Personalized Federated Learning Safety and Forgetting Methods and Systems for Heterogeneous Data

Abstract

This invention provides a personalized federated learning security and forgetting method and system for heterogeneous data, relating to the fields of artificial intelligence and privacy-preserving computing technology. The method includes: acquiring the identity identifiers of multiple clients and their corresponding local datasets; dynamically generating personalized model parameters for each client through a central supernetwork based on the client's identity identifiers; training the model on the local datasets of each client based on the personalized model parameters to obtain the changes in the model parameters; updating the parameters of the supernetwork based on the changes in the model parameters; constructing and maintaining a multi-level sample pool, including a positive sample pool, a negative sample pool, a historical negative sample pool, and an extreme negative sample pool; and performing parallel purification processing on the supernetwork through an online contrastive learning mechanism based on the sample pools to suppress the influence of malicious clients or to retract data contributions.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and privacy-preserving computing technology, and in particular to a personalized federated learning security and forgetting method and system for heterogeneous data. Background Technology

[0002] Federated learning, as an emerging distributed machine learning paradigm, allows multiple participants to collaboratively train models while maintaining data locality, effectively solving the data silo problem. Its basic process is as follows: each client trains the model locally, only uploading model updates to a central server for aggregation, generating a global model.

[0003] However, current mainstream federated learning methods (such as FedAvg) face the following challenges in practical applications:

[0004] (1) Data heterogeneity problem: In real-world application scenarios, the data distribution of each participant usually exhibits highly non-independent and identically distributed characteristics. For example, in a 10-class classification task, a single client may only hold data for 2-3 of the classes. This extreme heterogeneity significantly reduces the effectiveness of aggregation strategies based on simple parameter averaging, making it difficult for the global model to achieve good performance on all clients.

[0005] (2) Security vulnerability: The centralized aggregation architecture makes the global model a single attack target. Malicious clients can launch backdoor attacks or poison the model by uploading carefully crafted poisoned model updates. Once the global model is contaminated, its negative impact will quickly spread to the entire federated network.

[0006] (3) The problem of passive defense mechanism: Most existing defense methods adopt a passive mode of detection-repair, which usually triggers the defense mechanism only after the attack occurs. This post-attack approach cannot achieve pre-attack prevention, and the repair process often requires pausing the normal training process, which seriously affects the system efficiency.

[0007] (4) The problem of federated forgetting implementation: existing federated forgetting methods mostly rely on full retraining or approximate fine-tuning. The former has high computational cost, and the latter cannot guarantee the complete elimination of the impact of retracted data. At the same time, security defense and data forgetting are usually implemented as two independent functions, which leads to complex system design and conflicting strategies. Summary of the Invention

[0008] To address at least one of the technical problems existing in the background art, this invention, based on the technical features of centralized super-network personalized model generation, multi-level sample pool management, online comparison and purification mechanism, and dynamic transformation of defense phase, solves the technical problems of model performance degradation in federated learning under extreme heterogeneous data distribution, security vulnerability of centralized architecture, low efficiency of passive defense mechanism, and high cost of federated forgetting implementation.

[0009] The first aspect of this invention provides a personalized federated learning safety and forgetting method for heterogeneous data, comprising:

[0010] Obtain the identity identifiers of multiple clients and their corresponding local datasets;

[0011] Based on the client's identity identifier, personalized model parameters for each client are dynamically generated through the central super network;

[0012] The model is trained on the local dataset of each client based on the personalized model parameters to obtain the amount of change in the model parameters;

[0013] The parameters of the hypernetwork are updated based on the changes in the model parameters;

[0014] Build and maintain a multi-level sample pool, including a positive sample pool, a negative sample pool, a historical negative sample pool, and an extreme negative sample pool;

[0015] Based on the sample pool, the supernetwork is subjected to parallel purification processing through an online comparative learning mechanism to suppress the influence of malicious clients or to withdraw data contributions.

[0016] Furthermore, the step of constructing and maintaining a multi-level sample pool includes:

[0017] Model parameters are collected from normal clients as positive samples, and a quality score is calculated based on their performance on the local test set.

[0018] The quality score The calculation formula is:

[0019] ;

[0020] in, For the client The test set, For indicator functions, For the model to class The predicted probability;

[0021] Model parameters are collected from malicious clients as negative samples, and a toxicity score is calculated based on their backdoor attack success rate, attack confidence, and interference level.

[0022] Based on the toxicity score and time-triggered conditions, forced collection is performed and highly toxic samples are stored in the extreme negative sample pool.

[0023] Furthermore, the steps of the online comparative learning mechanism include:

[0024] Sample batches of positive and negative samples from the sample pool;

[0025] Calculate the similarity between the parameters of the client to be cleaned and the positive and negative samples;

[0026] A contrastive loss function is constructed based on similarity. for: ;

[0027] in, and These are positive and negative sample batches, respectively. and For sample weights, For temperature parameters, This is a similarity measurement function;

[0028] The hypernetwork is repaired by minimizing this loss function.

[0029] Furthermore, it also includes the defense phase transition steps:

[0030] Monitor the success rate of malicious client attacks;

[0031] The defense phase is dynamically switched based on the attack success rate threshold, including the normal phase, monitoring phase, and cleanup phase.

[0032] During the purification phase, training updates for normal clients and purification and repair for malicious clients are performed in parallel.

[0033] Furthermore, it also includes federal forgetting steps:

[0034] Receive forget requests from clients and mark their historical parameters as special negative samples;

[0035] The hypernetwork was repaired in multiple rounds using the enhanced contrastive loss function to eliminate the impact of the client.

[0036] Verify the forgetting effect to ensure that the influence of the client's parameters is effectively eliminated.

[0037] Furthermore, the federated forgetting step shares the same sample pool and repair process as the online comparative learning mechanism, achieving unified processing of security defense and data forgetting.

[0038] A second aspect of the present invention provides a personalized federated learning safety and forgetting system for heterogeneous data, comprising:

[0039] The data acquisition module is used to acquire the identity identifiers of multiple clients and their corresponding local datasets;

[0040] The hypernetwork module is used to dynamically generate personalized model parameters for each client through the central hypernetwork based on the client's identity identifier.

[0041] The local training module is used to train the model on the local dataset of each client based on the personalized model parameters, and to obtain the changes in the model parameters.

[0042] The hypernetwork update module is used to update the parameters of the hypernetwork based on the changes in the model parameters;

[0043] The sample pool management module is used to build and maintain multi-level sample pools, including positive sample pools, negative sample pools, historical negative sample pools, and extreme negative sample pools.

[0044] The purification module is used to perform parallel purification processing on the supernetwork based on the sample pool through an online comparative learning mechanism, so as to suppress the influence of malicious clients or realize the withdrawal of data contributions.

[0045] A third aspect of the present invention provides an electronic device including a memory, a processor, and a program stored in the memory and running on the processor, wherein the processor, when executing the program, implements the steps of the personalized federated learning security and forgetting method for heterogeneous data as described in the first aspect of the present invention.

