Multi-stage collaborative detection method for defending model poisoning attack in federated learning

Abstract

The invention discloses a multi-stage collaborative detection method for defending model poisoning attacks in federal learning, which comprises the following steps: step 1, when a training round starts, a server firstly distributes a current global model to participating clients; after model update uploaded by each client after local training is received, the server starts a stage 1: step 2: in order to identify a concealment attack operated on a specific layer, the server continues to execute a stage 2: fine-grained layer-by-layer detection on the client; 3, after the fine-grained check of the individual behaviors is completed, the server executes a stage 3: group consistency analysis to evaluate the collaborative credibility of the client group; and step 4, integrating evaluation results of the three stages by the server, screening credible clients and executing aggregation. According to the method, multi-dimensional cooperative detection is adopted, the coarse-to-fine three-stage progressive defense concept is adopted, high efficiency is achieved, the false alarm rate in the heterogeneous environment is reduced, and better robustness is shown.

Description

TECHNICAL FIELD

[0001] The present application relates to distributed machine learning, federated learning of information security, and poisoning attack defense technology, in particular to a multi-stage collaborative detection method for defending model poisoning attacks in federated learning. BACKGROUND

[0002] Federated Learning (FL) is a new paradigm of distributed machine learning. Its core idea is to allow multiple participants, such as mobile devices or medical institutions, to collaboratively train a global machine learning model without sharing their local private data. In a typical federated learning process, a central server is responsible for coordinating the entire training process: the server first distributes the initial global model to each client; the client trains locally using private data and calculates the model update (such as gradient or model weight); then, the client uploads the model update to the central server; finally, the server aggregates the collected model updates to update the global model. This process is iterated multiple times until the global model converges.

[0003] Due to the privacy protection of user data, federated learning allows data not to leave the local, and it has been widely used in fields such as finance, medical health, Internet of Things and edge computing, which are highly sensitive to data privacy. However, the distributed nature of federated learning and its dependence on clients also leads to security vulnerabilities. Since the central server cannot directly access or verify the local data of the client, it must trust the model updates submitted by the client to a certain extent. Without any defense measures, model poisoning attacks pose a serious challenge and threat to federated learning. In model poisoning attacks, one or more malicious clients submit carefully crafted and malicious model updates to the server. These malicious updates aim to undermine the integrity of the global model. According to the different attack goals, model poisoning attacks can be roughly divided into two categories:

[0004] Untargeted Attacks: The main goal of this type of attack is to reduce the overall performance of the global model, making its accuracy on all or most tasks decline, or even hindering model convergence.

[0005] Targeted Attacks: This type of attack is also known as backdoor attack. The attacker tries to implant a "backdoor" in the global model. The model behaves completely normally when processing normal and benign inputs, but once it encounters malicious inputs containing a specific "trigger", it will misclassify them with high confidence as the target label specified by the attacker.

[0006] Model poisoning attacks pose a significant challenge to the reliability and security of federated learning systems. Existing techniques have proposed defense methods including robust aggregation, anomaly detection, and model characterization. However, these techniques struggle to effectively counter increasingly sophisticated and stealthy advanced poisoning attacks. For example, in the LP attack backdoor attack proposed in the paper [Zhuang, Haomin, et al. Backdoor federated learning by poisoning backdoor-critical layers], attackers can bypass the defense mechanisms of the above methods by fine-grained model manipulation, leading to poisoning gradually penetrating into the model and ultimately causing defense failure. Therefore, there is room for improvement in existing techniques.

[0007] Prior art similar to the present invention:

[0008] A federated learning poisoning attack defense method disclosed in Chinese patent document CN118246009A analyzes the gradient and loss value uploaded by the client using the local outlier factor algorithm to identify and eliminate malicious parameter clusters that exhibit outlier points. During the model aggregation phase, to handle malicious nodes that may not have been completely eliminated, the method scores the clients in the remaining normal parameter clusters. This score combines the cosine distance between each client gradient and the sum vector of normal cluster gradients, as well as the client's loss value in two dimensions. The final score of the client is calculated as the aggregation weight to mitigate the impact of poisoning attacks.

