Detecting data and / or model poisoning attacks in fl

Abstract

A method includes: obtaining a first inference result based on test data and a first local FL model received from an FL client; obtaining a second reasoning result based on the test data and the reference FL model; checking whether the deviation between the first reasoning result and the second reasoning result is greater than a predefined threshold value or not; and in response to checking that a deviation between the first reasoning result and the second reasoning result is greater than a threshold, at least one of:-removing the FL client from the FL training process, or-reducing a trust score of the FL client; wherein the first local FL model and the reference FL model are obtained in an FL training process; the reference FL model is a second local FL model or a global FL model obtained from an aggregated local FL model during the FL training process.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to federated learning. Abbreviations

[0002] 3GPP: Third Generation Partnership Project

[0003] 5G / 6G / 7G: Fifth, Sixth, Seventh Generation

[0004] 5GC: Fifth Generation Core Network

[0005] ADRF: Analytics Data Repository Function

[0006] AI: Artificial Intelligence

[0007] AI / ML: Artificial Intelligence / Machine Learning

[0008] AnLF: Analytics Logic Function

[0009] FL: Federated Learning

[0010] gNB: Next Generation (5G) Node B

[0011] ID: Identifier

[0012] MDAF: Management Data Analytics Function

[0013] ML: Machine Learning

[0014] MTLF: Model Training Logic Function

[0015] NF: Network Function

[0016] NR: New Radio

[0017] NRF: Network Repository Function

[0018] NWDAF: Network Data Analytics Function

[0019] RAN: Radio Access Network

[0020] RIC: RAN Intelligent Controller

[0021] UDM: Unified Data Management

[0022] UE: User Equipment Glossary (extracted from 3GPP R1-2205695 and 3GPP R1-2300603) BACKGROUND

[0023] Many applications in mobile networks require large amounts of data from multiple distributed sources (e.g., UEs or distributed gNBs) for training a single generic model. To minimize the exchange of data between the distributed units generating the data and the centralized unit(s) creating the common model, the concept of federated learning (FL) can be applied. FL is a form of machine learning where instead of training a model at a single node, different versions of the model are trained at different distributed hosts (FL clients). This is different from distributed machine learning, where a single ML model is trained at distributed nodes to use the computing power of different nodes. In other words, FL differs from distributed learning in that: 1) each distributed node in the FL scenario has its own local training data, which can not be from the same distribution as the local training data at other nodes; 2) each node computes the parameters of its local ML model, 3) a central host (FL server) does not compute a version or part of the model, but rather combines the parameters of all distributed models to generate a master model (aggregating local models to a global model). One goal of this approach is to keep the training dataset where it is generated and perform model training locally at each individual learner in the federation.

[0024] After training the local models, each individual learner transmits its local model parameters, but not the (raw) training data set data, to the aggregation unit. The aggregation unit utilizes the local model parameters to update a global model, which can eventually be fed back to the local learners for further iterations until the global model converges. Thus, each local learner only benefits from the datasets of other local learners through the global model shared by the aggregator without explicit access to the (potentially privacy-sensitive) data available at each other local learner. large

[0025] In summary, the FL training process can be explained by the following main steps: • Initialization: a machine learning model (e.g., linear regression, neural network) is selected to be trained on the local nodes and initialized. • Client selection: a small fraction of the local nodes can be selected to start training on the local data. The selected nodes obtain the current statistical model, while the other nodes wait for the next federated round. • Reporting and aggregation: each selected node sends its local model to a central function (FL server) for aggregation. The central function aggregates the received models and sends the model updates back to the nodes. • Termination: after meeting a predefined termination criterion (e.g., reaching a maximum number of iterations), the central function aggregates the updates and finally determines the global model.

[0026] ​Table 1 shows some example deployment options for FL servers and FL clients in 3GPP networks. Table 1: Example FL Deployment Options in 3GPP Networks Summary of the Invention

[0027] Its purpose is to improve existing technology.

[0028] According to a first aspect, an apparatus is provided, the apparatus comprising: One or more processors, and a memory storing instructions that, when executed by the one or more processors, cause the device to perform: The first inference result is obtained based on the test data and the first local federated learning model. The second inference result is obtained based on test data and a reference federated learning model that is different from the first local federated learning model; Check whether the first deviation between the first inference result and the second inference result is greater than a predefined first deviation threshold; and In response to detecting that a first deviation between the first inference result and the second inference result is greater than a predefined first deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process, or - Reduce the trust score of the first federated learning client; among which The first local federated learning model and the reference federated learning model are acquired during the federated learning training process; The reference federated learning model is either a second local federated learning model or a global federated learning model obtained from the aggregated local federated learning models during the federated learning training process; The local federated learning model includes the first local federated learning model and the second local federated learning model; For aggregation, each local federated learning model in the local federated learning model is received from a corresponding federated learning client among multiple federated learning clients participating in the federated learning training process; and The first local federated learning model is received from the first local federated learning client.

[0029] When executed by the one or more processors, this instruction can also cause the device to obtain the first inference result in the following manner: The first inference result is computed using test data received from the first local federated learning model from the first federated learning client.

[0030] When executed by the one or more processors, this instruction can also cause the device to obtain the first inference result in the following manner: Send test data to the first federated learning client; Instruct the first federated learning client to use test data to compute inference in the first local federated learning model; and In response to an instruction to the first federated learning client, receive the first inference result from the first federated learning client.

