Backdoor attack detection and defense method and system based on personalized federated learning

Abstract

The application belongs to the technical field of machine learning, and particularly relates to a backdoor attack detection and defense method and system based on personalized federated learning. Through personalized training of model segmentation, density clustering grouping based on behavior characteristics and a reputation scoring mechanism with time smoothing, accurate identification and effective defense of backdoor attack clients are realized, while the personalized performance and aggregation efficiency of the federated learning model are ensured. Through density-aware client grouping, the interference of model differences on the detection result is eliminated, and the accuracy of backdoor attack identification is significantly improved. By introducing a time smoothing mechanism, misjudgment caused by single-round model fluctuations can be avoided, the reputation score of the client can reflect its long-term behavior characteristics, and the continuous and stable suppression of malicious clients is realized.

Description

Technical Field

[0001] This invention belongs to the field of machine learning technology, specifically relating to a backdoor attack detection and defense method and system based on personalized federated learning. Background Technology

[0002] Federated learning, by collaboratively training models across multiple clients without centralized collection of local client data, effectively solves the problems of data privacy and data silos, and has been widely applied in various fields such as finance, healthcare, and the Internet of Things. However, the distributed architecture of federated learning has significant security vulnerabilities: the server cannot directly access the client's local training data and training process. Malicious clients can participate in training by implanting backdoors, causing the global model to output incorrect results under specific triggering conditions, thus posing a serious threat to the entire federated learning system.

[0003] Currently, most federated learning backdoor defense methods rely on data distribution assumptions or gradient anomaly detection. In real-world scenarios where client data distribution is highly heterogeneous (not independent and identically distributed), these methods are prone to misclassifying normal model differences as anomalies or missing genuine backdoor attacks, resulting in high false positive and false negative rates. Furthermore, federated learning architectures that employ a unified global model mean that once a backdoor attack succeeds, its impact spreads to all clients, failing to limit the propagation scope of the backdoor. Summary of the Invention

[0004] To address the problems in the background technology, this invention provides a method and system for backdoor attack detection and defense based on personalized federated learning.

[0005] The technical solution of the present invention is as follows:

[0006] This invention provides a backdoor attack detection and defense method based on personalized federated learning, comprising:

[0007] S1: Initialize the shared model parameters on the server side and distribute them to each client;

[0008] S2: Based on the shared model parameters and local dataset, train the local model corresponding to each client, update the shared backbone network parameters, and upload the updated shared backbone network parameters of each client to the server.

[0009] S3: The data to be detected is processed by the shared backbone network of each client to obtain intermediate features, distribution features and statistical features. The intermediate features, distribution features and statistical features are concatenated to generate the behavioral feature vector of each client.

[0010] S4: Calculate the Euclidean distance between clients based on the behavioral feature vectors of each client; calculate the local density value of each client based on the Euclidean distance, neighborhood radius threshold, and indicator function; perform unsupervised clustering based on the local density value of each client to divide them into several client groups;

[0011] S5: For each client group, construct a statistical model of the group's behavioral characteristics using the mean vector and covariance matrix of the group's behavioral characteristics. Calculate the behavioral deviation of each client based on the statistical model to obtain potential abnormal clients.

[0012] S6: Update the reputation score of each client using a time smoothing mechanism. If the reputation score of a potentially abnormal client is lower than the reputation score threshold, then isolate the potentially abnormal client. Based on the reputation score of each client, perform weighted aggregation of the shared backbone network parameters uploaded to the server to obtain the updated shared model parameters. Then execute S2 until the preset conditions are met.

[0013] Furthermore, as described in S4, the local density value of each client is calculated based on the Euclidean distance between clients, the neighborhood radius threshold, and the indicator function, according to the formula: To achieve;

[0014] In the formula, Indicates the first Local density values ​​for each client; The neighborhood radius threshold; For indicator functions; Indicates the first The client and the first Euclidean distance between clients, , They represent the first The client, the first A behavioral feature vector for each client.

[0015] Furthermore, S5 describes calculating the behavioral deviation of each client based on a statistical model, using the formula: To achieve;

[0016] In the formula, Indicates the first Deviation in behavior of each client; Indicates the first Behavioral feature vectors of each client; , Representing client groups The mean vector and covariance matrix of behavioral characteristics.

[0017] Furthermore, S6 describes using a time smoothing mechanism to update the reputation score of each client, as shown by the formula: To achieve;

[0018] In the formula, , They represent the first The client in the first Wheel, First Wheel's reputation score; Indicates the first The client in the first Abnormal scores in the round; It is the smoothing coefficient, and 0 < <1.

