-square distribution with 3 degrees of freedom. First, set the threshold to... The threshold strategy is then fine-tuned through validation experiments covering various data distributions and attack scenarios, using the 95th percentile as the threshold. This threshold strategy can effectively distinguish between malicious and benign gradients while ensuring the overall performance of the federated learning system.

[0036] In the whitened feature space, the Mahalanobis distance between the gradient feature vector and the mean vector of each client is calculated, and this distance is used as its anomaly score.

[0037] Furthermore, clients are filtered based on Mahalanobis distance anomaly scores, specifically as follows:

[0038] Sort all clients’ Mahalanobis distance anomaly scores in ascending order;

[0039] Set a dynamic threshold to filter out clients whose scores are below the dynamic threshold and form a benign client set;

[0040] The dynamic threshold is determined by setting a ratio or by adaptively determining it based on the statistical characteristics of the score distribution.

[0041] Furthermore, the aggregation of model updates uploaded by clients deemed benign is specifically achieved by employing a federated averaging algorithm to perform a weighted average of the gradient updates uploaded by benign clients, thereby generating the parameter update results for the current round of the global model.

[0042] A second aspect of the present invention provides a system for implementing the above-described method, comprising:

[0043] On the server side, it is configured to: initialize the federated learning global model and identify at least one key layer in the global model that is easy to implant a backdoor;

[0044] On the server side, it is also configured to distribute the current global model parameters to multiple clients;

[0045] On the server side, it is also configured to receive model update information uploaded by each client, and the model update information shall at least include gradient information related to the key layers.

[0046] On the server side, it is also configured to: extract multi-dimensional gradient feature vectors for each client based on the gradient information of each client in the key layer. The multi-dimensional gradient feature vectors are composed of features calculated by different metric scales.

[0047] On the server side, it is also configured to: calculate the Mahalanobis distance anomaly score of each client relative to the overall client gradient distribution based on the multi-dimensional gradient feature vectors of all clients;

[0048] On the server side, it is also configured to: filter each client based on the Mahalanobis distance anomaly score, remove clients judged as abnormal, aggregate model updates uploaded by clients judged as benign, and generate a new global model.

[0049] A third aspect of the present invention provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the aforementioned defense method against federated learning backdoor attacks.

[0050] A fourth aspect of the present invention provides an electronic device including at least one processor and a memory connected to the processor, the memory being used to store a computer program; the processor being used to execute the computer program, enabling the electronic device to implement the above-described defense method against federated learning backdoor attacks.

[0051] Compared with existing technologies, one or more of the above technical solutions have the following beneficial effects:

[0052] 1. This solution effectively addresses the issues of high computational overhead and difficulty in deployment at the edge in existing defense methods, achieving efficient and lightweight backdoor defense. Existing technologies typically require monitoring and analyzing all parameters of the entire deep learning model, resulting in a heavy computational burden. This solution proactively analyzes the responses of each layer of the model to the auxiliary test set, accurately locating the critical layers that comprise only 10%–20% of the total, thus confining all subsequent computationally intensive operations (feature extraction, similarity calculation) to this extremely small range. This reduces the defense overhead from a linear relationship with model depth to a linear relationship with the number of critical layers, significantly reducing computational and communication resource consumption. This overcomes the difficulty of "computational resource overhead increasing significantly with model depth," enabling the practical deployment of this solution on edge devices with limited computing power.

[0053] 2. Significantly improves the detection accuracy of highly covert backdoor attacks, especially in non-independent, identically distributed data environments, effectively avoiding false positives and false negatives. This scheme constructs a ternary feature vector that fuses cosine similarity (direction), Manhattan distance (minor perturbations), and Euclidean distance (overall amplitude). This multi-scale fusion strategy comprehensively characterizes client update behavior from multiple orthogonal dimensions, making it difficult for attackers to simultaneously impersonate a benign client across all dimensions. For example, an attacker may control the gradient amplitude but cannot simultaneously maintain the consistency of the gradient direction (being captured by cosine similarity), and vice versa. The multi-dimensional joint analysis greatly enhances the ability to identify covert attacks, overcoming the problem of "incomplete characterization in feature dimensions" in existing technologies.

[0054] 3. This significantly enhances the adaptability and robustness of the defense system under different data distributions and attack scenarios, enabling accurate quantitative assessment of anomalous clients. This solution introduces Mahalanobis distance combined with whitening transformation to address this issue. Whitening transformation linearly transforms the feature space through the inverse of the covariance matrix, eliminating the correlation between the three feature dimensions—cosine similarity, two types of Minkowski distance, and normalizing their variances to form an isotropic standard space. By calculating Mahalanobis distance within this space, which naturally considers the covariance structure of the data distribution, it accurately measures the statistical deviation of a feature point (client) within the overall distribution. This ensures that the assessment results are no longer affected by feature dimensions and correlations, clearly distinguishing between "statistical anomalies" caused by malicious behavior and "natural divergence" caused by data heterogeneity, thus overcoming the problems of "normalization imbalance" and "false positives and false negatives."

[0055] 4. This solution constructs a complete defense closed loop combining proactive early warning and dynamic intervention, which can promptly block the cross-round propagation of backdoor attacks and ensure the final security of the global model. It organically combines proactive defense (key layer identification and early warning before training) and passive detection (multi-feature analysis and Mahalanobis scoring during training), and finally completes intervention through dynamic screening and secure aggregation. Proactive identification of key layers indicates efficient and accurate monitoring targets for passive detection; while accurate passive detection provides reliable decision-making basis (Mahathanobis score) for dynamic intervention. Through the closed-loop process of location-monitoring-evaluation-intervention, the system ensures that it can promptly detect and isolate malicious updates in each round of training, effectively preventing backdoors from accumulating and strengthening in multiple aggregations, and ultimately training a clean and secure global model. This fundamentally overcomes the deficiency of the background technology in "lacking an overall defense closed-loop mechanism, making it difficult to promptly block the cross-round propagation path of backdoor attacks." Attached Figure Description

[0056] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0057] Figure 1 This is a schematic diagram of a defense process against federated learning backdoor attacks provided by one or more embodiments of the present invention;

[0058] Figure 2 This is a schematic diagram of the ordinary layer and the backdoor key layer provided in one or more embodiments of the present invention;

[0059] Figure 3 This is a schematic diagram of backdoor attacks using federated learning provided in one or more embodiments of the present invention;

[0060] Figure 4This is a trend chart of defense performance against Edge-case PGD attacks using the CIFAR-10 dataset, provided by one or more embodiments of the present invention.

