Model training method and system, computer device and storage medium

Abstract

The application relates to a model training method and system, computer equipment and a storage medium. The method comprises the following steps: separating high-frequency and computationally intensive model verification and reputation management tasks from a blockchain consensus layer and sinking them to each edge server in an edge aggregation layer for parallel processing, so that the blockchain node no longer undertakes heavy computing tasks and only needs to process lightweight evidence transactions, thereby avoiding consensus congestion caused by repeated computation of full nodes, and greatly improving the throughput and response speed of the system. The client only establishes a secure channel with the edge server and is no longer directly exposed to the public network blockchain node. The edge server shields the network traffic characteristics of the client as a trusted proxy, and combines noise parameters to disturb the uploaded gradient, effectively preventing attackers from analyzing on-chain transactions to attack the client or deduce private data.

Description

Technical Field

[0001] This application relates to the field of model training technology, and in particular to a model training method, system, computer device, and storage medium. Background Technology

[0002] Existing blockchain federated learning schemes typically tightly couple model training verification with the blockchain consensus process, requiring all nodes in the blockchain consensus layer to verify and reach consensus on every model update uploaded by a client. Due to the large number of parameters in deep learning models and the complexity of verification calculations, this approach results in an excessively heavy computational load on the blockchain consensus layer. Furthermore, the consensus process usually requires simultaneous confirmation across the entire network, leading to high transaction confirmation latency. In other words, blockchain consensus efficiency is extremely low, failing to meet the high-frequency iteration requirements of federated learning and severely limiting the system's throughput and scalability. Summary of the Invention

[0003] This application provides a model training method, system, computer device, and storage medium to address the problems of excessive computational load on the blockchain consensus layer and privacy leakage risks caused by direct interaction between the terminal and the blockchain in the prior art.

[0004] In a first aspect, this application provides a model training method applied to an edge server, the method comprising:

[0005] Obtain the global model parameters and global reputation snapshot obtained from the previous training cycle from the distributed nodes;

[0006] The noise parameters corresponding to each qualified client within the jurisdiction of the edge server are determined based on the global reputation snapshot.

[0007] The global model parameters and the noise parameters corresponding to each qualified client are sent to each qualified client. The qualified client is used to update the model gradient using local private data, the global model parameters and the corresponding noise parameters to generate a local model gradient.

[0008] Upon receiving the local model gradients uploaded by each of the qualified clients, the local model gradients are validated for reasonableness, and a reasonableness validation result is obtained.

[0009] Based on the rationality verification results of the gradients of the local models that have been successfully verified, determine the local aggregated model for the current training cycle and the reputation value of each qualified client.

[0010] Based on the local aggregation model and the reputation values ​​of each qualified client, a notarized transaction package is generated and uploaded to the distributed node to participate in the global training of the model in the current training cycle.

[0011] Secondly, this application provides a model training method applied to distributed nodes, the method comprising:

[0012] Based on the reputation value of each qualified client in each existing transaction package, determine the selection probability corresponding to each existing transaction package;

[0013] Based on the selection probability corresponding to each of the existing transaction packages, the target transaction package to be referenced is determined;

[0014] Upon receiving the evidence storage transaction package uploaded by the edge server, the target transaction package is used as the parent node of the evidence storage transaction package, and a reference relationship is established between the target transaction package and the evidence storage transaction package.

[0015] The global reputation snapshot is updated based on the reputation values ​​of each qualified client in the evidence storage transaction package. Global model parameters are generated by global model training based on the model parameters corresponding to the local aggregation model in the target transaction package and the model parameters corresponding to the local aggregation model in the evidence storage transaction package.

[0016] Thirdly, this application provides a model training system, which includes a distributed ledger layer, an edge aggregation layer, and a client layer. Each edge server in the edge aggregation layer is used to implement the method described in the first aspect, and the distributed nodes in the distributed ledger layer are used to implement the method described in the second aspect.

[0017] Fourthly, this application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described model training method.

[0018] Fifthly, this application also provides a computer storage medium storing computer-executable instructions for executing the above-described model training method.

[0019] Compared with the prior art, the technical solution provided in this application has the following advantages: The method provided in this application involves an edge server obtaining global model parameters and a global reputation snapshot from a distributed node in the previous training cycle; determining noise parameters corresponding to each qualified client within the jurisdiction of the edge server based on the global reputation snapshot; distributing the global model parameters and the noise parameters corresponding to each qualified client to each qualified client, wherein the qualified client uses local private data, the global model parameters, and the corresponding noise parameters to update the model gradient to generate a local model gradient; upon receiving the local model gradient uploaded by each qualified client, performing a rationality check on the local model gradient to obtain a rationality check result; determining the local aggregated model and the reputation value of each qualified client in the current training cycle based on multiple local model gradients whose rationality check results are successful; generating a certificate of evidence transaction package based on the local aggregated model and the reputation value of each qualified client, and uploading the certificate of evidence transaction package to the distributed node to participate in the global model training in the current training cycle.

[0020] Based on the above method, high-frequency, computationally intensive model verification and reputation management tasks are decoupled from the blockchain consensus layer and processed in parallel on edge servers in the edge aggregation layer. This frees blockchain nodes from heavy computational burdens, allowing them to handle only lightweight notarized transactions, thus avoiding consensus congestion caused by repetitive computation across all nodes and significantly improving system throughput and response speed. Clients establish secure channels only with edge servers, no longer directly exposed to public blockchain nodes. The edge servers, acting as trusted proxies, shield the client's network traffic characteristics. Combined with noise parameter perturbation of the upload gradient, this effectively prevents attackers from performing deanonymization attacks or reverse-engineering private data by analyzing on-chain transactions. Therefore, this solves the problems of excessive computational load on the blockchain consensus layer and privacy leakage risks caused by direct interaction between the terminal and the blockchain in existing technologies. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0024] Figure 1 This is a schematic diagram of the structure of a model training system provided in an embodiment of this application;

