Federal learning backdoor attack defense method based on layer perception detection

Abstract

The invention discloses a federated learning backdoor attack defense method based on layer perception detection, which relates to the technical field of artificial intelligence security, and comprises the steps of client training and uploading, malicious client identification, backdoor key layer detection and deletion, robust aggregation updating and adversarial training for enhancing robustness. According to the method, the model parameters uploaded by the clients are subjected to clustering analysis, and the maximum benign cluster is identified by adopting an unsupervised clustering method, so that instability caused by single threshold judgment is avoided, and the benign client and the malicious client can be distinguished; and meanwhile, layer perception detection and elimination are used in the scheme, so that the backdoor introduced by a malicious client can be effectively identified and eliminated on the premise of ensuring the global model precision, and the influence of backdoor attack on the model is inhibited.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, specifically to a method for defending against backdoor attacks in federated learning based on layer-aware detection, which is suitable for improving the security and robustness of distributed machine learning models. Background Technology

[0002] Currently, with the deep integration of big data and artificial intelligence, data security and privacy protection have become core research areas. Traditional centralized machine learning requires aggregating data from various sources to train models, significantly increasing data exposure and increasing the risk of sensitive data leakage and misuse. Meanwhile, the application of machine learning in critical fields such as autonomous driving, finance, and healthcare places higher demands on model security, making the deployment of algorithms to defend against malicious attacks a focus of widespread attention. To address the privacy risks in cross-organizational data collaborative training, Federated Learning (FL), a distributed machine learning technology, has emerged. Its core advantage lies in the fact that client-side privacy data does not need to leave their local machine; it is only uploaded to a central server by the locally trained model parameters. The server then aggregates and updates the data into a global model and distributes it, effectively protecting user privacy from an architectural perspective, leading to its rapid adoption in the field of data privacy protection.

[0003] The distributed and open nature of federated learning makes its models vulnerable to attacks from malicious clients. The central server cannot fully control client behavior, allowing attackers to influence the global model through backdoor attacks. Specifically, attackers embed backdoor triggers in local training sets, training a poisoned model with a backdoor. This model classifies accurately under normal input, but when it receives malicious input containing the trigger, it activates the backdoor to output a specified category, making it highly stealthy. Through the model aggregation process, this backdoor "poisons" the global model, causing directional misjudgments under specific triggering conditions, seriously jeopardizing the security and reliability of the federated system. Therefore, research on defenses against backdoor attacks in federated learning is crucial.

[0004] The current mainstream defense method against backdoor attacks in federated learning is to detect and remove malicious clients that differ from most client models. While this method can defend against backdoors to some extent, it has significant drawbacks: in removing malicious clients, some benign neurons are mistakenly deleted, directly leading to a decline in the performance of the aggregated global model. Furthermore, ordinary defense methods are unable to cope with dynamic attacks and struggle to adapt to attackers' constantly changing strategies. These shortcomings mean that most federated systems currently fail to effectively defend against backdoor attacks, necessitating a better defense mechanism to address these issues. Therefore, to overcome the deficiencies and limitations of existing federated learning backdoor attack defense technologies, it is crucial to research a defense mechanism that can efficiently and accurately distinguish between malicious backdoor updates and benign updates, especially effective in environments where data is not independently and identically distributed, and capable of resisting adaptive attacks. Therefore, this paper proposes a layer-aware detection-based federated learning backdoor attack defense method to address the aforementioned problems. Summary of the Invention