[0061] Figure 5 This is a trend chart of defense performance against Edge-case PGD attacks using the CIFAR-10 dataset, provided by one or more embodiments of the present invention.

[0062] Figure 6 This is a trend chart of defense against Edge-case PGD attacks using the EMNIST dataset, provided by one or more embodiments of the present invention.

[0063] Figure 7 This is a trend chart of defense against Edge-case PGD attacks using the EMNIST dataset, provided by one or more embodiments of the present invention.

[0064] Figure 8 This is a schematic diagram illustrating the effect of testing attack frequency on defense mechanisms using the CIFAR-10 dataset, provided by one or more embodiments of the present invention.

[0065] Figure 9 This is a schematic diagram illustrating the effect of testing the attack frequency on the defense mechanism using the EMNIST dataset, provided by one or more embodiments of the present invention.

[0066] Figure 10 This is a schematic diagram illustrating the effect of testing the proportion of attackers on the defense mechanism using the CIFAR-10 dataset, provided by one or more embodiments of the present invention.

[0067] Figure 11 This is a schematic diagram illustrating the effect of testing the proportion of attackers on the defense mechanism using the EMNIST dataset, provided by one or more embodiments of the present invention. Detailed Implementation

[0068] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0069] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0070] The overall process of this solution is a closed loop of detection-screening-aggregation embedded in the federated learning training rounds, and its core process includes four stages.

[0071] Phase 1: System initialization and proactive key layer identification.

[0072] This step is performed once before formal training begins, aiming to narrow the scope of defense monitoring and reduce subsequent computational overhead. First, the server initializes the global model, setting parameters such as the total number of rounds and the number of clients, and generates an auxiliary test set, constructing a group of unlabeled test samples to probe model behavior. The test samples are input into the model, and the response intensity (such as gradients and activation values) of each layer is observed. Based on the activity or anomaly level of the response, the most sensitive 10%–20% of layers (such as certain convolutional layers) are selected as the "key layers" set, and their indices are recorded. All subsequent monitoring is performed only on these layers.

[0073] Phase 2: Client-side local computation and feature uploading during each training round.

[0074] The server distributes the current global model parameters to the selected clients. Each client trains the model using its local data, obtaining updated model parameters. Each client performs forward and backward propagation on the key layers, calculating and extracting the gradient tensors of the key layers. For the extracted gradients, three feature scales are calculated:

[0075] Cosine similarity angle: measures the degree of deviation of the gradient direction from the reference direction (such as the historical average gradient);

[0076] Minkowski distance (p=1): Calculates the Manhattan distance between this gradient and the reference gradient vector to capture subtle perturbations;

[0077] Minkowski distance (p=2): Calculates the Euclidean distance to assess the overall magnitude difference in updates.

[0078] These three scales are combined into a single feature vector, which is then uploaded to the server. At this point, the client's work is complete.

[0079] Phase 3: Passive detection and malicious client screening on the server side.

[0080] The third stage is the core defense step performed by the server before aggregation. The server collects multi-dimensional feature vectors uploaded by all clients. Since the features have different scales and may be correlated, the server performs a whitening transformation (using a covariance matrix) to eliminate correlations between features and unify variances, forming a standardized, isotropic feature space to prepare for subsequent fair comparisons. In the whitened feature space, the Mahalanobis distance between each client's feature vector and the overall client distribution center is calculated. This distance comprehensively reflects the degree of deviation of a client from the general population across multiple dimensions; the higher the score, the greater the likelihood of an anomaly.

[0081] The server sorts all clients based on their Mahalanobis scores and sets a dynamic threshold (e.g., selecting the bottom 80% of clients). Clients with scores above the threshold are considered "abnormal" or "malicious" and excluded from this round of aggregation.

[0082] Phase 4: Secure aggregation and model update.

[0083] The server uses a federated averaging algorithm to weight and aggregate the complete model updates (not just key layer gradients) uploaded by the selected set of benign clients, generating a new generation of global model. The updated, safer global model parameters are then distributed to the clients to begin the next round of training.

[0084] This process is executed cyclically in each training round, forming a continuous dynamic defense loop that can continuously identify and isolate potential backdoor attacks during training, ultimately resulting in a high-performance and secure global model.

[0085] Overall, this solution proactively identifies key backdoor layers to precisely narrow down the defense scope and designs a multi-scale gradient feature extraction mechanism, combined with Mahalanobis distance to achieve dynamic scoring and filtering of clients. This method achieves high-precision attack detection and isolation by analyzing only 10%–20% of the parameters of the entire model, effectively reducing overall computational and communication overhead. Simultaneously, the use of covariance whitening and dynamic threshold filtering mechanisms gives the defense algorithm good adaptability across data distributions, significantly enhancing the security and generalization ability of the federated model in real-world multi-party collaborative environments.

[0086] Defense methods against federated learning backdoor attacks include the following steps:

[0087] S1: Initialize the federated learning framework and identify the backdoor key layers of the model;

[0088] S2: Define and compute gradient features, and compute feature values ​​for each client;

[0089] S3: Perform Mahalanobis distance analysis on the distance between each client sample in the feature space to obtain the Mahalanobis score, and sort them according to the updated weight gradient score;

[0090] S4: Dynamically filter clients based on their Mahalanobis scores, removing malicious clients and retaining those deemed benign to participate in global model updates.

