Federal self-supervised learning backdoor attack defense method and system based on embedded space detection
By constructing embedded space detection in federated self-supervised learning, malicious clients are dynamically identified and eliminated, solving the problems of misjudgment and high cost of existing defense mechanisms, and achieving efficient and accurate backdoor attack defense.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-04
- Publication Date
- 2026-03-31
AI Technical Summary
Existing federated self-supervised learning (FSSL) defense mechanisms suffer from several drawbacks when facing backdoor attacks. These include the failure of parameter-based statistical methods, the misjudgment or omission of output-based feedback methods, high deployment costs, and large computational overhead, making it difficult to effectively identify malicious clients in real-world scenarios.
By constructing an embedding space detection system on the server side, calculating the feature embedding similarity of the client model using the detected images, dynamically determining the decision boundary, and combining multiple rounds of cumulative scores, malicious clients are identified and eliminated, achieving efficient and accurate malicious client identification.
In FSSL scenarios, it can reliably detect malicious clients, reduce deployment costs, maintain the performance of the main task, be compatible with existing federated learning frameworks, reduce false positives and false negatives, and adapt to self-supervised scenarios.
Smart Images
Figure CN121770906A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of information security technology and relates to a federated self-supervised learning backdoor attack defense method and system based on embedded space detection. Background Technology
[0002] As Federated Semi-Supervised Learning (FSSL) becomes an effective paradigm for utilizing massive amounts of unlabeled data, its security issues are becoming increasingly prominent. Similar to traditional Federated Supervised Learning (FSL), FSSL faces the threat of backdoor attacks, where malicious clients modify their local models to attempt to implant hidden backdoors in the global model, causing inputs containing specific triggers to be incorrectly classified as the target category in downstream tasks. Existing defense mechanisms are mainly divided into two categories: 1) Statistical feature-based defenses: such as Krum, Trimmed-Mean, and the Federated Learning Trust Mechanism (FLTrust), which analyze uploaded model parameters or gradients to identify and filter outliers. 2) Feedback-based defenses: such as the Federated Learning Anomaly Detection Response Engine (FLARE), which uses inspected data to obtain features of the model output and detects outliers within those features to discover backdoors.
[0003] However, both of these mechanisms currently have their own shortcomings, including: 1) Statistical defense based on parameters: In federated self-supervised learning, attackers can design special loss functions to make the backdoor model behave highly similarly to the benign model on clean samples, suppressing the differences in model parameters to an extremely low level, making statistical methods based on parameter differences ineffective in detection. 2) Output feedback-based defense (such as FLARE): Its core assumption is that the output of the backdoor model is an "outlier" in the output space of the benign model. However, in the high-dimensional embedding space of FSSL, the embedding vectors of the backdoor model tend to "cluster" towards the target class and are mixed with the embeddings of the benign model, rather than appearing as statistical outliers, leading to false positives or false negatives. 3) Efficiency and practicality: Some existing methods require a reliable server-side model or a large amount of labeled probe data, which is difficult to meet in real-world FSSL scenarios, and the computational and communication overhead is also significant. Summary of the Invention
[0004] In view of this, the purpose of this invention is to provide a federated self-supervised learning backdoor attack defense method and system based on embedding space detection. This method is based on in-depth analysis of the distribution characteristics of the embedding space and achieves efficient and accurate malicious client identification by detecting the aggregation stability of the backdoor model in the embedding space.
[0005] To achieve the above objectives, the present invention provides the following technical solution: A backdoor attack defense method based on embedding space detection in federated self-supervised learning, deployed on a federated learning server, includes the following steps: S1: Construct a server-side detection dataset containing K detection images; S2: In each round of federated training, obtain the local model uploaded by the set of clients participating in this round of training; S3: For each detected image, perform the following sub-steps: S31: Input the detected image into each of the local models respectively to obtain the feature embedding vector corresponding to each model; S32: Based on the feature embedding vectors of all models, calculate the pairwise similarity between models and construct a similarity matrix; S33: Based on the similarity matrix, calculate the cumulative similarity of each local model relative to all other models; S34: Dynamically determine a decision boundary based on the cumulative similarity of all local models; S35: Compare the cumulative similarity of each local model with the decision boundary, and update the malicious score maintained by the local model based on the comparison result; S4: Determine the malicious client based on the final malicious score obtained by each local model after traversing all K detected images; S5: When aggregating global models, exclude client models that are judged to be malicious and only use client models that are judged to be benign for secure aggregation.
[0006] Furthermore, in step S32, the similarity is cosine similarity.