[0005] In view of this, the technical problem to be solved by the present invention is to propose a backdoor attack defense method based on layer-aware detection in federated learning, which can effectively defend against the most advanced backdoor attacks while ensuring the performance of the federated learning main task, thus achieving a good defense effect.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a federated learning backdoor attack defense method based on layer-aware detection, comprising: S1, Client Training and Upload: In the t-th round of training, after each client receives the global model, it completes local model training by minimizing the loss function through gradient descent based on local data, and uploads the updated model parameters to the server. S2, Malicious Client Identification: The server flattens and standardizes the model parameters uploaded by all clients, calculates the cosine similarity matrix between clients, and uses the density clustering algorithm (HDBSCAN) unsupervised clustering algorithm to cluster the parameter vectors. The largest cluster is determined as the set of benign clients, and clients in non-largest clusters are marked as malicious client candidates. S3, Backdoor Key Layer Detection and Removal: Select a baseline model from the set of benign clients, replace each trainable layer of the malicious client candidate with the baseline model to build a test model, generate adversarial samples through projective gradient descent (PGD) attack, input them into the test model and calculate the attack success rate, determine the layers with attack success rates exceeding the preset threshold as backdoor key layers, and record the backdoor key layer index set. S4, Robust Aggregation Update: When the server aggregates the global model, it uses an indicator function to control the aggregation to use only the parameters of non-backdoor key layers based on the backdoor key layer index set. If there are no available non-backdoor key layer parameters for a certain layer, the global model parameters of the previous round of that layer are retained. S5, Adversarial Training Enhances Robustness: Based on the aggregated global model, an adversarial sample set is generated through non-targeted projective gradient descent (PGD) attack. The adversarial samples are mixed with clean samples to construct a new training dataset. The global model is then retrained using a hybrid training loss function to obtain a global model with enhanced robustness.

[0007] As a preferred embodiment, the method described in S1 in the first... In each round of training, each client Receive global model Then, several rounds of gradient descent updates are performed locally, with the local optimization objective being to minimize the loss function. The specific formula for the function is as follows:

[0008] In the formula, The model parameters are: Input time The output; This represents the cross-entropy loss function or other suitable classification loss function. This indicates the label corresponding to the sample. This represents the local dataset of each client; Among them, the client update model The formula is as follows:

[0009] In the formula, Represented as the learning rate, For the client No. Shift to local training parameters, This indicates the initial parameters received by the client. Represented as loss function For model parameters gradient, As a gradient operator, each client updates its model after training. Uploaded to the server for subsequent aggregation and testing.

[0010] As a preferred embodiment, the model parameter flattening and standardization processing in S2 is specifically as follows: S2.1 will upload the model from each client. Parameters flattened into high-dimensional vectors ,in For the model parameter dimensions, the flattening formula is:

[0011] S2.2 for high-dimensional vectors Standardization is performed to obtain a normalized vector. The specific formula is as follows:

[0012] In the formula, and These represent the mean and standard deviation of the model parameters for all clients, respectively.

[0013] Preferably, the calculation of the cosine similarity matrix described in S2, where any two clients and The formula for calculating cosine similarity is:

[0014] In the formula, This represents the total number of clients. and These are respectively represented as clients. and The normalized vector of flattened model parameters, where The closer the similarity is to 1, the more similar the client model update direction; malicious clients, due to carrying backdoors, usually have a significantly different distribution from benign clients, leading to a significant decrease in cosine similarity; the server will... Form a similarity matrix ; The density-based clustering algorithm (HDBSCAN) outputs the following labels:

[0015] In the formula, Indicates a noise point; other values ​​represent different clusters. This is expressed as the number of clusters obtained through clustering. The largest cluster of benign clients The determination formula is:

[0016] Clients in non-maximum clusters are marked as malicious client candidates. The density-based clustering algorithm (HDBSCAN) can adaptively adjust the number of clusters and automatically identify outliers, making it suitable for handling high-dimensional sparse model parameters in federated learning. This step completes the initial identification of malicious clients.

[0017] As a preferred approach, the test model construction method in S3 is as follows: assuming the model has a total of There are trainable layers, denoted as _ ... For each client model marked as malicious , and its first The layers are replaced in the baseline model to form a new test model. The expression is as follows:

[0018] In the formula, This represents the baseline model parameters selected from the set of benign clients, i.e., retaining the baseline model excluding the first parameter. All layer parameters except for the first layer are replaced. The layer corresponds to the malicious client; this operation can accurately test the impact of single-layer parameters on backdoor attacks. The Projected Gradient Descent (PGD) attack generates adversarial examples that simulate potential features for triggering backdoors. The PGD generation formula is as follows:

[0019] In the formula, This is the initial clean sample; Maximum permissible disturbance; This represents the step size for each iteration. This is a projection operator used to ensure that the disturbance does not exceed [a certain value]. , This is represented as an adversarial example generated in the previous round; This represents the label corresponding to the initial clean sample; The critical layer for backdoor detection in S3 is determined by the attack success rate. The success rate The calculation formula is:

[0020] Among them, ASR ( )> (in If the threshold is set, then the layer is determined to be a critical backdoor layer, and its index is recorded. Through this step, the server can obtain a set of BCLayer indexes. .