[0009] The above technical solution has the following disadvantages:

[0010] Although the invention provides a two-stage defense scheme, it still has some shortcomings in implementing and defending against advanced poisoning attacks. This method relies on fixed thresholds to divide malicious and normal parameter clusters, which is not flexible enough. When the proportion of malicious nodes is unknown or dynamically changing, it may lead to misjudgment. In addition, since this method needs to analyze the gradient and loss value uploaded by the client, it cannot effectively identify the stealthy malicious model generated by advanced poisoning attacks such as LP attack, which can easily bypass the detection mechanism, demonstrating the limitations of this method in dealing with advanced poisoning attacks. SUMMARY

[0011] The present application aims at the deficiencies of the prior art, such as the defense methods relying on global statistical features or single heuristic rules, in dealing with advanced model poisoning attacks. The present application provides a multi-stage cooperative detection method for defending model poisoning in federated learning, aiming to overcome the defects of the prior art relying on a single global indicator, being unable to cope with covert attacks, and being easily disturbed by data heterogeneity. Specifically, the present application aims to solve the following key technical problems:

[0012] (1) Detection problem for covert attacks: solve the problem that the prior art relies on global statistical features for detection, and is difficult to identify those covert backdoor poisoning attacks that are normal in global statistics but maliciously manipulated at the fine-grained model level.

[0013] (2) Poor defense adaptability: solve the problem that the prior art relies on static and single-dimensional heuristic rules, resulting in poor defense adaptability and being easily bypassed by attackers. The present application aims to build a multi-dimensional and cooperative evaluation system to achieve comprehensive and comprehensive evaluation of client model updates.

[0014] (3) Detection efficiency and accuracy: solve the contradiction between achieving high-precision detection and ensuring efficient operation of the system, aiming to design a progressive and coarse-to-fine defense process to balance computational efficiency and detection accuracy.

[0015] The present application provides a multi-stage cooperative detection method for defending model poisoning attacks in federated learning, which is mainly executed on the central server side of federated learning. As shown in Figure 1 , the figure is a schematic diagram of a federated learning system and its poisoning attack, which includes a central server and N clients, including benign clients and malicious clients, and the malicious clients upload malicious model updates to the server side to destroy the effectiveness of the federated learning system.

[0016] The core technical concept of the present application is that after receiving the model updates uploaded by the clients, the server does not immediately aggregate, but starts a multi-stage and cooperative detection process. This process reviews and scores each client update layer by layer from three dimensions of global statistical properties, fine-grained hierarchical structure and client group consistency, and finally evaluates the credibility of the client. Only the most credible client updates are aggregated to resist advanced and more covert model poisoning attacks.

[0017] In combination with the accompanying Figure 2 , the figure is a workflow diagram of the defense method designed by the present application, which elaborates the technical solutions and specific implementation processes of the present application. The technical solutions of the present application as a complete detection and aggregation process, in a training round , specifically includes the following steps:

[0018] Step One: In the training round At the beginning, the server first distributes the current global model to the participating clients Upon receiving the individual client After local training, the model updates are uploaded Then the server starts Phase One: Statistical Anomaly Detection, which aims to quickly filter out outliers with obvious statistical anomalies.

[0019] 1. Probability distribution conversion: The server first converts each client Update vector To a probability distribution To highlight its features.