[0091] S1 is as follows:

[0092] Initialize the federated learning system; the server builds a global model, which consists of several network layers. The model type can be a convolutional neural network, residual network, or other deep learning model structure. The number of training rounds, the total number of participating clients, and the number of clients selected in each round are set.

[0093] Generate an auxiliary test sample set; The server constructs a set of auxiliary test samples for key layer screening. The samples include noisy images, randomly perturbed samples, or unlabeled samples generated by generative adversarial networks. This sample set does not depend on specific task labels and is used to observe the model's response behavior at each layer.

[0094] Filtering the key layer set: Normalize the response intensity scores of all layers and set a threshold. Select the top p% of layers with the most active response or the greatest anomaly as the key layer set. The default value range is 10% to 20%, but it can be flexibly configured according to the model size and resources.

[0095] In this scheme, "response strength" refers to a statistic calculated from the layer activation values, used to quantify the activity of that layer. It is obtained by inputting test auxiliary samples into the model, acquiring the output of each layer, and calculating its L2 norm.

[0096] In this scheme, the larger the L2 norm, the more sensitive the layer is, and the higher its "abnormality".

[0097] Record key layer indexes: Store the layer number or index of key layers in the server database and mark them as sensitive layer areas that need to be monitored and processed in subsequent training rounds, in preparation for passive detection and parameter aggregation in steps S3 and S4.

[0098] S2 is as follows:

[0099] The client performs assisted forward and backward propagation: After the start of this training round, each selected client receives the global model parameters. The client inputs the model, performs forward propagation on the key layer set and computes the key layer outputs, and then performs backward propagation to obtain the corresponding gradient tensors.

[0100] Construct key layer gradient feature vectors: For each client, extract its gradient response at each key layer. Perform average pooling, flattening, or vectorization on the gradients of each layer to transform them into gradient feature vectors of uniform dimension.

[0101] Define the composite gradient feature scale:

[0102] =( , , );

[0103] in, The cosine similarity angular component represents the angle between the current client gradient direction and the standard direction (such as the average gradient of the previous round or the historical mean). Let represent the Minkowski distance, calculated using the first set of coefficients p=1 to determine the distance between the gradient and the reference gradient vector. The Minkowski distance is represented by the second set of coefficients p=2, which is used to calculate the distance between the gradient and the reference gradient vector. These three factors together constitute a three-dimensional scale for characterizing the gradient behavior of the client at this layer, denoted as:

[0104] ;

[0105] in, Indicates the first The cosine similarity angle component of each client in the current layer measures the angle between the current client's gradient direction and the standard direction (such as the average gradient of the previous round, the historical mean). This represents the Minkowski distance calculated using the first set of coefficients p=1, used to measure the distance between the current client gradient and the reference gradient vector; This represents the Minkowski distance calculated using the second set of coefficients p=2, which is also used to measure the distance between the current client gradient and the reference gradient vector. For each client, its ternary scale vectors on all key layers are aggregated using a layer mean strategy to obtain the client's final gradient feature vector. The client returns its calculated gradient feature values ​​to the server for use in the next step to calculate the global feature covariance matrix and anomaly metric score.

[0106] In this scheme, the "historical average" covers all rounds from the start of training to the current round, with higher weights given to values ​​closer to the current round.

[0107] In this scheme, the client returns the gradient feature values ​​it has calculated to the server. The "gradient feature values" are the model weights uploaded by each client. The server calculates the key layer gradients of each client based on the received model weights.

[0108] S3 is as follows:

[0109] First, after receiving the 3D gradient features uploaded by all clients, the server constructs a unified feature space based on the feature set. Since these features are calculated using different distance metrics (e.g., cosine similarity, Minkowski distance), there are scale inconsistencies and statistical correlations among the features, and direct comparisons would lead to analytical distortion. Therefore, the server employs a whitening transformation method to decorrelate and unify the scale of the feature vectors from all clients, thereby obtaining a more discriminative feature representation. The core idea of ​​whitening transformation is to map the original features to an isotropic space, ensuring that the variance of each feature dimension is consistent and independent, which is beneficial for further constructing a unified anomaly scoring mechanism.

[0110] As shown in the formula:

[0111] ;

[0112] in, This represents the whitening score of the i-th client gradient; It is the gradient feature vector of the i-th client, calculated based on the distance metric defined above (including...). (Difference information) This represents the mean of the gradient feature vectors of all clients in this round. It is the inverse of the covariance matrix of these vectors. The centering term. To ensure this metric aligns with the standard Mahalanobis distance definition, it effectively quantifies the deviation of each client feature from the global distribution. The threshold selection is determined through a combination of statistical theory and experimental verification: since the gradient feature vector is 3-dimensional, the centered Mahalanobis distance... It approximately follows a chi-square distribution with 3 degrees of freedom. First, set the threshold to... The threshold strategy is then fine-tuned through validation experiments covering various data distributions and attack scenarios, using the 95th percentile as the threshold. This threshold strategy can effectively distinguish between malicious and benign gradients while ensuring the overall performance of the federated learning system.

[0113] After whitening, the server calculates the Mahalanobis distance score for each client in the normalized feature space, serving as an assessment of whether its update behavior deviates from the overall distribution. This score reflects the degree of difference between each client's uploaded gradient features and the center of the overall distribution; a higher score indicates a more anomalous gradient update from the client, and a lower credibility for its participation in federated training. The server ranks clients based on their Mahalanobis scores and, in subsequent stages, selects clients with scores in the low-risk range for gradient aggregation, filtering out potential malicious actors. This method ensures robust identification of anomalous attackers even in environments with non-independent and identically distributed data.

[0114] S4 is as follows:

[0115] After calculating the Mahalanobis distance of the gradient features of each client's key layers and obtaining the corresponding scores, the server dynamically filters all clients based on the scores. To reduce the risk of backdoor attacks contaminating the global model, this step uses a dynamic threshold to segment the Mahalanobis scores, identifying and removing suspicious clients with high scores.