[0021] As a preferred option, the global model update formula in S4 is:

[0022] In the formula, This is represented as the global model of this round of aggregation. Layer parameters; Represented as client The Layer parameters; Represented as client The number of samples used locally; For index functions:

[0023] In the formula, express For the client The BCLayer index set; This process ensures that backdoor-related layers do not spread throughout the global model.

[0024] As a preferred embodiment, the formula for generating adversarial examples based on non-target projective gradient descent (PGD) attacks in S5 is as follows:

[0025] In the formula, This is represented as an adversarial example generated in this round; This is represented as the initial clean sample; Represented as the original input sample Centered on, with radius The perturbation constraint domain; This is represented as an adversarial example generated in the previous round; This is represented as a gradient operator; these samples are perturbed on the input, which can induce the model to make incorrect predictions, but the labels still use the true labels. Obtain the set of adversarial examples .

[0026] As a preferred embodiment, the expression for the hybrid training loss function in S5 is:

[0027] In the formula, This represents the loss for normal samples. To combat sample loss; This is the loss balance coefficient; through continuous adversarial training, the global model gradually acquires the ability to identify adversarial perturbations and backdoor samples, thereby reducing the attack success rate.

[0028] Compared with existing technologies, the federated learning backdoor attack defense method based on layer-aware detection provided by this invention has the following beneficial effects: (1) This invention can effectively distinguish between benign and malicious clients by performing cluster analysis on the model parameters uploaded by each client. The unsupervised clustering method is used to identify the largest benign cluster, avoiding the instability caused by a single threshold judgment, thereby significantly reducing the probability of benign clients being misjudged and improving the accuracy and robustness of malicious client detection.

[0029] (2) A layer-aware detection mechanism is proposed. By replacing layers one by one and detecting the attack success rate, the network layers in the model that are strongly related to backdoor attacks, namely the backdoor key layer (BC Layer), can be accurately located. Compared with existing methods that directly remove the entire malicious model, this invention only removes specific layers with backdoor risks, retaining the feature information learned by normal training to the greatest extent and effectively reducing the accuracy loss of the global model.

[0030] (3) During the global model aggregation process, backdoor key layer parameters are removed, and aggregation is performed only on non-BC layers to prevent the spread of backdoor attacks in the global model. At the same time, a credibility weighting mechanism is introduced to further enhance the anti-attack capability of the global model, so that the model achieves a good balance between security and performance.

[0031] (4) After aggregation, adversarial examples are generated specifically using inference attacks and mixed with normal training data to retrain the global model. This effectively strengthens the model's defense capabilities, enabling it to not only resist known backdoor attacks but also maintain robustness against unknown or new attacks, significantly reducing the success rate of backdoor attacks. Attached Figure Description

[0032] Figure 1 This is an overall flowchart of the federated learning backdoor attack defense method based on the combination of layer-aware detection and adversarial training proposed in this embodiment of the invention. Figure 2 This is a schematic diagram of the clustering method mentioned in the embodiments of the present invention; Figure 3 This is a flowchart illustrating the specific method for layer-aware detection proposed in this embodiment of the invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0034] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0035] Please refer to the example. Figures 1 to 3 As shown: This invention proposes a federated learning backdoor attack defense method based on layer-aware detection and adversarial training, including: Step 1: Federated learning initialization settings; In this embodiment, within a federated learning system, it is assumed that there exists Client A central server is used. The task is trained on the CIFAR-10 dataset for classification, using the SimpleVGG model (hereinafter referred to as the local model or client model). In each round of federated training, the server distributes the current global model parameters to each client. After several rounds of training based on the local data, the client uploads the updated model parameters back to the server. To verify the effectiveness of the defense method, 40% of the clients in the system (i.e., 8 clients) are assumed to be malicious clients. Client behavior is executed according to the following rules: (1) Data partitioning and client dataset configuration: The original CIFAR-10 training set contains 50,000 labeled color images (10 classes), and the test set contains 10,000 images.