[0025] Figure 2 A schematic flowchart illustrating a model training method provided in an embodiment of this application;

[0026] Figure 3 A schematic diagram of a noise disturbance process provided for an embodiment of this application;

[0027] Figure 4 This is a schematic diagram illustrating the anomaly recognition effect of reconstruction error provided in an embodiment of this application;

[0028] Figure 5 A schematic flowchart illustrating a model training method provided in an embodiment of this application;

[0029] Figure 6 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] The following disclosure provides numerous different embodiments or examples for implementing various structures of the invention. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of the invention. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0032] Figure 1 This is a diagram illustrating the application environment of a model training method in one embodiment. (Refer to...) Figure 1This model training method is applied to a model training system. The model training system includes a distributed ledger layer, an edge aggregation layer, and a client layer. The distributed ledger layer consists of at least one distributed node, which maintains a distributed ledger based on a Directed Acyclic Graph (DAG) structure. The distributed ledger layer utilizes the high concurrency and asynchronous characteristics of DAGs to receive transaction packets from the edge aggregation layer, achieving immutable data storage and global state audit consensus. Figure 1 As shown, the distributed ledger layer mainly stores transactions containing audit vouchers, log summaries, and reference relationships, without having to undertake heavy model validation computation tasks.

[0033] The edge aggregation layer is the computation offloading and governance hub of the system, typically composed of high-performance edge server clusters deployed at the network edge (such as 5G base stations or central computer rooms in industrial parks). The edge servers are explicitly configured as computation offloading zones and do not participate in the blockchain consensus process. The internal structure of the edge servers integrates the following core functional modules: a verification module for parallel off-chain gradient trend consistency detection and benchmark model performance verification, intercepting abnormal or malicious model updates; a reputation state engine for maintaining a dynamic client reputation state table locally, containing the following fields: {ClientID, Current_Reputation, History_Score_List, Last_Update_Time, Violation_Count}, updating the Current_Reputation field in real time based on verification results without frequent on-chain data reads and writes; and a local aggregation module for weighted aggregation of verified gradients based on reputation weights. This layer intercepts the raw heavy data (model gradients) uploaded by the client, performs calculations locally, and then transmits only lightweight evidence storage transaction packages to the distributed ledger layer for evidence storage.

[0034] The client layer consists of a massive number of heterogeneous computing devices, such as autonomous vehicles, smartphones, industrial robots, and IoT devices like smart cameras, each containing a client component. These devices act as lightweight computing nodes in federated learning, primarily responsible for collecting local private data and using it to perform Local Stochastic Gradient Descent (Local SGD) training to generate model update gradients. To protect data privacy, before transmitting model parameters (i.e., model gradients) upwards, the client uses differential privacy or other encryption techniques to perturb the model update gradients to obtain the final local model gradients. These local model gradients are then uploaded to the edge aggregation layer via a secure, high-bandwidth channel, rather than directly to the blockchain network. The client also utilizes the locally trained model corresponding to the local model gradients for local applications.

[0035] In one embodiment, Figure 2 This is a flowchart illustrating a model training method in one embodiment, with reference to... Figure 2 This paper provides a model training method. This embodiment primarily illustrates the application of this method to any edge server in the edge aggregation layer. The model training method specifically includes the following steps:

[0036] Step S210: Obtain the global model parameters and global reputation snapshot obtained from the distributed nodes in the previous training cycle.

[0037] Specifically, the distributed ledger maintained in the distributed nodes is recorded as a DAG ledger, which supports parallel verification and asynchronous confirmation of multiple transactions. Compared with the synchronous blocking block production mode of traditional blockchains, it greatly reduces transaction confirmation latency and adapts to the high-concurrency upload needs of massive clients. The distributed ledger records the latest global model parameters and global reputation snapshots. The global model parameters indicate the model gradient of the global model after global training, and the global reputation snapshot indicates the reputation value of each qualified client within the jurisdiction of different edge servers at the end of the previous training cycle. Through the global reputation snapshot, the reputation value of each qualified client within the jurisdiction of different edge servers at the end of the previous training cycle can be queried.

[0038] Step S220: Determine the noise parameters corresponding to each qualified client within the jurisdiction of the edge server based on the global reputation snapshot.

[0039] Specifically, each edge server corresponds to a jurisdiction. Clients initiate registration requests to the nearest edge server. The edge server authenticates the client entering its jurisdiction based on the registration request to determine if the client is a qualified client and establishes an initial reputation value for it in its local reputation status table. The initial reputation value is derived from a cold start reputation assessment of the client based on the information declared in the registration request or the detected data distribution characteristics. The data distribution characteristics specifically include data size, data distribution heterogeneity (Non-IID degree), feature space heterogeneity, update frequency, and linearity. Specifically, the initial reputation value is determined by the sum or weighted sum of the scores corresponding to the parameter ranges of data size, data distribution heterogeneity, feature space heterogeneity, update frequency, and linearity. Linearity indicates the client's online frequency and can be represented by the ratio between continuous online time and total online time. Total online time is the sum of continuous online time and offline time. Next, client compliance verification is required. Specifically, this verifies whether the client possesses the corresponding reputation value. Based on the client's reputation value, a legitimacy verification is performed to check if the client is on a service blacklist. Clients not on the service blacklist are considered qualified clients. Qualified clients that pass the initial authentication must undergo further qualification checks during each training cycle based on the dynamic changes in their real-time reputation value. Clients with real-time reputation values ​​below the qualification threshold are deemed unqualified.

[0040] The noise parameters for each qualified client are calculated based on the reputation values ​​of each qualified client within the jurisdiction of the edge server in the global reputation snapshot. The noise parameters are used to perturb the gradient of the model trained by the qualified client using differential privacy technology, so as to prevent attackers from performing deanonymization attacks on terminal devices or reverse-engineering privacy data by analyzing on-chain transactions.

