Federal learning method for collaborative security and incentive
By combining proactive alerting mechanisms and local differential privacy in a federated learning system, a game-theoretic incentive mechanism was designed to address the challenges of malicious attacks and resource consumption, achieving highly secure and highly incentivized collaborative learning results and enabling rapid recovery of model performance.
Patent Information
- Application Number
- CN202511786913.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-28
- Publication Date
- 2026-03-20
AI Technical Summary
Existing federated learning systems face challenges of malicious attacks and resource consumption, resulting in trade-offs and conflicts in security and incentive mechanisms. They are unable to effectively defend against poisoning and inference attacks, while failing to adequately incentivize clients to contribute high-quality data.
We design a collaborative security and incentive federated learning method that combines a proactive alarm mechanism with local differential privacy to build a dual defense system. By incorporating a game theory incentive mechanism, we reward benign clients based on multi-dimensional attributes and dynamically adjust the aggregation basis to achieve a synergy between security and incentives.
It effectively identifies and defends against poisoning attacks, protects client data privacy, incentivizes benign clients to contribute high-quality data, and demonstrates excellent fault tolerance and continuous learning capabilities by quickly recovering after an attack.
Smart Images
Figure CN121706892A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of federated learning technology, and in particular relates to a federated learning method with collaborative security and incentives. Background Technology
[0002] Federated learning, as a collaborative machine learning paradigm, allows multiple participants to jointly train a model without sharing local data. After training the model locally, participants only upload model updates to a central server, which aggregates these updates to generate a global model. Federated learning has been widely applied in fields such as language model training, health monitoring, autonomous driving, Industry 4.0, and healthcare. However, federated learning systems face two major challenges in practical applications: Security and privacy challenges: Federated learning systems face serious security threats from malicious clients. These malicious clients may attack the system by uploading locally updated data trained with poisoned data or by strategically tampering with model parameters. Currently, there are two main types of attacks: one is poisoning attacks aimed at disrupting the global model (including untargeted poisoning attacks and targeted model poisoning attacks), and the other is inference attacks that reconstruct client training data from model updates through gradient inversion. In untargeted poisoning attacks, attackers reduce the global model's performance on the main task using methods such as sign flipping and label flipping attacks; in targeted model poisoning attacks, attackers attempt to disrupt the global model's performance on specific classes while maintaining high accuracy on other samples, thus increasing the attack's stealth. Both types of attacks target the server and are collectively referred to as Byzantine attacks. Inference attacks, on the other hand, attempt to reconstruct the client's training data from a single model update through gradient inversion. While existing methods (such as Siren+ which enhances security through proactive alerting and differential privacy, and FLShield which uses each type of loss impact to identify and exclude malicious clients) can defend against these attacks to some extent, most existing methods focus only on detecting and filtering malicious updates and fail to adequately address the critical need to incentivize benign clients to proactively contribute high-quality data in adversarial environments.
[0003] Collaboration and incentive challenges are significant. Clients participating in federated learning consume substantial computational and storage resources. Due to privacy concerns and resource consumption, clients are typically unwilling to participate in federated learning training without sufficient financial compensation. Therefore, the server must incentivize clients to contribute their data and resources while minimizing overall costs (including recruitment rewards and model accuracy loss). Simultaneously, clients are unwilling to participate voluntarily without adequate incentive payments and controllable privacy guarantees. While existing Stackelberg game-based incentive studies attempt to balance client privacy needs with server compensation, they often overlook the detrimental impact of malicious attacks on model integrity and fail to adequately incentivize benign clients to actively contribute high-quality data in adversarial environments with malicious users, while simultaneously maintaining privacy and security.