[0031] When executed by the one or more processors, this instruction can also cause the device to perform: Check whether the second deviation between the calculated first inference result and the received first inference result is greater than a predefined second deviation threshold; and In response to the detection that a second deviation is greater than a predefined second deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process; or - Reduce the trust score of the first federated learning client.

[0032] When executed by the one or more processors, this instruction can also cause the device to perform: The selection of multiple federated learning clients for participation in the federated learning training process is based on their trust scores, ensuring that potential federated learning clients with higher trust scores are selected with a higher probability than those with lower trust scores.

[0033] When executed by the one or more processors, this instruction can also cause the device to perform: Check whether the first local federated learning model causes the first metric used to define the quality of the global federated learning model to be less than the corresponding predefined quality threshold; and In response to the detection that the first local federated learning model causes the first metric used to define the quality of the global federated learning model to be less than the corresponding predefined quality threshold, it is prohibited to check whether the first deviation is greater than the predefined first deviation threshold.

[0034] The first inference result can be a second metric for defining the quality of the first local federated learning model, and the second inference result can be a second metric for defining the quality of the global federated learning model.

[0035] The corresponding metrics in the first metric used to define quality and the second metric used to define quality may include at least one of the following: accuracy, precision, and recall of the corresponding federated learning model.

[0036] When executed by the one or more processors, this instruction can also cause the device to perform: Check whether the federated learning training process is marked as critical; and In response to the detection that the federated learning training process is not marked as critical, the check of whether the first deviation is greater than the predefined first deviation threshold is prohibited.

[0037] When executed by the one or more processors, this instruction can also cause the device to perform: Request the corresponding first portion of the test data from each of one or more potential federated learning clients; and In response to a first portion of the requested test data, a second portion of the test data is received from at least a subset of one or more potential federated learning clients, wherein the second portion is equal to or less than the first portion.

[0038] When executed by the one or more processors, this instruction can also cause the device to perform: For each of the one or more potential federated learning clients, check whether the corresponding second part of the test data is smaller than the corresponding first part of the test data; and For each of one or more potential federated learning clients, in response to the detection that the corresponding second part of the test data is smaller than the corresponding first part of the test data, or the corresponding potential federated learning client does not provide any second part of the test data, the priority of selecting the corresponding potential federated learning client as one of the multiple federated learning clients is reduced.

[0039] When executed by the one or more processors, this instruction can also cause the device to perform: The request data repository function provides test data; and Receive test data in response to a request for a data repository function.

[0040] When executed by the one or more processors, this instruction can also cause the device to obtain the second inference result in the following manner: The test data is used in the global federated learning model to compute the second inference result.

[0041] When executed by the one or more processors, this instruction can also cause the device to obtain the second inference result in the following manner: Select a second federated learning client from among multiple federated learning clients; and The second inference result is computed using test data in the second local federated learning model; where... The second federated learning client differs from the first federated learning client; and For aggregation, the second local federated learning model is received from the second federated learning client.

[0042] When executed by the one or more processors, this instruction can also cause the device to obtain the second inference result in the following manner: Select the second federated learning client from among the multiple federated learning clients; Send test data to the second federated learning client; and Instruct the second federated learning client to use the test data to compute inference in the second local federated learning model; In response to an instruction to the second federated learning client, a second inference result is received from the second federated learning client; wherein The second federated learning client differs from the first federated learning client; and For aggregation, the second local federated learning model is received from the second federated learning client.

[0043] When executed by the one or more processors, this instruction can also cause the device to perform: Choose a second federated learning client, so that the trust score of the second federated learning client is higher than that of the first federated learning client.

[0044] When executed by the one or more processors, this instruction can also cause the device to perform: The first federated learning client is paused from the federated learning training process before it is instructed to use test data to compute inference in the first local federated learning model; and The second federated learning client is paused from the federated learning training process before it is instructed to use the test data to compute inference in the second local federated learning model.

[0045] The first federated learning client can be a terminal.

[0046] This device can be included in network data analysis functions.

[0047] According to the second aspect, a method is provided, the method comprising: The first inference result is obtained based on the test data and the first local federated learning model. The second inference result is obtained based on test data and a reference federated learning model that is different from the first local federated learning model; Check whether the first deviation between the first inference result and the second inference result is greater than a predefined first deviation threshold; and In response to detecting that a first deviation between the first inference result and the second inference result is greater than a predefined first deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process, or - Reduce the trust score of the first federated learning client; among which The first local federated learning model and the reference federated learning model are acquired during the federated learning training process; The reference federated learning model is either a second local federated learning model or a global federated learning model obtained from the aggregated local federated learning models during the federated learning training process; The local federated learning model includes the first local federated learning model and the second local federated learning model; For aggregation, each local federated learning model in the local federated learning model is received from a corresponding federated learning client among multiple federated learning clients participating in the federated learning training process; and The first local federated learning model is received from the first local federated learning client.

[0048] The first reasoning result can be obtained in the following ways: The first inference result is computed using test data received from the first local federated learning model from the first federated learning client.

[0049] The first reasoning result can be obtained in the following ways: Send test data to the first federated learning client; Instruct the first federated learning client to use test data to compute inference in the first local federated learning model; and In response to an instruction to the first federated learning client, receive the first inference result from the first federated learning client.