[0036] In real-world federated learning applications, data from different clients often exhibits significant differences, making it difficult to satisfy the independent and identically distributed (IID) assumption. To more realistically simulate this complex scenario, this embodiment employs a Dirichlet distribution for non-IID partitioning, with distribution parameters set accordingly. This approach results in significant differences in the distribution of data categories held by different clients. Some clients may contain only a few categories of data, while others cover more categories, and the sample sizes are also unbalanced. This classification method better reflects the heterogeneity and imbalance of data in real-world scenarios, such as the differences in data collected by devices in different regions, thus providing a more complex and realistic experimental environment for verifying the effectiveness of subsequent defense methods.

[0037] For malicious clients, they possess the same clean local samples as benign clients, while simultaneously injecting backdoor samples into the local dataset. These backdoor samples are obtained by overlaying a fixed trigger consisting of four pixels onto the image and disguising its label as the attack target label. Note: This embodiment describes backdoor defense using a trigger-type backdoor as an example.

[0038] (2) Local training on the client side; Each round of federal training (the first) (round), the client performs local training and uploads according to the following process: Receive global model: The client receives global model parameters from the server. And initialize the local model, initialize the local model to .

[0039] Local data preparation: Building a local training set If it is a malicious client, then... A certain proportion of backdoor samples are mixed in; if it is a benign client, only clean samples are used. The proportion of malicious client injection can be set to... (For example, commonly used) (Scope), this embodiment defaults to .

[0040] Training hyperparameters: Number of local training epochs: Batch size: Optimizer: SGD, momentum = 0.9; initial learning rate A cosine annealing learning rate decay strategy is adopted.

[0041] (3) Local training iteration; The client performs a standard supervised training process on its local dataset, minimizing the cross-entropy loss to obtain updated model parameters. .

[0042] Step 2: Malicious client identification; like Figure 2 Received by the server Unsupervised analysis was performed on the model parameter sets uploaded by each client to identify benign clusters and clients, which were then used as the target set for subsequent layer-based perceptron detection. (The model parameter sets uploaded by the clients are shown in the original text.) each This is the complete weight set of SimpleVGG.

[0043] Weight flattening: Flattens each client model parameter into a long vector in a fixed order.

[0044] Ensure that the vector dimensions are consistent across different clients.

[0045] Standardization: for all Perform column-wise standardization to eliminate scale differences. The standardization formula is:

[0046] in These are the mean and standard deviation calculated on the client set.

[0047] HDBSCAN Unsupervised Clustering: Using Standardized Feature Vectors Clustering is performed, and the density-based clustering algorithm (HDBSCAN) selects cosine similarity as the metric. The cosine similarity matrix is ​​as follows: ,in

[0048] In the formula, This represents the total number of clients. and These are respectively represented as clients. and The normalized vector of flattened model parameters, where The closer it is to 1, the more similar the client model update directions are; Obtain cluster labels for each client ,Label Indicates noise / outlier points.

[0049] Benign cluster determination: The largest cluster is considered a benign cluster. The remaining clusters and noise points are considered as a suspicious / malicious candidate set. .

[0050] Step 3, Layer-aware detection; The procedure for this step is as follows: Figure 3 As shown. Benign clusters A client is randomly selected as the baseline model. The server holds the verification dataset. .

[0051] For suspicious clients Record model parameters Trainable parameter layer Each trainable layer Replace the baseline model respectively Corresponding layer parameters, baseline model Keeping the remaining layers unchanged, build the test model. Set the model to evaluation mode; Using PGD Generate adversarial examples and target them. Perform reasoning and calculate the attack success rate (ASR):

[0052] PGD ​​Generate Adversarial Examples Parameters: Maximum Perturbation Amplitude =8 / 255; Step size =2 / 255; Number of iterations =10; If the ASR exceeds the preset threshold, then a decision is made. For the BC layer of this suspicious client, record the BC layers of all suspicious clients to obtain the set of key layers for the malicious client backdoor. .