[0020] 2. Calculate JS divergence: The server calculates the pairwise JS divergence between the probability distributions of any two clients And The formula is as follows:

[0021]

[0022] Where

[0023] 3. Calculate the initial anomaly score: Based on the JS divergence, the server calculates the average JS divergence of each client Compared to all other clients, as its initial anomaly score :

[0024]

[0025] 4. Calculate the anomaly score of Phase One: To eliminate the score scale difference caused by different attack types, the server uses the median absolute deviation (MAD) for unification. First, calculate the median of all initial anomaly scores . Then, the score of the client And its absolute deviation as its final anomaly score :

[0026]

[0027] 5. Calculate the trust score of Phase One: The anomaly score Is proportional to the degree of suspicion of the client. Therefore, the trust score of Phase One Is defined as its reciprocal, where Is a small constant to prevent division by zero:

[0028]

[0029] Step 2: To identify covert attacks that manipulate only at specific layers, the server continues to perform Phase 2: fine-grained layer-by-layer detection on the client.

[0030] 1. Layer-by-layer distance calculation: The server updates the model for each client. Decomposed into Update at each level ,in For each level The server calculates the pairwise distance between clients using both direction and magnitude dimensions:

[0031] Directional Difference (Cosine Distance): Calculate and store the cosine distance matrix. :

[0032]

[0033] Amplitude Difference (Euclidean Distance): Calculate and store the Euclidean distance matrix. :

[0034]

[0035] 2. Layer-by-layer clustering and benign set identification: For each level The servers are respectively in and K-Means clustering is performed on the two distance matrices. Based on the assumption that benign clients constitute the majority, the server selects the larger cluster as the candidate benign set in both clustering operations. Subsequently, the server takes the intersection of these two candidate sets to obtain the level. The final benign set .

[0036] 3. Construct a membership matrix: The server aggregates the analysis results from all levels to construct a membership matrix. binary membership matrix ,in Indicates client Belongs to the hierarchy benign collection Conversely, it is 0.

[0037] 4. Phase Two Trust Score Calculation: The server calculates a benevolence score for each client. Considering that deeper features of the model are more complex and critical, a weight growth factor is introduced. Give higher weight to deeper levels. Trust score in Phase Two. The calculation is as follows:

[0038]

[0039] Step three: After the fine-grained examination of individual behaviors, the server performs phase three: group consensus analysis to assess the collaborative trustworthiness of the client population.

[0040] 1. Constructing the client affinity graph: The server constructs a weighted undirected graph using the membership matrix generated in phase two . The nodes in the graph correspond to the clients, and the edge weight between any two nodes and quantifies their behavioral consistency, i.e., the weighted frequency that they are simultaneously judged as benign in all tiers:

[0041]

[0042] 2. Core benign group identification: The server applies a spectral clustering algorithm on this affinity graph . To improve adaptability, the eigenvalue gap heuristic method is used to dynamically determine the optimal number of communities . After clustering, the server defines the largest group as the core benign group in this round, denoted as .

[0043] 3. Calculating phase three trust scores: The phase three trust score of a client is defined as its average affinity with all members in the core benign community :

[0044]

[0045] Step four: Finally, the server integrates the evaluation results of the three phases, screens the trustworthy clients, and performs aggregation.

[0046] 1. Trust score standardization: To eliminate the scale differences of the three phase scores , the server uses the zero-mean normalization method to standardize them. For any phase , its standardized score is:

[0047]

[0048] where and are the mean and standard deviation of all client scores in phase , respectively.

[0049] ​​2. Calculate the final trust score: the server fuses the three normalized phase scores into a final comprehensive trust score by weighted summation :

[0050]

[0051] wherein is a preset weight hyperparameter, and .

[0052] 3. Trust aggregation: the server sorts all clients according to the final trust score and selects the top clients to form a trusted set . The server only aggregates model updates from the trusted set to generate a new global model :

[0053]

[0054] The method described in the present application performs the above steps in each round of communication of federated learning. Through this multi-dimensional, layer-by-layer in-depth collaborative review mechanism, it is ensured that only the client updates that pass the triple test of global statistics, fine-grained structure and community consistency can be used for aggregation, thereby effectively resisting various model poisoning attacks and guaranteeing the integrity and robustness of the global model.