[0041] Step S230: The global model parameters and the noise parameters corresponding to each qualified client are sent to each qualified client. The qualified client is used to update the model gradient using local private data, the global model parameters and the corresponding noise parameters to generate a local model gradient.

[0042] Specifically, the edge server sends the global model parameters and the corresponding noise parameters for each qualified endpoint to the corresponding qualified client. The qualified client, upon receiving the global model parameters and noise parameters, will then utilize its local private data... The model update gradient is obtained by training the global model corresponding to the global model parameters through multiple rounds of local stochastic gradient descent (SGD). Where t indicates the t-th training cycle, k indicates the k-th client, and noise parameters are then used. To interfere with the model's gradient updates, specifically by first removing noise parameters... Vectorization yields the corresponding noise vector. ,in, This refers to the covariance matrix of the noise vector, while I is the identity matrix, used to ensure that each dimension of the noise vector is independent and that the variance of each dimension is equal to 1. The local model gradient is obtained by superimposing a noise vector on the model update gradient; that is, the local model gradient is... .

[0043] Reference Figure 3 For example, in scenario A, for high-reputation clients, it is only necessary to superimpose a small-scale noise vector (i.e., small noise scale) onto the original gradient (i.e., the original local model gradient). The model gradient after superimposing the noise vector is then: Figure 3 The bottom left corner of the scene illustrates the gradient effect, showing that the difference between the model gradient after adding a small-scale noise vector and the original gradient is small. In this case, the accuracy of the added model gradient is high, resulting in a high-precision model gradient. For example, in scene B, a larger-scale noise vector (i.e., large noise scale) is added for low-reputation clients. The resulting model gradient is... Figure 3 The gradient illustration at the bottom of the right-hand scene shows a significant difference between the model gradient after adding a large-scale noise vector and the original gradient. In this case, the accuracy of the superimposed model gradient is low, resulting in a low-precision model gradient. To minimize noise injection, clients must maintain honest behavior over the long term, thereby increasing their contribution to the global model, improving their reputation, and creating a positive cycle.

[0044] Step S240: Upon receiving the local model gradients uploaded by each of the qualified clients, perform a rationality check on the local model gradients to obtain a rationality check result.

[0045] Specifically, the edge server receives local model gradients uploaded by each qualified client within its jurisdiction. These local model gradients indicate the model parameters of the local model trained by the qualified client. The edge server needs to verify the reasonableness of these local model gradients to promptly intercept model gradients exhibiting malicious behavior before local model aggregation, thus ensuring high-quality convergence of the global model.

[0046] Step S250: Based on the rationality verification results for the gradients of the multiple local models that have been successfully verified, determine the local aggregated model for the current training cycle and the reputation value of each qualified client.

[0047] Specifically, the local model gradients uploaded by multiple qualified clients that have passed the rationality verification are aggregated to generate a local aggregated model. Based on the rationality verification results of the local model gradients uploaded by each qualified client, the reputation value of the corresponding qualified client is updated. The reputation value of qualified clients whose local model gradients have passed the verification is increased, while the reputation value of qualified clients whose local model gradients have failed the verification is maintained or decreased. This process deducts reputation for violations and provides positive incentives for compliant contributions.

[0048] Step S260: Generate a notarized transaction package based on the local aggregation model and the reputation values ​​of each qualified client, and upload the notarized transaction package to the distributed node to participate in the global training of the model in the current training cycle.

[0049] Specifically, a notarization transaction package is generated based on the model hash of the local aggregation model and the latest reputation value of each qualified client within the jurisdiction. The structure of the notarization transaction package is as follows:

[0050] ,in For model hashing, This is the storage addressing index for the local aggregation model in the off-chain IPFS (InterPlanetary File System). That is, only the model hash and storage addressing index CID are stored on the chain, while the complete model file is stored in IPFS. This saves on-chain storage space and allows the complete model to be quickly located through the CID. As audit credentials, audit credentials include key evidence of the local aggregation model training process, such as sample distribution, hashes of training steps, and signatures of intermediate results. These are used to allow other nodes or auditors to verify that the training process of this local aggregation model is compliant and trustworthy, and to prevent malicious nodes from submitting forged models.

[0051] ReputationChangeLog is a reputation change log used to record the reputation value, reason for change, and timestamp of each qualified client before and after each change. The parent transaction list records the previous batch of transactions that this evidence-preserving transaction package needs to reference or can reference in the DAG distributed ledger. It is used to establish dependencies between transactions in the DAG and ensure the consistency of the entire transaction graph. If the parent transaction list records the transaction identifier of an existing transaction package that the evidence-preserving transaction package needs to reference, the edge server, after determining the local aggregation model and the reputation values ​​of each qualified client, will send a transaction request to the distributed node to request the transaction identifier of the target transaction package to be referenced. The distributed node determines the transaction identifier of the target transaction package to be referenced based on the transaction request and feeds it back to the edge server. The edge server then generates the evidence-preserving transaction package based on the local aggregation model, the reputation values ​​of each qualified client, and the transaction identifier of the target transaction package.

[0052] Create a timestamp for the transaction. This is a digital signature for the entire transaction structure by the edge server, used to prove that the transaction was indeed initiated by the edge server, preventing the transaction from being impersonated or tampered with.

[0053] The edge server does not directly upload the massive model parameter body to the blockchain. Instead, it generates a lightweight evidence storage transaction package and uploads it to the distributed nodes for on-chain consensus. That is, only the audit certificate, model hash, and reputation change log are uploaded to the blockchain, while the massive model parameter body is stored off-chain. This completely solves the problem of blockchain ledger storage explosion caused by the increase in training rounds.

