Federal recommendation system end-cloud collaborative defense method based on disturbance trajectory consistency
By controlling the consistency of embedding amplitude and direction on the client side, and by using credibility assessment and weighted robust aggregation on the server side, the problem of model poisoning attacks in federated recommendation systems is solved, achieving efficient and stable defense effects and adapting to complex scenarios.
Patent Information
- Application Number
- CN202511834903.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-08
- Publication Date
- 2026-02-10
AI Technical Summary
Existing federated recommendation systems are inaccurate in detection, have a high false alarm rate, lack universality, and are difficult to effectively defend against model poisoning attacks when faced with high-dimensional sparse features, non-IID distributions, and complex multi-stage attack strategies.
A cloud-edge collaborative defense method based on perturbation trajectory consistency is adopted for federated recommender systems. Through embedding amplitude constraints and directional consistency guidance on the client side, and multi-round upload modeling and credibility assessment on the server side, potential malicious clients are identified and eliminated. A weighted robust aggregation strategy based on Dirichlet distribution is used to update the global model.
It significantly reduces the exposure rate of target items, maintains stable recommendation performance, adapts to different data density and non-IID distributions, requires no external validation set, has high computational efficiency, significant defense effect, and strong adaptability.
Smart Images
Figure CN121509054A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of security technology for federated learning and recommendation systems, and in particular to a cloud-edge collaborative defense method for federated recommendation systems based on the consistency of perturbation trajectories. Background Technology
[0002] With the widespread application of personalized recommendations in e-commerce, social media, search engines, and other fields, how to achieve high-quality recommendations while protecting user privacy has become an urgent problem to be solved.
[0003] Federated Recommendation (FedRec) effectively mitigates the risk of centralized data leakage by distributing model training tasks locally to users and uploading only model parameter updates instead of the original data.
[0004] However, this distributed and decentralized nature also makes the system extremely vulnerable to model poisoning attacks.
[0005] Model poisoning attacks refer to malicious clients uploading carefully designed model updates to inject backdoors into the global model or boost the ranking of specific target items in the user's recommendation list, seriously undermining the fairness and credibility of the system.
[0006] Most existing defense methods address the issue from either the client or the server side:
[0007] On the client side, regularization terms are added to limit the magnitude and direction of embedded updates. However, in high-dimensional sparse embedding spaces, this can be easily bypassed by attackers through small-amplitude, slow drifting. On the server side, robust aggregation methods such as Krum, TrimmedMean, and Bulyan are relied upon. These methods are mostly based on Euclidean distance or mean truncation to identify anomalous updates. However, under non-independent and identically distributed (non-IID) user interests, malicious clients can easily evade detection through alignment-type or slow drifting strategies.
[0008] In addition, some defense methods rely on external validation sets or prior attack information to be effective, but in actual deployments, it is often difficult to obtain this data or it may lead to privacy risks.
[0009] Therefore, existing technologies suffer from problems such as inaccurate detection, high false alarm rate, and lack of universality when facing high-dimensional sparse features, non-IID distributions, and complex multi-stage attack strategies.
[0010] To address the aforementioned shortcomings, a method that enables efficient poisoning detection and defense without the need for external validation sets, and improves the security and robustness of federated recommendation systems in complex scenarios, is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0011] In view of this, the present invention provides a cloud-edge collaborative defense method for federated recommendation systems based on the consistency of perturbation trajectories.
[0012] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:
[0013] The edge-cloud collaborative defense method for federated recommender systems based on perturbation trajectory consistency includes the following steps:
[0014] Step S1: Local training and disturbance control on the client side
[0015] The client performs optimization of the personalized recommendation model locally, introducing a structure-aware perturbation control mechanism, which is specifically limited by two key control terms: first, the embedding amplitude constraint term IMR, which limits the embedding update amplitude of popular items, specifically controlled by calculating the embedding change and relative perturbation rate, and suppressing if the update amplitude exceeds the set threshold; second, the direction consistency guidance term DIR, which ensures that the update direction of user interests is consistent with historical interests by calculating the cosine similarity between user embedding and historical interest direction, and avoids malicious clients forging interest directions.