[0055] Compared with the prior art, the multi-stage collaborative detection framework proposed in the present application replaces the detection method relying on a single heuristic rule with a global statistics-layer-by-layer structure-group consistency three-dimensional integrated comprehensive evaluation system, which brings the following significant beneficial effects:

[0056] Technical aspects:

[0057] (1) Multi-dimensional collaborative detection, improving detection accuracy and breadth: the present application overcomes the limitations of a single index through the collaborative evaluation of three dimensions of global statistical properties, fine-grained layer-by-layer structure and group consistency among clients. In particular, the layer-by-layer structure analysis in phase two and the group consistency analysis mechanism in phase three of the present application can perform in-depth and fine-grained checks on model updates, thereby accurately identifying advanced stealthy attacks that are difficult to detect by the prior art, significantly improving the accuracy of detection and enhancing the defense capability.

[0058] (2) Gradual filtering process, taking into account detection efficiency and overhead: The three-stage gradual defense concept adopted by the present application from coarse to fine has high efficiency. The rapid statistical screening of stage one can filter out a large number of obvious outliers at a low cost and quickly, which greatly reduces the number of clients that need to be processed in the subsequent stages, thereby reducing the computational burden of the stage two fine-grained layer-by-layer analysis and the stage three group consistency analysis. This process design effectively balances the system overhead while ensuring high accuracy, achieving the unity of efficiency and accuracy.

[0059] (3) Adaptive identification mechanism, realizing robustness to data heterogeneity: The present application does not rely on pre-set static abnormal threshold, but dynamically constructs the client affinity graph in each round of training and adaptively identifies the core benign group. This design can effectively distinguish between malicious manipulation and normal benign deviation caused by data heterogeneity (Non-IID), accurately isolate malicious groups while tolerating benign differences, reduce false positive rate in heterogeneous environment, and show better robustness.

[0060] Application aspects:

[0061] (1) Ensure the integrity and reliability of the global model: By effectively filtering various model poisoning attacks before aggregation, the present application can prevent the performance of the global model from declining or being implanted with malicious backdoors, ensuring that the final trained global model performs truly and reliably on real tasks and has excellent performance.

[0062] (2) Improve the security of federated learning system: The present application provides a defense framework that can resist advanced and adaptive attacks, significantly improving the security of the entire federated learning system in an adversarial environment. This enhances the confidence of deployers and participants in the credibility and security of federated learning technology, and helps its promotion in more application fields.

[0063] (3) Enhance the applicability of the scheme in real complex scenarios: The robustness of the present application to data heterogeneity makes it very suitable for real-world application scenarios. For example, in medical, financial, Internet of Things and other scenarios, the data distribution of each participant usually has significant differences. The robustness and adaptability of the present application can work in such complex scenarios, and have good application deployment value. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 A federated learning system subject to model poisoning attacks.

[0065] Figure 2 A workflow diagram of the multi-stage cooperative defense of the present application to detect poisoning attacks. DETAILED DESCRIPTION

[0066] The application provides a multi-stage cooperative detection method for defending against model poisoning attacks in federated learning, which is mainly executed on the central server side of federated learning. Figure 1 As shown in the figure, the figure is a schematic diagram of a federated learning system and a poisoning attack thereof, which includes a central server and N clients, the clients include benign clients and malicious clients, and the malicious clients upload malicious model updates to the server side to destroy the effectiveness of the federated learning system.

[0067] The core technical concept of the application is that after receiving the model updates uploaded by the clients, the server does not immediately aggregate, but starts a multi-stage, cooperative detection process. The process reviews and scores each client update layer by layer from three dimensions of global statistical characteristics, fine-grained hierarchical structure and client group consistency, finally comprehensively evaluates the credibility of the client, and only aggregates the most credible client updates, thereby resisting advanced and more concealed model poisoning attacks.