[0046] A fourth aspect of the present invention provides a computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the steps of the personalized federated learning security and forgetting method for heterogeneous data as described in the first aspect of the present invention.

[0047] A fifth aspect of the present invention provides a computer program product including software code, wherein the program in the software code performs steps in the personalized federated learning security and forgetting method for heterogeneous data as described in the first aspect of the present invention.

[0048] Compared with existing technologies, the personalized federated learning safety and forgetting method and system for heterogeneous data provided by this invention has the following beneficial effects:

[0049] (1) This invention proposes a personalized federated learning framework, the core of which is to replace the traditional global model aggregation paradigm with a central hypernetwork. As a parameterized model generator, the hypernetwork can dynamically tailor a high-performance personalized local model for each participant based on their unique identity, thereby solving the data heterogeneity problem at the architecture level.

[0050] (2) Based on the supernetwork, this invention introduces an innovative online comparative purification mechanism. This mechanism continuously collects and maintains positive sample parameters representing benign behavior and negative sample parameters representing anomalous behavior (such as attacks or the influence of data to be forgotten) from the federated network, and uses contrastive learning technology to perform real-time and parallel online correction on the supernetwork itself. The unique feature of this design is that the purification process runs parallel to normal federated training, enabling the system to actively suppress malicious influences while continuing to utilize data from other normal participants to improve model performance, ultimately achieving an efficient defensive training mode of training and purification simultaneously.

[0051] (3) The federated forgetting function of this invention is a natural extension and direct application of this online defense mechanism. When a data retraction request occurs, the system only needs to logically classify the historical contributions of the party whose data is being retracted as abnormal behavior, and the already running purification mechanism will automatically and efficiently complete the forgetting operation without initiating a separate and expensive retraining process. Therefore, this invention provides a complete solution for next-generation trusted federated learning that is highly unified and logically self-consistent from architecture to mechanism to function. Attached Figure Description

[0052] The accompanying drawings, which form part of this disclosure, are used to provide a further understanding of this disclosure. The illustrative embodiments of this disclosure and their descriptions are used to explain this disclosure and do not constitute an undue limitation of this disclosure.

[0053] Figure 1 This is an overall flowchart of the personalized federated learning safety and forgetting method for heterogeneous data provided in Embodiment 1 of the present invention;

[0054] Figure 2 This is a diagram of the overall structure of the algorithm provided in Embodiment 1 of the present invention;

[0055] Figure 3 This is a schematic diagram of the parallel training and purification mechanism module provided in Embodiment 1 of the present invention;

[0056] Figure 4 This is a schematic diagram of a personalized federated learning security and forgetting system for heterogeneous data provided in Embodiment 2 of the present invention. Detailed Implementation

[0057] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0058] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments of the invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0059] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0060] All data acquisition in this embodiment is carried out in accordance with laws and regulations and with user consent, and the data is used legally.

[0061] Terminology Explanation:

[0062] 1. HyperNetwork: Refers to a type of neural network that generates parameters for other neural networks. In this invention, the central hypernetwork generates personalized local model parameters based on the client's identity, replacing the traditional model parameter aggregation operation, and is the core component for realizing personalized federated learning.

[0063] 2. Federated Unlearning: In a federated learning framework, this refers to the technique of completely removing a user's data contribution from the trained model upon request. This invention redefines federated forgetting as a model behavior correction task and implements it uniformly through an online comparative cleanup mechanism.

[0064] 3. Non-Independent Identical Distribution (Non-IID): This refers to situations where the local data of each client does not satisfy the independent and identically distributed assumption. In this invention, it specifically refers to extreme heterogeneous scenarios, such as when each client only holds data from a few categories of the global data categories.

[0065] 4. Online comparison and purification mechanism: The core security mechanism proposed in this invention continuously collects positive and negative samples and uses comparative learning technology to correct the supernetwork in real time, realizing parallel execution of training and purification, and avoiding the interruption problem of the traditional stop-repair mode.

[0066] 5. Multi-level sample pool: A four-level architecture including a positive sample pool, a negative sample pool, a historical negative sample pool, and an extreme negative sample pool is used to systematically manage and maintain the samples required for comparative learning, ensuring the long-term effectiveness of the defense mechanism.

[0067] 6. Defense Phase Transition: The adaptive defense strategy proposed in this invention dynamically adjusts the system state based on the attack success rate, including the normal phase, monitoring phase, and purification phase, to achieve a balance between defense accuracy and system efficiency.

[0068] 7. Personalized model parameters: These are model parameters specifically generated for each client. They are dynamically generated by HyperNetwork based on the client's identity and are fully adapted to the local data distribution characteristics of each client.

[0069] 8. Toxicity Score: A comprehensive indicator for assessing the threat level of malicious clients. It is calculated based on backdoor attack success rate, attack confidence, and interference level, and is used for quality assessment and hierarchical management of negative samples.

[0070] 9. Forced Collection Mechanism: An innovative mechanism that ensures the continuous collection of malicious samples even when attacks are suppressed, maintaining the long-term effectiveness of defense capabilities through time-triggered conditions.

[0071] 10. Parallel purification process: This refers to the operating mode in which normal federated training and security purification are executed simultaneously. It is a key innovation of this invention and ensures continuous security protection without interrupting the training process.

[0072] Example 1

[0073] This embodiment provides a personalized federated learning safety and forgetting method for heterogeneous data, including:

[0074] Obtain the identity identifiers of multiple clients and their corresponding local datasets;

[0075] Based on the client's identity identifier, personalized model parameters for each client are dynamically generated through the central super network;

[0076] The model is trained on the local dataset of each client based on the personalized model parameters to obtain the amount of change in the model parameters;

[0077] The parameters of the hypernetwork are updated based on the changes in the model parameters;

[0078] Build and maintain a multi-level sample pool, including a positive sample pool, a negative sample pool, a historical negative sample pool, and an extreme negative sample pool;

[0079] Based on the sample pool, the supernetwork is subjected to parallel purification processing through an online comparative learning mechanism to suppress the influence of malicious clients or to withdraw data contributions.

[0080] Specifically, the steps of constructing and maintaining a multi-level sample pool include:

[0081] Model parameters are collected from normal clients as positive samples, and a quality score is calculated based on their performance on the local test set.

[0082] The quality score The calculation formula is:

[0083] ;

[0084] in, For the client The test set, For indicator functions, For the model to class The predicted probability;

[0085] Model parameters are collected from malicious clients as negative samples, and a toxicity score is calculated based on their backdoor attack success rate, attack confidence, and interference level.

[0086] Based on the toxicity score and time-triggered conditions, forced collection is performed and highly toxic samples are stored in the extreme negative sample pool.

[0087] Specifically, the steps of the online contrastive learning mechanism include:

[0088] Sample batches of positive and negative samples from the sample pool;

[0089] Calculate the similarity between the parameters of the client to be cleaned and the positive and negative samples;

[0090] A contrastive loss function is constructed based on similarity. for: ;

[0091] in, and These are positive and negative sample batches, respectively. and For sample weights, For temperature parameters, This is a similarity measurement function;

[0092] The hypernetwork is repaired by minimizing this loss function.