[0050] The method may also include: Check whether the second deviation between the calculated first inference result and the received first inference result is greater than a predefined second deviation threshold; and In response to the detection that a second deviation is greater than a predefined second deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process; or - Reduce the trust score of the first federated learning client.

[0051] The method may also include: The selection of multiple federated learning clients for participation in the federated learning training process is based on their trust scores, ensuring that potential federated learning clients with higher trust scores are selected with a higher probability than those with lower trust scores.

[0052] The method may also include: Check whether the first local federated learning model causes the first metric used to define the quality of the global federated learning model to be less than the corresponding predefined quality threshold; and In response to the detection that the first local federated learning model causes the first metric used to define the quality of the global federated learning model to be less than the corresponding predefined quality threshold, it is prohibited to check whether the first deviation is greater than the predefined first deviation threshold.

[0053] The first inference result can be a second metric for defining the quality of the first local federated learning model, and the second inference result can be a second metric for defining the quality of the global federated learning model.

[0054] The corresponding metrics in the first metric used to define quality and the second metric used to define quality may include at least one of the following: accuracy, precision, and recall of the corresponding federated learning model.

[0055] The method may also include: Check whether the federated learning training process is marked as critical; and In response to the detection that the federated learning training process is not marked as critical, the check of whether the first deviation is greater than the predefined first deviation threshold is prohibited.

[0056] The method may also include: Request the corresponding first portion of the test data from each of one or more potential federated learning clients; and In response to a first portion of the requested test data, a second portion of the test data is received from at least a subset of one or more potential federated learning clients, wherein the second portion is equal to or less than the first portion.

[0057] The method may also include: For each of the one or more potential federated learning clients, check whether the corresponding second part of the test data is smaller than the corresponding first part of the test data; and For each of one or more potential federated learning clients, in response to the detection that the corresponding second part of the test data is smaller than the corresponding first part of the test data, or the corresponding potential federated learning client does not provide any second part of the test data, the priority of selecting the corresponding potential federated learning client as one of the multiple federated learning clients is reduced.

[0058] The method may also include: The request data repository function provides test data; and Receive test data in response to a request for a data repository function.

[0059] The second reasoning result can be obtained in the following ways: The test data is used in the global federated learning model to compute the second inference result.

[0060] The second reasoning result can be obtained in the following ways: Select a second federated learning client from among multiple federated learning clients; and The second inference result is computed using test data in the second local federated learning model; where... The second federated learning client differs from the first federated learning client; and For aggregation, the second local federated learning model is received from the second federated learning client.

[0061] The second reasoning result can be obtained in the following ways: Select the second federated learning client from among the multiple federated learning clients; Send test data to the second federated learning client; and Instruct the second federated learning client to use the test data to compute inference in the second local federated learning model; In response to an instruction to the second federated learning client, a second inference result is received from the second federated learning client; wherein The second federated learning client differs from the first federated learning client; and For aggregation, the second local federated learning model is received from the second federated learning client.

[0062] Selecting a second federated learning client can be executed, such that the trust score of the second federated learning client is higher than that of the first federated learning client.

[0063] The method may also include: The first federated learning client is paused from the federated learning training process before it is instructed to use test data to compute inference in the first local federated learning model; and The second federated learning client is paused from the federated learning training process before it is instructed to use the test data to compute inference in the second local federated learning model.

[0064] The first federated learning client can be a terminal.

[0065] This method can be performed by network data analysis functions.

[0066] This method could be a federated learning method.

[0067] According to a third aspect, a computer program product is provided, comprising an instruction set that, when executed on a device, is configured to cause the device to perform the method according to the second aspect. The computer program product may be embodied in a computer-readable medium or directly loadable into a computer.

[0068] According to some example embodiments, at least one of the following advantages can be achieved: • It can detect data and / or model poisoning attacks in federated learning; • It can mitigate data and / or model poisoning attacks in federated learning; • Flexible task allocation, for example, depending on the capabilities of the FL server and FL client.

[0069] It should be understood that any of the above modifications may be applied, alone or in combination, to the corresponding aspects they refer to, unless alternatives are explicitly excluded. Attached Figure Description

[0070] Further details, features, objects, and advantages will be apparent from the following detailed description of preferred exemplary embodiments, taken in conjunction with the accompanying drawings, in which:

[0071] Figure 1 (including Figure 1A and Figure 1B) shows a message sequence diagram according to some example embodiments;

[0072] Figure 2 A message sequence diagram according to some example embodiments is shown;

[0073] Figure 3 A message sequence diagram according to some example embodiments is shown;

[0074] Figure 4 An apparatus according to an example embodiment is shown;

[0075] Figure 5 A method according to an example embodiment is shown; and

[0076] Figure 6 An apparatus according to an example embodiment is shown. Detailed Implementation

[0077] Hereinafter, certain exemplary embodiments will be described in detail with reference to the accompanying drawings, wherein, unless otherwise stated, the features of the exemplary embodiments can be freely combined with each other. However, it should be clearly understood that the description of certain exemplary embodiments is given by way of example only and is in no way intended to limit this disclosure to the details disclosed.

[0078] Furthermore, it should be understood that the device is configured to perform the corresponding method, although in some cases only the device or only the method is described.

[0079] The very nature of FL introduces new threat vectors, such as data poisoning and model poisoning. In particular (but not only that), the threat surface is essentially expanded if the UE participates in FL training as a FL client. Therefore, such potential attacks should be detected and, where possible, mitigated.