[0004] Therefore, the problem with existing technology is: 1) Existing defense methods mainly focus on server-side detection and robust aggregation, which limits their effectiveness against malicious updates and data leaks, while neglecting how to incentivize clients to contribute high-quality data; 2) Existing incentive mechanisms often assume that clients are honest when they are designed. However, in the presence of malicious participants, a more robust reward distribution strategy is needed to prevent attackers from manipulating contributions to obtain unfair rewards. 3) Simultaneously addressing the challenges of security and incentives inherently involves trade-offs and conflicts. On the one hand, to protect the global model from poisoning and inference attacks, stringent security measures must be adopted (such as injecting large amounts of noise through differential privacy and proactive alerts). While these measures enhance security, they inevitably reduce the quality of local model updates by obscuring the true signal. On the other hand, incentive mechanisms aim to reward clients based on data contribution and alert accuracy to encourage active participation. However, if security measures (differential privacy noise) are too aggressive, they can distort the utility signal on which the incentive mechanism relies, potentially leading to suboptimal client selection and reward allocation. Summary of the Invention
[0005] In view of the above-mentioned deficiencies in the prior art, this invention proposes a federated learning method for collaborative security and incentives, aiming to design a unified framework that can simultaneously achieve high security and strong incentive effects. The technical solution designed in this invention includes the following steps: S1: The server selects the optimal subset of clients, determines the total number of global iterations and the total reward budget, and broadcasts the initial global model and the total reward budget to the optimal subset of clients; S2: Each client in the optimal client subset performs performance evaluation on the global model and the local model and generates alarm decisions, which are then uploaded to the server. S3: Each client in the optimal client subset calculates the optimal local training batch based on the total reward budget. If the optimal local training batch size is not greater than zero, the current client chooses not to participate in this round of training. S4: Clients participating in this round of training select either the global model or the local model to generate model updates based on alarm decisions, and upload the model updates to the server; S5: The server determines the set of benign clients based on alarm information; S6: Aggregate the model updates corresponding to the benign client set to generate a new generation of global model; S7: Broadcast the next-generation global model to the optimal client subset for the next round of training; S8: Repeat S2-S7 until the total number of global iterations is reached.
[0006] Preferably, the alarm generation decision in S2 includes: If the accuracy of the global model on the local test set is lower than the product of the accuracy of the local model and a confidence threshold, an alarm is triggered; otherwise, no alarm is triggered.
[0007] Preferably, calculating the optimal local training batch in S3 includes: Each client calculates the optimal local training batch size based on a utility function, the formula of which is as follows:
[0008] In the formula, each client solves... To calculate the optimal local training batch size , The degree of non-independent and identically distributed nature of client k. To ensure the alarm reliability of client k, For batch size, For the total reward budget, Resource cost per unit batch size.
[0009] Preferably, the step S4 of selecting a global model or a local model to generate a model update includes: If the client does not trigger an alarm in S2, then the global model is selected as the training starting point; If the client triggers an alarm in S2, the local model is selected as the starting point for training.
[0010] Preferably, the generative model update in S4 includes: A local differential privacy protection mechanism is enabled to prune the training gradients and inject them with noise that conforms to a Gaussian distribution.
[0011] Preferably, S5 includes: The server categorizes clients into alarm sets based on alarm information. With silence ; The server performs analysis in the following three scenarios: Scenario 1: If none of the clients trigger an alarm, then all clients are considered a benign client set. ; Scenario 2: If an alarm client exists, and the alarm set... Local model accuracy across all clients All meet ,but: when Determine the silent set A collection of benign clients ; when Determine the alarm set A collection of benign clients ; Scenario 3, if the alarm is collected There exists at least one client-side local model accuracy. ,satisfy Then determine the alarm set. All of the above satisfy The client is a collection of benign clients. ; in, alarm set The highest local model accuracy in China. The preset accuracy difference threshold, For silent sets The highest local model accuracy.
[0012] Preferably, generating the next-generation global model in S6 includes: When in case one or the set of silences A collection of benign clients When the current round's global model is used as the aggregation basis; When in situation three or the alarm set is determined A collection of benign clients At that time, the previous round's global model is used as the basis for aggregation.