[0019] Furthermore, as described in S6, the shared backbone network parameters uploaded to the server are weighted and aggregated based on the reputation scores of each client to obtain updated shared model parameters, specifically:

[0020] Clients with reputation scores not lower than the reputation score threshold are designated as valid clients. The proportion of each valid client's reputation score to the total reputation scores of all valid clients is calculated and used as the aggregation weight. Based on the aggregation weight, the shared backbone network parameters uploaded to the server by valid clients are weighted and aggregated to generate updated shared model parameters.

[0021] Furthermore, the updating of the shared backbone network parameters described in S2 is achieved through the formula: To achieve;

[0022] In the formula, This indicates the updated shared backbone network parameters. Indicates the first Shared backbone network parameters during round training Indicates shared model parameters. Indicates the first Private model header parameters for each client For learning rate, Indicates the first The local training objective function for each client. Indicates shared model parameters Find the gradient.

[0023] Furthermore, as described in S5, the behavioral deviation of each client is calculated based on a statistical model to identify potentially abnormal clients, specifically:

[0024] If the client's behavior deviation exceeds the behavior deviation threshold, the client is determined to be a potentially abnormal client.

[0025] If the client's behavior deviation is not greater than the behavior deviation threshold, the client is determined to be a normal client.

[0026] This invention also provides a backdoor attack detection and defense system based on personalized federated learning, comprising:

[0027] Initialization module: Used to initialize the shared model parameters on the server side and distribute them to each client;

[0028] Local training module: Based on shared model parameters and local datasets, train the local model corresponding to each client, update the shared backbone network parameters, and upload the updated shared backbone network parameters of each client to the server.

[0029] Feature extraction module: The data to be detected is processed by the shared backbone network of each client to obtain intermediate features, distribution features and statistical features. The intermediate features, distribution features and statistical features are concatenated to generate the behavioral feature vector of each client.

[0030] Clustering module: Calculates the Euclidean distance between clients based on their behavioral feature vectors; calculates the local density value of each client based on the Euclidean distance, neighborhood radius threshold, and indicator function; performs unsupervised clustering based on the local density value of each client, dividing them into several client groups.

[0031] Group detection module: For each client group, a statistical model of the group's behavioral characteristics is constructed using the mean vector and covariance matrix of the group's behavioral characteristics. Based on the statistical model, the behavioral deviation of each client is calculated to identify potential abnormal clients.

[0032] Parameter aggregation module: Update the reputation score of each client using a time smoothing mechanism. If the reputation score of a potentially abnormal client is lower than the reputation score threshold, then the client is isolated. Based on the reputation score of each client, the shared backbone network parameters uploaded to the server are weighted and aggregated to obtain the updated shared model parameters. Then, S2 is executed until the preset conditions are met.

[0033] Furthermore, the clustering module calculates the local density value for each client based on the Euclidean distance between clients, the neighborhood radius threshold, and the indicator function, according to the formula: To achieve;

[0034] In the formula, Indicates the first Local density values ​​for each client; The neighborhood radius threshold; For indicator functions; Indicates the first The client and the first Euclidean distance between clients, , They represent the first The client, the first A behavioral feature vector for each client.

[0035] Furthermore, the group detection module calculates the behavioral deviation of each client based on a statistical model, using the formula: To achieve;

[0036] In the formula, Indicates the first Deviation in behavior of each client; Indicates the first Behavioral feature vectors of each client; , Representing client groups The mean vector and covariance matrix of behavioral characteristics.

[0037] Beneficial effects

[0038] This invention achieves accurate identification and effective defense against backdoor attack clients through personalized training of model segmentation, density clustering based on behavioral features, and a time-smoothed reputation scoring mechanism, while ensuring the personalized performance and aggregation efficiency of the federated learning model. Specifically, density-aware client grouping eliminates the interference of model differences on detection results, significantly improving the accuracy of backdoor attack identification. The introduction of the time-smoothing mechanism avoids misjudgments caused by fluctuations in a single round of model analysis, allowing the client reputation score to reflect its long-term behavioral characteristics, thus achieving continuous and stable suppression of malicious clients. Detailed Implementation

[0039] The following examples are intended to illustrate the present invention, and not to further limit the invention.

[0040] Example 1

[0041] This embodiment provides a backdoor attack detection and defense method based on personalized federated learning, including:

[0042] S1: Initialize the shared model parameters on the server side and distribute them to each client to build the initial state of the local model on each client.