[0093] Specifically, it also includes the defense phase transition steps:

[0094] Monitor the success rate of malicious client attacks;

[0095] The defense phase is dynamically switched based on the attack success rate threshold, including the normal phase, monitoring phase, and cleanup phase.

[0096] During the purification phase, training updates for normal clients and purification and repair for malicious clients are performed in parallel.

[0097] Specifically, it also includes federal forgetting steps:

[0098] Receive forget requests from clients and mark their historical parameters as special negative samples;

[0099] The hypernetwork was repaired in multiple rounds using the enhanced contrastive loss function to eliminate the impact of the client.

[0100] Verify the forgetting effect to ensure that the influence of the client's parameters is effectively eliminated.

[0101] Specifically, the federated forgetting step shares the same sample pool and repair process as the online comparative learning mechanism, achieving unified processing of security defense and data forgetting.

[0102] In one specific embodiment, the present invention provides a personalized federated learning safety and forgetting method for heterogeneous data, such as... Figure 1 As shown, the process includes the following steps:

[0103] S1, Data Initialization

[0104] To simulate the data heterogeneity in real-world federated learning scenarios, this invention designs a controllable non-independent identically distributed (Non-IID) data allocation mechanism. Assume the federated network contains... N A set of clients. Original dataset Include There are 1 category, denoted as Each client holds data in only K categories, where, .

[0105] Category assignment process:

[0106] For each category Define its total number of occurrences across all clients as:

[0107] ;

[0108] in, This indicates a rounding up operation, ensuring that each category is fully allocated. For each category... The The second occurrence ( ), generate a probability value :

[0109] ;

[0110] in, Indicates uniform distribution. and This is a preset probability boundary used to control the degree of imbalance in the data distribution. The normalized probability is:

[0111] ;

[0112] Sample allocation process: Set categories The set of all samples is The total number of samples is Client Obtain Category Number of samples for:

[0113] ;

[0114] here Indicate category When was it assigned to the client? , This indicates rounding down. Ultimately, the client... Local dataset for:

[0115] ;

[0116] in, Indicates assignment to the client i The set of categories and ; Indicates the category obtained by the client. A subset of samples.

[0117] S1.1 Malicious Data Construction

[0118] To verify the effectiveness of the defense mechanism of this invention, the system supports targeting a specified set of malicious clients. Inject backdoor data.

[0119] Trigger definition: Define the trigger function. This function converts a normal image into an image with a backdoor trigger. (The left side is the input space (original image), and the right side is the output space (image with trigger). Although the input and output dimensions are the same (both are...), the function converts the image into a normal image. A three-dimensional tensor, wherein, Image height, Image width, (This refers to the number of channels), but the image content has been modified. Specifically, for the input image x, the trigger function in the specified region... (For example, the 4x4 pixel square in the bottom right corner) Add specific visual modes:

[0120] ;

[0121] in, This represents element-wise multiplication. For the mask matrix, in the trigger region The inner value is The remaining positions are , For the trigger pattern matrix, the visual pattern data poisoning process of the triggers is defined:

[0122] For malicious clients Its training dataset It is divided into two parts:

[0123] ;

[0124] in, Keep the original labels. , Indicates the proportion of poisoning, for Each sample in Perform the following transformation:

[0125] ;

[0126] in, All poisoned samples were relabeled as the target category based on the preset target label.

[0127] S1.2 Data Preprocessing and Normalization

[0128] To eliminate scale differences between different data sources, all input data must be normalized. For input images... Normalization transformation is defined as:

[0129] ;

[0130] in, This is the mean vector of each channel. This represents the standard deviation vector for each channel, and the division operation is performed channel by channel. Appropriate statistical parameters are used for different datasets. For example, the CIFAR-10 dataset uses... and , For color channels.

[0131] S1.3, Dataset Partitioning

[0132] Each client's local data is further divided into training set, validation set, and test set:

[0133] ;

[0134] The division ratio follows , and Importantly, the three subsets maintain the same class distribution, that is, for any class... satisfy:

[0135] ;

[0136] This ensures the fairness and consistency of model evaluation.

[0137] S2, Hypernetwork Construction

[0138] S2.1 Hypernet Structure Design

[0139] The core innovation of this invention lies in employing a HyperNetwork architecture to generate personalized model parameters. For example... Figure 2 Hypernetwork It is a parameterized neural network whose input is the client's identity identifier and whose output is the complete model parameters for that client. Let the parameters of the hypernetwork be... For the client The process by which a hypernetic network generates its personalized model parameters can be represented as:

[0140] ;

[0141] in, Indicates client The target network's complete parameter set. The hypernetwork employs a multi-layered, fully connected structure, comprising three main components: an embedding layer, a hidden layer, and a parameter generation layer. First, the client identifier... Mapped to via embedding layer 3D continuous vector space:

[0142] ;

[0143] in, For learnable embedding matrices, Total number of clients For the embedding dimension. The selection follows the adaptive principle: when If not specified, the system will set it automatically. This ensures that the embedded space can fully express the client's characteristics without being over-parameterized.

[0144] S2.2 Hidden Layer Transformation

[0145] Embedded vector go through The nonlinear transformation of the hidden layers is defined as follows:

[0146] ;

[0147] This formula describes the first... The calculation process of the hidden layer. Indicates the first The output vector of the layer belongs to 3D real space For hidden layer dimensions Indicates the first The output vector of the layer is used as the input of the current layer when hour, client The embedding vector.

[0148] For the first The weight matrix of a layer has different dimensions depending on the layer's position: when hour, ,Will dimensional embedding vector mapping to Hidden space; when hour, ,exist Transformations are performed within the hidden space. For the first The layer bias vector is used to increase the expressive power of the model.

[0149] The activation function is ReLU, defined as follows: The activation function is applied independently to each element. This introduces non-linearity, enabling the hypernetwork to learn complex mappings.

[0150] To enhance the network's expressive power and control parameter size, the system can selectively apply spectral normalization to the hidden layer weights. :

[0151] ;

[0152] in, Representing the maximum singular value of the matrix, spectral normalization ensures the stability of the supernetwork training.

[0153] S2.3, Parameter Generation Layer

[0154] The final output of the hidden layer The weights and biases of each layer of the target network are generated using multiple parameter generators. The layer parameters are generated as follows:

[0155] ;

[0156] ;

[0157] in, For weight generation function, For the first The total number of layer weight parameters, This indicates matrix vectorization operations. This represents the weight matrix of the k-th layer of the target network. : For bias generation functions, For the first The dimension of the layer bias parameter. Indicates the target network's... The bias vector of the layer. Specifically, for the target convolutional neural network model, the hypernetwork needs to generate the following parameters: Convolutional layer parameter generation requires... Convolutional layers There are n convolutional kernels, each with a size of [size missing]. Input channel Output channel The parameter generation dimension is:

[0158] ;

[0159] ;

[0160] Fully connected layer parameter generation: For the first One fully connected layer (input dimension) Output dimension The parameter generation dimension is:

[0161] ;

[0162] ;

[0163] S2.4, Personalized Model Instantiation

[0164] Parameters generated Loaded into the target network In the middle, a client is formed. Personalized models:

[0165] ;

[0166] in, This design allows each client to share the same network architecture, even though it is used for input data. However, it has completely different parameter configurations adapted to its local data distribution. .