[0068] In combination with the accompanying Figure 2 , the figure is a workflow diagram of the defense method designed by the application, which elaborates the technical scheme and specific implementation process of the application. The technical scheme of the application is a complete detection and aggregation process, which includes the following steps in one training round:

[0069] Step one: at the beginning of the training round , the server first distributes the current global model to the participating clients. After receiving the model updates uploaded by each client after local training , the server starts phase one: statistical anomaly detection, which aims to quickly filter out outliers with obvious statistical anomalies.

[0070] 1. Probability distribution conversion: the server first converts the update vector of each client into a probability distribution to highlight its features.

[0071] 2. Calculate JS divergence: the server calculates the pairwise JS divergence between the probability distributions of any two clients and , and the calculation formula is as follows:

[0072]

[0073] Wherein

[0074] 3. Calculate the initial anomaly score: based on the JS divergence, the server calculates the initial anomaly score of each client​​ The initial anomaly score of a client as compared to the average JS divergence of all other clients :

[0075]

[0076] 4. Compute phase one anomaly score: To eliminate the score scale difference caused by different attack types, the server adopts the median absolute deviation (MAD) for unification. First, compute the median of all initial anomaly scores . Then, the score of a client and its absolute deviation from the median are taken as its final anomaly score :

[0077]

[0078] 5. Compute phase one trust score: The anomaly score is proportional to the suspicious degree of a client. Therefore, the phase one trust score is defined as its inverse, where is a small constant to prevent division by zero:

[0079]

[0080] Step two: To identify the stealthy attack that only manipulates at specific layers, the server continues to perform phase two: fine-grained layer-wise detection on the clients.

[0081] 1. Layer-wise distance computation: The server decomposes the model update of each client into layer-wise updates , where . For each layer , the server computes the pairwise distance between clients from two dimensions: direction and magnitude.

[0082] Direction difference (cosine distance): Compute and store the cosine distance matrix :

[0083]

[0084] Magnitude difference (Euclidean distance): Compute and store the Euclidean distance matrix :

[0085]

[0086] 2. Layer-wise clustering and benign set identification: For each layer , the server respectively clusters the clients in and K-Means clustering algorithm is performed on both distance matrices. Based on the assumption that benign clients are in the majority, the server selects the larger cluster as the candidate benign set in both clustering. Then, the server takes the intersection of the two candidate sets to obtain the final benign set of the level .

[0087] 3. Constructing membership matrix: The server aggregates the analysis results of all levels to construct a binary membership matrix , where indicates that the client belongs to the benign set of level , and 0 otherwise.

[0088] 4. Calculating phase two trust score: The server calculates a benign score for each client. Considering that the features in the deeper layers are more complex and critical, a weight growth factor is introduced to give higher weight to the deeper layers. The phase two trust score is calculated as follows:

[0089]

[0090] Step three: After completing the fine-grained examination of individual behavior, the server performs phase three: group consensus analysis to assess the collaborative trustworthiness of the client group.

[0091] 1. Constructing client affinity graph: The server uses the membership matrix generated in phase two to construct a weighted undirected graph . The nodes in the graph correspond to clients, and the edge weight between any two nodes quantifies their behavioral consistency, i.e., the weighted frequency that they are simultaneously determined to be benign in all levels:

[0092]

[0093] 2. Core benign group identification: The server applies the spectral clustering algorithm on the affinity graph . To improve adaptability, the eigenvalue gap heuristic method is used to dynamically determine the optimal community size . After clustering, the server defines the largest group as the core benign group of this round, denoted as .

[0094] 3. Calculating phase three trust score: The client ​​​​​the third phase trust score defined as its average affinity with all members of the core benign community

[0095]

[0096] Step 4: Finally, the server integrates the evaluation results of the three stages, screens trusted clients and performs aggregation.