[0013] Beneficial effects: 1. This invention constructs a dual defense system by organically combining an active alarm mechanism with local differential privacy. The alarm mechanism can effectively identify and resist poisoning attacks targeting model integrity, while local differential privacy protects client data privacy from the source and resists inference attacks, thereby ensuring data confidentiality while guaranteeing model availability. 2. This invention innovatively couples game theory incentives with security defense mechanisms. Based on the reward allocation, it not only considers the amount of data contribution, but also incorporates multi-dimensional attributes such as data quality and alarm contribution, so that the rewards are tilted towards benign clients with high-quality and high-security contributions, thereby naturally inhibiting malicious behavior while incentivizing participation. 3. This invention, through the linkage of alarm-silent cross-analysis algorithm and model rollback strategy, can intelligently identify client properties and dynamically adjust the aggregation basis. This enables the system to automatically switch to "repair mode" even after the model performance deteriorates due to an attack, and quickly recover from the security checkpoint using benign updates, demonstrating excellent fault tolerance and continuous learning capabilities. Attached Figure Description
[0014] Figure 1 This is a flowchart illustrating a preferred embodiment of the present invention. Detailed Implementation
[0015] The embodiments of the present invention will be described in detail below. The embodiments described below are implemented based on the technical solution of the present invention, and detailed implementation methods and specific operation processes are given. However, the protection scope of the present invention is not limited to the embodiments described below.
[0016] This invention designs a federated learning method with collaborative safety and incentives, such as... Figure 1 As shown, the technical solution includes the following steps, specifically: S1: The server selects the optimal subset of clients, determines the total number of global iterations and the total reward budget, and broadcasts the initial global model and the total reward budget to the optimal subset of clients; S2: Each client in the optimal client subset performs performance evaluation on the global model and the local model and generates alarm decisions, which are then uploaded to the server. S3: Each client in the optimal client subset calculates the optimal local training batch based on the total reward budget. If the optimal local training batch size is not greater than zero, the current client chooses not to participate in this round of training. S4: Clients participating in this round of training select either the global model or the local model to generate model updates based on alarm decisions, and upload the model updates to the server; S5: The server determines the set of benign clients based on alarm information; S6: Aggregate the model updates corresponding to the benign client set to generate a new generation of global model; S7: Broadcast the next-generation global model to the optimal subset of clients for the next round of training; S8: Repeat S2-S7 until the total number of global iterations is reached.
[0017] Specifically, for S1, the server minimizes the total cost function. To perform incentive optimization to select the optimal subset of clients. Total number of global iterations and total reward budget The total cost function is: Where L is the model accuracy loss term, representing the degree to which the client data is not independently and identically distributed. Privacy Budget and batch size The expected loss in model accuracy; R is the total reward; This is a risk penalty term used to quantify the risk cost arising from the number of malicious clients and the false positive rate. The server uses the Pareto selection principle for client selection: first, it initializes by selecting all candidate clients K, and then calculates their Nash equilibrium to obtain the initial set. and maximum response time Then, iteratively remove the client with the longest response time from K, recalculate the Nash equilibrium, and obtain a new Pareto choice; finally, compare the server costs under all Pareto choices. Choose the configuration that minimizes cost. , , For a fixed set of clients N and the number of iterations T, the optimal reward is... By solving the cubic equation Obtain, among which , , These are coefficients related to client-side attributes.
[0018] Preferably, the alarm generation decision in S2 includes: An alarm is triggered if the global model's accuracy on the local test set is lower than the product of the local model's accuracy and a confidence threshold; otherwise, no alarm is triggered.
[0019] Specifically, for S2, client k receives the global model. Then, use its local test dataset. Test the global model separately and its cached local model To obtain the accuracy rate and The condition for judgment is: if If the global model is deemed suspicious, an alarm will be triggered. Otherwise, the global model is considered reliable, and no alarm is triggered. .in This is the threshold at which the client accepts the difference between the global model and the local model. Alarm information is uploaded to the server via a secure channel.
