Federal learning-based model training method and device, equipment, medium and product

Abstract

The invention relates to a federated learning-based model training method and apparatus, a device, a medium and a product. The method comprises the steps of obtaining gradient behavior characteristics of gradient behaviors of a local model in a current round of training; determining gradient behavior information corresponding to the training based on the gradient behavior characteristics; and based on the gradient behavior information, prompt information is sent to a federated coordination center, and the prompt information is used by the federated coordination center to determine whether to use the model parameters of the local model to train a global model deployed by the federated coordination center. According to the method, a potential malicious gradient can be accurately positioned, a fine-grained risk assessment basis is provided for a federal coordination center, pollution of abnormal parameters to a global model is blocked in time from the source, dynamic credible verification of local training behaviors is realized by the mechanism, data privacy is protected, training safety and cooperation reliability of the global model are guaranteed, and the reliability of the global model is improved. And the anti-attack capability of the federal system is improved.

Description

Technical Field

[0001] This disclosure relates to the field of federated learning technology, and more specifically, to a model training method, apparatus, device, medium, and product based on federated learning. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, aims to solve the problems of data privacy and data silos, and has broad application prospects, especially in the healthcare field. It allows multiple participants to collaboratively train a global model without sharing the original data. However, although federated learning achieves "data not leaving the domain," the gradient information uploaded by participants still poses a risk of privacy leakage. Existing research shows that by analyzing gradient information, attackers can carry out membership inference attacks to determine whether a specific data sample participated in training, or attribute inference attacks to infer information about sensitive attributes in the training data. These attacks pose a serious threat to the privacy protection of medical data.

[0003] In related technologies, when dealing with privacy attacks in federated learning, it is impossible to effectively block the attacks within a valid timeframe, thus allowing the risk of privacy leakage to persist. Summary of the Invention

[0004] The purpose of this disclosure is to provide a model training method, apparatus, device, medium, and product based on federated learning.

[0005] To achieve the above objectives, firstly, this disclosure provides a model training method based on federated learning, applied to a client, wherein the client has a locally deployed model, and the method includes: Obtain the gradient behavior features of the local model in this round of training; Based on the gradient behavior characteristics, determine the gradient behavior information corresponding to this round of training, wherein the gradient behavior information includes the attack probability that the gradient behavior is an attack behavior; Based on the gradient behavior information, a prompt message is sent to the federal coordination center. The prompt message is used by the federal coordination center to determine whether to use the model parameters of the local model to train the global model deployed by the federal coordination center.

[0006] Optionally, after determining the gradient behavior information corresponding to the current training round based on the gradient behavior features, the method further includes: If the attack probability is greater than a preset probability threshold, then the gradient behavior in this round of training is determined to be an attack behavior. If the attack probability is less than or equal to the preset probability threshold, then the gradient behavior in this round of training is determined not to be an attack behavior.

[0007] Optionally, the prompt information includes anomaly prompt information, and the step of sending the prompt information to the federal coordination center based on the gradient behavior information includes: If the gradient behavior information indicates that the gradient behavior in this round of training is an attack behavior, the abnormal prompt information is sent to the Federal Coordination Center so that the Federal Coordination Center can delete the model parameters that have been uploaded for this round of training of the local model.

[0008] Optionally, the client further includes a federated communication interface, the prompting information includes normal prompting information, and the step of sending prompting information to the federated coordination center based on the gradient behavior information includes: If the gradient behavior information indicates that the gradient behavior in this round of training is not an attack behavior, the normal prompt information is sent to the federal coordination center, and the encrypted model parameters are continued to be uploaded to the federal coordination center through the federal communication interface so that the global model can use the model parameters of the local model for training.

[0009] Optionally, the client further includes a detection module, which is deployed with an anomaly detection model. The step of determining the gradient behavior information corresponding to the current training round based on the gradient behavior features includes: The gradient behavior features are input into the anomaly detection model to obtain the gradient behavior information of this training round. The anomaly detection model is trained using multiple normal gradient trajectory samples and multiple simulated attack gradient trajectory samples.

[0010] Optionally, the gradient behavior features include the gradient L2 norm, gradient direction cosine, and gradient update time sequence. The step of inputting the gradient behavior features into the anomaly detection model to obtain the gradient behavior information for this round of training includes: The gradient feature map is determined using the anomaly detection model based on the gradient L2 norm, gradient direction cosine, and gradient update sequence. The anomaly detection model is used to perform anomaly detection analysis on the gradient feature map to obtain the gradient behavior information of this training round.

[0011] Optionally, the detection module is set within a sandbox, which further includes a sandbox control module and a training container. The local model is deployed in the training container. After the anomaly detection model performs anomaly detection analysis on the gradient feature map to obtain the gradient behavior information of this training round, the method further includes: If, based on the gradient behavior information, it is determined that the gradient behavior in this round of training is an attack behavior, the sandbox control module issues a stop command to the training container to interrupt the training of the local model in this round.

[0012] Secondly, this disclosure provides a model training method based on federated learning, applied to a federated coordination node in federated learning, wherein the federated coordination node deploys a global model, and the method includes: The system receives a prompt message sent by the client. The prompt message is used to indicate whether the global model is trained using the model parameters of the local model on the client. The prompt message is determined by the client based on the gradient behavior information of the local model in this round of training. The gradient behavior information is determined based on the gradient behavior features of the gradient behavior in this round of training. The global model is trained based on the aforementioned prompt information.