[0054] Based on the above method, high-frequency, computationally intensive model verification and reputation management tasks are decoupled from the blockchain consensus layer and processed in parallel on edge servers in the edge aggregation layer. This frees blockchain nodes from heavy computational burdens, allowing them to handle only lightweight notarized transactions, thus avoiding consensus congestion caused by repetitive computation across all nodes and significantly improving system throughput and response speed. Clients establish secure channels only with edge servers, no longer directly exposed to public blockchain nodes. The edge servers, acting as trusted proxies, shield the client's network traffic characteristics. Combined with noise parameter perturbation of the upload gradient, this effectively prevents attackers from performing deanonymization attacks or reverse-engineering private data by analyzing on-chain transactions. Therefore, this solves the problems of excessive computational load on the blockchain consensus layer and privacy leakage risks caused by direct interaction between the terminal and the blockchain in existing technologies.

[0055] In one embodiment, determining the noise parameters corresponding to each qualified client within the jurisdiction of the edge server based on the global reputation snapshot includes:

[0056] The current reputation value of each qualified client within the jurisdiction of the edge server is determined based on the global reputation snapshot.

[0057] The current reputation value is normalized to obtain a normalized reputation value;

[0058] The function value obtained by substituting the normalized reputation value into the attenuation function or the linear interpolation constraint function is determined as the noise parameter.

[0059] Specifically, current reputation value The value range is [0, 100]. The current reputation value is normalized to a value in the range [0, 1] to obtain the normalized reputation value. Substituting the normalized reputation value into the attenuation function, the formula for calculating the noise parameter is as follows:

[0060] .

[0061] in, Let be the standard deviation of the Gaussian noise to be added to the k-th client. The larger the standard deviation, the stronger the noise and the higher the degree of privacy protection, but the greater the loss of model accuracy; conversely, the privacy protection becomes weaker and the accuracy loss becomes smaller. The baseline noise standard deviation is an initial parameter of the algorithm that provides a benchmark level for noise. This is an adjustable scaling factor used to control the magnitude of adaptive adjustment. The larger the noise level, the higher the noise level. The greater the magnitude of the change. For a decay function of a Sigmoid variant, when When the power is 0.5, the exponent is 0, and the function value is 1 / (1+1)=0.5; when... When the value is greater than 0.5, the exponent is positive, the function value approaches 0, and noise will tend to... Convergence; when When the value is less than 0.5, the exponent is negative, the function value approaches 1, and the noise is amplified. .

[0062] The formula for calculating the noise parameter is obtained by substituting the normalized reputation value into the linear interpolation constraint function:

[0063] .

[0064] in: Minimal noise is required to ensure basic privacy, suitable for high-reputation, high-contribution clients. A high noise penalty that is forcibly imposed on clients with low reputation. This refers to the hyperparameters used to adjust sensitivity.

[0065] In one embodiment, upon receiving the local model gradients uploaded by each of the qualified clients, performing a reasonableness check on the local model gradients to obtain a reasonableness check result includes:

[0066] Upon receiving the local model gradient uploaded by the qualified client, the local model gradient is subjected to compliance verification to obtain the compliance verification result;

[0067] When the compliance verification result is successful, a gradient trend audit is performed on the local model gradient to obtain the gradient trend audit result;

[0068] When the gradient trend audit result is passed, the performance gain audit of the local model gradient is performed to obtain the performance gain audit result. The rationality verification result includes the compliance verification result, the gradient trend audit result, and the performance gain audit result.

[0069] Specifically, the edge server performs compliance verification on the local model gradients uploaded by different qualified clients to obtain compliance verification results, in order to determine whether the noise parameters used in the local model gradient after noise parameter perturbation are compliant, and to prevent clients from privately reducing noise to fraudulently obtain high-precision rewards.

[0070] If the compliance verification is successful, a gradient trend audit is further performed on the local model gradient to determine if there is any abnormal behavior in the local model gradient. This yields the gradient trend audit result, effectively blocking advanced poisoning attacks that are consistent in direction but have abnormal amplitudes or consistent in direction but contain orthogonal noise. If the compliance verification fails, the gradient trend audit will not be performed on the local model gradient, and the penalty level corresponding to this abnormal state will be determined as Level 1. The local model gradient will be discarded, and the reputation value of the qualified client that uploaded the local model gradient will be deducted according to the first penalty score corresponding to Level 1.

[0071] If the gradient trend audit passes, a performance gain audit is further performed on the local model gradient to determine whether the model accuracy of the local model corresponding to the gradient shows a significant negative increase, thus effectively intercepting performance poisoning attacks. If the gradient trend audit fails, the performance gain audit will not be performed on the local model gradient, and the penalty level corresponding to this abnormal state will be determined as Level 2. The local model gradient will be discarded, and the reputation value of the qualified client that uploaded the local model gradient will be deducted according to the second penalty score corresponding to Level 2.

[0072] If the performance gain audit result is "audit passed," the rationality verification result is determined to be "verification successful." If the performance gain audit result is "audit failed," the penalty level corresponding to this abnormal state is determined to be Level 3, the local model gradient is discarded, and the reputation value of the qualified client that uploaded the local model gradient is deducted according to the Level 3 penalty score. If at least one of the compliance verification result, gradient trend audit result, and performance gain audit result indicates verification failure or audit failure, the rationality verification result is determined to be "verification failed," and the second penalty score is greater than the first penalty score and greater than the third penalty score. The first penalty score and the third penalty score can be the same or different.

[0073] In one embodiment, performing compliance verification on the local model gradient to obtain a compliance verification result includes:

[0074] Based on the noise parameters and model dimensions of the qualified client corresponding to the local model gradient, determine the expected norm of the qualified client;

[0075] The actual norm corresponding to the qualified client is determined based on the local model gradient.

[0076] When the difference between the actual norm and the expected norm is within a preset norm range, the compliance verification result corresponding to the local model gradient is determined to be a successful verification.