[0097] 1. Trust score standardization: In order to eliminate the scale differences of the three stage scores (T1, T2, T3), the server uses the zero-mean normalization method to standardize them. For any stage i, its standardized score is:

[0098]

[0099] where and are the mean and standard deviation of all client scores in stage i, respectively. 2. Calculate the final trust score: The server fuses the three standardized stage scores into a final comprehensive trust score T by weighted summation:

[0100]

[0101] where

[0102] is a preset weight hyperparameter, and . 3. Trusted aggregation: The server sorts all clients according to the final trust score T and selects the top

[0103] clients to form a trusted set . The server only aggregates model updates from the trusted set to generate a new global model :

[0104] The method described in the present application performs the above steps in each round of communication of federated learning. Through this multi-dimensional, layer-by-layer deepening collaborative review mechanism, it ensures that only the client updates that have passed the triple test of global statistics, fine-grained structure and community consistency can be used for aggregation, thereby effectively resisting various model poisoning attacks and ensuring the integrity and robustness of the global model.

[0105]

[0106] ​​​​​​The technical core of the present application lies in its unique multi-stage collaborative detection process.

[0107] (1) A multi-stage collaborative detection method: the method is executed before the federal learning server aggregates the client model updates, characterized in that it sequentially or collaboratively includes the following three stages:

[0108] Stage one: global statistical rapid screening; stage two: fine-grained hierarchical structure analysis; stage three: client group consistency analysis.

[0109] (2) Quick screening method for malicious updates: in stage one, the method uses at least one global statistical indicator to detect outliers of client updates. The key point is to use Jensen-Shannon divergence to measure the distribution difference of updates, and use median absolute deviation (MAD) for robust outlier detection, and accordingly mark or punish significantly abnormal updates.

[0110] (3) Fine-grained hierarchical analysis of malicious updates: in stage two, the structural similarity or affinity between each pair of clients at each or specific key neural network layer is calculated. Based on the above hierarchical similarity, a membership matrix is constructed, which quantifies the mutual relationship of clients at the fine-grained level. In stage three, the system uses the fine-grained information generated in stage two for group analysis, based on the membership matrix generated in stage two, a global client affinity graph is constructed, through clustering analysis, automatically divide the clients into different communities, and identify the largest or most dense community as the core benign group, to exclude malicious nodes.

[0111] (4) Trust score synthesis and decision mechanism: the method of the present application does not rely solely on the results of any stage, but designs a trust score synthesis mechanism to combine the performances of clients in stage one (global statistical score), stage two (hierarchical structure score) and stage three (community attribution score) to generate a final and comprehensive trust score. The server finally only aggregates the client updates whose trust scores are higher than a certain threshold (or the top K% of scores), and rejects the model updates of malicious nodes identified.

[0112] One embodiment of the present application is to defend against multiple poisoning attacks on the Fashion-MNIST dataset, including non-targeted attacks such as Krum, Min-Max, LIE, DBA, LPattack, and backdoor attacks. This embodiment provides a detailed process for defending against multiple typical model poisoning attacks in a specific application scenario using the method described in the present application. 100 clients are set, and 20% of the clients are randomly selected to participate in training and upload model updates to the server in each round, i.e. the number of participating clients in this round is 20, and the number of malicious clients is set to 10%, 20%, 30%, and 40%, i.e. the number of malicious clients is set to 2, 4, 6, and 8 for testing. The dataset is the Fashion-MNIST image dataset, and the image classification task is performed. All clients and servers use a standard convolutional neural network (CNN) model, which includes two convolutional layers and two fully connected layers.

[0113] The server selects the final aggregated number of clients as 18, 16, 14, and 12, respectively, i.e. selects the top 18, 16, 14, and 12 clients with the highest trust scores from the 20 participating clients in each round to perform model aggregation. The hierarchical weight factor is set to 2, which is used to give higher weights to the deep layers of the model in the second and third stages. The fusion weight is set , which represents the proportion of trust scores in the first, second, and third stages, respectively.