[0116] ;

[0117] in, Indicates the first The degree of deviation of a client's gradient, that is, the difference between that client's gradient and the gradients of other clients. A higher score means that the gradient of that client is more likely to be anomalous or malicious. Includes all clients participating in federated learning. Indicates from the global client collection Filter out those with scores below the threshold The client, This represents the remaining set of clients. Specifically, the server first sets a deviation threshold γ based on the distribution characteristics of all client scores, and then selects clients whose scores are below this threshold to form a benign client set.

[0118] This threshold can be used to filter at a fixed ratio, ensuring the stability and robustness of the filtering results under different data heterogeneity and attack strengths. The filtered benign client gradients are not only more consistent in direction, but their perturbation characteristics and data dependencies also better align with the global training objective. After benign client filtering, the server performs an aggregation operation on the uploaded model gradient updates. The aggregation method uses a standard federated averaging algorithm, which performs a weighted average of the gradient updates uploaded by benign clients to generate the parameter update results for the current round of the global model.

[0119] This proposal suggests a federated learning backdoor defense framework that combines active localization and passive detection, enabling the server to dynamically identify and isolate malicious behavior without accessing the client's raw data. By embedding a key layer screening mechanism during training, high-risk network layers are identified, and passive feature detection and behavior evaluation are performed only on these key layers. Through one-time, low-cost key layer localization and detection, the high detection cost per round is reduced from targeting the entire model (L layers) to targeting only a small subset (one layer in the experiment), significantly reducing the number of parameters required compared to other full-parameter detection methods. This strategy significantly reduces computational overhead and detection complexity while preserving the training value of benign layers, effectively blocking the cross-layer propagation path of backdoor attacks, and improving the robustness and security of the model training process.

[0120] This scheme designs a gradient feature extraction method that integrates multi-scale distance metrics. Based on cosine similarity and Minkowski distances of different orders, a unified feature scale is constructed, achieving cross-dimensional feature alignment while maintaining the differences in gradient behavior. Combined with a Mahalanobis distance whitening transformation strategy, the statistical characteristics of gradients uploaded by different clients are unified, avoiding the information distortion problem caused by traditional normalization. This feature extraction and scoring mechanism is both universal and stable, adaptable to various non-IID data distributions and attack scenarios, providing accurate client selection criteria for trusted federated aggregation.

[0121] This solution proposes a client selection mechanism based on behavioral scores, combining gradient deviation scoring and a dynamic threshold strategy. The server ranks clients by their potential anomaly level based on the Mahalanobis scores of the gradients uploaded in each round, and removes high-risk clients according to a set threshold, retaining only low-scoring, benign clients for model aggregation. This mechanism uses an entropy-weighted strategy to integrate multi-dimensional feature differences, improving the interpretability and adaptability of the evaluation results, effectively avoiding interference from anomalous gradients on the global model update, and ensuring the accuracy of the aggregation results and backdoor attack defense capabilities.

[0122] Combination Figures 1-3 This section describes the specific implementation process of this plan.

[0123] S1: In the federated learning training initialization phase, the federated learning framework is initialized, and the differential analysis method is used to automatically identify the key layers that may be used by attackers to inject backdoors.

[0124] The federated learning framework is based on the FedAvg federated averaging algorithm, whose formula is as follows:

[0125] ;

[0126] ;

[0127] in, This indicates that the k-th client is at time step Model parameters, It is the gradient of client k on local data. It's the learning rate. In round t, the server will initialize the global model parameters. The data is sent to selected clients, and each client k performs several gradient descent updates using its local dataset. This refers to the amount of data from client k, where K is the number of clients. The server collects updated model parameters from participating clients. These parameters are then weighted and averaged to generate new global model parameters. .

[0128] In traditional federated learning frameworks, multiple clients retain their own data locally, train models locally to generate updates, and then upload these updates to a central server. The server then executes aggregation algorithms such as FedAvg to generate a new global model. This process effectively protects data privacy and reduces communication costs, making federated learning widely used in fields with high data sensitivity, such as finance, healthcare, and industry. However, because the server cannot directly access the local training data of each client, attackers can control certain clients, inject training samples with specific triggering patterns (backdoor samples), and manipulate their model updates. This can cause the global model to produce abnormal outputs expected by the attacker under specific input conditions—the backdoor attack problem in federated learning.

[0129] In backdoor attacks, the attacker's goal is to poison the global model. Using specific triggers, the poisoning model is activated. In specific input The above demonstrates incorrect behavior. This goal can be represented by the following formula:

[0130] ;

[0131] here This represents the test dataset with a backdoor trigger, while This indicates that the attacker wants the model to make incorrect predictions. To make the poisoned global model... Accepted by central server S We should try our best to imitate Performance on benign datasets.

[0132] In federated learning frameworks, attackers can introduce training data containing backdoor samples to train a model with an implanted backdoor locally, then upload it to the server, thus polluting the global model and compromising the security of the entire federated learning system. While some simple backdoor attacks can be identified and blocked by existing defenses, sophisticated, well-designed, and stealthy attacks are often difficult to defend against effectively with current technologies. Therefore, this paper proposes a novel defense mechanism that provides general protection against various known attack strategies, effectively improving the robustness and security of federated learning systems against complex backdoor attacks.

[0133] First, identify the key backdoor layer of the deep learning model, such as... Figure 2 As shown, the characteristics of the backdoor critical layer are as follows:

[0134] ;

[0135] Traditional backdoor defense methods require full parameter analysis of all layers in the global model (e.g., ResNet-50 contains 49 convolutional layers and 1 fully connected layer), resulting in computational overhead increasing linearly with model complexity. This approach proactively identifies and defends key layers, allowing passive defense detection to be performed only on selected key layers (accounting for 10%–20% of the total layers). In this way, while malicious parameters from backdoor attacks can propagate layer by layer through a federated aggregation process, the parameters of other layers remain uncontaminated, thus blocking cross-layer coupling paths.

[0136] S2: Define and compute the gradient features of the backdoor key layer. Based on three scales consisting of cosine distance and two different Minkowski distances, a new scale is proposed to represent the key layer features.