[0080] In federated learning, because FL clients use their local data to train the model and only send model parameters to the FL server (aggregator), a malicious FL client could train the model with tampered data and send the model parameters to the FL server. This could lead to adversarial attacks, where the global model generated by the FL server might misclassify entities during inference in a manner consistent with the intentions of (multiple) malicious FL clients. This problem can occur across various FL deployment options, such as in telecommunications networks.

[0081] Some example implementations provide a mechanism for detecting any attacks by malicious FL clients using poisoned local training data, thereby compromising the global model that can be sent to all FL clients.

[0082] In some example implementations, for any given analytics ID, security test data is stored at ADRF (or any other NF). A defensive FL procedure is initiated if an FL consumer (e.g., NWDAF AnLF) requests a secure FL service, or if the FL server determines that the analytics ID for which the FL is performed is critical. In some example implementations, the defensive FL procedure may be executed by default, regardless of any requests or the analytics ID.

[0083] In defensive FL (Flexible Learning) processes, firstly, the FL server updates for each FL client at least one of the following: accuracy, precision, and recall, for each FL round. Typically, the FL server monitors the accuracy, precision, and recall of the global FL model. Accuracy, precision, and recall are metrics (quality metrics) used to determine whether the global FL model (or any other machine learning model) reflects reality. They are defined as follows:

[0084] Accuracy = Correct Predictions / Total Predictions Precision = True positive / (True positive + False positive) Recall rate = True positives / (True positives + False negatives)

[0085] If the FL server detects an anomalous deviation in the metric in subsequent FL rounds, it will challenge at least one FL client using stored test data. Typically, at least one FL client is suspected of causing the anomalous deviation. For this challenge, test data (assuming it has not been tampered with) is provided to the local FL model of at least one FL client to compute inference. There are two options for computed inference using test data: - The FL server sends test data to the FL client, the FL client performs inference and provides the inference results back to the FL server; or - The FL server calculates the inference itself based on the local FL model received from the FL client.

[0086] The choice of which option to use can depend on the implementation. For example, the capabilities of the FL server and FL client (e.g., processing power, memory, etc.) can be considered. These capabilities can depend on the type of network function. For example, the UE may have less processing power and / or memory than NWDAF. In some example embodiments, the selected option may be predefined.

[0087] The result of the challenge is the inference result that the FL server compares with the expected inference result of the test data.

[0088] If there is a significant deviation from the expected inference result (i.e., the deviation is greater than a deviation threshold), the FL server can remove (multiple) of the corresponding FL clients from the FL process. Alternatively, the FL server can trigger NRF to lower the trust score of the FL client (typically set during FL client registration). In some example embodiments, the trust score can be lowered only if the metric no longer decreases in the next FL round after the removal of (multiple) suspicious FL clients.

[0089] In some example implementations, the defense process may not include monitoring global FL model metrics before challenging one or more FL clients. For example, the FL server may periodically select some FL clients randomly and challenge those selected clients.

[0090] Now refer to Figure 1 to... Figure 3 Some example implementations are described in more detail. Note that each of these example implementations uses only one implementation option of the challenge described above (using test data on the FL client to compute inference, or using test data on the FL server to compute inference), but typically, the other option is also feasible.

[0091] Figure 1 illustrates an example implementation entirely within the 5GC. For instance, an NWDAF MTLF can act as an FL server (aggregator), while other NWDAF MTLFs can act as FL clients. As another example, an NWDAF (or another 5GC NF) can act as an FL server (aggregator), while the UE can act as an FL client. Test data can be stored on the ADRF or at another suitable data storage device. For this purpose, metadata (e.g., "securityTestData") is added to the test data in the ADRF, indicating that the test data cannot be used by any other entity, but only by authorized FL servers in the event of a suspected attack.

[0092] Furthermore, the profile of the FL client (in this case, NWDAF MTLF) stored at the NRF can be enhanced to include an FL trust score. The FL server can then modify (decrease) the FL trust score if an attack by the corresponding FL client is detected or suspected. The FL trust score can be used to select FL clients to participate in FL training: the higher the trust score of a potential FL client, the higher the probability that the potential FL client will be selected to participate in the FL training process.

[0093] The actions in Figure 1 are as follows:

[0094] Action 1: The analytics consumer (e.g., NWDAF AnLF) sends an analytics request to the FL server (e.g., NWDAQ MTLF). Specifically, AnLF may request to subscribe to a service that employs a defensive FL process (e.g., a "secure FL service"). This service instructs the FL server to make efforts to ensure that the FL models provided to AnLF are not tampered with or attacked by any malicious entity during the model training phase.

[0095] Action 2a: The FL server selects an FL client and initiates the FL process. For example, the FL server can use a trust score to select an FL client.

[0096] Action 2b: In the event of a request from AnLF for the "Secure FL Service", or if the FL server considers AnLF's analysis ID request to be critical (e.g., NF load forecasting), the FL server will initiate a defensive FL process.

[0097] Actions 3 and 4: For a given analytics ID, the FL server sends a request to ADRF for the collection of security test data for the FL tag. If available, ADRF sends the data as a response.

[0098] Action 5: The FL server initiates the FL process at the FL client. (In some example embodiments, actions 3 and 4 may follow action 5, or these actions may be performed entirely or partially in parallel.)

[0099] Action 6: After the FL process is initiated, the FL server monitors quality metrics (accuracy, precision, recall (or at least one of them)) for each FL client in each FL round.