[0020] Preferably, calculating the optimal local training batch in S3 includes: Each client calculates the optimal local training batch size based on a utility function, the formula of which is as follows:
[0021] In the formula, each client solves... To calculate the optimal local training batch size , The degree of non-independent and identically distributed nature of client k. To ensure the alarm reliability of client k, For batch size, For the total reward budget, Resource cost per unit batch size.
[0022] Specifically, for S3, the utility function The first item The client k represents the data quality (as determined by...) and (Characteristics) and computational contribution The share of the reward that can be obtained; the second item This represents the cost of its local training. The optimal batch size is calculated by maximizing its utility by solving for the first derivative to zero. If the calculated The client will choose not to participate in this round of training because there is no profit to be made.
[0023] Preferably, the selection of a global model or a local model to generate model updates in S4 includes: If the client does not trigger an alarm in S2, the global model is selected as the training starting point. If the client triggers an alarm in S2, the local model is selected as the starting point for training.
[0024] Preferably, the generative model update in S4 includes: A local differential privacy protection mechanism is enabled to prune the training gradients and inject them with noise that conforms to a Gaussian distribution.
[0025] Specifically, for S4, client k uses local training data. Perform local training; additionally, when differential privacy is not enabled, train directly using standard gradient descent, while when local differential privacy is enabled, defend against inference attacks as follows: S41: Calculate the gradient of the loss function f: ; S42: Gradient clipping: ,in The gradient clipping threshold for client k; S43: Noise injection: The injected noise intensity η is the learning rate, and δ is the privacy failure probability. Privacy budget for client k.
[0026] S44: Model Update: Using Noisy Gradients The local model was updated, and after multiple iterations, the result was obtained. .
[0027] Finally, model update Unified definition: updated local model The initial global model issued by the server in this round The difference between them, i.e. The client updates and uploads this model to the server, while simultaneously updating the new local model. The cache is used for the next round of alarm detection.
[0028] Preferably, S5 includes: The server categorizes clients into alarm sets based on alarm information. With silence ; The server performs analysis in the following three scenarios: Scenario 1: If none of the clients trigger an alarm, then all clients are considered a benign client set. ; Scenario 2: If an alarm client exists, and the alarm set... Local model accuracy across all clients All meet ,but: when Determine the silent set A collection of benign clients ; when Determine the alarm set A collection of benign clients ; Scenario 3, if the alarm is collected There exists at least one client-side local model accuracy. ,satisfy Then determine the alarm set. All of the above satisfy The client is a collection of benign clients. ; in, alarm set The highest local model accuracy in China. The preset accuracy difference threshold, For silent sets The highest local model accuracy.
[0029] Specifically, for S5, in scenario three, the server considers the global model... Unreliable, therefore the most trustworthy part is selected from the alarm clients.
[0030] Preferably, generating the next-generation global model in S6 includes: When in case one or the set of silences A collection of benign clients When the current round's global model is used as the aggregation basis; When in situation three or the alarm set is determined A collection of benign clients At that time, the previous round's global model is used as the basis for aggregation.
[0031] Specifically, for S6, the determination in case one or case two... At that time, the aggregation formula is: .
[0032] In case two, the judgment is made. = Or, in case three, the aggregation formula: This operation reverts to the previous round of the global model. As a basis for aggregation, to eliminate what is believed to have been poisoned. The impact of aggregation weights. Distribution can be based on the data contribution of the client.
[0033] In addition, the present invention includes a penalty and reward mechanism step after S6 and before S7: Penalty Mechanism: The server maintains a penalty counter for each client. For clients deemed malicious in this round, their penalty count is incremented. When a client's penalty count exceeds a preset threshold... If so, mark it as a malicious client and prohibit it from participating in subsequent training.