[0013] Optionally, the prompt information includes abnormal prompt information and normal prompt information, and the step of training the global model based on the prompt information includes: If the prompt message is an abnormal prompt message, then delete the model parameters uploaded by the client in this round of training, and train the global model based on the model parameters uploaded by other clients in federated learning; If the prompt message is a normal prompt message, then the model parameters uploaded by the local model in this round of training will be used for training.

[0014] Optionally, the method further includes: If the prompt message is an abnormal prompt message, the abnormal information is recorded in the blockchain corresponding to federated learning.

[0015] Thirdly, this disclosure provides a model training apparatus based on federated learning, applied to a client, wherein the client has a local model deployed locally, and the apparatus includes: The feature acquisition module is configured to acquire gradient behavior features of the local model in this round of training; The information determination module is configured to determine the gradient behavior information corresponding to the current training round based on the gradient behavior features. The information sending module is configured to send a prompt message to the federal coordination center based on the gradient behavior information. The prompt message is used by the federal coordination center to determine whether to use the model parameters of the local model to train the global model deployed by the federal coordination center.

[0016] Fourthly, this disclosure provides a model training device based on federated learning, applied to a federated coordination node in federated learning, wherein the federated coordination node includes a global model, and the device includes: The information receiving module is configured to receive prompt information sent by the client. The prompt information is used to indicate whether the global model is trained using the model parameters of the local model on the client. The prompt information is determined by the client based on the gradient behavior information of the local model in this round of training. The gradient behavior information is determined based on the gradient behavior features of the gradient behavior in this round of training. The model training module is configured to train the global model based on the prompt information.

[0017] Fifthly, this disclosure provides a client, including: Local model; A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method of any one of the first aspects.

[0018] Sixthly, this disclosure provides a federal coordination center, including: Global model; A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method of any of the second aspects.

[0019] In a seventh aspect, this disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects, or implements the steps of the method described in any one of the second aspects.

[0020] Eighthly, this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects, or the steps of the method described in any one of the second aspects.

[0021] By extracting gradient behavior features and quantifying attack probabilities through the above technical solutions, potential malicious gradients can be accurately located, providing the federal coordination center with fine-grained risk assessment basis. This timely and source-based blocking of abnormal parameters from polluting the global model enables dynamic and reliable verification of local training behavior. While protecting data privacy, this mechanism ensures the training security and collaborative reliability of the global model, thereby enhancing the anti-attack capability of the federal system.

[0022] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0023] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the following detailed description to explain the present disclosure, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating a client-side federated learning-based model training method according to an exemplary embodiment.

[0024] Figure 2 This is a flowchart illustrating a client-side method for training a model based on federated learning, according to another exemplary embodiment.

[0025] Figure 3 This is a flowchart illustrating a federated learning-based model training method on a federated coordination node according to an exemplary embodiment.

[0026] Figure 4 This is a block diagram of a client-side model training apparatus based on federated learning, according to an exemplary embodiment.

[0027] Figure 5 This is a block diagram illustrating a model training apparatus based on federated learning on a federated coordination node, according to an exemplary embodiment.

[0028] Figure 6 This is a block diagram illustrating a client according to an exemplary embodiment.

[0029] Figure 7 This is a block diagram illustrating a federal coordination node according to an exemplary embodiment. Detailed Implementation

[0030] The specific embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit this disclosure.

[0031] It should be noted that all actions involving the acquisition of signals, information, or data in this disclosure are carried out in compliance with the relevant data protection laws and policies of the country where the location is situated, and with authorization from the owner of the relevant device.

[0032] Figure 1 This is a flowchart illustrating a federated learning-based model training method according to an exemplary embodiment, applied to a client that has a local model deployed thereon. The method includes the following steps.

[0033] In step S11, the gradient behavior features of the local model in this round of training are obtained.

[0034] The gradient, in this context, describes the rate of change and direction of a multivariate function at a given point. In model training, the model's gradient refers to the gradient of the model's loss function with respect to its learnable parameters, such as weights and biases. Gradient behavior refers to the dynamic changes and characteristics of the gradient during model training, including the evolution of its magnitude, direction, distribution, and stability as training progresses. It reflects how the "driving force" for model parameter updates changes with the training state, directly affecting the model's convergence speed, stability, and final performance.

[0035] Furthermore, gradient behavior characteristics include, but are not limited to, the L2 norm of gradients, the cosine similarity of gradients, and the temporal sequence of gradient updates. The L2 norm of the gradient reflects the overall magnitude or strength of the gradient vector. An abnormally large norm may indicate that the model has over-updated in a particular direction, which could be a sign of data poisoning or gradient spoofing attacks. The cosine similarity of gradients measures the consistency between the current gradient and historical or global gradient directions. During normal training, gradient directions typically exhibit a certain degree of continuity and stability. If the gradient direction suddenly deviates significantly, for example, completely opposite to the global model update direction, this may indicate that a malicious actor is attempting to corrupt the global model by uploading incorrect gradients or to perform a gradient inversion attack. The temporal characteristics of gradient updates include, but are not limited to, the frequency, interval, and continuity of gradient generation. Abnormal update sequences, such as uploading a large number of gradients in a short period or suddenly uploading gradients after a long period of inactivity, may be associated with timed attacks or resource abuse.

[0036] In this embodiment, the gradient behavior features of the local model in the current training round can be obtained by the client's data acquisition module or by the client's anomaly detection module. Preferably, to better obtain the gradient behavior features of the gradient behavior in the current training round, a probe module can be set up on the client. The probe module runs in a non-intrusive manner to monitor and collect the gradient behavior features generated during the local model training process in real time. Different acquisition methods are used for different gradient behavior features. The acquisition methods include, but are not limited to, the probe periodically calculating and acquiring the L2 norm of the gradient for each training step (or each layer), the probe module acquiring the gradient information for each training round, calculating the cosine similarity between the current gradient and the previous gradient or the globally aggregated gradient, and the probe module acquiring and recording information such as the timestamp of each gradient upload and the number of training steps.