[0053] Step 4: Robust aggregation; In the standard federated average (FedAvg), the global model parameters are summed using a weighted average based on the number of client samples:

[0054] In the formula, Represented as client Number of samples used; K represents the total number of clients; This step introduces layer-by-layer controllable aggregation based on this: for the identified BC layer index set A hard rejection strategy is adopted, using the following aggregation:

[0055] In the formula, This is represented as the global model of this round of aggregation. Layer parameters; Represented as client The Layer parameters; Represented as client The number of samples used locally; For index functions:

[0056] By employing a targeted elimination strategy, backdoor parameters are prevented from propagating to the global model, while preserving as many beneficial parameters as possible, resulting in a high-performance and robust global model. .

[0057] Step 5: Competitive training; Based on the current global model As a benchmark, for the verification data Subset execution based on non-targeted PGD attacks:

[0058] In the formula, This is represented as an adversarial example generated in this round; This represents the initial clean sample; Represented as the original input sample Centered on, with radius The perturbation constraint domain; This is represented as an adversarial example generated in the previous round; Represented as the gradient operator; Generate a new batch of adversarial examples Adversarial examples maintain a high degree of similarity to the original samples in the input space, but are easily misjudged by the model in the decision space, simulating potential backdoor triggering modes and unknown attack methods.

[0059] Subsequently, the generated adversarial examples are mixed with clean examples to form a new training dataset. The global model is retrained on this dataset, and the total loss function is:

[0060] A new global model is obtained Through adversarial training, the global model gradually acquires the ability to identify adversarial perturbations and backdoor samples, further reducing the success rate of attacks.

[0061] In summary, this invention proposes a federated learning backdoor attack defense method based on layer-aware detection and adversarial training. This method effectively identifies and eliminates backdoors introduced by malicious clients while maintaining the accuracy of the global model, thereby suppressing the impact of backdoor attacks on the model. By introducing robust aggregation and adversarial training mechanisms, this method not only improves the robustness of the global model but also maintains good adaptability in complex non-independent and identically distributed scenarios, demonstrating higher security and practical value compared to existing defense methods.

[0062] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0063] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A layer-awareness detection-based federal learning backdoor attack defense method, characterized in that, Comprise: S1, client training and uploading: in the tth round of training, each client receives the global model, and the local model is trained by gradient descent to minimize the loss function based on local data, and the updated model parameters are uploaded to the server; S2, malicious client identification: the server performs flattening and standardization processing on the model parameters uploaded by all clients, calculates the cosine similarity matrix between the clients, and uses a density clustering algorithm to cluster the parameter vectors, and the largest cluster is determined as the benign client set, and the non-maximum cluster clients are marked as malicious client candidates; S3, backdoor key layer detection and deletion: select a benchmark model from the benign client set, replace each trainable layer of the malicious client candidate to the benchmark model to construct a test model, generate an adversarial sample by projection gradient descent attack, input the test model and calculate the attack success rate, and the layer with an attack success rate higher than the preset threshold is determined as the backdoor key layer, and the backdoor key layer index set is recorded; S4, robust aggregation update: when the server aggregates the global model, based on the backdoor key layer index set, only the parameters of the non-backdoor key layer are used for aggregation by the index function, if there is no available non-backdoor key layer parameter for a layer, the last round of global model parameters for the layer are retained; S5, adversarial training enhances robustness: based on the aggregated global model, an adversarial sample set is generated by non-target projection gradient descent attack, the adversarial samples and clean samples are mixed to construct a new training data set, and the global model is trained again using a mixed training loss function to obtain a global model with enhanced robustness.

2. The method of claim 1, wherein the method is characterized in that: S1 in the first In each round of training, each client receives the global model After that, several rounds of gradient descent updates are performed locally, with the local optimization objective being to minimize the loss function , which is expressed in the function formula as In the formula, represents the output of the model parameter when input ; represents a cross-entropy loss function or other suitable classification loss function, represents the corresponding label of the sample, represents the local data set of each client; In the above formula, the client updates the model The expression formula is: wherein, is represented as a learning rate, is a client The first round of local training parameters, is represented as a client initial receiving parameter, is represented as a loss function of the model parameters, the gradient, is a gradient operator, after each client completes training, the updated model is uploaded to the server for subsequent aggregation and detection.