[0043] In this embodiment, ResNet-18 is selected as the basic model architecture on the server side. The server-side shared model parameters are initialized, including the parameters of feature extraction layers such as convolutional layers and pooling layers. The initialized shared model parameters are then distributed to each client, and the shared backbone network parameters of the local model are initialized based on the shared model parameters.

[0044] By using a unified initialization method, each client initializes its local model based on the same shared backbone network parameters, ensuring that the local models of each client have a consistent parameter base in the early stages of training, thus providing a prerequisite for subsequent horizontal comparisons based on model behavior.

[0045] S2: Based on the shared model parameters and local dataset, train the local model corresponding to each client, update the shared backbone network parameters, and upload the updated shared backbone network parameters of each client to the server.

[0046] The local model consists of a shared backbone network and a client-side private model header. The shared backbone network parameters are used for federated aggregation across clients, while the client-side private model header parameters (including decision layer parameters such as fully connected layers and classification layers) are updated only locally and do not participate in aggregation. The design of the private model header ensures the personalized performance of the client-side local model, meeting the specific needs of different clients. In other words, the client trains a local model containing both the shared backbone network and the client-side private model header based on local data, and only uploads the shared backbone network parameters to the server.

[0047] By using the model segmentation method described above, the impact of backdoor attacks on the model can be mainly concentrated at the shared backbone network level, avoiding interference from client-side private model headers on model behavior analysis, effectively reducing the scope of backdoor attacks, reducing the harm of attacks, and taking into account the personalized performance of the model.

[0048] Each client trains its local model based on its local dataset. Taking medical imaging data as an example, the data distribution varies among clients, with some clients focusing on lung images and others focusing on brain images.

[0049] Furthermore, the updated shared backbone network parameters are determined by the following formula: To achieve;

[0050] In the formula, This indicates the updated shared backbone network parameters. Indicates the first Shared backbone network parameters during round training Indicates shared model parameters. Indicates the first Private model header parameters for each client For learning rate, Indicates the first The local training objective function for each client. Indicates shared model parameters Find the gradient.

[0051] After the client completes local training, it only uploads the updated shared backbone network parameters to the server. The client's private model header parameters are only updated locally and do not participate in cross-client parameter aggregation.

[0052] S3: The data to be detected is processed by the shared backbone network of each client to obtain intermediate features, distribution features and statistical features. The intermediate features, distribution features and statistical features are concatenated to generate the behavioral feature vector of each client.

[0053] The server-side acquires behavioral feature representations of each client model based on the data to be detected. This data is a clean dataset that has not participated in any local client training, and it does not rely on assumptions about the local data distribution of the clients, thus avoiding false positives and false negatives caused by data heterogeneity. It maintains stable detection performance even in scenarios with non-independent and identically distributed models. Furthermore, different client models respond under the same input conditions, ensuring the comparability of behavioral features in cross-client analysis.

[0054] The behavioral features include the intermediate layer output features of the shared backbone network, the model's predicted output distribution features, and statistical features (such as mean, variance, etc.) calculated based on the output distribution. These features are used to characterize the model's decision-making behavior on the data to be detected, rather than relying on the training data itself or the magnitude of parameter updates.

[0055] S4: Calculate the Euclidean distance between clients based on the behavioral feature vectors of each client; calculate the local density value of each client based on the Euclidean distance, neighborhood radius threshold, and indicator function; perform unsupervised clustering based on the local density value of each client, and divide clients with similar behavioral features into the same client group to obtain several client groups.

[0056] In federated learning scenarios, due to significant differences in client data distribution, direct global anomaly detection can easily lead to false positives due to model discrepancies. Density-aware clustering can mitigate the interference from data heterogeneity to some extent, establishing a reasonable benchmark for subsequent anomaly detection.

[0057] The step of calculating the local density value of each client based on the Euclidean distance between clients, the neighborhood radius threshold, and the indicator function is based on the formula: To achieve;

[0058] In the formula, Indicates the first Local density values ​​for each client; The neighborhood radius threshold; This is an indicator function that outputs 1 when the condition within the parentheses is true, and 0 otherwise. Indicates the first The client and the first Euclidean distance between clients, , They represent the first The client, the first A behavioral feature vector for each client.

[0059] By using density-aware client grouping, clients with similar behavioral characteristics are grouped together, and anomaly detection is performed within each group. This eliminates the interference of model differences on the detection results and significantly improves the accuracy of backdoor attack identification.