[0037] In step S12, based on the gradient behavior features, the gradient behavior information corresponding to this round of training is determined, and the gradient behavior information includes the attack probability that the gradient behavior is an attack behavior.

[0038] One method for determining this is through probability and statistics. This involves analyzing the differences in the statistical distribution of gradient features between normal training and attack scenarios to calculate the probability that the current feature belongs to an "attack." For example, if the current L2 norm falls within the high-probability interval of the attack distribution, the attack probability increases accordingly. Another method is model-based determination. This involves training an anomaly detection model using gradient behavior feature samples from both normal and attack scenarios. The model then analyzes the gradient behavior features corresponding to this round of training to determine the gradient behavior information. No specific limitations are imposed on the determination method here.

[0039] In step S13, based on the gradient behavior information, a prompt message is sent to the federal coordination center. The prompt message is used by the federal coordination center to determine whether to use the model parameters of the local model to train the global model deployed by the federal coordination center.

[0040] The prompt message can be a text prompt, a binary prompt, or a prompt message carrying specific information.

[0041] For example, taking the prompt message as information carrying specific information as an example, the specific information may be the client's public key, or it may be a prompt message used to indicate that the client has malicious involvement.

[0042] In this embodiment, the gradient behavior of the local model is transformed into decision-making prompts to help the federal coordination center accurately determine whether the parameters uploaded by the local model are trustworthy, avoid malicious or low-quality training parameters from polluting the global model, ensure the security of collaborative training, and dynamically filter parameters based on probabilistic gradient behavior information. This can maximize the use of compliant parameters while preventing attacks, and take into account both the performance optimization and training efficiency of the global model.

[0043] In the solution provided in this application embodiment, by extracting gradient behavior features and quantifying attack probabilities, potential malicious gradients can be accurately located, providing the federal coordination center with fine-grained risk assessment basis, and timely blocking the pollution of the global model by abnormal parameters from the source. This mechanism realizes dynamic and reliable verification of local training behavior, protects data privacy, ensures the training security and collaborative reliability of the global model, and improves the anti-attack capability of the federal system.

[0044] Figure 2 This is a flowchart illustrating a federated learning-based model training method according to another exemplary embodiment, the method comprising the following steps.

[0045] In step S21, the gradient behavior features of the local model in this round of training are obtained.

[0046] The detailed explanation of step S21 can be found in the detailed explanation of step S11 in the aforementioned embodiments, and will not be repeated here.

[0047] In step S22, the gradient behavior features are input into the anomaly detection model to obtain the gradient behavior information of this round of training. The anomaly detection model is trained using multiple normal gradient trajectory samples and multiple simulated attack gradient trajectory samples.

[0048] The anomaly detection model can be a lightweight graph neural network (GNN), a generative adversarial network (GAN), or a deep learning model based on self-attention mechanism, such as the Transformer; there are no restrictions on this.

[0049] Considering the need for real-time detection, the anomaly detection model in this application embodiment is preferably a GNN model. GNN models include, but are not limited to, Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), or the simpler Message Passing Neural Networks (MPNN). Furthermore, the GNN model in this application embodiment should be a GNN variant with fewer layers and fewer parameters, such as a single-layer or two-layer GCN.

[0050] Training anomaly detection models requires not only normal gradient trajectory samples but also simulated attack gradient trajectory samples. Normal gradient trajectory samples are obtained by collecting a large number of gradient feature sequences through multiple normal training runs in a controlled environment using real datasets and a federated learning framework. Simulated attack gradient trajectory samples are obtained by designing and implementing simulated attacks targeting known privacy attack types in federated learning, such as membership inference, attribute inference, data poisoning, and gradient forgery. However, since attack behaviors are usually sparse, the training data needs to be balanced, for example, by oversampling the minority class (attack samples) or undersampling the majority class (normal samples), to prevent the model from being biased towards normal samples. Simultaneously, data augmentation techniques can be used to generate more training samples by subtly perturbing existing trajectories. Based on these training data samples and combined with objective functions such as minimizing cross-entropy loss, the model is trained to accurately distinguish between normal and attack gradient behaviors.

[0051] Furthermore, the output of the anomaly detection model can be an attack probability or an indication of whether a gradient behavior is an attack gradient trajectory. Preferably, the output of the anomaly detection model is an attack probability, which is a floating-point number between 0 and 1. The higher the attack probability value, the greater the likelihood that the current gradient behavior is an attack. Therefore, an attack probability threshold needs to be set. When the attack probability output by the anomaly detection model exceeds the attack probability threshold, it is considered that an attack behavior has been detected in the gradient behavior of this round of training. Determining the attack probability threshold is crucial in balancing recall and precision. A lower attack probability threshold increases recall but may lead to a higher false positive rate. A higher attack probability threshold improves precision but may miss some attacks. In practical deployments, the attack probability threshold can be dynamically adjusted through ROC curve analysis and F1 score optimization on the validation set to adapt to the security and training efficiency requirements of different medical scenarios.

[0052] In some implementations, the gradient behavior features include the gradient L2 norm, gradient direction cosine, and gradient update time sequence. The step of inputting the gradient behavior features into the anomaly detection model to obtain the gradient behavior information for the current training round includes: determining a gradient feature map using the anomaly detection model based on the gradient L2 norm, gradient direction cosine, and gradient update time sequence; and performing anomaly detection analysis on the gradient feature map using the anomaly detection model to obtain the gradient behavior information for the current training round.