[0016] Step S2: Embed amplitude constraints on the client side
[0017] The client introduces an embedding magnitude constraint term during local training. Specifically, it calculates the relative perturbation rate ρ between the embedding change of popular items and their original embeddings. If the perturbation rate exceeds a set threshold, the embedding update magnitude of that item is limited, thereby controlling the relative perturbation magnitude of popular items.
[0018] Step S3: Guiding Client User Preferences
[0019] During the local training phase, the client also adds a user preference direction guidance regularization term. Specifically, by calculating the cosine similarity or KL divergence between the user embedding update direction and the historical interest trajectory, it encourages the user embedding update direction to be consistent with the historical interests and controls the smooth evolution of the interest distribution, reducing the possibility of malicious clients forging interest directions.
[0020] Step S4: Server-side multi-round upload modeling and credibility assessment
[0021] Updates uploaded by the client are transmitted to the server via a communication channel. The server records the client's upload history during multiple rounds of training and analyzes the client's behavioral characteristics by modeling directional consistency and amplitude stability. Directional consistency is evaluated by calculating the directional similarity of the client's uploaded updates, while amplitude stability is analyzed by evaluating the stability of the change in the gradient norm of the client's uploads. Based on these analysis results, the server calculates the credibility score for each client, which is used for subsequent filtering and weighted aggregation.
[0022] Based on the trajectory information uploaded by the client in multiple rounds, the server calculates the trust score for each client, specifically through directional consistency and amplitude stability. The server filters trustworthy clients based on these scores, and uses threshold filtering and voting mechanisms to filter trust levels, eliminating or downgrading potentially malicious clients. During aggregation, the server adopts a weighted aggregation strategy based on Dirichlet distribution, using the client's trust score to assign a weighted aggregation weight to each client, ensuring that trustworthy clients have a greater influence on the global model.
[0023] Step S5: Server-side weighted robust aggregation and global model update
[0024] After completing the client trustworthiness scoring, the server selects a set of trustworthy clients based on the evaluation results. The selection method includes setting a threshold based on trustworthiness scores and a voting mechanism to ensure that the selected clients are trustworthy. Then, the server adopts a weighted robust aggregation strategy based on Dirichlet distribution, assigning weighted aggregation weights according to the trustworthiness score of each client and updating the global model parameters. Through this strategy, trustworthy clients have a greater influence on the global model, thereby improving the robustness of aggregation and preventing malicious clients from affecting the update of the global model.
[0025] Preferably, in step S1, the total loss function for client-side optimization is:
[0026]
[0027] in, Let represent the total loss function for client-side optimization, where The cross-entropy loss is used for binary classification, measuring the error of the model in predicting user click behavior. The embedding amplitude constraint loss is used to limit the embedding update amplitude of popular items, preventing attackers from manipulating the embedding of target items through minute changes. To guide the loss for directional consistency, it is used to ensure that the update direction embedded by the user is consistent with its historical interest direction, and to prevent malicious clients from forging the user's interest direction; and These are hyperparameters that control the degree of influence of embedding amplitude constraints and directional consistency guidance loss on the total loss function, respectively.
[0028] Preferably, in step S2, the specific formula is as follows:
[0029]
[0030] in, Denotes the embedding magnitude constraint loss, where, This represents a collection of popular projects. For items The amount of embedded updates in the current round compared to the previous round. It is an item In the previous round of embedding values, It is a tiny constant used to prevent division by zero. It is an item The squared L2 norm of the embedding variation represents the magnitude of the change in item embedding. This formula, by constraining the change in the embedding of popular items, ensures that the change in item embedding is not too large, thereby preventing malicious clients from manipulating the recommendation system's effect through minor perturbations.