[0137] Current methods rely on a single metric for defense, which cannot handle malicious clients with diverse characteristics, allowing experienced attackers to easily bypass this specific gradient detection.

[0138] For example, PGD attacks bypass Euclidean distance-based defenses by cropping the gradient norm to a small value, while BCA attacks completely disable similarity methods by replacing non-backdoor key layers of the model and reducing the total number of gradient parameters.

[0139] Furthermore, attackers launch attacks under different environments and data distributions, resulting in malicious gradients with various characteristics that cannot be handled by a single metric.

[0140] Therefore, the new scale proposed in this scheme is:

[0141] =( , , );

[0142] Among them, among them, The cosine similarity angular component represents the angle between the current client gradient direction and the standard direction (such as the average gradient of the previous round or the historical mean). Let represent the Minkowski distance, calculated using the first set of coefficients p=1 to determine the distance between the gradient and the reference gradient vector. The Minkowski distance is represented by the second set of coefficients p=2, which is used to calculate the distance between the gradient and the reference gradient vector. The three factors together constitute a three-dimensional scale for describing the gradient behavior of the client at this layer.

[0143] The fundamental logic of distance-based defense lies in establishing indicative metrics that effectively distinguish between gradient updates originating from malicious clients and those from legitimate clients. By applying these metrics, the defense mechanism can identify and exclude updates deemed anomalous or harmful, thus ensuring that only reliable, uncontaminated data updates participate in the federated learning model's aggregation process. Previous methods commonly used metrics such as gradient length (i.e., Euclidean distance), while FoolGold utilizes cosine similarity to measure the differences between updates.

[0144] Minkowski distance is a distance metric in multidimensional space. The core of Minkowski distance lies in its parameter p; different p values ​​lead to different distance calculation methods. When p=1, the distance is the Manhattan distance. When p=2, it is the Euclidean distance, one of the most commonly used metrics, suitable for situations where features are independent and have the same scale.

[0145] The new scale integrates the directional metric of cosine similarity with the magnitude information of two Minkowski distances, enabling a comprehensive characterization of the gradient upload features of each client at key layers from multiple dimensions. Compared to traditional methods that use only a single distance metric, this scale effectively alleviates the problem of Euclidean distance failure in high-dimensional space while maintaining the accuracy of gradient feature identification, thus improving the stability and robustness of backdoor client identification, and is particularly suitable for anomaly detection in non-independent and identically distributed data environments.

[0146] S3: After determining the gradients and characteristics of the key layers in the neural network backdoor, the challenge lies in transforming these characteristics into an effective scoring system applicable to different data distributions and attack scenarios. Two aspects need to be considered: the angle of cosine similarity. Minkowski distance Length, and Minkowski distance The three different distance metrics, length, and distance itself, have different scales, hindering their ability to work together. Because of the correlation between these metrics, traditional maximum normalization may not be applicable, necessitating the introduction of a new form of regularization. The diversity of data distributions (e.g., varying degrees of non-independence) can lead to differences in gradients generated by malicious and benign clients.

[0147] Therefore, to ensure the effectiveness of the defense mechanism in various environments and attacks, a dynamic weighting method must be adopted for adjustment. This ensures that the scoring system is both consistent and adaptable to changing conditions. Considering the above factors, this scheme uses whitening transformation to adjust the weights of each gradient feature vector. The main purpose of whitening transformation is to remove correlations in the data and make each feature have the same variance.

[0148] Model updates between two malicious clients are more similar than those between two benign clients, making... ,in Represents the cosine distance matrix. Let represent the Minkowski distance matrix. Let i, j and k, l represent any two benign clients and any two malicious clients.

[0149] Attackers insert backdoor triggers into backdoor samples and relabel them with the same specified tags. This results in lower data distribution heterogeneity between malicious clients compared to benign clients. Therefore, malicious local models are more similar than benign local models. Because malicious and benign clients have different mission objectives, and because of backdoor samples, the data distribution between malicious and benign clients is more heterogeneous than the data distribution between two benign clients, thus possessing... .

[0150] S4: After receiving the key layer gradient updates uploaded by all clients, the aggregation server first evaluates the deviation of the uploaded gradients of all clients in the feature space based on the Mahalanobis distance score calculated by multi-scale feature fusion.

[0151] Specifically, the server maps the gradient feature representation of each client to a unified covariance normalization space, thereby obtaining its relative position difference in the global client distribution. The higher the score, the greater the deviation of the client's gradient feature from the global average behavior in the feature space, and therefore the greater the risk of backdoors being implanted or abnormal behavior.

[0152] The server sorts all clients in ascending order based on their Mahalanobis scores and sets a global threshold γ to distinguish between "benign" and "suspicious" clients. This threshold selects the bottom 80% of clients with the lowest scores; only clients with scores below this threshold are considered to have benign behavior, and their uploaded model gradient updates will be included in the current round of model aggregation.

[0153] Finally, the server only performs the federated averaging algorithm on the set of clients deemed benign, weighting and fusing the gradients uploaded by each client according to the amount of data they contain, and then updates the global model parameters.

[0154] In preliminary experiments, the defense effectiveness was tested with different thresholds (70%, 75%, 80%, 85%). It was found that when the threshold was set within the range of 70% to 80%, the defense success rate and the accuracy of the model's main task achieved the best balance. Therefore, 80% is chosen as the default recommended value to introduce this solution, as it achieves stable and reliable results in most scenarios.

[0155] The detailed steps of this method are as follows:

[0156] (1) Initialize the federated learning framework, which consists of N clients and a central server. Set the total number of training rounds T and the number of clients participating in each round K.

[0157] (2) The central server initializes the global model parameters and sets the auxiliary test sample set for backdoor detection to determine the key layer of the backdoor.

[0158] (3) The central server sends global model parameters to the currently selected K clients. (Round t).

[0159] (4) Each client uses local private data to perform several rounds of local training to obtain updated model parameters or their corresponding gradient updates.