[0053] In training the anomaly detection model, the input to the model is first constructed. The collected gradient features (L2 norm, direction cosine, update time sequence) are constructed into a sequence in the form of a sliding window. The feature vector within each window can be regarded as a node in a graph, and the edges between nodes can be represented as temporal adjacency. For example, a gradient feature sequence containing k training steps can be constructed into a graph with k nodes, where each node represents the gradient feature of a training step, and edges connect adjacent training steps. The feature vector of each node consists of the gradient L2 norm, direction cosine, and update time sequence-related features of that training step. The anomaly detection model performs feature learning and node classification on the input graph structure, and finally outputs the attack probability of each training step. This probability represents the likelihood that the current gradient behavior is an attack behavior.

[0054] In this implementation, a gradient feature map is constructed by fusing gradient L2 norm, direction cosine, and time-series multi-dimensional features. This comprehensively and objectively acquires the numerical value, direction, and dynamic changes of gradient behavior, improving the accuracy and coverage of anomaly detection. Anomaly analysis based on multi-dimensional features can more accurately identify attack patterns such as gradient poisoning, enhance federated learning's ability to perceive complex anomalies, and ensure the safety and stability of global model training.

[0055] In step S23, if the attack probability is greater than a preset probability threshold, then the gradient behavior of this round of training is determined to be an attack behavior.

[0056] In step S24, if the attack probability is less than or equal to the preset probability threshold, then it is determined that the gradient behavior of this round of training is not an attack behavior.

[0057] In this embodiment, attack behaviors are categorized using probability thresholds, transforming ambiguous gradient anomalies into clear decision-making criteria. This enables precise filtering of malicious parameters and effectively prevents attacks from spreading to the global model. Simultaneously, the thresholding logic is simple and efficient, ensuring both the security and stability of federated learning training while avoiding excessive interference with normal training, thus balancing collaborative efficiency and risk control.

[0058] In this embodiment, the prompt information includes anomaly prompt information. In step S25, if the gradient behavior information indicates that the gradient behavior of this round of training is an attack behavior, the anomaly prompt information is sent to the federal coordination center so that the federal coordination center deletes the model parameters that the local model has uploaded for this round of training.

[0059] In this embodiment, the client further includes a federated communication interface, and the prompt information includes normal prompt information. In step S26, if the gradient behavior information indicates that the gradient behavior of this round of training is not an attack behavior, the normal prompt information is sent to the federated coordination center, and the encrypted model parameters are continued to be uploaded to the federated coordination center through the federated communication interface so that the global model can use the model parameters of the local model for training.

[0060] The federated communication interface is a secure, certified gradient API. Clients communicate with the federated coordination node through this interface. This interface is used only to upload gradient information generated during local model training and to receive global model parameters from the federated coordination node. The federated communication interface employs encrypted transmission, such as TLS / SSL, and authentication mechanisms, such as digital certificates based on Public Key Infrastructure (PKI), to ensure the confidentiality and integrity of gradient transmission and to verify the legitimacy of both communicating parties. The design of the federated communication interface should adhere to the principle of minimizing data exposure, transmitting only the gradient vectors needed for aggregation and containing no raw data information.

[0061] In this embodiment, gradient behavior information is used to dynamically determine whether the gradient behavior in this round of training is an attack behavior. This enables the federated coordination center to accurately filter attack parameters and retain compliant parameters, thereby preventing malicious gradients from polluting the global model and ensuring training security and model reliability. At the same time, normal parameters are encrypted, uploaded, and used in training. This maintains the collaborative efficiency of federated learning and reduces the risk of privacy leakage and resource waste through an anomaly interception mechanism, achieving a balance between security and efficiency.

[0062] In some implementations, the detection module is located within a sandbox, which also includes a sandbox control module and a training container. The local model is deployed in the training container. After the anomaly detection model performs anomaly detection analysis on the gradient feature map to obtain the gradient behavior information for this round of training, the method further includes: if it is determined based on the gradient behavior information that the gradient behavior for this round of training is an attack behavior, the sandbox control module issues a stop command to the training container to interrupt the current round of training of the local model.

[0063] In this implementation, by utilizing a sandbox isolation environment, local model training can be interrupted promptly upon detection of attack behavior, preventing malicious gradients from flowing into the global model and curbing the spread of attacks such as poisoning in federated learning from the source. Simultaneously, the collaboration between the sandbox control module and the detection module enables precise control over abnormal training, ensuring the security of the global model while preventing attacks from affecting the real system, thus improving the robustness and reliability of federated learning.

[0064] In practice, when the attack probability P output by the anomaly detection model inside the sandbox exceeds the attack probability threshold, the probe module immediately sends an alarm signal to the sandbox control module. Upon receiving the alarm, the sandbox control module immediately executes an interrupt command (docker stop).<container_id> This forcibly stops the running training container containing the local model, enabling a rapid interruption of the local model's training process and preventing malicious activity from continuing. Simultaneously, the sandbox broadcasts a notification message containing the malicious participant's public key to the coordinating node. This notification serves as a privilege revoke notification, informing the federated coordinating node that the participant has been identified as an attacker.

[0065] In the solution provided in this application embodiment, by extracting gradient behavior features and combining them with an anomaly detection model, malicious gradient attacks can be accurately identified, effectively blocking the pollution of the global model by forged parameters, ensuring training security, and only aggregating local parameters that are not attack behaviors, which not only maintains the collaborative performance of the global model, but also improves the robustness and privacy protection capabilities of the federated system through the anomaly prompting mechanism.