[0031] Preferably, in step S3, the specific formula is as follows:
[0032]
[0033] in, To guide the loss in order to ensure consistency of direction, among which, For users Embedded representation, For users The change in embedding between the current round and the previous round. For users Historical interests These are hyperparameters that control the relative weights of the directional consistency guiding loss and the KL divergence term. The Kullback-Leibler divergence measures the difference between the distribution of the current user embeddings and the distribution of historical embeddings. For users Embedding distribution of the current round For users In the previous round of embedding distribution, the formula ensured that the update direction of user interests was consistent with the historical trajectory by calculating the cosine similarity between the user embedding changes and the historical interest directions. It also promoted the smooth evolution of interest updates by constraining the difference between the current user embedding distribution and the historical embedding distribution through KL divergence.
[0034] The present invention achieves the following technical effects compared to the prior art:
[0035] (1) The invention has a significant defensive effect:
[0036] On datasets such as MovieLens, the target item exposure rate (ER@10) can be reduced to below 0.04, which is 85%-99% lower than existing methods;
[0037] (2) The present invention recommends stable performance:
[0038] While maintaining high safety, the recommendation accuracy (HR@10) is on par with or even slightly better than the best baseline;
[0039] (3) The present invention has strong adaptability:
[0040] It is compatible with different data densities and non-IID distributions, and does not require an external validation set;
[0041] (4) The present invention is computationally efficient:
[0042] Both client-side control and server aggregation adopt a lightweight design, with manageable additional computational overhead. Attached Figure Description
[0043] Figure 1 This is a general structural diagram of the defense framework of the present invention, which includes the collaborative workflow of the client defense module and the server defense module;
[0044] Figure 2 This is a comparison chart of the HR@10 index of the present invention with the baseline method on the ML-100K dataset under five types of attacks;
[0045] Figure 3 The graph shows the defensive performance of this invention on the ML-100K dataset compared to the comparison method under the HR@10 metric.
[0046] Figure 4 The graph shows the impact of different proportions of malicious users and recommendation list lengths on the ML-100K dataset on the ER@10 defense effectiveness of the method of this invention under five types of attacks.
[0047] Figure 5 The graph shows the impact of the number of perturbation constraints N for different popular items on the ML-100K dataset on the ER@10 defense performance of the method of this invention under five types of attacks. Detailed Implementation
[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0049] like Figure 1 and Figure 2 As shown, this invention discloses a cloud-edge collaborative defense method for federated recommendation systems based on perturbation trajectory consistency, comprising the following steps:
[0050] Step S1: Local training and disturbance control on the client side
[0051] The client performs optimization of the personalized recommendation model locally, and introduces a structure-aware perturbation control mechanism to limit the update range of popular items and the drift of user interest direction;
[0052] The total loss function for client-side optimization is:
[0053] ;
[0054] Step S2: Embed amplitude constraints on the client side
[0055] To prevent attackers from manipulating the similarity of popular items through minute adjustments, the client introduces an embedded magnitude constraint term during local training.
[0056] This constraint term limits the relative perturbation size of the popular item embedding, as shown in the formula:
[0057] ;
[0058] Step S3: Guiding Client User Preferences
[0059] To defend against interest-drift attacks, the client also adds a user preference direction guidance regular expression during the local training phase;
[0060] This encourages users to embed updates in a direction consistent with historical interests and controls the smooth evolution of interest distribution. The specific formula is as follows:
[0061] ;
[0062] Step S4: Server-side multi-round upload modeling and credibility assessment
[0063] The updates uploaded by the client are transmitted to the server through the communication channel. The server records the client's upload history in multiple rounds of training and analyzes the client's behavioral characteristics by modeling and analyzing directional consistency and amplitude stability.