[0167] Adaptiveness of S2.5 parameter generation

[0168] Hypernetworks are trained end-to-end, automatically learning the mapping between client embeddings and their optimal model parameters. This applies to clients with similar data distributions. and Its embedding vector and During the learning process, they naturally tend to converge, thus generating similar model parameters, achieving implicit client-side clustering and knowledge sharing. This mechanism enables the system to:

[0169] ;

[0170] in, Represents the norm, This indicates that the data distributions of the two clients are similar. This adaptability is key to how this invention handles extreme data heterogeneity.

[0171] S3, Dual-layer Optimization Training

[0172] S3.1, Two-layer optimization framework

[0173] This invention employs a two-layer optimization framework to achieve personalized federated learning, comprising an outer layer of hypernetwork optimization and an inner layer of local model optimization. In the... During the training round, clients are randomly selected. Conduct training. The overall optimization goal can be expressed as:

[0174] ;

[0175] in, Given hypernetwork parameters Next, client Model parameters after local optimization For the client The local loss function.

[0176] S3.2, Local Optimization of Inner Loop

[0177] For the selected client First, the initial model parameters are generated using a hypernetwork:

[0178] ;

[0179] Then execute on the local training dataset Step gradient descent:

[0180] ;

[0181] in, Indicates the number of iterations in the inner loop. For the inner loop learning rate, For client The first training set Batch data from step sampling. Indicates the model parameters Find the gradient and loss function. Using cross-entropy:

[0182] ;

[0183] in, The model represents the input Predicted as category The probability, One-hot encoding of the real labels (a method of converting category labels into binary vectors) This represents a sample in a batch, where, For the input image, The true category label for the image (an integer, such as a number between 0 and 9). For batch data, containing One sample.

[0184] S3.3 Calculation of parameter changes

[0185] After the inner loop optimization is completed, calculate the total change in model parameters:

[0186] ;

[0187] This change Reflects the client The direction and magnitude of local data optimization of model parameters are key signals for hypernetwork learning.

[0188] S3.4, External Loop Hypernetwork Update

[0189] Using parameter changes The gradient of the supernetwork is calculated using an automatic differentiation mechanism:

[0190] ;

[0191] in, This represents the inner product operation. Output the Jacobian matrix of the hypernetwork's parameters. The hypernetwork parameter updates employ an adaptive optimizer.

[0192] ;

[0193] in, For the outer loop learning rate, the Optimizer can be either Adam or SGD.

[0194] S3.5, Gradient Clipping and Stability

[0195] To prevent gradient explosion, the gradients of both the inner and outer loops are clipped. When the gradient norm... When the threshold is exceeded, the gradient is scaled to:

[0196] ;

[0197] When the gradient norm Not exceeding the threshold At that time, maintain the original gradient Unchanged. Among them, This is the gradient clipping threshold, typically 50. This gradient clipping mechanism ensures numerical stability during training and prevents parameter updates from going out of control due to excessively large gradients.

[0198] S4, Sample Pool Management

[0199] S4.1 Sample Pool Architecture Design

[0200] One of the core innovations of this invention is the design of a multi-level sample pool management system for efficiently collecting and maintaining the positive and negative samples required for contrastive learning. The system employs a three-level sample pool architecture, with each pool implemented based on a first-in, first-out (FIFO) queue structure and having preset capacity limits to balance storage overhead and sample diversity.

[0201] The specific sample pool is defined as follows:

[0202] ;

[0203] in, This represents the positive sample pool, used to store model parameter samples that represent benign behavior. Indicates the first There are 1 positive samples, with values ​​ranging from 1 to 1. , The maximum capacity of the positive sample pool is set to 50 in this invention.

[0204] ;

[0205] in, This represents the negative sample pool, used to store model parameter samples that represent malicious behavior. Indicates the first There are negative samples, with values ​​ranging from 1 to... , The maximum capacity of the negative sample pool is set to 50 in this invention.

[0206] ;

[0207] in, This represents the historical negative sample pool, specifically designed to store historical parameter trajectories of malicious clients, providing a longer time span for malicious behavior patterns. Indicates the first A historical sample, with values ​​ranging from 1 to... , The maximum capacity of the historical sample pool is set to 200 in this invention, which is larger than the capacity of the main sample pool to store more historical information.

[0208] ;

[0209] in, This represents the extreme negative sample pool, which specifically stores samples with extremely high toxicity scores. These samples play a crucial anchoring role in contrastive learning. Indicates the first A few extreme samples, with values ​​ranging from 1 to... , The maximum capacity of the extreme sample pool is set to 100 in this invention. The data structure for each sample is uniformly defined as a quadruple or quintuple. For positive samples:

[0210] ;

[0211] in, For the client's embedding vector, d For the embedded dimension; This is the complete set of model parameters for the client, including the weights and biases of all layers; The quality score reflects the degree of benignity of the sample. This is a timestamp that records the time of sample collection and is used for sample management and deduplication.

[0212] For negative samples, the data structure is expanded to a quintuple:

[0213] ;

[0214] in, This is the embedding vector for the malicious client; These are the model parameters for malicious clients; The toxicity score reflects the degree of malice of the sample; a higher value indicates a more serious threat. For timestamps; The source identifiers are current, historical, and extreme, where current indicates direct collection in the current round, historical indicates collection from historical parameter trajectories, and extreme indicates high-risk samples that meet extreme conditions.

[0215] S4.2 Positive Sample Collection and Quality Assessment

[0216] Positive samples are collected from well-performing, normal clients, i.e., for clients... satisfy ,in, Represents the set of all clients. This represents the set of clients identified as malicious. This represents the set of normal clients after excluding malicious clients from all clients. The system first generates its personalized model parameters through the hypernetwork:

[0217] ;

[0218] in, Represents a hypernetic function. For client identification, For the parameter set of the hypernetwork, For the generated client Model parameters. Quality score. The calculation takes into account both classification accuracy and prediction confidence:

[0219] ;

[0220] in, Indicates client The test dataset, Indicates the number of samples in the test set. This represents a pair of samples in the test set. For input data, For real labels, As an indicator function, when predicting labels Equal to real label Returns 1 if true, otherwise returns 0. . This indicates the model's prediction results. Indicates the use of parameters The model for input Predicted as category The probability when the quality score Exceeding the threshold At that time, positive samples are constructed and added to the positive sample pool, where, The preset quality threshold is used, which has been experimentally optimized to ensure that enough positive samples can be collected in the early stages of training.