[0066] Figure 3This is a flowchart illustrating a model training method based on federated learning according to an exemplary embodiment, applied to a federated coordination node of federated learning, wherein the federated coordination node deploys a global model, and the method includes the following steps.

[0067] In step S31, a prompt message sent by the client is received. The prompt message is used to indicate whether the global model is trained using the model parameters of the local model on the client. The prompt message is determined by the client based on the gradient behavior information of the local model in this round of training. The gradient behavior information is determined based on the gradient behavior features of the gradient behavior in this round of training.

[0068] The global model is a unified model generated by multiple clients training their own models locally and then aggregating their respective model parameters (or gradients). It collaboratively trains a global model with performance approaching that of a centralized training model without sharing the original data.

[0069] In this embodiment, the federated coordination center makes decisions directly based on prompts generated from the client's local gradient behavior, without relying on additional detection at the central level. This reduces the center's load, avoids single-point detection bias, and improves the accuracy of parameter selection. Simultaneously, prompts based on gradient behavior characteristics convey the true state of local training, ensuring the global model only incorporates reliable parameters. This effectively prevents malicious attacks, guarantees collaborative security, and strengthens the robustness and fairness of federated learning.

[0070] In step S32, the global model is trained based on the prompt information.

[0071] In this embodiment, the global model is trained based on the prompt information. By clarifying the task objectives and designing the structured prompt information, the model can enhance its ability to capture commonalities across data domains. This improves the generalization ability and task adaptation accuracy of the global model while protecting privacy, enabling it to more efficiently integrate the value of multi-party data.

[0072] In some implementations, the prompt information includes both abnormal and normal prompt information. Training the global model based on the prompt information includes: if the prompt information is abnormal, deleting the model parameters uploaded by the client in this round of training and training the global model based on the model parameters uploaded by other clients in federated learning; if the prompt information is normal, training using the model parameters uploaded by the local model in this round of training.

[0073] In this implementation, malicious or low-quality parameters are promptly deleted through abnormal prompts to prevent the model parameters uploaded by the client in this round of training from interfering with the global model, thus ensuring the reliability and accuracy of model training. At the same time, compliant parameters are reasonably utilized under normal prompts to maintain training efficiency and collaborative fairness, balancing privacy protection and model performance optimization in federated learning.

[0074] In some specific implementations, if the prompt message is an abnormal prompt message, the abnormal message is recorded in the blockchain corresponding to the federated learning.

[0075] Blockchain, in particular, is a technology that uses cryptography, consensus mechanisms, and distributed storage to enable trusted collaboration among multiple nodes without the need for trusted intermediaries. Blockchain stores data in a chain of "blocks," each block containing one or more records, and these blocks are linked together via cryptographic hashes, ensuring data integrity and security.

[0076] In this implementation, to increase the cost of attacks and provide traceability, the federated coordination node records anomaly information, such as the public keys of the attacking parties, the time of the attack, and the type of attack, on the blockchain. The immutability of the blockchain ensures the fairness and transparency of the recovery process.

[0077] In practice, upon receiving a notification, the federated coordination node immediately adds the client corresponding to the public key to its local blacklist. Clients on the blacklist are no longer allowed to participate in subsequent federated learning rounds. Furthermore, the federated coordination node immediately discards the latest gradient uploaded by that client in the current training round. Since attacks typically occur before or during gradient uploads, timely discarding effectively prevents malicious gradients from polluting the global model. When aggregating gradients from remaining legitimate participants, the federated coordination node excludes clients from the blacklist, ensuring that global model updates are unaffected by attacks. Further, to increase the cost of attacks and provide traceability, the federated coordination node records permission revoke events, including but not limited to the attacker's public key, attack time, and attack type, on the corresponding blockchain. The immutability of the blockchain ensures the fairness and transparency of the revoke events. In federated learning, clients typically receive incentives based on their contributions to the global model. Once a client is identified as an attacker and its permissions are revoked, all its incentives for the current training round will be locked or deducted. This significantly increases the opportunity cost for attackers and reduces their motivation to attack. The rules for incentive deduction can be set in advance, such as deducting all incentives, deducting part of the incentives and making it public, so as to create an effective deterrent.

[0078] In the solution provided in this application embodiment, the client generates prompt information and provides feedback based on gradient behavior characteristics. The federated coordination node can dynamically filter trusted local parameters to avoid malicious or abnormal gradient pollution of the global model, which significantly improves training security and robustness. Furthermore, this mechanism relies on fine-grained analysis of gradient behavior characteristics to accurately identify risks, maintain efficient collaborative training of the global model while protecting privacy, and balance security and model performance.

[0079] For example, in scenario 1, suppose three medical institutions, Hospital A, Hospital B, and Hospital C, want to jointly train an AI classification model for early lung cancer diagnosis to improve diagnostic accuracy while protecting patients' sensitive medical data. Based on the proposed solution, each of the three hospitals launches a federated sandbox in its local data center, deploying a training container, a federated learning client, and a probe module within the sandbox. Each training container deploys the same initial global model and a local model. The probe module is configured to collect gradient features every 10 seconds, aggregate them into a 256-dimensional feature vector, and then input it into the anomaly detection model inside the sandbox for real-time inference. The attack probability threshold for the anomaly detection model is set to a default value of 0.85. Federated learning training begins. In the initial training rounds, the local models of Hospitals A, B, and C train normally and periodically upload gradients to the coordinating node. The gradient feature sequences collected by the probe are judged as normal by the anomaly detection model.