[0114] This embodiment is described in detail in a highly challenging scenario, where 8 malicious clients perform LPattack backdoor attacks, which tamper with the parameters of the key layers of the CNN model to implant backdoors, while the parameters of other layers remain similar to benign updates. The server receives model updates from the 20 clients in the $t$ round , and performs the following steps:

[0115] Step 1: Global statistical anomaly detection (Stage 1)

[0116] 1. The server converts the 20 vectors into probability distributions .

[0117] 2. The server calculates , obtaining 20 initial anomaly scores.

[0118] 3. Calculate the median of the 20 scores .

[0119] 4. Calculate the 20 stage one anomaly scores

[0120] 5. Compute phase one trust score

[0121] Step two: Fine-grained layer-by-layer detection (Phase two)

[0122] 1. Server performs layer-by-layer detection on 20 updates .

[0123] 2. Layer-by-layer distance calculation and benign set identification. The server calculates the cosine distance matrix and the Euclidean distance matrix of the model layers. K-Means clustering is performed on the cosine distance and Euclidean distance between clients respectively, and the cluster where the benign clients are located is selected as the candidate benign set. The server takes the intersection of the two candidate sets to obtain the benign set .

[0124] 3. Construct membership matrix. If a client is identified as malicious at the first layer, it is 0, and if it is identified as benign, it is 1. The server constructs the matrix .

[0125] 4. Compute phase two trust score .

[0126] Step three: Group consensus analysis (Phase three)

[0127] 1. Construct client affinity graph. The server uses the membership matrix and the layer weight factor λ to construct the affinity graph of 20 nodes , and calculates the edge weight and between any two nodes , representing the frequency of being simultaneously determined as benign in all layers.

[0128] 2. Core benign group identification. The server applies spectral clustering to form a group of clients with the most consistent behavior and the largest size, which is identified as the core benign group .

[0129] 3. Compute phase three trust score

[0130] Step four: Trust score fusion and global model aggregation

[0131] 1. Trust score standardization. The server normalizes the three-phase trust scores of the 20 clients respectively to obtain , , .​

[0132] 2. Calculate the final trust score for each client. .

[0133] 3. According to each client The models are sorted by trust scores, and the model updates of the top k clients that meet the preset number are then aggregated globally. .

[0134] Through the steps of this embodiment, the method of the present invention successfully detects and excludes malicious updates in scenarios where malicious clients execute advanced stealth LPattack attacks with different proportions. This ensures the security of the aggregation process through multi-stage collaborative detection. Table 1 shows the performance of the present invention against LPattack and four other attacks when the proportion of malicious clients is 10%, 20%, 30%, and 40% in the Fashion-MNIST dataset. Tables 1 and 2 illustrate the model accuracy and backdoor attack success rate under all attacks, respectively. Higher model accuracy indicates better defense performance, and a lower backdoor attack success rate indicates better defense performance.

[0135] Table 1. Model accuracy of the present invention when defending against different attack and malicious client ratios.

[0136]

[0137] Table 2. Backdoor attack success rate of this invention in defending against backdoor attacks.

[0138]

Claims

1. A multi-stage collaborative detection method for defending against model poisoning attacks in federated learning, characterized in that the method is executed on the central server side of the federated learning; In one training round comprises the following steps: Step 1: In training rounds Initially, the server first distributes the current global model to the participating clients. Upon receiving data from various clients Model updates uploaded after local training Then, the server starts in phase one: Step two: To identify hidden attacks that manipulate at a specific layer, the server continues to perform phase two: fine-grained layer-by-layer detection on the clients; Step three: After completing the fine-grained check of individual behavior, the server performs phase three: group consistency analysis to assess the collaborative trustworthiness of the client group; Step four: The server integrates the evaluation results of the three stages, filters the trusted clients and performs aggregation.

2. The multi-stage collaborative detection method against model poisoning attacks in federated learning according to claim 1, wherein, The federated learning system includes a central server and N clients, including benign clients and malicious clients in the clients, and the malicious clients will upload malicious model updates to the server side to destroy the effectiveness of the federated learning system; After receiving the model updates uploaded by the clients, the central server does not immediately aggregate, but starts a multi-stage, collaborative detection process; From the three dimensions of global statistical characteristics, fine-grained hierarchical structure and client group consistency, each client update is reviewed and scored layer by layer, and finally the trustworthiness of the client is comprehensively evaluated, and only the most trusted client update is aggregated, thereby resisting advanced and more hidden model poisoning attacks.