[0221] S4.3 Negative Sample Collection and Toxicity Assessment

[0222] Negative sample collection targets clients identified as malicious. ,satisfy ,in, This is a collection of malicious clients. Toxicity score. The computation requires evaluating the model's performance on the backdoor test set:

[0223] ;

[0224] in, This represents the attack confidence level, reflecting the model's average level of confidence in its prediction of the target class. The confidence level reward coefficient. This is the confidence threshold. The success rate of a backdoor attack is indicated by the following formula:

[0225] ;

[0226] in, This represents a backdoor test set containing triggers. This represents a sample with a trigger. The numerator represents the number of samples that successfully triggered the backdoor, and the denominator represents the total number of samples in the backdoor test set. The attack confidence level is represented and calculated as follows:

[0227] ;

[0228] in, Represents the mathematical expectation, and calculates the average prediction confidence of all backdoor samples for the target category;

[0229] S4.4, Forced Collection and Extreme Sample Strategy

[0230] A key innovation of this invention is the forced collection mechanism, which ensures that the system can continue to collect malicious samples even when an attack is successfully suppressed. The triggering condition for forced collection is defined as follows:

[0231] ;

[0232] in, This is a Boolean function that returns whether forced data collection was triggered. Indicates time The success rate of the attack; For low Threshold; This indicates the time interval since the client last forced data collection. For the current moment, The timestamp of the last forced data collection; Minimum acquisition interval; Represents logical AND operations.

[0233] when At that time, the client's current parameters are unconditionally added to the extreme sample pool:

[0234] ;

[0235] in, This indicates an assignment operation. The set union operation represents the process of adding a new negative sample. Add to extreme sample pool The grading strategy for extreme samples comprises three levels. First, all toxicity scores meet... The samples are automatically placed into the extreme pool, where, The threshold for extreme toxicity is set. Secondly, clients detected as malicious more than three times consecutively have all their historical parameters marked as extreme samples. Finally, samples obtained through forced collection are randomly assigned to the extreme sample pool with a 30% probability, ensuring sample diversity. This design ensures the priority collection of high-threat samples while avoiding a homogenized sample pool.

[0236] S4.5 Dynamic Management and Optimization of Sample Pool

[0237] Dynamic management of the sample pool involves several optimization strategies. The deduplication mechanism is implemented by calculating a combination key of parameter hash and timestamp:

[0238] ;

[0239] in, This is a Boolean function used to determine the new sample. Is it a duplicate? Quantifiers indicating existence; Represents any sample pool; and These are the timestamps for the old and new samples, respectively. This is the threshold for the time window; and These are the hash values ​​of the parameters for the new and old samples, respectively, and hash(•) is the hash function. and These represent the model parameters contained in the new and old samples, respectively. Dynamic evaluation of sample quality is performed at the end of each training epoch. For each sample in the positive sample pool... Reassess its quality score:

[0240] ;

[0241] in, For the re-evaluation of the quality score, Evaluate is the evaluation function. This is the current evaluation dataset. If it satisfies... ,in, If the original quality score is not obtained, the sample is removed from the sample pool to ensure that the sample pool maintains high-quality samples.

[0242] S5, Online Comparative Learning Purification Mechanism

[0243] S5.1 Design of Contrast Loss Function

[0244] This invention employs an improved InfoNCE loss function for contrastive learning. For the client i to be cleaned, its contrastive loss is defined as:

[0245] ;

[0246] in, Indicates client The contrastive learning loss function aims to make the parameters of the client to be cleaned move away from negative samples and closer to positive samples. and These are the positive and negative sample batches, with each batch typically containing 8 samples. , For the sample. and The weights are determined by the number of samples, with positive samples receiving a larger weight to reinforce positive behavior. Temperature is a parameter that controls the sharpness of the similarity distribution; a smaller temperature parameter results in a sharper distribution. The value makes the model focus more on the most similar and least similar samples. For similarity function, Indicates the client to be cleaned. The current model parameters, This represents the model parameters in the positive samples. This represents the model parameters in the negative samples. This represents the natural exponential function. This represents the natural logarithm function.

[0247] S5.2 Parameter Similarity Measurement

[0248] Parameter similarity is calculated using cosine similarity:

[0249] ;

[0250] in, and Here are two sets of model parameters to be compared. For vectorization, all weight matrices and bias vectors in the parameter dictionary are flattened and concatenated into a one-dimensional vector. This represents the vector dot product operation, which calculates the sum of the element-wise products of two vectors. express Norm, or the Euclidean length of a vector. Similarity values ​​are constrained to... Interval:

[0251] ;

[0252] in, The function limits the similarity values ​​to a specified range to ensure numerical stability.

[0253] S5.3, Hypernetwork Repair Process

[0254] The hypernetwork is repaired by minimizing the contrastive loss, causing the parameters of malicious clients it generates to deviate from negative samples and approach positive samples. The repair process employs an independent optimizer.

[0255] ;

[0256] in, This represents the current parameters of the hypernetic network. This indicates the parameters of the repaired hypernetic network. To fix the learning rate, This indicates calculating the gradient with respect to the hypernetwork parameters. The repair process is then executed. Wheel, among which, Ensure adequate parameter adjustments:

[0257] ;

[0258] in, This indicates that the round index needs to be repaired. , Indicates the first The hypernetwork parameters of the rounds, Adam represents the adaptive moment estimation optimizer, which can automatically adjust the learning rate of each parameter.

[0259] S5.4, Evaluation of Repair Effectiveness

[0260] After repair, assess the change in average similarity between positive and negative samples:

[0261] ;

[0262] ;

[0263] in, This represents the change in similarity to positive samples. This represents the change in similarity with negative samples. and These represent the batch sizes of the positive and negative samples, respectively. Indicates the client before the repair. Model parameters, This represents the parameters of the repaired model. Ideally, This indicates that the repair makes the parameters closer to those of positive samples. This indicates that the repair moves the parameters away from negative samples. If both conditions are met, it means that the repair has successfully adjusted the malicious client parameters in a benign direction.

[0264] S6, Defense and Control Phase

[0265] S6.1, Design Concept of Three-Stage Defense Model

[0266] The three-stage defense model proposed in this invention simulates the response mechanism of the biological immune system: the normal stage corresponds to a healthy state, the surveillance stage corresponds to immune surveillance, and the purification stage corresponds to an active immune response. The system defines three defense stages:

[0267]

[0268] Here, "Phase" represents the current defense phase. The characteristics and transitions of each phase are determined by the attack success rate. Real-time monitoring implementation:

[0269] ;

[0270] in, Indicates time attack success rate Represents a collection of malicious clients. The number of malicious clients, This represents the client-side backdoor test set, containing all test samples with triggers. This represents a sample with a trigger. Indicates the target attack tag. This is an indicator function that returns 1 if the prediction result equals the target label, and 0 otherwise. Indicates time Client Model parameters, Indicates the use of parameters The model for samples Predicted as category The probability of.

[0271] To improve monitoring efficiency, The evaluation employs a sampling strategy, evaluating only a subset of the test samples each time. Meanwhile, system maintenance... Historical records are used for trend analysis:

[0272] ;

[0273] in, It is an exponential moving average. It is a smoothing coefficient that controls the weight of historical information.

[0274] S6.2 Fixed Trigger Mode

[0275] The fixed trigger mode transitions between stages based on a preset number of training steps, suitable for scenarios with known attack patterns or requiring periodic protection. Let the current training step number be... Define defense parameters: To defend the start steps, This refers to the length of the preparation period.