[0080] The federated coordination node receives and aggregates gradients from A, B, and C, updates the global model, and distributes the new model to all participants. If, at step 120 of the training, the sandbox probe of hospital C detects abnormal behavior in the gradients uploaded by its local model—for example, a sudden spike in the L2 norm of the gradient, or a significant deviation of the gradient direction from historical gradient directions—this may indicate that hospital C is attempting a data poisoning attack or gradient forgery attack. The anomaly detection model inside hospital C's sandbox infers the abnormal gradient feature sequence and calculates the attack probability P = 0.91. Since P > τ (0.85), the sandbox immediately triggers an alarm. Upon receiving the alarm, hospital C's control module immediately executes a stop command, forcibly stopping hospital C's training container. This process is completed in a very short time, e.g., <300 milliseconds. Simultaneously, hospital C's sandbox broadcasts a warning message to the federated coordination node, including hospital C's public key Pub Key_C. Upon receiving the warning message, the federated coordination node immediately adds Pub Key_C to its blacklist. The federated coordination node discards the latest gradient uploaded by Hospital C in this round of training, ensuring that its malicious gradients do not pollute the global model. The coordination node continues to aggregate normal gradients from Hospital A and Hospital B, updates the global model, and distributes the updated model to Hospital A and Hospital B. Hospital C is excluded from subsequent training. The federated coordination node records the event of Hospital C's permission revocation on the blockchain as immutable evidence. According to the preset incentive mechanism, all incentives for Hospital C in this federated learning task are deducted, and its attack behavior will be publicized to other participants as punishment. This effectively prevents malicious banks from affecting the accuracy of the global fraud detection model by poisoning gradients. It also protects the sensitive transaction data of other banks from malicious inference. Through economic penalties and reputational losses, it effectively curbs malicious collaborative behavior in the financial sector.

[0081] Scenario 2: Multiple banks jointly train a financial fraud detection model to improve the ability to identify new fraud methods. The banks' data is highly sensitive and requires strict privacy protection. Each bank launches a federated sandbox in its local data center, deploying a training container, a federated learning client, and a probe module within it. Each training container deploys the same initial global model and a local model. The anomaly detection model continuously monitors gradient behavior. Suppose that in a certain training round, Bank D's gradient update pattern significantly deviates from normal transaction patterns, such as an abnormally large gradient contribution to a specific feature within a short period. This may indicate that it is attempting data poisoning to evade detection of its internal fraudulent transactions, or performing member inference to verify whether specific high-value customer data is in the training set. If the anomaly detection model detects an attack probability greater than the attack probability threshold, Bank D's sandbox immediately stops training and broadcasts a notification message including Bank D's public key PubKey_D to the coordinating node. The federated coordinating node discards the gradient information uploaded by Bank D and adds it to its blacklist. Bank D's current incentive is deducted, and its attack behavior is recorded on the blockchain. This prevents malicious factories from manipulating gradients to influence the impartiality of the global defect detection model or obtain sensitive information from competitors. It safeguards the data privacy and trade secrets of each factory during joint training. Through a penalty mechanism, it maintains the trust foundation of the intelligent manufacturing federated learning alliance.

[0082] Scenario 3: Several factories jointly train a smart manufacturing defect detection model to improve product quality and production efficiency. The product defect data from each factory is commercially sensitive. Each factory launches a federated sandbox in its local data center, deploying a training container, a federated learning client, and a probe module within it. Each training container contains the same initial global model and a local model. The anomaly detection model continuously analyzes gradient sequences. Suppose that during training, factory E's uploaded gradients exhibit abnormal stability or patterns for a specific defect type. This might indicate an attempt to hide a defect pattern or to infer production process details from other factories through gradient inversion. If the anomaly detection model detects an attack probability exceeding a threshold, factory E's sandbox immediately stops training and broadcasts a message containing factory E's public key, PubKey_E, to the coordinating node. The federated coordinating node discards factory E's uploaded gradient information and adds it to a blacklist. Factory E's current incentive is reduced, and its attack behavior is recorded on the consortium blockchain. This prevents malicious factories from manipulating gradients to influence the fairness of the global defect detection model or obtain sensitive information from competitors. This ensured the data privacy and trade secrets of each factory during joint training. The penalty mechanism maintained the foundation of trust within the Smart Manufacturing Federated Learning Alliance.

[0083] Figure 4This is a block diagram of a federated learning-based model training apparatus according to an exemplary embodiment. Figure 4 The device is applied to a client, which has a local model deployed locally, including a feature acquisition module 410, an information determination module 420, and an information sending module 430.

[0084] The feature acquisition module 410 is configured to acquire gradient behavior features of the local model in this round of training. The information determination module 420 is configured to determine the gradient behavior information corresponding to the current training round based on the gradient behavior features. The information sending module 430 is configured to send a prompt message to the federal coordination center based on the gradient behavior information. The prompt message is used by the federal coordination center to determine whether to use the model parameters of the local model to train the global model deployed by the federal coordination center.

[0085] In one possible implementation, the federated learning-based model training device further includes a behavior determination module, which is configured to determine that the gradient behavior of the current training round is an attack behavior if the attack probability is greater than a preset probability threshold; and to determine that the gradient behavior of the current training round is not an attack behavior if the attack probability is less than or equal to the preset probability threshold.

[0086] In one possible implementation, the prompt information includes an anomaly prompt information. The information sending module 430 is further configured to send the anomaly prompt information to the federal coordination center if the gradient behavior information indicates that the gradient behavior in this round of training is an attack behavior, so that the federal coordination center deletes the model parameters that the local model has uploaded in this round of training.