[0160] (5) The client uploads model update information to the server, including the weight update or gradient vector of the key layer.

[0161] (6) The central server identifies and locks the critical backdoor layer in the global model. This layer is most sensitive to the backdoor triggering mode, and subsequent analysis focuses on this layer.

[0162] (7) The server extracts the parameters or gradient vectors of the key layers from the information uploaded by each client as the basis for analysis.

[0163] (8) The server calculates three core metrics to characterize the behavioral differences of each client:

[0164] (9) Combine the above three scales into a unified gradient feature vector to represent the client’s multidimensional performance in the key layer.

[0165] (10) Whiten the feature vectors of all clients to remove the correlation between dimensions and standardize the variance of each feature to make each feature comparable.

[0166] (11) Calculate the Mahalanobis distance score of each client in the feature space and evaluate the degree of deviation of its behavior from the distribution of behavior of all clients.

[0167] (12) Set a deviation threshold γ, sort according to Mahalanobis score, and retain only clients with scores less than γ as benign, and temporarily exclude the rest.

[0168] (13) Use the FedAvg algorithm to aggregate the model updates uploaded by the retained benign clients to generate a new round of global model parameters.

[0169] (14) The central server will implement the new global model It will be distributed to the next round of participating clients and enter the next iteration.

[0170] (15) Repeat steps (13) to (14) until the number of training rounds T reaches the preset condition or the model accuracy meets the requirements.

[0171] This proposal suggests a federated learning backdoor defense framework that combines active localization and passive detection, enabling the server to dynamically identify and isolate malicious behavior without accessing the client's raw data. By embedding a key layer screening mechanism during training, high-risk network layers are identified, and passive feature detection and behavior evaluation are performed only on these key layers. This strategy significantly reduces computational overhead and detection complexity while preserving the training value of benign layers, effectively blocking the cross-layer propagation path of backdoor attacks and improving the robustness and security of the model training process.

[0172] This scheme designs a gradient feature extraction method that integrates multi-scale distance metrics. Based on cosine similarity and Minkowski distances of different orders, a unified feature scale is constructed, achieving cross-dimensional feature alignment while maintaining the differences in gradient behavior. Combined with a Mahalanobis distance whitening transformation strategy, the statistical characteristics of gradients uploaded by different clients are unified, avoiding the information distortion problem caused by traditional normalization. This feature extraction and scoring mechanism is both universal and stable, adaptable to various non-IID data distributions and attack scenarios, providing accurate client selection criteria for trusted federated aggregation.

[0173] This solution proposes a client selection mechanism based on behavioral scores, combining gradient deviation scoring and a dynamic threshold strategy. The server ranks clients by their potential anomaly level based on the Mahalanobis scores of the gradients uploaded in each round, and removes high-risk clients according to a set threshold, retaining only low-scoring, benign clients for model aggregation. This mechanism uses an entropy-weighted strategy to integrate multi-dimensional feature differences, improving the interpretability and adaptability of the evaluation results, effectively avoiding interference from anomalous gradients on the global model update, and ensuring the accuracy of the aggregation results and backdoor attack defense capabilities.

[0174] The following examples illustrate this point:

[0175] The publicly available image classification dataset CIFAR-10 was selected as the basis for the experiment. This dataset contains 60,000 images across 10 categories, with 50,000 images in the training set and 10,000 images in the test set. The training set was divided into 10 subsets using a non-independent identically distributed (Non-IID) method to simulate 10 edge clients participating in federated learning. This approach constructs a federated learning environment based on federated averaging (FedAvg) and injects an edge-case backdoor attack into the system.

[0176] S1: Initialization and attack settings Figure 3 In this study, a federated learning architecture with N=10 clients is initialized, and a central server is configured to coordinate model training. Four clients are randomly selected as attackers, and specific backdoor trigger samples (such as corner occlusion or target pattern embedding) are inserted into their training set. The labels are then altered to mislead the model into outputting incorrect classifications under specific trigger conditions. This type of attack is highly covert and transferable.

[0177] S2: Figure 2 In this study, 100 samples from CIFAR-100 were used as a induced dataset to identify key backdoor layers.

[0178] S3: After the client uploads the gradient, multi-scale feature analysis is performed. After the server receives the key layer gradients from all clients, it calculates three behavioral scales. The angle between the client gradient direction and the global average direction is analyzed by cosine similarity. The Minkowski distance (p=1) is used to measure the change in gradient response to perturbation samples, and the Minkowski distance (p=2) is used to evaluate the absolute deviation of the update amplitude.

[0179] S4: Calculate Mahalanobis scores and filter benign clients. Based on the multi-scale features mentioned above, the server calculates the Mahalanobis distance score for each client to measure the deviation between its gradient features and the overall client distribution. A threshold γ is set, and only clients with scores below this threshold are included in the "benign client set". The gradient of this set participates in the FedAvg aggregation of the current round, while the others do not participate in the aggregation operation for the time being.

[0180] S5: Perform a standard federated averaging algorithm to update the global model for the selected benign clients, and broadcast the new global model parameters to all clients. Repeat the above steps iteratively until training is complete.

[0181] S6: Figures 4-7 This demonstrates the defensive trends of our proposed method on the CIFAR-10 dataset under Edge-case PGD attack conditions.

[0182] Figures 4-7There are eight curves in total. Black represents the proposed scheme, red represents RAF (a robust federated aggregation method), blue represents Multi-Metrics (a multi-scale federated learning backdoor defense method), purple represents Krum (a federated learning backdoor defense method based on Euclidean distance), cyan represents Multi-Krum (a multi-scale federated learning backdoor defense method based on Euclidean distance), brown represents Foolsgold (a federated learning backdoor defense method based on cosine similarity), cyan represents Fedavg (a federated averaging algorithm without any defense method), and brown represents FedCPP-Nobc (a backdoor defense method without critical layer defense).