3. The multi-stage collaborative detection method against model poisoning attacks in federated learning of claim 1, wherein Step one includes: 1) Probability distribution conversion: The server first converts each client's update vector to a probability distribution to highlight its features; 2) Compute JS divergence: The server computes the pairwise JS divergence between the probability distributions of any two clients and The formula is as follows: JS (P, Q) = 0.5 * (D(P || Q) + D(Q || P)) ； wherein ; 3) Compute initial anomaly score: Based on JS divergence, the server computes each client's average JS divergence compared to all other clients as its initial anomaly score : ； 4) Calculate the anomaly score of phase one: in order to eliminate the score scale difference caused by different attack types, the server uses the median absolute deviation MAD for unification; first, calculate the median of all initial anomaly scores ; then, the score of the client is subtracted from its absolute deviation as its final anomaly score : ； 5) Compute Phase One Trust Score: the anomaly score inversely proportional to the degree of suspicion of the client; thus, the Phase One Trust Score is defined as the inverse of it, where is a small constant that prevents division by zero: 。 4. The multi-stage collaborative detection method against model poisoning attacks in federated learning of claim 3, wherein Step two includes: 1) Layer-wise distance computation: The server computes the model updates for each client are decomposed into individual layer updates where ; for each layer , the server computes pairwise distances between clients from both the direction and magnitude dimensions: Directional difference: compute and store cosine distance matrix : ； Amplitude difference: compute and store matrix of euclidean distances : ； 2) Layer-wise clustering and benign set identification: for each layer , the server performs K-Means clustering algorithm on and two distance matrices respectively; based on the assumption that benign clients are in the majority, the server selects the larger cluster as the candidate benign set in both clustering; then, the server takes the intersection of the two candidate sets to obtain the final benign set of the layer ; 3) Construct a membership matrix: The server aggregates the analysis results from all levels and constructs a membership matrix. Binary membership matrix ,in Indicates the client Belongs to the hierarchy benign collection Conversely, it is 0; 4) Compute phase two trust score: server computes a benign score for each client; considering the deeper features of the model are more complex and more critical, introduce a weight growth factor Give higher weight to deeper layers; phase two trust score Compute as follows: 。 5. The multi-stage collaborative detection method against model poisoning attacks in federated learning according to claim 4, wherein, Step three includes: 1) Constructing a client affinity graph: The server utilizes the membership matrix generated in phase two. Construct a weighted undirected graph ;node correspond One client, any two nodes and Between the boundary weights Their behavioral consistency was quantified, that is, the weighted frequency of being judged as benign across all levels: ； 2) Core benign group identification: the server applies the spectral clustering algorithm to the affinity matrix to improve adaptability, the heuristic method of eigenvalue gap is used to dynamically determine the optimal number of communities After clustering, the server defines the largest group as the core benign group in this round, denoted as ; 3) Compute Phase 3 Trust Score: Client of the Core Good Community is defined as the average affinity of the client with all members of the Core Good Community : 。 6. The multi-stage collaborative detection method against model poisoning attacks in federated learning according to claim 5, wherein, Step four includes: 1) Trust score standardization: To eliminate the three-stage scoring ( To standardize the scale differences, the server uses zero-mean normalization; for any stage Its standardized score for: ； wherein and are the mean and standard deviation, respectively, of all client scores in phase . 2) Calculate the final trust score: the server combines the three normalized stage scores into a final, overall trust score by means of a weighted sum : ； wherein is a preset weight hyperparameter, and ; 3) Trusted aggregation: server aggregates model updates from only the trusted set :​​​​ 。

Images