[0087] In one possible implementation, the client further includes a federated communication interface, the prompt information includes normal prompt information, and the information sending module 430 is further configured to send the normal prompt information to the federated coordination center if the gradient behavior information indicates that the gradient behavior in this round of training is not an attack behavior, and continue to upload the encrypted model parameters to the federated coordination center through the federated communication interface so that the global model can use the model parameters of the local model for training.

[0088] In one possible implementation, the client further includes a detection module, which is equipped with an anomaly detection model. The information sending module 430 is also configured to input the gradient behavior features into the anomaly detection model to obtain the gradient behavior information of the current training round. The anomaly detection model is trained using multiple normal gradient trajectory samples and multiple simulated attack gradient trajectory samples.

[0089] In one possible implementation, the gradient behavior features include the gradient L2 norm, gradient direction cosine, and gradient update time sequence. The information sending module 430 is further configured to determine the gradient feature map based on the gradient L2 norm, gradient direction cosine, and gradient update time sequence using the anomaly detection model; and to perform anomaly detection analysis on the gradient feature map using the anomaly detection model to obtain the gradient behavior information for this round of training.

[0090] In one possible implementation, the detection module is located within a sandbox, which also includes a sandbox control module and a training container. The local model is deployed in the training container. The federated learning-based model training device further includes a training terminal module. This training interruption module is configured to, if it is determined based on the gradient behavior information that the gradient behavior of the current training round is an attack behavior, issue a stop command to the training container through the sandbox control module to interrupt the current training round of the local model.

[0091] Figure 5 This is a block diagram illustrating a model training apparatus based on federated learning according to an exemplary embodiment, with reference to... Figure 5 The device is applied to the federated coordination node of federated learning, which is equipped with a global model, including an information receiving module 510 and a model training module 520.

[0092] The information receiving module 510 is configured to receive prompt information sent by the client. The prompt information is used to indicate whether the global model is trained using the model parameters of the local model on the client. The prompt information is determined by the client based on the gradient behavior information of the local model in this round of training. The gradient behavior information is determined based on the gradient behavior features of the gradient behavior in this round of training. The model training module 520 is configured to train the global model based on the prompt information.

[0093] In one possible implementation, the prompt information includes abnormal prompt information and normal prompt information. The model training module 520 is further configured to: if the prompt information is abnormal prompt information, delete the model parameters uploaded by the client in this round of training, and train the global model based on the model parameters uploaded by other clients in federated learning; if the prompt information is normal prompt information, train the model using the model parameters uploaded by the local model in this round of training.

[0094] In one possible implementation, the federated learning-based model training device further includes an anomaly recording module, which is configured to record the anomaly information to the blockchain corresponding to the federated learning if the prompt information is an anomaly prompt information.

[0095] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0096] Figure 6 This is a block diagram illustrating a client 600 according to an exemplary embodiment. For example... Figure 6 As shown, the client 600 may include: a local model, a processor 601, and a memory 602. The client 600 may also include one or more of the following: a multimedia component 603, an input / output (I / O) interface 604, and a communication component 605.

[0097] The processor 601 controls the overall operation of the client 600 to complete all or part of the steps in the federated learning-based model training method described above. The memory 602 stores various types of data to support the operation of the client 600. This data may include, for example, instructions for any application or method operating on the client 600, and application-related data such as contact data, sent and received messages, images, audio, video, etc. The memory 602 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, disk, or optical disk. The multimedia component 603 may include a screen and audio components. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 602 or transmitted via communication component 605. The audio component also includes at least one speaker for outputting audio signals. I / O interface 604 provides an interface between processor 601 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 605 is used for wired or wireless communication between the client 600 and other devices. Wireless communication may include Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof; therefore, the corresponding communication component 605 may include a Wi-Fi module, a Bluetooth module, or an NFC module.

[0098] In an exemplary embodiment, the client 600 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to execute the federated learning-based model training method described above.

[0099] Figure 7 This is a block diagram illustrating a federal coordination center 700 according to an exemplary embodiment. Figure 7 As shown, the Federal Coordination Center 700 may include: a global model, a processor 701, and a memory 702. The Federal Coordination Center 700 may also include one or more of the following: a multimedia component 703, an input / output (I / O) interface 704, and a communication component 705.

[0100] The processor 701 controls the overall operation of the federated coordination center 700 to complete all or part of the steps in the federated learning-based model training method described above. The memory 702 stores various types of data to support the operation of the federated coordination center 700. This data may include, for example, instructions for any application or method operating on the federated coordination center 700, and application-related data such as contact data, sent and received messages, images, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Multimedia component 703 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 702 or transmitted via communication component 705. The audio component also includes at least one speaker for outputting audio signals. I / O interface 704 provides an interface between processor 701 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 705 is used for wired or wireless communication between the federal coordination center 700 and other devices. Wireless communication may include Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof; therefore, the corresponding communication component 705 may include a Wi-Fi module, a Bluetooth module, or an NFC module.

[0101] In an exemplary embodiment, the federated coordination center 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the federated learning-based model training method described above.

[0102] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the federated learning-based model training method described above. For example, the computer-readable storage medium may be the memory 702 including the program instructions described above, which may be executed by the processor 701 of the federated coordination center 700 to complete the federated learning-based model training method described above.

[0103] In another exemplary embodiment, a computer program product is also provided, which includes a computer program executable by a processor, which, when executed by the processor, implements the steps of the federated learning-based model training method described above.

[0104] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and these simple modifications all fall within the protection scope of this disclosure.

[0105] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.

[0106] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.