[0183] Figure 4 and Figure 5 The performance trend of this solution on the CIFAR-10 dataset is shown. Figure 4 The x-axis and y-axis represent the number of federated learning training rounds and the main task accuracy, respectively. Figure 5 The x-axis and y-axis represent the number of training rounds of federated learning and the accuracy of backdoor attack success, respectively.

[0184] Among these methods, Fedavg and RAF showed good success rates in the main task, but after 100 rounds, they became completely ineffective against backdoor attacks. Other defense methods, besides those proposed in this study, experienced a significant increase in backdoor attack success rates after 150 rounds, rendering their defenses ineffective. Simultaneously, their main task accuracy remained low, severely impacting the model's original performance. This proposed solution maintains a low backdoor attack success rate while preserving a high main task accuracy, outperforming other defense methods.

[0185] Figure 6 and Figure 7 The performance trend of this solution on the EMNIST dataset is shown. Figure 6 The x-axis and y-axis represent the number of federated learning training rounds and the main task accuracy, respectively. Figure 7 The x-axis and y-axis represent the number of training rounds of federated learning and the accuracy of backdoor attack success, respectively.

[0186] Figure 6 In the study, the accuracy of the Foolsgold method for the main task dropped significantly, while the other methods maintained a relatively high accuracy for the main task. Figure 7 In the study, our proposed solution successfully defended against federated learning backdoor attacks in all training epochs. In contrast, the success rate of federated learning backdoor attacks on other methods increased significantly with each training epoch, rendering their backdoor defenses ineffective. This demonstrates that our proposed solution exhibits superior defense performance against federated learning backdoor attacks on the EMNIST dataset, significantly reducing the attack success rate while maintaining the global model's classification accuracy on the normal test set.

[0187] This solution significantly reduces the computational and communication overhead of federated learning backdoor defense, improving the feasibility of deployment on resource-constrained edge devices. By proactively identifying critical backdoor layers, the defense monitoring scope is focused from all parameters of the entire model to the most sensitive and vulnerable 10%–20% of critical layers. Subsequent feature extraction, computation, and analysis are performed only on these critical layers. This overcomes the problem of existing solutions where computational and communication costs increase linearly with model complexity due to the need for full parameter analysis of the global model, making it possible to deploy high-performance backdoor defense on edge devices with limited computing power.

[0188] This solution significantly improves the detection accuracy and robustness against covert backdoor attacks, especially in non-independent, identically distributed data environments, effectively reducing false positives and false negatives. It employs a multi-dimensional gradient feature constructed jointly using cosine similarity and dual-coefficient Minkowski distance. This multi-scale feature fusion method comprehensively and accurately characterizes client behavior from multiple dimensions, including the direction of gradient updates, subtle perturbations, and overall magnitude, avoiding the shortcomings of single metrics that are easily bypassed or distorted. It overcomes the problems of insufficient feature characterization and susceptibility to bypassing in traditional methods (such as those relying solely on Euclidean distance or cosine similarity) when facing highly covert attacks, as well as the high false positive rate caused by the divergence inherent in benign updates.

[0189] This solution achieves precise quantitative assessment and dynamic adaptive filtering of abnormal client behavior, enhancing the versatility and stability of the defense system. It employs a whitening transformation scoring mechanism based on Mahalanobis distance. Mahalanobis distance considers the correlation between feature dimensions and unifies the scale, thus more scientifically measuring the statistical deviation of each client relative to the overall distribution in a complex multidimensional feature space, making the evaluation results more objective and accurate. It overcomes the problem of unstable defense effects caused by traditional thresholding methods (such as fixed thresholds or simple normalization) due to their inability to adapt to dynamic changes in different rounds and data distributions. This solution provides a data-driven, adaptive, and dynamic filtering scheme.

[0190] This solution constructs a closed-loop defense system combining active and passive defenses, capable of timely blocking the propagation and accumulation of backdoor attacks during training, thereby ensuring the security of the final global model. It organically combines active early warning (critical layer identification) with passive detection (multi-feature Mahalanobis distance analysis), rather than using them in isolation. First, it actively narrows the defense scope, then performs precise detection within that scope, and finally dynamically intervenes in the aggregation process based on the detection results, forming a complete "identification-monitoring-detection-isolation" defense closed loop. This overcomes the shortcomings of existing defense strategies, such as their reliance on single methods and lack of coordination, or sacrificing model performance like differential privacy, or only being able to analyze after aggregation without timely intervention like some detection methods. This solution achieves real-time, online suppression of backdoor attacks with almost no impact on the convergence performance of the benign model.

[0191] This solution effectively defends against backdoor attacks while ensuring that the performance of the global model on the main task is not significantly affected. Its dynamic filtering mechanism aims to precisely eliminate abnormal clients, rather than blindly suppressing all updates. By retaining benign clients with consistent gradient behavior for federated averaging, it ensures that the information used to update the global model is high-quality and uncontaminated, thus improving security while maintaining model effectiveness. It overcomes the fundamental contradiction in proactive defense strategies (such as differential privacy and adding noise) where it is difficult to balance defense effectiveness with model utility. Through precise identification and isolation, it avoids sacrificing the performance of all client models for the sake of defense.

[0192] Accordingly, the system required to implement the above method includes:

[0193] On the server side, it is configured to: initialize the federated learning global model and identify at least one key layer in the global model that is easy to implant a backdoor;

[0194] On the server side, it is also configured to distribute the current global model parameters to multiple clients;

[0195] On the server side, it is also configured to receive model update information uploaded by each client, and the model update information shall at least include gradient information related to the key layers.

[0196] On the server side, it is also configured to: extract multi-dimensional gradient feature vectors for each client based on the gradient information of each client in the key layer. The multi-dimensional gradient feature vectors are composed of features calculated by different metric scales.

[0197] On the server side, it is also configured to: calculate the Mahalanobis distance anomaly score of each client relative to the overall client gradient distribution based on the multi-dimensional gradient feature vectors of all clients;

[0198] On the server side, it is also configured to: filter each client based on the Mahalanobis distance anomaly score, remove clients judged as abnormal, aggregate model updates uploaded by clients judged as benign, and generate a new global model.