[0100] Action 7: If a quality metric decreases after receiving a model update from (multiple) specific FL clients in a specific FL round, the FL server adds those (multiple) FL clients to a suspicious list.

[0101] Action 8: The FL server then sends the test data received in Action 4 to (multiple) suspected FL clients to retrieve inference from their local FL models. This acts as a challenge to the suspected FL clients to reassure them that they are genuine and not attackers.

[0102] Action 9: The FL server also uses test data from the global aggregation model to compute inference in parallel.

[0103] Action 10: (Multiple) suspicious FL clients send the inference results of the given test data to the FL server.

[0104] Action 11: The FL server analyzes the inference of all suspicious FL clients. More specifically, the FL server compares the inference results of (multiple) suspicious FL clients with the inference results obtained in Action 9. Based on the discrepancy between the inference results (if any), the FL server discards one or more suspicious FL clients with the highest discrepancy (inference bias) from the ongoing FL process. The FL server now resumes monitoring accuracy, precision, and recall for each remaining FL round.

[0105] Action 12: When accuracy no longer declines, the FL server instructs the NRF to reduce the trust score of (multiple) suspicious FL clients, resulting in a decrease in accuracy, precision, and recall.

[0106] Some example implementations can also prevent a suspicious FL client from being disguised as a malicious FL client by retraining the model with real local data before providing inference results based on test data, and then using this retrained model to provide inference based on test data back to the FL server. The FL server can detect this cheating by using test data from the local FL model received from the suspicious FL client to perform additional inference and comparing the inference result with the inference output based on the test data received from the suspicious FL client. If the discrepancy is greater than a certain threshold, the FL server can consider the suspicious FL client malicious and perform actions 11 and / or 12 in Figure 1.

[0107] In some example embodiments, a deviation in the inference result (between the local FL model at the suspicious FL client and the global FL model, and between the local FL model at the FL client and the local FL model from the suspicious FL client at the FL server) greater than a corresponding threshold is sufficient to cause the FL server to drop the suspicious FL client from FL training and / or lower the trust score of the suspicious FL client. In some example embodiments, both deviations must be greater than the corresponding threshold for the FL server to drop the suspicious FL client from FL training and / or lower the trust score of the suspicious FL client. In some example embodiments, a deviation in the inference result greater than a corresponding threshold is sufficient to cause the FL server to drop the suspicious FL client from FL training, but both deviations must be greater than the corresponding threshold for the FL server to lower the trust score of the suspicious FL client, and vice versa.

[0108] Figure 2 Another example embodiment is shown. As an option, the example embodiment can be entirely within the 5GC, where the NWDAF MTLF acts as the FL server (aggregator), and other NWDAF MTLFs act as FL clients. Alternatively, the FL server can be any 5GC NF (such as NWDAF), and the FL client can be a UE. Unlike the example embodiment of Figure 1, in this example embodiment, test data is obtained from other FL clients, specifically from FL clients that the FL server considers trustworthy. Furthermore, unlike Figure 1, test data from other FL clients in the local FL model received from suspicious FL clients for aggregation is used at the FL server to compute the inference results of the challenge.

[0109] Figure 2 The actions in the middle are as follows:

[0110] Action 1: Analyze the consumer (AnLF) MTLF FL Server – An analysis request for the secure FL service. This request can be a subscription.

[0111] Start: FL client selection

[0112] Action 2: MTLF FL Server (Multiple) potential MTLF FL clients – a portion (x%) of the test data requested by the analytics ID.

[0113] Action 3: (Multiple) Potential MTLF FL Clients The MTLF FL server receives y% of the test data for the analysis ID. Some FL clients may only be willing to share less than x% of the test data, or some FL clients may not be willing to share any test data. Therefore, for each FL client: y% ≤ x%. The test data is historical data and is assumed to be tagged.

[0114] Action 4: MTLF FL Server – Perform FL client selection among potential FL clients. In this selection, the FL server may consider a portion (y%) of the test data received from each potential FL client in Action 3. For example, the FL server may assume that potential FL clients willing to provide a larger portion (y%) of the test data are more likely to be actual clients than those unwilling to provide any test data or providing only a smaller portion (y%). Therefore, the FL server may prioritize potential FL clients who can share more test data in the FL client selection. The FL server may use other selection criteria to replace or supplement the portion (y%) of test data received from each potential FL client.

[0115] End: FL client selection

[0116] Start: FL training process (iteration)

[0117] Action 5: The FL server initiates the FL procedure at the selected FL client.

[0118] Action 6: The MTLF FL server requests and receives trust scores from the NRF for the selected FL clients. Furthermore, the MTLF FL server can assign an initial reputation score to each selected FL client (e.g., 0 for FL clients sharing no test data, 0.1 for FL clients sharing less than x% of test data, and 0.2 for FL clients sharing x% of shared data). Based on the trust score and the initial reputation score, the MTLF FL server can assign an initial reputation score to each selected FL client. The reputation score can be considered as a locally valid trust score. In some example embodiments, MTLF may use only one of the trust score and the initial reputation score as the initial reputation score.

[0119] Actions 5 and 6 can be executed in any order. They can be executed completely or partially in parallel.

[0120] Action 7: The FL client sends the locally trained model to the FL server.

[0121] Action 8: MTLF FL Server – Use test data (test dataset) jointly provided by several (or all) potential FL clients to determine (test) the quality metrics (accuracy, precision, recall, or at least one of them) of the local model reported by each FL client.