[0034] Reward / Recovery Mechanism: For clients that have been banned, if they are deemed benign in a subsequent training round, their penalty count is reduced. When the penalty count drops to a threshold... If the condition is as follows, the individual is allowed to rejoin the training.
[0035] Furthermore, this invention models the interaction between the server and the client as a two-phase Stackelberg game, including: Phase 1 (Server as Leader): The server first determines the incentive and security policies (N, T, R and security parameters). Phase Two (Clients as Followers): Each selected client k∈N decides whether to participate and selects the batch size. Privacy noise scale (by adjusting) or noise variance (and alarm strategies.)
[0036] By jointly analyzing the utility functions in these two stages of the game, the system reaches an equilibrium state (Nash equilibrium and Stackelberg equilibrium). This equilibrium occurs when all clients have calculated their optimal strategies. Nash equilibrium is reached when no client can improve utility by unilaterally changing its strategy. The server achieves this by minimizing its cost function. To select the optimal configuration { , , This leads to a Stackelberg equilibrium. This game-theoretic perspective ensures that, under adversarial conditions, benign clients receive fair compensation while malicious clients cannot profit, thus achieving a synergy between security and incentives.
[0037] In addition, the present invention provides an embodiment 1 for a financial fraud detection scenario: In the context of financial fraud detection, multiple banks (including large state-owned banks, local commercial banks, and rural credit cooperatives) aim to jointly train a fraud detection model without sharing customer data. Significant differences exist in data quality, volume, and computing resources among the different banks, and there is also the possibility of compromised bank nodes attempting to disrupt the model. The specific implementation process is as follows: The first step involves the regulatory agency, acting as a trusted third party, establishing a federated learning server to collect attribute information from each bank (including data volume, computing power, network latency, etc.) and initializing a candidate client set K (containing 50 banks).
[0038] The second step involves the server executing an approximate incentive optimization algorithm. (1) Based on the response time and data quality attributes of each bank, the Pareto selection principle is used to gradually filter the clients; (2) For each subset of clients selected by Pareto, calculate the optimal global iteration number T and total reward R under Nash equilibrium; (3) Comparing all Pareto choices, 30 banks were finally selected. =30), Determine the global iteration count =100, Total Reward =50,000 yuan.
[0039] The third step is to initialize the global fraud detection model on the server. (Based on ResNet architecture), and will Total Rewards The broadcast was sent to the 30 selected banks.
[0040] The fourth step is for each bank to receive the global model. Then, perform the following operations: (1) Active alarm detection: Since this is the first round of training and there is no cached local model, alarm detection is skipped and set =0; (2) Batch size calculation: based on its own data quality attributes ( ), alarm reliability ( Initially set to 1), resource cost ( ) and total reward Calculate the optimal batch size For example, a large bank calculated that... =256, calculated by a small bank =32; (3) Local training: using local fraudulent transaction data The training process uses normal transaction data, with each training batch consisting of 5 epochs. (4) Differential privacy protection: based on privacy budget =2.0, calculate noise intensity Clipping the gradient ( =1.0) and noise injection; (5) Upload model update: calculation And upload it to the server, while caching it. .
[0041] Fifth, the server collects alarm information from all 30 banks. and model update Since none of the banks triggered any alerts, the server directly aggregated the data. ,in Depending on the batch size of each bank Distribute the allocation.
[0042] In the sixth step, during the 10th round of training, three banks (which had been controlled by the attackers) uploaded model updates that had been poisoned by a label flipping attack.
[0043] Step seven: During the eleventh round of training, the remaining 27 healthy banks will conduct proactive alarm detection. (1) Using the local test dataset (Including 1000 transaction records) Test the global model separately and cached local model ; (2) Test results of a large bank A: =0.72, =0.89, since 0.72 < 0.89 × (1 - 0.1) = 0.801 (assuming...) =0.1), triggering an alarm. =1; (3) All 27 benign banks triggered alarms, while 3 malicious banks remained silent. =0).