[0199] By analyzing the model's response to specific test samples, the key network layers most vulnerable to backdoor implantation are proactively identified, narrowing the defense scope and significantly reducing computational overhead. Subsequently, in the passive detection stage before aggregation, gradient updates of the client at key layers are extracted, and multi-scale feature vectors are jointly constructed using cosine similarity and dual-coefficient Minkowski distance to comprehensively characterize update behavior. Finally, Mahalanobis distance is used to calculate the abnormal score of each client in the whitened feature space, and benign clients are selected for aggregation based on a dynamic threshold. This effectively isolates malicious updates while ensuring the performance of the main task, improving the robustness and security of the global model.

[0200] Accordingly, a computer program product includes computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the aforementioned defense method against federated learning backdoor attacks.

[0201] Accordingly, an electronic device includes at least one processor and a memory connected to the processor, the memory being used to store a computer program; the processor is used to execute the computer program, enabling the electronic device to implement the aforementioned defense method against federated learning backdoor attacks.

[0202] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A defense method against federated learning backdoor attacks, characterized in that, Includes the following steps: The server initializes the federated learning global model and identifies at least one key layer in the global model that is easy to implant a backdoor. The server distributes the current global model parameters to multiple clients and receives model update information uploaded by each client. The model update information includes at least gradient information related to the key layers. Based on the gradient information of each client at the key layer, a multi-dimensional gradient feature vector is extracted for each client. The multi-dimensional gradient feature vector is composed of features calculated by different metric scales. Based on the multi-dimensional gradient feature vectors of all clients, calculate the Mahalanobis distance anomaly score of each client relative to the overall client gradient distribution; Based on the Mahalanobis distance anomaly score, each client is filtered out, clients judged as abnormal are removed, and model updates uploaded by clients judged as benign are aggregated to generate a new global model.

2. The defense method against federated learning backdoor attacks as described in claim 1, characterized in that, Identify at least one key layer in the global model that is easily implanted with backdoors, specifically including: The server constructs an auxiliary test sample set, which includes noisy images, randomly perturbed samples, or unlabeled samples generated by a generative adversarial network. Input auxiliary test samples into the global model to obtain the response strength of each network layer of the model to the test samples; The networks are sorted based on their response intensity, and the top p% of the network layers with the most active response or the highest degree of anomaly are selected as the key layer set, where p is an integer between 10 and 20; the index information of the key layers is stored.

3. The defense method against federated learning backdoor attacks as described in claim 1, characterized in that, Extract the multi-dimensional gradient feature vector for each client, specifically as follows: For each client, calculate the cosine similarity angle component between its key layer gradient and the reference gradient vector; Calculate the first Minkowski distance with coefficient p=1 between the gradient of its key layer and the reference gradient vector; Calculate the second Minkowski distance with coefficient p=2 between the key layer gradient and the reference gradient vector; The cosine similarity angle component, the first Minkowski distance, and the second Minkowski distance are combined to form the client's multi-dimensional gradient feature vector.

4. The defense method against federated learning backdoor attacks as described in claim 3, characterized in that, The reference gradient vector is the average gradient of the key layer corresponding to the global model in the previous training round, the historical average gradient, or the predefined standard gradient.

5. The defense method against federated learning backdoor attacks as described in claim 1, characterized in that, The Mahalanobis distance anomaly score for each client is calculated, specifically including: Calculate the global feature covariance matrix based on the multi-dimensional gradient feature vectors of all clients; The gradient feature vector of each client is whitened to eliminate correlation between features and unify variance. The formula is as follows: ； in It is the score of the gradient of the i-th client after whitening. This represents the calculated gradient feature vector of the i-th client. This represents the mean of the gradient feature vectors of all clients in this round. Represents the i-th gradient eigenvector The matrix obtained through the inverse of the covariance matrix; In the whitened feature space, the Mahalanobis distance between the gradient feature vector and the mean vector of each client is calculated, and this distance is used as its anomaly score.

6. The defense method against federated learning backdoor attacks as described in claim 1, characterized in that, Clients are filtered based on Mahalanobis distance anomaly scores, specifically as follows: Sort all clients’ Mahalanobis distance anomaly scores in ascending order; Set a dynamic threshold to filter out clients whose scores are below the dynamic threshold and form a benign client set; The dynamic threshold is determined by setting a ratio or by adaptively determining it based on the statistical characteristics of the score distribution.

7. The defense method against federated learning backdoor attacks as described in claim 1, characterized in that, The aggregation of model updates uploaded by clients deemed benign is specifically achieved by using a federated averaging algorithm to perform a weighted average of the gradient updates uploaded by benign clients, thereby generating the parameter update results for the global model in this round.

8. A defense system against federated learning backdoor attacks, characterized in that, include: On the server side, it is configured to: initialize the federated learning global model and identify at least one key layer in the global model that is easy to implant a backdoor; On the server side, it is also configured to distribute the current global model parameters to multiple clients; On the server side, it is also configured to receive model update information uploaded by each client, and the model update information shall at least include gradient information related to the key layers. On the server side, it is also configured to: extract multi-dimensional gradient feature vectors for each client based on the gradient information of each client in the key layer. The multi-dimensional gradient feature vectors are composed of features calculated by different metric scales. On the server side, it is also configured to: calculate the Mahalanobis distance anomaly score of each client relative to the overall client gradient distribution based on the multi-dimensional gradient feature vectors of all clients; On the server side, it is also configured to: filter each client based on the Mahalanobis distance anomaly score, remove clients judged as abnormal, aggregate model updates uploaded by clients judged as benign, and generate a new global model.

9. A computer program product, characterized in that, It includes computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the defense method against federated learning backdoor attacks as described in any one of claims 1-7.

10. An electronic device, characterized in that, It includes at least one processor and a memory connected to the processor, the memory being used to store computer programs; the processor is used to execute the computer programs, enabling the electronic device to implement the defense method against federated learning backdoor attacks as described in any one of claims 1-7.

Images