[0122] Action 9: MTLF FL Server – Aggregates local models received from (multiple) FL clients to generate a global model.

[0123] Action 10: MTLF FL Server – Use test data (test dataset) jointly provided by several (or all) FL clients to determine the quality metrics of the aggregated global model.

[0124] Action 11: MTLF FL Server – For each FL client, compare the quality metrics obtained in Actions 8 and 10. Increase or decrease the reputation score accordingly, for example, by 0.1. That is, if the local model's quality metric is substantially equal to the global model's quality metric (deviation less than a predefined first threshold), the reputation score can be increased; if the deviations are substantially different (deviation greater than a predefined second threshold, which is equal to or greater than the predefined first threshold), the reputation score can be decreased.

[0125] Action 12: MTLF FL Server (Multiple) MTLF FL Clients – Notifications are issued to (multiple) FL clients that have exceeded a predefined first minimum reputation score threshold (e.g., -1), indicating that they cannot participate in the FL training process from the next iteration. Alternatively, a warning action may be present before removing (multiple) MTLF FL clients from the FL training process.

[0126] Action 13: MTLF FL Server NRF reduces the trust score of NWDAF MTLF that has exceeded a predefined second minimum trust score threshold. The predefined second minimum trust score threshold can be the same as or different from the predefined first minimum trust score threshold. For example, the predefined first minimum trust score threshold can be lower than the predefined second minimum trust score threshold. In this case, the FL client can still participate in the FL training process, but its trust score will be reduced.

[0127] End: FL training process (iteration)

[0128] In some example embodiments, trust scores may be disregarded, thus actions 6 and 13 can be omitted. In some example embodiments, reputation scores are not used. For example, in such example embodiments, if the quality metric of the local model is substantially different from the quality metric of the global model, the trust score may be reduced.

[0129] Figure 3 Another example embodiment is shown, in which the FL server is located in the 5GC or RAN, and the FL client is preferably a UE. (See Figure 1 and...) Figure 2 In the example implementation, the aggregated FL model is used as the reference model. Figure 3 In this process, the local FL model of another FL client (preferably a trusted FL client) is used as a reference model, which is compared with the local FL model of the suspected FL client (using test data). The actions are as follows:

[0130] Action 2a: When a consumer requests the secure FL service (Action 1 in Figure 1), Figure 3 Afterwards (not shown in the image), the FL server selects some FL clients (e.g., based on their trust scores) and initiates an FL process with the selected FL clients. The selected FL clients can be considered as an FL group.

[0131] Action 2b: The FL server detects that one of the FL clients (here, UE1) is causing a decrease in quality metrics, making UE1 a suspicious FL client and selecting it for challenge. Furthermore, the FL server suspends UE1's participation in the FL training process (removing it from the FL group).

[0132] Actions 3 and 4: The FL server requests test data from a data repository (e.g., ADRF) and receives the test data in response.

[0133] Action 4b: The FL server selects another FL client (here: UE3, a "good" UE) to provide its local FL model as a reference model. Preferably, UE3 is a trusted UE. For example, UE3's trust score can be higher than UE1's trust score. If necessary for performance reasons, the FL server can also suspend UE3's participation in the FL training process.

[0134] Actions 3 and 4, along with action 4b, can be executed in any order and can be executed completely or partially in parallel. Actions 3 and 4 can be executed before action 2b, or completely or partially in parallel with action 2b.

[0135] Action 5: The FL server sends test data to UE1 and UE3, and instructs UE1 and UE3 to use the test data in their respective local FL models to calculate inference.

[0136] Action 6: UE1 and UE3 send the corresponding inference results back to the FL server.

[0137] Action 7: The FL server compares the inference results of the suspicious FL client UE1 with the inference results of the trusted UE3.

[0138] Action 8: If the bias of the inference result exceeds a predefined threshold, the FL server discards the suspicious FL client UE1 from the ongoing FL process. The FL server now resumes monitoring of quality metrics (accuracy, precision, recall) for each remaining FL round. If UE3 is paused, the FL server can add UE3 back to the FL training cycle. In addition to discarding UE1, or instead of discarding UE1, the FL server can lower UE1's trust score.

[0139] In some example implementations (not shown in the figures), if the FL server detects that one of the UEs (UE1) is causing a decrease in quality metrics, the FL server can... Figure 3 In action 2b, the FL process at all FL client (UE) locations is stopped. Then, the FL server must initiate the FL process at UE1 and the selected "good" UE (UE3) to perform inference using the test data (in... Figure 3 (After action 4b in the middle).

[0140] Figure 4 An apparatus according to an example embodiment is shown. The apparatus may be an FL server or a component thereof. Figure 5 A method according to an example embodiment is shown. Figure 4 The device can perform Figure 5 This method, but not limited to this method. Figure 5 The method can be derived from Figure 4 The device performs the action, but is not limited to the device performing the action.

[0141] The apparatus includes at least one of a first component 110 for acquisition, a second component 120 for acquisition, a component 130 for inspection, and a component 140 for removal or a component 150 for reduction. The first component 110, the second component 120, the inspection component 130, the removal component 140, and the reduction component 150 may respectively be a first acquisition component, a second acquisition component, an inspection component, a removal component, and a reduction component. The first component 110, the second component 120, the inspection component 130, the removal component 140, and the reduction component 150 may respectively be a first acquirer, a second acquirer, an inspector, a remover, and a reducer. The first component 110, the second component 120, the inspection component 130, the removal component 140, and the reduction component 150 may respectively be a first acquisition processor, a second acquisition processor, an inspection processor, a removal processor, and a reduction processor.