[0276] The phase transition rule is: when When, maintain the Normal phase; when At that time, it enters the Monitoring stage; when At that time, the Purification phase is initiated. Specifically, the Normal phase corresponds to... The system focuses on routine, personalized federated learning, and the hypernetwork continuously optimizes itself through interaction with various clients. The Monitoring phase corresponds to... The system enters an early warning state, increasing alert levels. The monitoring frequency was reduced from every 20 steps to every 10 steps, accelerating negative sample collection to establish a defense foundation. The Purification phase corresponds to... The system initiates active purification, performing comparative learning and repair every 5 steps. Sample collection is initiated independently of the defense phase. Collection will begin at that time to ensure that enough samples have been accumulated before the defense is officially launched.

[0277] S6.3, Dynamic Trigger Mode

[0278] The dynamic triggering mode adaptively adjusts the defense strategy based on the real-time threat level. Three key thresholds are defined: To monitor trigger thresholds, The purification trigger threshold, This is a safe rollback value.

[0279] The phase transition rules include three cases. First, the current phase is Normal and... At that time, it transitions to the Monitoring phase. Secondly, it is currently in the Monitoring phase and... Then, it transitions to the Purification phase. Third, the average of the last 5 steps in the current Purification phase... Below At this point, it can revert to the Monitoring stage, in which the average The calculation is as follows:

[0280] ;

[0281] Rate of change as an auxiliary trigger condition:

[0282] ;

[0283] when Even at that time Even a low absolute value can trigger an alarm, as a rapid increase may indicate a new type of attack.

[0284] S6.4, Phase-Specific Operations and Resource Allocation

[0285] The operational strategies and resource allocation differ significantly at different stages.

[0286] In the Normal phase, standard personalized federated learning training is performed, with clients selected uniformly and randomly, and the selection probability is... ,in, This represents the normal number of clients. Monitoring frequency. That is, an evaluation is performed every 20 steps. Sample collection probability =0.1, maintaining basic sample collection.

[0287] During the Monitoring phase, training continues as normal, but the alert level is raised, and the monitoring frequency is increased. The probability of sample collection has increased to =0.5, while preloading the computing resources required for comparative learning and generating system logs to record abnormal behavior patterns.

[0288] The Purification phase activates the contrastive learning purification mechanism to repair frequency. This means a repair is performed every 5 steps. The probability of detecting malicious clients is increased to [percentage missing]. However, normal clients still maintain The system adjusts the processing probability to ensure training continuity. It also evaluates the purification effect in real time and dynamically adjusts the repair intensity.

[0289] The phase transition includes a smooth transition mechanism to avoid the impact of abrupt changes on the system. The transition period from Normal to Monitoring is 50 steps, from Monitoring to Purification is 30 steps, and the transition period from Purification back to Monitoring is 20 steps. During the transition period, system parameters are gradually adjusted according to linear interpolation.

[0290] ;

[0291] in, and These represent the initial and target acquisition probabilities, respectively. The transition begins at this time. This refers to the length of the transition period. This gradual adjustment ensures the smooth operation of the system.

[0292] S7, Parallel Training Stream and Cleanup Stream Mechanism

[0293] S7.1, such as Figure 3 Dual-stream parallel architecture

[0294] The key innovation of this invention lies in achieving fully parallel execution of the training and purification streams, rather than the traditional serial stop-and-repair mode. The parallel execution of the system is represented as follows:

[0295] ;

[0296] in, Indicates time The system status, Indicates the main training stream. Indicates purification flow. This indicates parallel execution. The main training stream processes model updates from normal clients, and its execution process is as follows: Select a normal client. ,in, For all client sets, A collection of malicious clients. Represents the subtraction symbol for sets; generates personalized parameters through hypernetworks. ;implement Local optimization to obtain parameter changes Update hypernetic parameters .

[0297] The parameter correction for malicious clients in the purification stream processing involves the following steps: Selecting a malicious client. ,in, Extracting batches of positive and negative samples from the sample pool and ; Calculate comparative loss Perform repair updates ;

[0298] S7.2 Client Selection Strategy

[0299] Each training step The system uses probabilistic scheduling to determine which type of client to handle. During the normal or monitoring phase, all normal clients are selected evenly with a probability of 1 / 2. During the purification phase, hybrid scheduling is implemented: the selection probability of normal clients is... The probability of a malicious client being selected is ,in, The total probability of handling malicious clients during the cleanup phase.

[0300] S7.3 Consistency Guarantee

[0301] Parallel updates may cause conflicts; version control mechanisms ensure consistency. Each update is assigned a version number. When two streams are updated simultaneously, a weighted merge is used:

[0302] ;

[0303] in, Ensure the dominance of training updates. For the update results of the training stream, This is the updated result for the purification flow.

[0304] S8, Federal Forgotten

[0305] S8.1, Forgot Request Handling

[0306] When a data retraction request is received from client i, the system converts it into a sanitization task. First, the request's legitimacy is verified, including identity authentication and permission confirmation. Upon successful verification, a forgetting task identifier (forget_id) is generated for tracking. Forgetting tasks are assigned medium priority, lower than emergency security sanitization but higher than regular training.

[0307] S8.2 Construction of Forgotten Samples

[0308] Relabel the parameters of the client to be forgotten as special negative samples:

[0309] ;

[0310] in, For the client Embedded vector, For historical parameter set, Prioritize treatment to ensure the highest toxicity score. For timestamps, This serves as a special source identifier. A set of positive samples for comparison is also constructed:

[0311] ;

[0312] Among them, high-quality clients with similar data distributions but who have not requested forgetting are selected as positive samples.

[0313] S8.3 Forgotten Execution Process

[0314] Forgetting is achieved through reinforced contrastive learning, using a specialized loss function: ;

[0315] in, New parameters generated for the hypernet. For more precise temperature parameters, Enhance the rejection of historical parameters. Set the number of repair rounds. This means performing 5 rounds of comparative learning optimization on the hypernetwork, with a learning rate of [missing information] in each round. To ensure complete forgetting.

[0316] S8.4, Verification of Forgetting Effect

[0317] After the forgetting process is complete, the effectiveness is verified using three metrics. Parameter distance verification:

[0318] ;

[0319] Require ,in, A threshold set based on the parameter space size. Performance degradation verification:

[0320] ;

[0321] Require ,in, =1 / C represents the accuracy of random guessing, where C is the total number of classes in the dataset. This confirms that the model has "forgotten" the client's data pattern. Impact elimination validation:

[0322] ;

[0323] Require It has been confirmed that the impact of the forgotten client on the hypernetic network is now negligible.

[0324] S8.5 The Unity of Forgetting and Defense

[0325] This invention recognizes that both forgetting and defense are essentially tasks of eliminating the adverse effects of specific clients. Malicious defense can be viewed as temporary forgetting, and forgetting as permanent defense. Both utilize the same contrastive learning mechanism, sample pool system, and hypernetwork repair process, achieving complete technical unification. This unification not only simplifies system design but also provides readily available infrastructure for forgetting through the continuous operation of the defense mechanism, significantly improving system efficiency.