[0077] When the difference between the actual norm and the expected norm is outside the preset norm range, the compliance verification result corresponding to the local model gradient is determined to be a verification failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced.

[0078] Specifically, the expected norm of the gradient of the local model uploaded by the client is calculated based on the noise parameters and model dimensions corresponding to the local model gradient. ,in, Let be the noise parameter, and d be the model dimension. The actual norm is... ,in, This represents the local model gradient corresponding to the k-th client. If the difference between the actual norm and the expected norm exceeds the preset norm interval, it indicates that the actual norm is significantly greater than the theoretical expected value, and it is inferred that there may be abnormal perturbation or poisoning. If the difference between the actual norm and the expected norm is lower than the preset norm interval, it indicates that the actual norm is significantly less than the theoretical expected value, and it is inferred that the client has not added enough noise. Only when the difference between the actual norm and the expected norm is within the preset norm interval is the compliance verification result considered successful. Otherwise, the local model gradient is eliminated, and the reputation value of the corresponding qualified client is deducted according to the penalty score corresponding to the abnormal state, thereby effectively intercepting malicious behaviors such as model poisoning before local model aggregation.

[0079] In one embodiment, performing gradient trend auditing on the local model gradient to obtain gradient trend audit results includes:

[0080] The gradients of multiple historical models whose rationality verification results are successful are obtained according to a preset sliding window.

[0081] Construct a gradient feature matrix based on the gradients of multiple historical models;

[0082] Based on the singular value decomposition results of the gradient feature matrix, determine the orthogonal basis matrix;

[0083] The reconstruction error corresponding to the local model gradient is determined based on the projection vector of the local model gradient onto the orthogonal basis matrix.

[0084] A dynamic threshold is determined based on the reconstruction errors corresponding to multiple historical model gradients and / or the reconstruction errors corresponding to each local model gradient received by the edge server in the current model update batch.

[0085] When the reconstruction error corresponding to the local model gradient is greater than the dynamic threshold, the gradient trend audit result is determined to be an audit failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced.

[0086] When the reconstruction error corresponding to the local model gradient is less than or equal to the dynamic threshold, the gradient trend audit result is determined to be an audit success.

[0087] Specifically, a preset sliding window is used to collect historical model gradients that have passed the rationality check in the most recent m rounds. The window length W of the preset sliding window determines the number of historical model gradients to select. The window length can be customized according to the actual application. Historical model gradients refer to the local model gradients that have successfully passed the rationality check and received by the edge server from different qualified clients before the current training cycle. The preset sliding window slides closer to the current time to select the multiple historical model gradients that have passed the rationality check most recently. The multiple historical model gradients collected using the preset sliding window are... Construct a gradient feature matrix based on the gradients of multiple historical models. d represents the model dimension.

[0088] Perform singular value decomposition or principal component analysis on the gradient feature matrix M to extract the left singular vectors corresponding to the first n largest singular values, thus constructing an orthogonal basis matrix. The orthogonal basis matrix is... Orthogonal basis matrices are used to indicate the benign feature subspace of the current model evolution, i.e., referencing Figure 4 The space formed by the dashed lines is the benign feature subspace. The projection vector is obtained by calculating the orthogonal projection of the local model gradient onto the orthogonal basis matrix. , ,in, , refer to Figure 4 The historical gradient refers to the historical model gradient, and the elliptical region refers to the projection vector. The Euclidean distance between the local model gradient and the projection vector is then calculated as the reconstruction error. Figure 4 The distance between the gradient of the new anomaly (i.e., the gradient of the local model) and the projection vector, and the formula for calculating the reconstruction error are as follows: .

[0089] Each local model gradient uploaded by a qualified client will have a reconstruction error calculated. The reconstruction errors corresponding to multiple historical model gradients are used to determine the dynamic threshold corresponding to the current training period. Alternatively, the reconstruction errors corresponding to each local model gradient received by the edge server within the current model update batch can be used. The current model update batch is used to indicate the model update batch that has received multiple local model gradients within the most recent preset time period. There are multiple model update batches within a training period. The model update batches are divided by preset time periods. That is, each model update batch corresponds to a preset time period. For example, if the preset time period is 1 hour, then 9:00 to 10:00 corresponds to the first model update batch, and 10:00 to 11:00 corresponds to the second model update batch.

[0090] The dynamic threshold can be determined based on the reconstruction error of historical model gradients alone, or based solely on the reconstruction errors of the latest local model gradients received in the current model update batch, or by combining the reconstruction errors of historical model gradients and the latest local model gradients received in the current model update batch. The formula for calculating the dynamic threshold is as follows: ,in This refers to the average reconstruction error of all model gradients involved in determining the dynamic threshold, such as the average reconstruction error of multiple historical model gradients, the average reconstruction error of multiple local model gradients within the current model update batch, and the average reconstruction error of multiple historical model gradients and multiple local model gradients within the current model update batch. The standard deviation of the reconstruction error of all model gradients involved in determining the dynamic threshold is used, such as the standard deviation between the reconstruction errors of multiple historical model gradients, the standard deviation between the reconstruction errors of multiple local model gradients in the current model update batch, and the standard deviation between the reconstruction errors of multiple historical model gradients and multiple local model gradients in the current model update batch.

[0091] Determining thresholds based on historical model gradient reconstruction errors fully leverages the overall model characteristics reflected by long-term data accumulation, reducing interference from short-term anomalies in threshold setting. This results in more accurate threshold determination in stable data environments, effectively avoiding erroneous judgments due to random errors. Setting thresholds solely based on the latest local model gradient reconstruction error within the current model update batch allows for rapid response to real-time data changes, capturing the model's latest state promptly. In scenarios with highly dynamic data, thresholds can be quickly adjusted to adapt to new data patterns, improving system real-time performance and sensitivity. Combining both approaches to determine dynamic thresholds integrates the advantages of long-term stability and short-term adaptability. It considers both historical model performance and timely reflects current data trends, enabling more accurate identification of abnormal gradients in complex and ever-changing data environments. This ensures the security and stability of model training, reduces risks from malicious attacks or data anomalies, and enhances the robustness and reliability of the entire model training system.