[0142] The first component 110, used for acquisition, obtains a first inference result based on test data and a first local FL model (S110). The second component 120, used for acquisition, obtains a second inference result based on test data and a reference FL model different from the first local FL model (S120). The first local FL model and the reference FL model are acquired during FL training. The reference FL model is either the second local FL model or a global FL model acquired from aggregated local FL models during FL training. The local FL models include the first local FL model and the second local FL model. For aggregation, each local FL model is received from the corresponding FL client among the multiple FL clients involved in the FL training process; specifically, the first local FL model is received from the first local FL client.

[0143] S110 and S120 can be executed in any order. They can be executed completely or partially in parallel.

[0144] The component 130 used for inspection checks whether the deviation between the first inference result and the second inference result is greater than a predefined deviation threshold (S130).

[0145] In response to the detection that the deviation between the first inference result and the second inference result is greater than a predefined deviation threshold (S130 = Yes), at least one of the following may occur: - The component 140 for removal (if present in the device) can remove the first FL client from the FL training process (S140); or - The component 150 used for reduction (if present in the device) reduces the trust score of the first FL client (S150).

[0146] Figure 6 An apparatus according to an example embodiment is shown. The apparatus includes at least one processor 810 and at least one memory 820 storing instructions, which, when executed by the at least one processor 810, cause the apparatus to perform at least the following: Figure 5 And related methods of description.

[0147] Some example implementations have been explained for 5G (NR). However, other example implementations may be used in other 3GPP generations (such as 4G, 6G, 7G, etc.), in other wireless or wired communication networks, and in other systems employing federated learning.

[0148] UE is an example of a terminal. Other examples are MTC devices. Each terminal can be implemented as a smartphone, mobile phone, laptop, sensor device, etc.

[0149] A message can be sent from one entity to another in one or more messages. Each of these messages may include other (different) information.

[0150] The names of network elements, network functions, protocols, and methods are based on the current standard. In other versions or other technologies, the names of these network elements and / or network functions and / or protocols and / or methods may differ, as long as they provide the corresponding functionality. The same applies to terminals.

[0151] Unless otherwise stated or explicitly stated from the context, different claims by two entities indicate that they perform different functions. This does not necessarily mean that they are based on different hardware. That is, each entity described in this specification may be based on different hardware, or some or all entities may be based on the same hardware. This does not necessarily mean that they are based on different software. That is, each entity described in this specification may be based on different software, or some or all entities may be based on the same software. Each entity described in this specification can be deployed in the cloud.

[0152] Based on the above description, it is obvious that, for example, the exemplary embodiments provide an FL server or a component thereof, an apparatus embodying the FL server or a component thereof, a method for controlling and / or operating the FL server or a component thereof, a plurality of computer programs for controlling and / or operating the FL server or a component thereof, and a medium carrying such a plurality of computer programs and forming a plurality of computer program products.

[0153] By way of non-limiting example, implementations of any of the blocks, devices, systems, techniques, or methods described above include hardware, software, firmware, special-purpose circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof. Each entity described in this specification can be implemented in the cloud.

[0154] It should be understood that the above description represents what is currently considered a preferred exemplary embodiment. However, it should be noted that the description of the preferred exemplary embodiment is given by way of example only, and various modifications can be made without departing from the scope of disclosure defined by the appended claims.

[0155] Unless otherwise stated, the terms “first X” and “second X” include the following options: “first X” is the same as “second X”, and “first X” is different from “second X”. As used herein, “at least one of the following: ” and “<at least one item in a list of two or more elements>” and similar wording (where a list of two or more elements is connected by “and” or “or”) means at least any one of these elements, or at least any two or more of these elements, or at least all of these elements.

Claims

1. An apparatus comprising: One or more processors, and a memory storing instructions, which, when executed by the one or more processors, cause the device to perform: The first inference result is obtained based on the test data and the first local federated learning model. The second inference result is obtained based on the test data and a reference federated learning model that is different from the first local federated learning model; Check whether the first deviation between the first inference result and the second inference result is greater than a predefined first deviation threshold; and In response to detecting that the first deviation between the first inference result and the second inference result is greater than the predefined first deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process, or - Reduce the trust score of the first federated learning client; in The first local federated learning model and the reference federated learning model are acquired during the federated learning training process; The reference federated learning model is a second local federated learning model, or a global federated learning model obtained from the aggregated local federated learning model during the federated learning training process. The local federated learning model includes the first local federated learning model and the second local federated learning model; For the aggregation, each local federated learning model in the local federated learning model is received from a corresponding federated learning client among the multiple federated learning clients participating in the federated learning training process; and The first local federated learning model is received from the first local federated learning client.

2. The apparatus of claim 1, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform the acquisition of the first inference result in such a manner as follows: The test data is used in the first local federated learning model received from the first federated learning client to compute the first inference result.

3. The apparatus according to any one of claims 1 and 2, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform the acquisition of the first inference result in such a manner as follows: Send the test data to the first federated learning client; Instruct the first federated learning client to use the test data to compute inference in the first local federated learning model; and In response to the instruction, the first federated learning client receives the first inference result from the first federated learning client.