[0044] Step 8: After collecting alarm information, the server performs alarm-silence cross-analysis: (1) Divide the clients into alarm sets (27 well-regarded banks) and the Silent Collection (3 malicious banks); (2) Calculate the maximum accuracy within the alarm set: =0.92 (assuming) =0.05); (3) Check whether the accuracy rates within the alarm set are similar: the accuracy rates of all alarm banks are greater than 0.92×(1-0.05)=0.874, indicating that the accuracy rates within the alarm set are similar; (4) Calculate the maximum accuracy of the silent set: =0.65; (5) Since 0.92×(1-0.05)=0.874>0.65, the alarming bank is judged to be benign, and the silent bank is malicious. Global model Poisoning has occurred; (6) Increase the number of penalties recorded for the 3 malicious banks by 1, and add the number of penalties for the good banks. = ; (7) Revert to the previous round of global model for aggregation: .
[0045] In the ninth step, the above process was repeated. After 100 iterations, the global fraud detection model finally converged, achieving a test accuracy of 94.5%, successfully identifying malicious banks while protecting the privacy of legitimate banks. Throughout the training process, no bank's original transaction data was leaked. Furthermore, through an incentive mechanism, banks with high-quality data received greater rewards (a large bank received a reward of 3,500 yuan, and a small bank received a reward of 800 yuan).
[0046] In addition, the present invention provides a second embodiment, which is for a medical image diagnosis scenario: In the context of medical imaging diagnosis, multiple hospitals (including tertiary hospitals, secondary hospitals, and community clinics) wish to jointly train a pneumonia diagnostic model. However, due to the highly sensitive nature of medical data, strict protection of patient privacy is essential. Furthermore, differences in the quality of imaging equipment and the level of doctor annotation among different hospitals may lead to "false" or malicious data due to annotation errors or equipment malfunctions. The specific implementation process is as follows: The first step is for the medical consortium to set up a federated learning server, collect parameter information from 10 hospitals, and determine the candidate client set K=10.
[0047] The second step involves the server performing approximate incentive optimization. Since the number of hospitals is relatively small and the data quality is relatively balanced, all 10 hospitals are selected for training. =10), confirm =150 rounds =100,000 yuan.
[0048] The third step is to initialize the global diagnostic model on the server. (Based on CNN architecture), and will and The broadcast was sent to all hospitals.
[0049] The fourth step involves each hospital implementing local training: (1) Due to the high sensitivity of medical data, all hospitals have implemented differential privacy and set privacy budgets. =1.5 (stricter privacy protection); (2) A tertiary hospital calculates batch size =128, calculated by a community clinic. =16; (3) Clipping the gradient ( =0.5) and noise injection (noise intensity based on =1.5 (calculated). (4) Training was performed using local lung X-ray image data, with a training batch of 10 epochs.
[0050] Fifth, during the 20th round of training, a hospital uploaded a model update containing a large number of erroneous features due to a malfunction in its imaging equipment (although the hospital was "benign," the data quality was extremely poor).
[0051] In the sixth step, during the 21st round of training, the remaining 9 hospitals performed active alarm detection and found that the global model performance had significantly decreased, triggering alarms in all of them.
[0052] Step 7: The server performs alarm-silent cross-analysis. (1) Alarm set Includes 9 hospitals, Silent Assembly Includes 1 hospital (the hospital with equipment failure); (2) Compare the accuracy of the two sets and determine that the alarming hospitals are benign and the equipment failure hospitals are "malicious" (actually, it is a data quality problem). (3) Increment the number of times the hospital records equipment failures are penalized by 1 (penalty threshold). =3).
[0053] In the eighth step, after the hospital discovered the equipment malfunction and repaired it, it submitted a high-quality model update during the 30th training round. The server re-evaluated it as benign, reducing the penalty count by 1. After three rounds of benign performance, the hospital's penalty count dropped to 0, and it continued to participate in training normally.