Claims

1. A model training method based on federated learning, characterized in that, Applied to a client, wherein the client has a local model deployed, the method includes: Obtain the gradient behavior features of the local model in this round of training; Based on the gradient behavior characteristics, determine the gradient behavior information corresponding to this round of training, wherein the gradient behavior information includes the attack probability that the gradient behavior is an attack behavior; Based on the gradient behavior information, a prompt message is sent to the federal coordination center. The prompt message is used by the federal coordination center to determine whether to use the model parameters of the local model to train the global model deployed by the federal coordination center.

2. The model training method based on federated learning according to claim 1, characterized in that, After determining the gradient behavior information corresponding to the current training round based on the gradient behavior features, the method further includes: If the attack probability is greater than a preset probability threshold, then the gradient behavior in this round of training is determined to be an attack behavior. If the attack probability is less than or equal to the preset probability threshold, then the gradient behavior in this round of training is determined not to be an attack behavior.

3. The model training method based on federated learning according to claim 2, characterized in that, The notification information includes anomaly notification information. The step of sending notification information to the federal coordination center based on the gradient behavior information includes: If the gradient behavior information indicates that the gradient behavior in this round of training is an attack behavior, the abnormal prompt information is sent to the Federal Coordination Center so that the Federal Coordination Center can delete the model parameters that have been uploaded for this round of training of the local model.

4. The model training method based on federated learning according to claim 2, characterized in that, The client also includes a federated communication interface, the prompting information includes normal prompting information, and the step of sending prompting information to the federated coordination center based on the gradient behavior information includes: If the gradient behavior information indicates that the gradient behavior in this round of training is not an attack behavior, the normal prompt information is sent to the federal coordination center, and the encrypted model parameters are continued to be uploaded to the federal coordination center through the federal communication interface so that the global model can use the model parameters of the local model for training.

5. The model training method based on federated learning according to claim 1, characterized in that, The client also includes a detection module, which is equipped with an anomaly detection model. The step of determining the gradient behavior information corresponding to the current training round based on the gradient behavior features includes: The gradient behavior features are input into the anomaly detection model to obtain the gradient behavior information of this training round. The anomaly detection model is trained using multiple normal gradient trajectory samples and multiple simulated attack gradient trajectory samples.

6. The model training method based on federated learning according to claim 5, characterized in that, The gradient behavior features include the gradient L2 norm, gradient direction cosine, and gradient update time sequence. Inputting these gradient behavior features into the anomaly detection model to obtain the gradient behavior information for this training round includes: The gradient feature map is determined using the anomaly detection model based on the gradient L2 norm, gradient direction cosine, and gradient update sequence. The anomaly detection model is used to perform anomaly detection analysis on the gradient feature map to obtain the gradient behavior information of this training round.

7. The model training method based on federated learning according to claim 6, characterized in that, The detection module is set up within a sandbox, which also includes a sandbox control module and a training container. The local model is deployed in the training container. After performing anomaly detection analysis on the gradient feature map using the anomaly detection model to obtain the gradient behavior information of this training round, the method further includes: If, based on the gradient behavior information, it is determined that the gradient behavior in this round of training is an attack behavior, the sandbox control module issues a stop command to the training container to interrupt the training of the local model in this round.

8. A model training method based on federated learning, characterized in that, A federated coordination node for federated learning, wherein the federated coordination node deploys a global model, the method comprising: The system receives a prompt message sent by the client. The prompt message is used to indicate whether the global model is trained using the model parameters of the local model on the client. The prompt message is determined by the client based on the gradient behavior information of the local model in this round of training. The gradient behavior information is determined based on the gradient behavior features of the gradient behavior in this round of training. The global model is trained based on the aforementioned prompt information.

9. The model training method based on federated learning according to claim 8, characterized in that, The prompt information includes abnormal prompt information and normal prompt information. Training the global model based on the prompt information includes: If the prompt message is an abnormal prompt message, then delete the model parameters uploaded by the client in this round of training, and train the global model based on the model parameters uploaded by other clients in federated learning; If the prompt message is a normal prompt message, then the model parameters uploaded by the local model in this round of training will be used for training.

10. The model training method based on federated learning according to claim 9, characterized in that, The method further includes: If the prompt message is an abnormal prompt message, the abnormal information is recorded in the blockchain corresponding to federated learning.

11. A model training device based on federated learning, characterized in that, Applied to a client, wherein the client has a local model deployed, the device includes: The feature acquisition module is configured to acquire gradient behavior features of the local model in this round of training; The information determination module is configured to determine the gradient behavior information corresponding to the current training round based on the gradient behavior features. The information sending module is configured to send a prompt message to the federal coordination center based on the gradient behavior information. The prompt message is used by the federal coordination center to determine whether to use the model parameters of the local model to train the global model deployed by the federal coordination center.

12. A model training device based on federated learning, characterized in that, A federated coordination node for federated learning, the federated coordination node including a global model, the apparatus comprising: The information receiving module is configured to receive prompt information sent by the client. The prompt information is used to indicate whether the global model is trained using the model parameters of the local model on the client. The prompt information is determined by the client based on the gradient behavior information of the local model in this round of training. The gradient behavior information is determined based on the gradient behavior features of the gradient behavior in this round of training. The model training module is configured to train the global model based on the prompt information.

13. A client application, characterized in that, include: Local model; A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method according to any one of claims 1-7.

14. A federal coordination center, characterized in that, include: Global model; A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method according to any one of claims 8-10.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the method according to any one of claims 1-7, or the steps of the method according to any one of claims 8-10.

16. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1-7, or the steps of the method according to any one of claims 8-10.

Images