[0092] Reference Figure 4 If the reconstruction error corresponding to the local model gradient is greater than the dynamic threshold, such as... Figure 4 If the reconstruction error in the local model gradient exceeds the benign feature subspace, it indicates that the local model gradient contains anomalous components that cannot be explained by the benign main feature subspace, i.e., it contains non-benign features. The local model gradient is considered a poisoning attack and is intercepted, i.e., the gradient trend audit result is judged as audit failure. Conversely, if the reconstruction error corresponding to the local model gradient is less than or equal to the dynamic threshold, it indicates that the local model gradient does not contain anomalous components that cannot be explained by the benign main feature subspace, and the gradient trend audit result is judged as audit success.

[0093] When an audit fails and local model gradients containing non-benign features are blocked, poisoning attacks can be effectively resisted, ensuring the security and reliability of the entire model training process. This prevents maliciously injected anomalous components from contaminating the global model, allowing the final trained model to more accurately reflect the characteristics and patterns of real data, thus improving the model's performance and effectiveness in practical applications. For example, in image recognition scenarios, it can prevent attackers from using poisoning attacks to cause the model to misjudge certain images, thereby ensuring the accuracy and stability of the image recognition system.

[0094] A successful audit indicates that the local model gradient is in a healthy state and has not been disturbed. This helps maintain the consistency and effectiveness of the model gradients across nodes in a distributed training environment, promoting efficient model training. Dynamic threshold settings increase the flexibility and adaptability of the audit, allowing for real-time adjustments based on different training stages and data distributions, further optimizing audit performance and improving the system's ability to identify and prevent complex and ever-changing attack patterns.

[0095] In one embodiment, performing performance gain audit on the local model gradient to obtain the performance gain audit result includes:

[0096] Based on the loading and application results of the local model gradient, determine the model accuracy corresponding to the local model gradient;

[0097] The amount of accuracy change is determined based on the difference between the model accuracy corresponding to the local model gradient and the model accuracy corresponding to the global model parameters;

[0098] When the change in accuracy is greater than or equal to a preset change, the performance gain audit result is determined to be successful.

[0099] When the change in accuracy is less than the preset change, the performance gain audit result is determined to be an audit failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced.

[0100] Specifically, the local model gradients are loaded onto the local validation set on the edge server and inference is run, calculating the change in accuracy between the model accuracy corresponding to the global model parameters. If the change in accuracy equals the preset change, it means the model accuracy of the local model gradient is similar to that of the global model parameters. If the change in accuracy is greater than the preset change, it means the model accuracy of the local model gradient is significantly better than that of the global model parameters. In both cases, the performance gain audit result is considered successful. For cases where the change in accuracy equals the preset change, since the model accuracy has not increased significantly, the reputation value of the qualified client corresponding to the local model gradient remains unchanged. For cases where the change in accuracy is greater than the preset change, since the model accuracy has increased significantly, the reputation value of the qualified client corresponding to the local model gradient is increased according to the positive incentive score. The positive incentive score can be customized based on the actual application scenario, such as 1, 2, 3, 4, 5, etc.

[0101] If the change in accuracy is less than the preset change, it means that the model accuracy of the local model gradient is significantly lower than the model accuracy of the global model parameters. In other words, the model accuracy of the local model gradient has shown a significant negative growth phenomenon. If performance poisoning is suspected, the performance gain audit result is determined to be an audit failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced according to the penalty score corresponding to the abnormal state. The penalty score corresponding to the abnormal state can be customized according to the actual application scenario, such as 1, 2, 3, 4, 5, etc.

[0102] After verifying the reasonableness of each local model gradient, the edge server updates the real-time reputation value of each qualified client in the local reputation status table based on the reasonableness verification results. For qualified clients that fail the legitimacy check, a corresponding reputation score will be deducted based on the penalty score corresponding to the reason for the failure, and a corresponding violation log will be generated. The edge server removes the local model gradients that fail the legitimacy check and calculates the aggregate weight of the qualified client only based on the real-time reputation values ​​of the qualified clients corresponding to the multiple local model gradients that succeed in the legitimacy check. The aggregation weight of qualified clients is directly proportional to their real-time reputation value; the higher the real-time reputation value, the greater the aggregation weight, thus reducing the negative impact of low-reputation clients. A weighted average aggregation calculation is performed using the gradient of the local model that passed the rationality check and the corresponding aggregation weight of qualified clients to generate a local aggregation model. .

[0103] In one embodiment, refer to Figure 5 A model training method is provided for distributed nodes, the method comprising:

[0104] Step S310: Determine the selection probability corresponding to each existing transaction package based on the reputation value of each qualified client in each existing transaction package.

[0105] Specifically, an existing transaction package refers to a notarized transaction package uploaded to the distributed nodes by different edge servers during previous training cycles. Each existing transaction package contains the reputation value of each qualified client within the jurisdiction of the corresponding edge server at the end of the corresponding training cycle. The average or weighted average of the reputation values ​​of each qualified client in the existing transaction package is used as the overall reputation value corresponding to that existing transaction package. The node weight corresponding to that existing transaction package is calculated using the overall reputation value. The formula for calculating the node weight is as follows:

[0106] .

[0107] in, for The overall reputation value corresponding to the existing transaction package, For reputation weight, For the current moment, for The time of transaction creation for an existing transaction package This indicates the duration for which the existing transaction package has existed. It is an exponentially decaying function, here The decay rate is determined by the length of time the function has existed; the longer it has existed, the smaller the value of this exponential decay function becomes. The node weight is determined by combining the overall reputation value and existing duration of the existing transaction package, which prevents old transactions from being permanently prioritized for reference. Instead, newer existing transactions are prioritized for reference, thus ensuring the activity and fairness of the DAG.