[0326] S9. Effectiveness Evaluation

[0327] To verify the effectiveness of the method of the present invention, an extreme heterogeneous scenario with 20 clients (each client holds only 2 types of data, including 2 malicious / forgotten clients) was constructed on the CIFAR-10 dataset. The three modes of normal training, forget training and retraining were uniformly trained for 1000 rounds. The core indicators and their meanings are as follows: (1) Average number of clients (Accuracy): The average classification accuracy of the 20 client-side personalized models on the local test set, reflecting the model's adaptability and generalization performance to heterogeneous data. The higher the value, the better the personalized model matches the local data distribution of each client. The range is [0,1], where 1 indicates a completely correct classification. (2) (Backdoor Attack Success Rate): The probability that a sample with a backdoor trigger generated by a malicious client is incorrectly predicted as the target label by the model, reflecting the degree to which the model is affected by malicious data. The lower the value, the better the security defense or forgetting effect. The range is [0,1], where 0 indicates that the backdoor attack is completely suppressed and 1 indicates that all backdoor samples trigger the attack.

[0328] 2. The experimental results are as follows:

[0329] In the normal training mode, which only performs personalized federated training without defense / forgetting mechanisms, the model averages The accuracy rate reached 87.12%, proving that the personalized model generated by the central supernetwork can effectively adapt to extremely heterogeneous data distributions and solve the data silo problem; however, its The accuracy rate of 16.41% (higher than the random guess accuracy rate of 10% for the CIFAR-10 dataset) indicates that the backdoor impact of the malicious client has been left behind through the hypernetic network update, posing a clear security risk.

[0330] Under the forgetting training mode employing the multi-level sample pool and online contrastive learning mechanism of this invention, after 1000 rounds of training, the model's average... It further improved to 88.62% (an increase of 1.5 percentage points compared to normal training), while The value dropped to 0%. This result proves that the online purification mechanism of this invention completely eliminates the impact of malicious client backdoors. While resetting the system to zero, it not only did not interrupt the training process of the normal client, but also achieved parallel forgetting and performance improvement by continuously absorbing beneficial knowledge, verifying the efficiency and effectiveness of the unified architecture for security defense and forgetting.

[0331] In contrast, the traditional gold standard method of full retraining after excluding client data to be forgotten, while also achieving the same results... It dropped to 0%, but its final average The success rate was 88.27% (0.35 percentage points lower than the forget-training method of this invention), and it required performing a complete 1000 rounds of training from scratch, resulting in high time and computational costs. This result highlights the inherent performance loss and inefficiency of traditional retraining methods, further demonstrating the significant superiority of this invention in balancing performance, safety, and efficiency.

[0332] In summary, in the extremely heterogeneous scenario of the CIFAR-10 dataset and 20 clients, the personalized federated learning security and forgetting method for heterogeneous data proposed in this invention can not only ensure the performance of personalized models through a central supernetwork, but also achieve efficient and thorough security defense and federated forgetting by relying on online comparative learning and multi-level sample pools. Its overall performance is better than the gold standard retraining method and has practical application value.

[0333] The actual application scenarios and results are summarized as follows:

[0334] The personalized federated learning security and forgetting method and system for heterogeneous data provided by this invention are particularly suitable for application scenarios with high requirements for data privacy and heterogeneity, such as cross-institutional risk control in finance, multi-center medical image diagnosis, and industrial IoT fault prediction. In actual deployment, for situations where the data distribution of each participant exhibits extreme non-independent and identically distributed characteristics, this invention can generate personalized models through a central hypernetwork, effectively solving the data silo problem while maintaining data locality. Combined with an online comparative learning mechanism, it minimizes the impact of malicious attacks, thereby ensuring the security and reliability of critical business decisions such as credit approval and assisted diagnosis. Simultaneously, in response to increasingly stringent data compliance requirements, this invention supports efficient real-time federated forgetting. Upon receiving a data withdrawal request, it can quickly eliminate the impact of specific data through online correction without suspending business operations or performing full retraining, ensuring the continuity of business systems. Furthermore, thanks to the lightweight design of the hypernetwork architecture, this invention significantly reduces the hardware resource requirements of terminal devices, making it possible to deploy a high-performance, reliable federated learning system on small and medium-sized participant devices with limited computing resources, effectively reducing system deployment costs and maintenance complexity.

[0335] Example 2

[0336] like Figure 4This embodiment provides a personalized federated learning safety and forgetting system for heterogeneous data, including:

[0337] The data acquisition module is used to acquire the identity identifiers of multiple clients and their corresponding local datasets;

[0338] The hypernetwork module is used to dynamically generate personalized model parameters for each client through the central hypernetwork based on the client's identity identifier.

[0339] The local training module is used to train the model on the local dataset of each client based on the personalized model parameters, and to obtain the changes in the model parameters.

[0340] The hypernetwork update module is used to update the parameters of the hypernetwork based on the changes in the model parameters;

[0341] The sample pool management module is used to build and maintain multi-level sample pools, including positive sample pools, negative sample pools, historical negative sample pools, and extreme negative sample pools.

[0342] The purification module is used to perform parallel purification processing on the supernetwork based on the sample pool through an online comparative learning mechanism, so as to suppress the influence of malicious clients or realize the withdrawal of data contributions.

[0343] The personalized federated learning security and forgetting method and system proposed in this invention demonstrates significant superiority over existing technologies in a series of key performance indicators. Its core architectural innovation—a personalized model generation mechanism based on hypernetworks—fundamentally solves the performance bottleneck problem of traditional federated learning when handling extremely non-independent identically distributed (Non-IID) data. Even under the stringent condition that each client possesses only a few categories of data, this method can still generate high-performance, dedicated models for each participant, ensuring the overall effectiveness and high accuracy of the federated system. Based on this robust architecture, this invention eliminates the single attack target of traditional federated learning by abandoning the centralized global model, thereby constructing a stronger intrinsic security barrier at the architectural level. More importantly, this invention is the first to achieve an online parallel defense mode of training and cleaning simultaneously. This mode overturns the traditional stop-and-repair offline process, enabling continuous and proactive cleaning of the negative impact of malicious attacks or data to be forgotten without interrupting normal federated training, continuously reducing the success rate of backdoor attacks. While maintaining or even improving the overall classification accuracy of the model by leveraging contributions from normal clients, This significantly improves the efficiency, robustness, and continuity of federated learning. The federated forgetting function of this invention directly embodies this innovative mechanism, cleverly transforming data withdrawal requests into an efficient and low-cost model behavior correction task. Compared to costly full retraining, the cost of forgetting is reduced by several orders of magnitude. Finally, this invention treats security defense and data forgetting as the same type of problem—eliminating the adverse effects of specific clients—and achieves this through a unified online comparison and cleanup mechanism. This high degree of functional unity and logical consistency not only simplifies the system architecture but also provides excellent scalability for supporting larger-scale client federated networks.