4. The apparatus according to claim 3, which is dependent on claim 2, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: Check whether the second deviation between the calculated first inference result and the received first inference result is greater than a predefined second deviation threshold; and In response to detecting that the second deviation is greater than the predefined second deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process; or - Reduce the trust score of the first federated learning client.

5. The apparatus according to any one of claims 1 to 4, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: The federated learning clients are selected to participate in the federated learning training process based on their trust scores, such that a potential federated learning client with a higher trust score is selected to participate in the federated learning training process with a higher probability than a potential federated learning client with a lower trust score.

6. The apparatus according to any one of claims 1 to 5, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: Check whether the first local federated learning model causes a first metric used to define the quality of the global federated learning model to be less than a corresponding predefined quality threshold; and In response to the detection that the first local federated learning model causes the first metric used to define the quality of the global federated learning model to be less than the corresponding predefined quality threshold, the check of whether the first deviation is greater than the predefined first deviation threshold is prohibited.

7. The apparatus according to any one of claims 1 to 6, wherein the first inference result is a second metric for defining the quality of the first local federated learning model, and the second inference result is a second metric for defining the quality of the global federated learning model.

8. The apparatus according to any one of claims 6 and 7, wherein the corresponding measure in the first metric for defining the quality and the second metric for defining the quality includes at least one of the following: accuracy, precision, or recall of the corresponding federated learning model.

9. The apparatus according to any one of claims 1 to 8, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: Check whether the federated learning training process is marked as critical; and In response to the detection that the federated learning training process is not marked as critical, the check of whether the first deviation is greater than the predefined first deviation threshold is prohibited.

10. The apparatus according to any one of claims 1 to 9, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: Request the corresponding first portion of the test data from each of one or more potential federated learning clients; and In response to the request for the corresponding first portion of the test data, a corresponding second portion of the test data is received from at least a subset of the one or more potential federated learning clients, wherein the second portion is equal to or less than the first portion.

11. The apparatus of claim 10, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: For each of the one or more potential federated learning clients, check whether the corresponding second portion of the test data is smaller than the corresponding first portion of the test data; and For each of the one or more potential federated learning clients, in response to detecting that the corresponding second portion of the test data is smaller than the corresponding first portion of the test data, or that the corresponding potential federated learning client does not provide any second portion of the test data, the priority of selecting the corresponding potential federated learning client as one of the plurality of federated learning clients is reduced.

12. The apparatus according to any one of claims 1 to 9, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: The request data repository function provides the test data; and The test data is received in response to the request by the data repository function.

13. The apparatus according to any one of claims 1 to 11, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform the acquisition of the second inference result in such a manner as follows: The test data is used in the global federated learning model to compute the second inference result.

14. The apparatus according to any one of claims 1 to 13, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform the acquisition of the second inference result in such a way as: Select the second federated learning client from the plurality of federated learning clients; as well as The test data is used in the second local federated learning model to compute the second inference result; in The second federated learning client is different from the first federated learning client; and For the aggregation, the second local federated learning model is received from the second federated learning client.

15. The apparatus according to any one of claims 1 to 14, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform the acquisition of the second inference result in such a manner as follows: Select the second federated learning client from the plurality of federated learning clients; The test data is sent to the second federated learning client; as well as The second federated learning client is instructed to use the test data to compute inference in the second local federated learning model. In response to the instruction, the second federated learning client receives the second inference result from the second federated learning client; in The second federated learning client is different from the first federated learning client; and For the aggregation, the second local federated learning model is received from the second federated learning client.

16. The apparatus according to any one of claims 14 and 15, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: The second federated learning client is selected such that its trust score is higher than that of the first federated learning client.

17. The apparatus according to any one of claims 14 to 16, wherein the instructions, when executed by the one or more processors, further cause the apparatus to perform: The first federated learning client is paused from the federated learning training process before it is instructed to use the test data to compute inference in the first local federated learning model; and The second federated learning client is paused from the federated learning training process before it is instructed to use the test data to compute inference in the second local federated learning model.

18. The apparatus according to any one of claims 1 to 17, wherein at least one of the following: - The first federated learning client is a terminal; or - The device is included in the network data analysis function.

19. A method comprising: The first inference result is obtained based on the test data and the first local federated learning model. The second inference result is obtained based on the test data and a reference federated learning model that is different from the first local federated learning model; Check whether the first deviation between the first inference result and the second inference result is greater than a predefined first deviation threshold; and In response to detecting that the first deviation between the first inference result and the second inference result is greater than the predefined first deviation threshold, at least one of the following: - Remove the first federated learning client from the federated learning training process, or - Reduce the trust score of the first federated learning client; in The first local federated learning model and the reference federated learning model are acquired during the federated learning training process; The reference federated learning model is a second local federated learning model, or a global federated learning model obtained from the aggregated local federated learning model during the federated learning training process. The local federated learning model includes the first local federated learning model and the second local federated learning model; For the aggregation, each local federated learning model in the local federated learning model is received from a corresponding federated learning client among the multiple federated learning clients participating in the federated learning training process; and The first local federated learning model is received from the first local federated learning client.

20. A computer program product comprising an instruction set, which, when executed on a device, is configured to cause the device to perform the method according to claim 19.

21. The computer program product of claim 20 is embodied in a computer-readable medium or can be directly loaded into a computer.

Images