[0108] The selection probability is calculated using the node weights of existing transaction packets. The formula for calculating the selection probability is: Assuming we are currently at node , that is to An existing transaction package is used as the current transaction node, and its optional set of sub-transactions is: In other words, a sub-transaction in a sub-transaction set refers to a transaction that directly references... Subsequent transactions, nodes Towards the child transaction Probability of transition Defined as Softmax form, i.e. The probability of selecting an existing transaction package is: ,in, ,Right now For any sub-transaction in the sub-transaction set, Possibly The probability of choosing a sub-transaction Node weights and sub-transactions The ratio between the sum of the node weights of all sub-transactions in the sub-transaction set.

[0109] Step S320: Determine the target transaction package to be referenced based on the selection probability corresponding to each of the existing transaction packages.

[0110] Specifically, after determining the current transaction node... After selecting the probability of each sub-transaction, the walk proceeds according to the sub-transaction with the higher selection probability. Then, the sub-transaction with the higher selection probability is used as the current transaction node to calculate the subsequent sub-transactions. This random walk is used to calculate the number of transitions for each end transaction. End transactions (Tips) refer to existing transaction packets that are not referenced at the end of the DAG. The two end transactions with the most transitions are selected as the target transaction packets.

[0111] Step S330: Upon receiving the evidence storage transaction package uploaded by the edge server, the target transaction package is used as the parent node of the evidence storage transaction package, and a reference relationship is established between the target transaction package and the evidence storage transaction package.

[0112] Specifically, upon receiving the latest evidence storage transaction package uploaded by the edge server, a reference relationship is established between the evidence storage transaction package and the target transaction package.

[0113] Step S340: Update the global reputation snapshot according to the reputation values ​​of each qualified client in the evidence storage transaction package, and perform global model training to generate global model parameters according to the model parameters corresponding to the local aggregation model in the target transaction package and the model parameters corresponding to the local aggregation model in the evidence storage transaction package.

[0114] Specifically, the global reputation snapshot is updated using the reputation values ​​of each qualified client in the evidence storage transaction package. The global model parameters are generated by using the model parameters (model hash) corresponding to the local aggregation model in the evidence storage transaction package. The global model parameters are then generated by global training of the model. The global model is converged and aggregated in the distributed nodes. This solves the problem that traditional DAGs are only used for storage and lack business collaboration in federated learning. It ensures that the global model state with the highest accuracy and the greatest contribution is ultimately confirmed by the entire network.

[0115] Once the distributed nodes reach a consensus on a new round of transactions, each edge server synchronizes the latest DAG state, updates the global model parameters and global reputation snapshot based on the consensus result, and prepares to enter the next round of training. ).

[0116] Based on the above method, the client layer is only responsible for local gradient calculation and differential privacy encryption, and does not directly participate in blockchain consensus, thus reducing terminal resource consumption. The edge aggregation layer is configured as a "computation offloading hub," independently undertaking high-frequency model verification, reputation management, and local aggregation tasks, achieving risk isolation before consensus. The distributed ledger layer adopts a directed acyclic graph topology, and is only responsible for receiving audit credentials and state summaries submitted by the edge layer, using a Tangle structure to achieve high-concurrency asynchronous evidence storage.

[0117] Figure 2 and Figure 5 This is a flowchart illustrating a model training method in one embodiment. It should be understood that, although... Figure 2 and Figure 5 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 and Figure 5 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0118] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the system, can run in environments such as... Figure 1 The hardware environment shown can be implemented either through software or through hardware.

[0119] like Figure 6 As shown, this application embodiment provides a computer device, including a processor 711, a communication interface 712, a memory 713, and a communication bus 714. The processor 711, the communication interface 712, and the memory 713 communicate with each other through the communication bus 714. The memory 713 is used to store computer programs. When the processor 711 executes the program stored in the memory 713, it implements the model training method provided in any of the aforementioned method embodiments.

[0120] The memory and processor in the aforementioned electronic devices communicate with each other via a communication bus and a communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0121] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage system located remotely from the aforementioned processor.

[0122] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0123] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0124] According to another aspect of the embodiments of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the above embodiments.

[0125] In one embodiment, the model training system provided in this application can be implemented as a computer program, which can be implemented in the form of, for example... Figure 6 The system runs on the computer device shown. The computer device's memory can store the various program modules that make up the model training system. The computer program, composed of the various program modules, causes the processor to execute the model training methods of the various embodiments described in this specification.

[0126] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the model training method provided in any of the foregoing method embodiments.

[0127] Optionally, in embodiments of this application, the computer-readable medium is configured to store program code for the processor to execute any of the above embodiments.

[0128] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0129] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0130] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0131] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, units, and processes described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0132] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between systems or units, and may be electrical, mechanical, or other forms.

[0133] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0134] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0135] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a USB flash drive, external hard drive, ROM, RAM, magnetic disk, or optical disk, or other media capable of storing program code, including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0136] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also mean including the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that alternatives or substitutions may be used.