[0064] Based on the trajectory information uploaded by the client in multiple rounds, the server calculates the credibility score of each client, which is used for subsequent filtering and aggregation weight allocation, thereby identifying and isolating potential malicious clients;
[0065] Step S5: Server-side weighted robust aggregation and global model update
[0066] After completing the client trustworthiness scoring, the server selects a set of trustworthy clients based on the evaluation results and updates the global model parameters using a weighted robust aggregation strategy based on Dirichlet distribution.
[0067] By rationally allocating weights, the pollution of the global model by malicious uploads is effectively reduced, ensuring the security and stable recommendation performance of the federated recommendation system under complex attack scenarios.
[0068] Example 1:
[0069] like Figure 3 As shown, in the ML-100K dataset, facing the high sparsity and diversity of user behavior, ER@10 can remain below 0.05 under various poisoning attacks, and HR@10 is maintained in the range of 0.39 to 0.45, which is significantly better than other methods.
[0070] Example 2:
[0071] like Figure 4 As shown, under different settings where the attack ratio varies from 1% to 15%, the method of the present invention can effectively maintain an extremely low ER@10 level, and the HR@10 curve is stable, indicating that its defense strategy has good robustness and generalizability when facing different attack intensities.
[0072] Experimental results show that, without any defenses, the ER@10 index of the target project is close to 1.0, while the method of this invention can significantly reduce ER@10 to the range of 0.0007~0.06. Simultaneously, while maintaining an extremely low attack exposure rate, this invention maintains an HR@10 recommendation accuracy at a near-attack-free level, demonstrating its excellent balance between security and business performance.
[0073] Example 3:
[0074] like Figure 5 As shown, compared with mainstream methods such as Krum, TrimmedMean, Bulyan, and Regula, this invention exhibits lower target exposure and higher recommendation accuracy across all attack scenarios and different datasets, demonstrating stronger versatility and adaptability. The influence of the number N of perturbation constraints for different popular items on the ML-100K dataset on the ER@10 defense performance of this invention under five types of attacks is also investigated.
[0075] In summary, this invention, through a collaborative defense mechanism on the client and cloud sides, can effectively identify and defend against various complex poisoning attacks without an external validation set. The client-side structure-aware perturbation control restricts the manipulation paths of popular item embeddings and maintains the stability of user interest directions during the local training phase, significantly reducing the feasibility of poisoning attacks. On the cloud side, through multiple rounds of historical modeling and noise injection, combined with consistency and stability scoring, the client weights are dynamically adjusted to achieve unsupervised anomaly update identification. The overall solution can adapt to non-IID distributions and highly sparse embedding spaces, ensuring the safety of global model updates and the stability of recommendation performance.
[0076] The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the technical scope of the present invention. Therefore, any minor modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.
Claims
1. A federated recommendation system edge-cloud collaborative defense method based on perturbation trajectory consistency, characterized in that, Includes the following steps: Step S1: Local training and disturbance control on the client side The client performs optimization of the personalized recommendation model locally, introducing a structure-aware perturbation control mechanism, which is specifically limited by two key control terms: first, the embedding amplitude constraint term IMR, which limits the embedding update amplitude of popular items, specifically controlled by calculating the embedding change and relative perturbation rate, and suppressing if the update amplitude exceeds the set threshold; second, the direction consistency guidance term DIR, which ensures that the update direction of user interests is consistent with historical interests by calculating the cosine similarity between user embedding and historical interest direction, and avoids malicious clients forging interest directions. Step S2: Embed amplitude constraints on the client side The client introduces an embedding magnitude constraint term during local training. Specifically, it calculates the relative perturbation rate ρ between the embedding change of popular items and their original embeddings. If the perturbation rate exceeds a set threshold, the embedding update magnitude of that item is limited, thereby controlling the relative perturbation magnitude of popular items. Step S3: Guiding Client User Preferences During the local training phase, the client also adds a user preference direction guidance regularization term. Specifically, by calculating the cosine similarity or KL divergence between the user embedding update direction and the historical interest trajectory, it encourages the user embedding update direction to be consistent with the historical interests and controls the smooth evolution of the interest distribution, reducing