[0344] Example 3

[0345] Embodiment 3 of the present invention provides an electronic device.

[0346] An electronic device includes a memory, a processor, and a program stored in the memory and running on the processor, wherein the processor executes the program to implement the steps of the personalized federated learning security and forgetting method for heterogeneous data as described in Embodiment 1 of the present invention.

[0347] The detailed steps are the same as those of the personalized federated learning safety and forgetting method for heterogeneous data provided in Example 1, and will not be repeated here.

[0348] Example 4

[0349] Embodiment 4 of the present invention provides a computer-readable storage medium.

[0350] A computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the steps of the personalized federated learning security and forgetting method for heterogeneous data as described in Embodiment 1 of the present invention.

[0351] The detailed steps are the same as those of the personalized federated learning safety and forgetting method for heterogeneous data provided in Example 1, and will not be repeated here.

[0352] Example 5

[0353] Embodiment 5 of the present invention provides a computer program product.

[0354] A computer program product includes software code, wherein the program in the software code performs the steps of the personalized federated learning security and forgetting method for heterogeneous data as described in Embodiment 1 of the present invention.

[0355] The detailed steps are the same as those of the personalized federated learning safety and forgetting method for heterogeneous data provided in Example 1, and will not be repeated here.

[0356] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) in which computer-usable program code is contained. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0357] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0358] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0359] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0360] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0361] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0362] The above description is merely a preferred embodiment of this practice and is not intended to limit the scope of this practice. Various modifications and variations can be made to this practice by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this practice should be included within the protection scope of this practice.

Claims

1. A personalized federated learning safety and forgetting system for heterogeneous data, characterized in that, Applications in the field of image data include: The data acquisition module is used to acquire the identity identifiers of multiple clients and their corresponding local image datasets; The hypernetwork module is used to dynamically generate personalized model parameters for each client through the central hypernetwork based on the client's identity identifier. The local training module is used to train the model on the local image dataset of each client based on the personalized model parameters, and to obtain the changes in the model parameters. The hypernetwork update module is used to update the parameters of the hypernetwork based on the changes in the model parameters; The sample pool management module is used to build and maintain multi-level sample pools, including positive sample pools, negative sample pools, historical negative sample pools, and extreme negative sample pools. The purification module is used to perform parallel purification processing on the supernetwork based on the sample pool through an online comparative learning mechanism, so as to suppress the influence of malicious clients or realize the withdrawal of data contributions. The negative sample pool is used to store model parameter samples representing malicious behavior; the historical negative sample pool is specifically used to store the historical parameter trajectory of malicious clients, providing malicious behavior patterns over a longer time span. The steps of the online comparative learning mechanism include: Sample batches of positive and negative samples from the sample pool; Calculate the similarity between the parameters of the client to be cleaned and the positive and negative samples; A contrastive loss function is constructed based on similarity. for: in, and These are positive and negative sample batches, respectively. and For sample weights, For temperature parameters, This is a similarity measurement function; This represents the current model parameters of client i to be purified. This represents the model parameters in the positive samples. This represents the model parameters in the negative samples; By minimizing this loss function, the hypernetwork is repaired so that the parameters of the malicious clients it generates are far away from negative samples and close to positive samples. It also includes the defense phase transition steps: Monitor the success rate of malicious client attacks; The defense phase is dynamically switched based on the attack success rate threshold, including the normal phase, monitoring phase, and cleanup phase. During the purification phase, training updates for normal clients and purification and repair for malicious clients are performed in parallel.

2. The system as described in claim 1, characterized in that, The steps for constructing and maintaining a multi-level sample pool include: Model parameters are collected from normal clients as positive samples, and a quality score is calculated based on their performance on the local test set. The quality score The calculation formula is: in, For the client The test set, This represents a pair of samples in the test set. For input data, This is a real label; For indicator functions, For the model to class The predicted probability; Model parameters are collected from malicious clients as negative samples, and a toxicity score is calculated based on their backdoor attack success rate, attack confidence, and interference level. Based on the toxicity score and time-triggered conditions, forced collection is performed and highly toxic samples are stored in the extreme negative sample pool.

3. The system as described in claim 1, characterized in that, It also includes the federal forgetting process: Receive forget requests from clients and mark their historical parameters as special negative samples; The hypernetwork was repaired in multiple rounds using the enhanced contrastive loss function to eliminate the impact of the client. The formula for the enhanced contrast loss function is: ； in, New parameters generated for the hypernet. For historical parameter set, For more precise temperature parameters, To compare with the positive sample set; This is the rejection coefficient for historical parameters; Verify the forgetting effect to ensure that the influence of the client's parameters is effectively eliminated.

4. The system as described in claim 3, characterized in that, The federated forgetting step shares the same sample pool and repair process as the online comparative learning mechanism, achieving unified processing of security defense and data forgetting.

5. A personalized federated learning safety and forgetting method for heterogeneous data, characterized in that, Applications in the field of image data include: Obtain the identity identifiers of multiple clients and their corresponding local image datasets; Based on the client's identity identifier, personalized model parameters for each client are dynamically generated through the central super network; The model is trained on the local image dataset of each client based on the personalized model parameters to obtain the changes in the model parameters. The parameters of the hypernetwork are updated based on the changes in the model parameters; Build and maintain a multi-level sample pool, including a positive sample pool, a negative sample pool, a historical negative sample pool, and an extreme negative sample pool; Based on the sample pool, the supernetwork is subjected to parallel purification processing through an online comparative learning mechanism to suppress the influence of malicious clients or to withdraw data contributions. The negative sample pool is used to store model parameter samples representing malicious behavior; the historical negative sample pool is specifically used to store the historical parameter trajectory of malicious clients, providing malicious behavior patterns over a longer time span. The steps of the online comparative learning mechanism include: Sample batches of positive and negative samples from the sample pool; Calculate the similarity between the parameters of the client to be cleaned and the positive and negative samples; A contrastive loss function is constructed based on similarity. for: in, and These are positive and negative sample batches, respectively. and For sample weights, For temperature parameters, This is a similarity measurement function; This represents the current model parameters of client i to be purified. This represents the model parameters in the positive samples. This represents the model parameters in the negative samples; By minimizing this loss function, the hypernetwork is repaired so that the parameters of the malicious clients it generates are far away from negative samples and close to positive samples. It also includes the defense phase transition steps: Monitor the success rate of malicious client attacks; The defense phase is dynamically switched based on the attack success rate threshold, including the normal phase, monitoring phase, and cleanup phase. During the purification phase, training updates for normal clients and purification and repair for malicious clients are performed in parallel.

6. A personalized federated learning security and forgetting device for heterogeneous data, characterized in that, The device includes a memory and a processor; the memory is used to store a computer program; the processor is used to implement, when executing the computer program, the personalized federated learning security and forgetting method for heterogeneous data as described in claim 5.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, implements the personalized federated learning security and forgetting method for heterogeneous data as described in claim 5.

8. A computer program product, comprising software code, characterized in that, The program in the software code performs the steps of the personalized federated learning safety and forgetting method for heterogeneous data as described in claim 5.

Images