3. The method of claim 1, wherein the method is characterized by: The model parameter flattening and standardization processing in S2 is specifically: S2.1 Upload the model uploaded by each client Parameter flattening into a high-dimensional vector where is the dimension of the model parameters, and the flattening formula is: S2.2 Normalization of high-dimensional vector S2.2.1 Standardization The specific expression formula is: where and are the mean and standard deviation of all client model parameters, respectively.

4. The method of claim 1, wherein the method is characterized in that: S2 calculates the cosine similarity matrix, wherein any two clients and The cosine similarity calculation formula is: In the formula, is expressed as the total number of clients, and is expressed as the total number of clients and is the normalized vector after flattening the model parameters, wherein is closer to 1, indicating that the client model update direction is more similar; malicious clients usually have a large difference from benign clients due to carrying backdoors, resulting in a significant decrease in cosine similarity; the server will combine all to form a similarity matrix ; The density clustering algorithm (HDBSCAN) clustering output label is: wherein represents a noise point, and other values represent different clustering clusters, represents the number of clusters obtained as clustering; the maximum cluster of the benign clients The decision formula is: Wherein, the clients in the non-maximum cluster are marked as malicious client candidates, the density clustering algorithm (HDBSCAN) can adaptively adjust the number of clusters and automatically identify abnormal points, and is suitable for processing high-dimensional sparse model parameters in federated learning; Through this step, the preliminary identification of malicious clients is completed.

5. The method of claim 1, wherein the method is characterized by: The test model in S3 is constructed in the following manner: assuming that the model has a total of trainable layers, denoted as ; For each client model that is flagged as malicious replaces its first layer into the baseline model, forming a new test model i.e. the expression is as follows: wherein, The reference model parameters are selected from the benign client set, i.e. the reference model retains all parameters except the layer, which is replaced by the corresponding layer for the malicious client; this operation allows to precisely test the impact of a single layer parameter on the backdoor attack; layer, which is replaced by the corresponding layer for the malicious client; this operation allows to precisely test the impact of a single layer parameter on the backdoor attack; The projection gradient descent attack generates an adversarial sample that simulates the potential features that trigger the backdoor, and the projection gradient descent generation formula is: wherein, is the initial clean sample; is the maximum allowed perturbation; is the step size for each iteration; is the projection operator that ensures the perturbation does not exceed , denotes the adversarial sample generated in the previous round; denotes the label corresponding to the initial clean sample; The backdoor key layer determination basis in S3 is attack success rate The success rate The calculation formula is: wherein, ASR ) (wherein is a preset threshold value), it is determined that the layer is a backdoor key layer, and the index of the layer is recorded . Through this step, the server can obtain a set of BCLayer index collection 6. The method of claim 1, wherein the method is characterized in that: The global model update formula in S4 is: In the formula, is an index function: is expressed as; is expressed as; The client The number of training samples, The total number of samples; In the formula, BCLayer index set representing the first client; the process ensures that the backdoor-related layer will not spread in the global model.

7. The method of claim 1, wherein the method is characterized by: The formula for generating an adversarial sample based on a non-target projection gradient descent attack in S5 is: In the formula, The generated adversarial samples in the current round are represented as The initial clean samples are represented as The perturbation constraint field with the original input sample as the center and a radius of is represented as The adversarial samples generated in the last round are represented as The gradient operator is represented as These samples are perturbed on the input and can induce the model to make an incorrect prediction, but the label still uses the true label , and the adversarial sample set is obtained.

8. The method of claim 1, wherein the method is characterized by: The mixed training loss function expression in S5 is: In the formula, is a normal sample loss; is an adversarial sample loss; is a loss balance coefficient; through continuous adversarial training, the global model gradually obtains the ability to identify adversarial perturbations and backdoor samples, thereby reducing the success rate of attacks.

Images