[0060] S5: For each client group, construct a statistical model of the group's behavioral characteristics using the mean vector and covariance matrix of the group's behavioral characteristics. Calculate the behavioral deviation of each client based on the statistical model to identify potential abnormal clients.

[0061] The server calculates the degree of behavioral deviation of each client relative to its client group within the client group. Preferably, the calculation of the behavioral deviation of each client based on a statistical model is performed using the formula: To achieve;

[0062] In the formula, Indicates the first Deviation in behavior of each client; Indicates the first Behavioral feature vectors of each client; , Representing client groups The mean vector and covariance matrix of behavioral characteristics.

[0063] Furthermore, the step of calculating the behavioral deviation of each client based on a statistical model to identify potentially abnormal clients is as follows:

[0064] If the client's behavior deviation exceeds the behavior deviation threshold, the client is determined to be a potentially abnormal client.

[0065] If the client's behavior deviation is not greater than the behavior deviation threshold, the client is determined to be a normal client.

[0066] Because anomaly detection is performed only within groups of clients exhibiting similar behavior, statistical failures caused by cross-distribution comparisons are effectively avoided, thereby improving the accuracy of backdoor attack identification. When a client shows a consistently significant deviation within its client group, the server marks it as a potentially anomalous client.

[0067] S6: Update the reputation score of each client using a time smoothing mechanism. If the reputation score of a potentially abnormal client is lower than the reputation score threshold, then isolate the potentially abnormal client. Based on the reputation score of each client, perform weighted aggregation on the shared backbone network parameters uploaded to the server to obtain the updated shared model parameters. Then execute S2 until the preset conditions are met, such as the preset number of rounds.

[0068] S6 describes updating the reputation scores of each client using a time smoothing mechanism, which is achieved through the formula: To achieve;

[0069] In the formula, , They represent the first The client in the first Wheel, First Wheel's reputation score; It is the smoothing coefficient, and 0 < <1, used to balance the weights of historical reputation and current round anomalies; Indicates the first The client in the first The anomaly score of a round is used to reflect the degree of anomaly of the client in the current training round. In one implementation, the anomaly score is obtained by normalizing or thresholding the behavior deviation described in S5. The greater the behavior deviation, the higher the corresponding anomaly score. This transforms the "instantaneous" anomaly detection result of S5 into an accumulative anomaly score in S6, and introduces a time smoothing mechanism to comprehensively evaluate anomalies in multiple rounds, thereby achieving a stable characterization of the client's long-term behavioral reliability.

[0070] The server-side performs cumulative analysis of client behavior deviations based on multiple rounds of anomaly detection results. By introducing a time smoothing mechanism, it avoids misjudgments caused by fluctuations in a single round of modeling, enabling the client's reputation score to reflect its long-term behavioral characteristics and achieve continuous and stable suppression of malicious clients.

[0071] S6 describes the weighted aggregation of the shared backbone network parameters uploaded to the server based on the reputation scores of each client to obtain updated shared model parameters, specifically as follows:

[0072] Clients with reputation scores not lower than the reputation score threshold are designated as valid clients. The proportion of each valid client's reputation score to the total reputation scores of all valid clients is calculated and used as the aggregation weight. Based on the aggregation weight, the shared backbone network parameters uploaded to the server by valid clients are weighted and aggregated to generate updated shared model parameters.

[0073] During the aggregation phase, the server weights the shared backbone network parameters uploaded by the client based on the reputation score; isolated clients are no longer involved in the subsequent model aggregation process, thus achieving stable backdoor defense with a low false positive rate.

[0074] This embodiment is applicable to federated learning scenarios where client data distribution is heterogeneous and faces the risk of backdoor attacks, such as cross-institutional medical data collaborative training and multi-regional IoT device model updates. Through personalized training via model segmentation, density clustering based on behavioral features, and a time-smooth reputation scoring mechanism, it achieves accurate identification and effective defense against backdoor attack clients, while ensuring the personalized performance and aggregation efficiency of the federated learning model.

[0075] Example 2

[0076] Based on Example 1, this example provides a backdoor attack detection and defense system based on personalized federated learning, including:

[0077] Initialization module: Used to initialize the shared model parameters on the server side and distribute them to each client.

[0078] Local training module: Based on shared model parameters and local datasets, train the local model corresponding to each client, update the shared backbone network parameters, and upload the updated shared backbone network parameters from each client to the server.