[0137] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A model training method, characterized in that, Applied to edge servers, the method includes: Obtain the global model parameters and global reputation snapshot obtained from the previous training cycle from the distributed nodes; The noise parameters corresponding to each qualified client within the jurisdiction of the edge server are determined based on the global reputation snapshot. The qualified client refers to a client that initiates a registration request to the nearest edge server, and the edge server authenticates the client entering the jurisdiction based on the registration request. The client is not listed in the service blacklist and its real-time reputation value is not lower than the qualified threshold. The global model parameters and the noise parameters corresponding to each qualified client are sent to each qualified client. The qualified client is used to update the model gradient using local private data, the global model parameters and the corresponding noise parameters to generate a local model gradient. Upon receiving the local model gradients uploaded by each of the qualified clients, the local model gradients are validated for reasonableness, and a reasonableness validation result is obtained. Based on the rationality verification results of the gradients of the local models that have been successfully verified, determine the local aggregated model for the current training cycle and the reputation value of each qualified client. Based on the local aggregation model and the reputation values ​​of each qualified client, a notarized transaction package is generated and uploaded to the distributed node to participate in the global training of the model in the current training cycle. The step of determining the noise parameters corresponding to each qualified client within the jurisdiction of the edge server based on the global reputation snapshot includes: The current reputation value of each qualified client within the jurisdiction of the edge server is determined based on the global reputation snapshot. The current reputation value is normalized to obtain a normalized reputation value; The function value obtained by substituting the normalized reputation value into the attenuation function or the linear interpolation constraint function is determined as the noise parameter; Upon receiving the local model gradients uploaded by each of the qualified clients, the step of performing a reasonableness check on the local model gradients to obtain a reasonableness check result includes: Upon receiving the local model gradient uploaded by the qualified client, the local model gradient is subjected to compliance verification to obtain the compliance verification result; When the compliance verification result is successful, a gradient trend audit is performed on the local model gradient to obtain the gradient trend audit result; When the gradient trend audit result is passed, the performance gain audit of the local model gradient is performed to obtain the performance gain audit result. The rationality verification result includes the compliance verification result, the gradient trend audit result, and the performance gain audit result.

2. The method according to claim 1, characterized in that, The compliance verification of the local model gradient, to obtain the compliance verification result, includes: Based on the noise parameters and model dimensions of the qualified client corresponding to the local model gradient, determine the expected norm of the qualified client; The actual norm corresponding to the qualified client is determined based on the local model gradient. When the difference between the actual norm and the expected norm is within a preset norm range, the compliance verification result corresponding to the local model gradient is determined to be a successful verification. When the difference between the actual norm and the expected norm is outside the preset norm range, the compliance verification result corresponding to the local model gradient is determined to be a verification failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced.

3. The method according to claim 1, characterized in that, The step of performing gradient trend audit on the local model gradient to obtain gradient trend audit results includes: The gradients of multiple historical models whose rationality verification results are successful are obtained according to a preset sliding window. Construct a gradient feature matrix based on the gradients of multiple historical models; Based on the singular value decomposition results of the gradient feature matrix, determine the orthogonal basis matrix; The reconstruction error corresponding to the local model gradient is determined based on the projection vector of the local model gradient onto the orthogonal basis matrix. A dynamic threshold is determined based on the reconstruction errors corresponding to multiple historical model gradients and / or the reconstruction errors corresponding to each local model gradient received by the edge server in the current model update batch. When the reconstruction error corresponding to the local model gradient is greater than the dynamic threshold, the gradient trend audit result is determined to be an audit failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced. When the reconstruction error corresponding to the local model gradient is less than or equal to the dynamic threshold, the gradient trend audit result is determined to be an audit success.

4. The method according to claim 1, characterized in that, The performance gain audit of the local model gradient, to obtain the performance gain audit result, includes: Based on the loading and application results of the local model gradient, determine the model accuracy corresponding to the local model gradient; The amount of accuracy change is determined based on the difference between the model accuracy corresponding to the local model gradient and the model accuracy corresponding to the global model parameters; When the change in accuracy is greater than or equal to a preset change, the performance gain audit result is determined to be successful. When the change in accuracy is less than the preset change, the performance gain audit result is determined to be an audit failure, and the reputation value of the qualified client corresponding to the local model gradient is reduced.

5. A model training method, characterized in that, Applied to distributed nodes, the method includes: Based on the reputation value of each qualified client in each existing transaction package, the selection probability corresponding to each existing transaction package is determined. The qualified client refers to a client that initiates a registration request to the nearest edge server. After the edge server verifies the identity of the client entering its jurisdiction based on the registration request, the client is not included in the service blacklist and the real-time reputation value is not lower than the qualified threshold. The existing transaction package refers to the evidence-based transaction package uploaded by the edge server to the distributed node in previous training cycles. The existing transaction package contains the reputation value of each qualified client within the jurisdiction of the corresponding edge server at the end of the corresponding training cycle. The step of determining the selection probability of each existing transaction package based on the reputation value of each qualified client in each existing transaction package includes: calculating the overall reputation value of the existing transaction package based on the average or weighted average of the reputation values ​​of each qualified client in the existing transaction package; determining the node weight based on the overall reputation value and the existing duration of the existing transaction package; and calculating the selection probability of the existing transaction package based on the node weight. Based on the selection probability corresponding to each of the existing transaction packages, the target transaction package to be referenced is determined; When the evidence storage transaction package uploaded by the edge server is received, the target transaction package is used as the parent node of the evidence storage transaction package, and a reference relationship is established between the target transaction package and the evidence storage transaction package. The evidence storage transaction package is a transaction package containing a local aggregation model and reputation change log uploaded by the edge server to the distributed node in the current training cycle. The evidence storage transaction package contains the reputation values ​​of each qualified client within the jurisdiction of the corresponding edge server at the end of the current training cycle. The global reputation snapshot is updated based on the reputation values ​​of each qualified client in the evidence storage transaction package. Global model parameters are generated by global model training based on the model parameters corresponding to the local aggregation model in the target transaction package and the model parameters corresponding to the local aggregation model in the evidence storage transaction package. The global reputation snapshot and the global model parameters are sent to the edge server to participate in the training of the local aggregation model in the next training cycle.

6. A model training system, characterized in that, The model training system includes a distributed ledger layer, an edge aggregation layer, and a client layer. Each edge server in the edge aggregation layer is used to implement the method of any one of claims 1 to 4, and the distributed nodes in the distributed ledger layer are used to implement the method of claim 5.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5.

Images