the possibility of malicious clients forging interest directions. Step S4: Server-side multi-round upload modeling and credibility assessment The client uploads updates to the server via a communication channel. The server records the client's upload history during multiple training rounds and analyzes the client's behavioral characteristics by modeling directional consistency and amplitude stability. Directional consistency is evaluated by calculating the directional similarity of the client's uploaded updates, while amplitude stability is analyzed by evaluating the stability of the change in the gradient norm of the client's uploads. Based on these analysis results, the server calculates a credibility score for each client, which is used for subsequent filtering and weighted aggregation. Based on the trajectory information uploaded by the client in multiple rounds, the server calculates the trust score of each client, specifically through directional consistency and amplitude stability. The server filters trustworthy clients based on these scores and uses threshold filtering and voting mechanisms to filter trust levels, eliminating or downgrading potentially malicious clients. During aggregation, the server adopts a weighted aggregation strategy based on Dirichlet distribution, which uses the client's trust score to assign a weighted aggregation weight to each client, ensuring that trusted clients have a greater influence on the global model. Step S5: Server-side weighted robust aggregation and global model update After completing the client trustworthiness scoring, the server selects a set of trustworthy clients based on the evaluation results. The selection method includes setting a threshold based on the trustworthiness score and a voting mechanism to ensure that the selected clients are trustworthy. Then, the server adopts a weighted robust aggregation strategy based on Dirichlet distribution, which assigns weighted aggregation weights according to the trust score of each client and updates the global model parameters. Through this strategy, trusted clients have a greater influence on the global model, thereby improving the robustness of aggregation and preventing malicious clients from affecting the update of the global model.
2. The edge-cloud collaborative defense method for federated recommendation systems based on perturbation trajectory consistency according to claim 1, characterized in that, In step S1, the total loss function for client-side optimization is: In the formula, Let represent the total loss function for client-side optimization, where The cross-entropy loss is used for binary classification, measuring the error of the model in predicting user click behavior. The embedding amplitude constraint loss is used to limit the embedding update amplitude of popular items, preventing attackers from manipulating the embedding of target items through minute changes. To guide the loss for directional consistency, it is used to ensure that the update direction embedded by the user is consistent with its historical interest direction, and to prevent malicious clients from forging the user's interest direction; and These are hyperparameters that control the degree of influence of embedding amplitude constraints and directional consistency guidance loss on the total loss function, respectively.
3. The edge-cloud collaborative defense method for federated recommendation systems based on perturbation trajectory consistency according to claim 1, characterized in that, In step S2, the specific formula is as follows: in, Denotes the embedding magnitude constraint loss, where, This represents a collection of popular projects. For items The amount of embedded updates in the current round compared to the previous round. It is an item In the previous round of embedding values, It is a tiny constant used to prevent division by zero. It is an item The squared L2 norm of the embedding variation represents the magnitude of the change in item embedding. This formula, by constraining the change in the embedding of popular items, ensures that the change in item embedding is not too large, thereby preventing malicious clients from manipulating the recommendation system's effect through minor perturbations.
4. The edge-cloud collaborative defense method for federated recommendation systems based on perturbation trajectory consistency according to claim 1, characterized in that, In step S3, the specific formula is as follows: in, To guide the loss in order to ensure consistency of direction, among which, For users Embedded representation, For users The change in embedding between the current round and the previous round. For users Historical interests These are hyperparameters that control the relative weights of the directional consistency guiding loss and the KL divergence term. The Kullback-Leibler divergence measures the difference between the distribution of the current user embeddings and the distribution of historical embeddings. For users Embedding distribution of the current round For users In the previous round of embedding distribution, the formula ensured that the update direction of user interests was consistent with the historical trajectory by calculating the cosine similarity between the user embedding changes and the historical interest directions. It also promoted the smooth evolution of interest updates by constraining the difference between the current user embedding distribution and the historical embedding distribution through KL divergence.