[0079] The local training module adopts a model splitting architecture, which splits the local model into a shared backbone network and a private model head. The private model head ensures that each client has personalized performance requirements to adapt to the characteristics of local data, while strictly limiting the impact of backdoor attacks to the shared backbone network level, preventing the attack from spreading to the client's local inference process, and greatly reducing the overall harm caused by the attack.

[0080] Feature extraction module: The data to be detected is processed by the shared backbone network of each client to obtain intermediate features, distribution features and statistical features. The intermediate features, distribution features and statistical features are concatenated to generate the behavioral feature vector of each client.

[0081] Clustering module: Calculates the Euclidean distance between clients based on their behavioral feature vectors; calculates the local density value of each client based on the Euclidean distance, neighborhood radius threshold, and indicator function; performs unsupervised clustering based on the local density value of each client, dividing them into several client groups.

[0082] Furthermore, the clustering module calculates the local density value for each client based on the Euclidean distance between clients, the neighborhood radius threshold, and the indicator function, according to the formula: To achieve;

[0083] In the formula, Indicates the first Local density values ​​for each client; The neighborhood radius threshold; For indicator functions; Indicates the first The client and the first Euclidean distance between clients, , They represent the first The client, the first A behavioral feature vector for each client.

[0084] Group detection module: For each client group, a statistical model of the group's behavioral characteristics is constructed using the mean vector and covariance matrix of the group's behavioral features. Based on the statistical model, the behavioral deviation of each client is calculated to identify potential abnormal clients.

[0085] Furthermore, the group detection module calculates the behavioral deviation of each client based on a statistical model, using the formula: To achieve;

[0086] In the formula, Indicates the first Deviation in behavior of each client; Indicates the first Behavioral feature vectors of each client; , Representing client groups The mean vector and covariance matrix of behavioral characteristics.

[0087] Density-aware clustering and intra-group anomaly detection effectively eliminate the interference of normal model differences caused by data heterogeneity, significantly improve the accuracy of backdoor attack identification, and reduce the false positives and false negatives of traditional methods in non-independent and identically distributed scenarios.

[0088] Parameter aggregation module: Update the reputation score of each client using a time smoothing mechanism. If the reputation score of a potentially abnormal client is lower than the reputation score threshold, then the client is isolated. Based on the reputation score of each client, the shared backbone network parameters uploaded to the server are weighted and aggregated to obtain the updated shared model parameters. Then, S2 is executed until the preset conditions are met.

[0089] The time-smooth reputation scoring mechanism takes into account both historical behavior and current round status, avoiding misjudgments caused by single-round fluctuations. By combining reputation scoring with model aggregation weights, it achieves gradual isolation and continuous suppression of abnormal clients, ensuring the stability and long-term effectiveness of the defense.

[0090] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A backdoor attack detection and defense method based on personalized federated learning, characterized in that, include: S1: Initialize the shared model parameters on the server side and distribute them to each client; S2: Based on the shared model parameters and local dataset, train the local model corresponding to each client, update the shared backbone network parameters, and upload the updated shared backbone network parameters of each client to the server. S3: The data to be detected is processed by the shared backbone network of each client to obtain intermediate features, distribution features and statistical features. The intermediate features, distribution features and statistical features are concatenated to generate the behavioral feature vector of each client. S4: Calculate the Euclidean distance between clients based on the behavioral feature vectors of each client; calculate the local density value of each client based on the Euclidean distance, neighborhood radius threshold, and indicator function; perform unsupervised clustering based on the local density value of each client to divide them into several client groups; S5: For each client group, construct a statistical model of the group's behavioral characteristics using the mean vector and covariance matrix of the group's behavioral characteristics. Calculate the behavioral deviation of each client based on the statistical model to obtain potential abnormal clients. S6: Update the reputation score of each client using a time smoothing mechanism. If the reputation score of a potentially abnormal client is lower than the reputation score threshold, then isolate the potentially abnormal client. Based on the reputation score of each client, perform weighted aggregation of the shared backbone network parameters uploaded to the server to obtain the updated shared model parameters. Then execute S2 until the preset conditions are met.

2. The backdoor attack detection and defense method based on personalized federated learning according to claim 1, characterized in that, S4 describes calculating the local density value for each client based on the Euclidean distance between clients, the neighborhood radius threshold, and the indicator function, according to the formula: To achieve; In the formula, Indicates the first Local density values ​​for each client; The neighborhood radius threshold; For indicator functions; Indicates the first The client and the first Euclidean distance between clients, , They represent the first The client, the first A behavioral feature vector for each client.