[0054] In the ninth step, after 150 iterations, the global pneumonia diagnosis model converged, achieving a test accuracy of 96.2% (AUC = 0.98 on the independent test set). Throughout the training process: (1) No patient’s medical images were leaked (differential privacy protection, AUC close to 0.5). (2) Hospitals with poor data quality were successfully identified and temporarily isolated, while being given the opportunity to correct their mistakes and re-participate; (3) Top-tier hospitals with high-quality data received more rewards (approximately RMB 15,000), while small clinics also received reasonable rewards (approximately RMB 5,000).
[0055] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.
Claims
1. A federated learning method for collaborative safety and incentives, characterized in that, include: S1: The server selects the optimal subset of clients, determines the total number of global iterations and the total reward budget, and broadcasts the initial global model and the total reward budget to the optimal subset of clients; S2: Each client in the optimal client subset performs performance evaluation on the global model and the local model and generates alarm decisions, which are then uploaded to the server. S3: Each client in the optimal client subset calculates the optimal local training batch based on the total reward budget. If the optimal local training batch size is not greater than zero, the current client chooses not to participate in this round of training. S4: Clients participating in this round of training select either the global model or the local model to generate model updates based on alarm decisions, and upload the model updates to the server; S5: The server determines the set of benign clients based on alarm information; S6: Aggregate the model updates corresponding to the benign client set to generate a new generation of global model; S7: Broadcast the next-generation global model to the optimal client subset for the next round of training; S8: Repeat S2-S7 until the total number of global iterations is reached.
2. The federated learning method for collaborative security and incentives according to claim 1, characterized in that, The alarm generation decision in S2 includes: If the accuracy of the global model on the local test set is lower than the product of the accuracy of the local model and a confidence threshold, an alarm is triggered; otherwise, no alarm is triggered.
3. The federated learning method for collaborative security and incentives according to claim 1, characterized in that, The calculation of the optimal local training batch in S3 includes: Each client calculates the optimal local training batch size based on a utility function, the formula of which is as follows: In the formula, each client solves... To calculate the optimal local training batch size , The degree of non-independent and identically distributed nature of client k. To ensure the alarm reliability of client k, For batch size, For the total reward budget, Resource cost per unit batch size.
4. The federated learning method for collaborative security and incentives according to claim 1, characterized in that, The step S4, which involves selecting either the global model or the local model to generate model updates, includes: If the client does not trigger an alarm in S2, then the global model is selected as the training starting point; If the client triggers an alarm in S2, the local model is selected as the starting point for training.
5. The federated learning method for collaborative security and incentives according to claim 1, characterized in that, The generative model update in S4 includes: A local differential privacy protection mechanism is enabled to prune the training gradients and inject them with noise that conforms to a Gaussian distribution.
6. The federated learning method for collaborative security and incentives according to claim 1, characterized in that, The S5 includes: The server categorizes clients into alarm sets based on alarm information. With silence ; The server performs analysis in the following three scenarios: Scenario 1: If none of the clients trigger an alarm, then all clients are considered a benign client set. ; Scenario 2: If an alarm client exists, and the alarm set... Local model accuracy across all clients All meet ,but: when Determine the silent set A collection of benign clients ; when Determine the alarm set A collection of benign clients ; Scenario 3, if the alarm is collected There exists at least one client-side local model accuracy. ,satisfy Then determine the alarm set. All of the above satisfy The client is a collection of benign clients. ; in, alarm set The highest local model accuracy in China. The preset accuracy difference threshold, For silent sets The highest local model accuracy.
7. The federated learning method for collaborative security and incentives according to claim 6, characterized in that, The generation of the next-generation global model in S6 includes: When in case one or the set of silences A collection of benign clients When this happens, the global model of the current round is used as the basis for aggregation; When in situation three or the alarm set is determined A collection of benign clients At that time, the previous round's global model is used as the basis for aggregation.