3. The backdoor attack detection and defense method based on personalized federated learning according to claim 1, characterized in that, S5 describes the calculation of the behavioral deviation of each client based on a statistical model, using the formula: To achieve; In the formula, Indicates the first Deviation in behavior of each client; Indicates the first Behavioral feature vectors of each client; , Representing client groups The mean vector and covariance matrix of behavioral characteristics.

4. The backdoor attack detection and defense method based on personalized federated learning according to claim 1, characterized in that, S6 describes updating the reputation scores of each client using a time smoothing mechanism, which is achieved through the formula: To achieve; In the formula, , They represent the first The client in the first Wheel, First Wheel's reputation score; Indicates the first The client in the first Abnormal scores in the round; It is the smoothing coefficient, and 0 < <1.

5. The backdoor attack detection and defense method based on personalized federated learning according to claim 1, characterized in that, S6 describes the weighted aggregation of the shared backbone network parameters uploaded to the server based on the reputation scores of each client to obtain updated shared model parameters, specifically as follows: Clients with a reputation score not lower than the reputation score threshold are defined as valid clients. The proportion of each valid client's reputation score to the total reputation scores of all valid clients is calculated and used as the aggregation weight. Based on the aggregation weight, the shared backbone network parameters uploaded to the server by valid clients are weighted and aggregated to generate updated shared model parameters.

6. The backdoor attack detection and defense method based on personalized federated learning according to claim 1, characterized in that, S2 describes updating the shared backbone network parameters using the formula: To achieve; In the formula, This indicates the updated shared backbone network parameters. Indicates the first Shared backbone network parameters during round training Indicates shared model parameters. Indicates the first Private model header parameters for each client For learning rate, Indicates the first The local training objective function for each client. Indicates shared model parameters Find the gradient.

7. The backdoor attack detection and defense method based on personalized federated learning according to claim 1, characterized in that, S5 describes calculating the behavioral deviation of each client based on a statistical model to identify potentially abnormal clients, specifically as follows: If the client's behavior deviation exceeds the behavior deviation threshold, the client is determined to be a potentially abnormal client. If the client's behavior deviation is not greater than the behavior deviation threshold, the client is determined to be a normal client.

8. A backdoor attack detection and defense system based on personalized federated learning, characterized in that, include: Initialization module: Used to initialize the shared model parameters on the server side and distribute them to each client; Local training module: Based on shared model parameters and local datasets, train the local model corresponding to each client, update the shared backbone network parameters, and upload the updated shared backbone network parameters of each client to the server. Feature extraction module: The data to be detected is processed by the shared backbone network of each client to obtain intermediate features, distribution features and statistical features. The intermediate features, distribution features and statistical features are concatenated to generate the behavioral feature vector of each client. Clustering module: Calculates the Euclidean distance between clients based on their behavioral feature vectors; calculates the local density value of each client based on the Euclidean distance, neighborhood radius threshold, and indicator function; performs unsupervised clustering based on the local density value of each client, dividing them into several client groups. Group detection module: For each client group, a statistical model of the group's behavioral characteristics is constructed using the mean vector and covariance matrix of the group's behavioral characteristics. Based on the statistical model, the behavioral deviation of each client is calculated to identify potential abnormal clients. Parameter aggregation module: Update the reputation score of each client using a time smoothing mechanism. If the reputation score of a potentially abnormal client is lower than the reputation score threshold, then the client is isolated. Based on the reputation score of each client, the shared backbone network parameters uploaded to the server are weighted and aggregated to obtain the updated shared model parameters. Then, S2 is executed until the preset conditions are met.

9. The backdoor attack detection and defense system based on personalized federated learning according to claim 8, characterized in that, The clustering module calculates the local density value for each client based on the Euclidean distance between clients, the neighborhood radius threshold, and the indicator function, according to the formula: To achieve; In the formula, Indicates the first Local density values ​​for each client; The neighborhood radius threshold; For indicator functions; Indicates the first The client and the first Euclidean distance between clients, , They represent the first The client, the first A behavioral feature vector for each client.

10. The backdoor attack detection and defense system based on personalized federated learning according to claim 8, characterized in that, The group detection module calculates the behavioral deviation of each client based on a statistical model, using the formula: To achieve; In the formula, Indicates the first Deviation in behavior of each client; Indicates the first Behavioral feature vectors of each client; , Representing client groups The mean vector and covariance matrix of behavioral characteristics.

Images