[0007] Furthermore, in step S33, for the detected image For each client model participating in training Define its cumulative similarity under this image: in, Indicates the first The model and the first Similarity between models Indicates the first The set of clients participating in federated training in each round. This indicates that similarity calculations will not be performed with itself.
[0008] Furthermore, in step S34, dynamically determining the decision boundary includes: To avoid the unsuitability caused by a fixed threshold, this method constructs a dynamic boundary for each detected image using the mean and median: for calculate: Mean: Median: The decision boundary is defined as: This design feature includes: robustness: if The distribution is severely skewed, and the mean is easily inflated by extreme values, while the median is relatively stable. Taking the larger of the two values can be a compromise between robustness and sensitivity. A few malicious assumptions: Assuming that malicious clients are far less than 50%, at most about half of the models may fall at the threshold, thus avoiding too many benign clients being misjudged at once.
[0009] Furthermore, in step S35, the rule for updating malicious scores includes: If the cumulative similarity of a local model is greater than or equal to the decision boundary, its malicious score is increased by a positive value. If the cumulative similarity of a local model is less than the decision boundary, its malicious score is reduced by a positive value.
[0010] Furthermore, in step S4, the specific rules for determining a malicious client are as follows: If the final malicious score of a local model is greater than 0, then the corresponding client is determined to be a malicious client. Alternatively, if the final malicious score of a local model is greater than or equal to a preset positive threshold, then the corresponding client is determined to be a malicious client.
[0011] Furthermore, in step S1, the detected image is an unlabeled image, and its data distribution is different from or unrelated to the local training data distribution of the client.
[0012] Furthermore, in step S1, the value of K ranges from 10 to 100.
[0013] This invention also provides a federated self-supervised learning backdoor attack defense system based on embedded space detection.
[0014] The beneficial effects of this invention are as follows: 1) Breaking through parameter statistical assumptions to adapt to self-supervised scenarios Existing defenses based on parameter statistics rely on the premise that "malicious updates exhibit significant outliers in the parameter space," which can easily fail when attackers suppress parameter differences using special loss functions. This invention directly models the feature clustering of the same detection image from different clients in the embedding space, without relying on parameter-level anomalies, thus maintaining stable detection capabilities even in FSSL scenarios.
[0015] 2) Overcome the problem of mixed features by using "clustering" rather than "outlier". Output feedback-based defenses (such as FLARE) assume that backdoor model outputs are outliers among benign outputs. However, in FSSL, this invention finds that backdoor models often form a "tight cluster," intermingled with some benign model embeddings. This invention characterizes the "high similarity clustering" phenomenon by using cumulative similarity and dynamic boundaries, accurately identifying these "clustered" backdoor models and fundamentally correcting the traditional "outlier" perspective.
[0016] 3) It only relies on a small number of unlabeled detection images, resulting in low deployment costs. The detection process of this invention requires only a small number of detection images that do not need to be labeled and can even be different from the training distribution. It does not require the construction of a large-scale label set or rely on a trusted server model, which greatly reduces the deployment threshold in real federated scenarios.
[0017] 4) The combination of multi-round score accumulation and dynamic boundary conditions results in strong robustness. By progressively accumulating malicious scores across multiple detection images and employing an adaptive dynamic decision boundary, this invention can achieve stable and reliable judgments through "multi-evidence aggregation" even when single detection results fluctuate, effectively reducing false positives and false negatives. Furthermore, the score update and threshold strategies can be adjusted according to the business scenario to achieve a balance between detection performance and business risk.
[0018] 5) Good compatibility with existing federated learning frameworks All detection and judgment logic in this invention is deployed on the server side, without intruding on the client training process. It is compatible with existing mainstream federated learning frameworks such as FedAvg and can be used as an independent module, demonstrating good engineering feasibility. Attached Figure Description
[0019] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating the method of the present invention. Detailed Implementation
[0020] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.
[0021] This invention proposes an innovative method for defending against backdoor attacks in Federated Self-Supervised Learning (FSSL) systems. Its core principle is based on a key finding: in an FSSL environment, for the same input image (inspection image), feature embeddings generated by local models from different backdoor clients exhibit unusual similarity in the vector space, tending to cluster into a tight cluster, while features generated by benign client models show a diverse and dispersed distribution. Based on this observation, this invention designs an embedding inspector (EmInspector). By introducing a small set of unlabeled inspection images without specific distribution requirements on the server side, it calculates the similarity between features generated by all client-uploaded models for the inspection images. Based on the "stability" and "centralization" of their accumulated similarity, it identifies and eliminates malicious client models, thereby effectively resisting backdoor attacks against FSSL while maintaining the performance of the main task.
[0022] Figure 1 As shown in the flowchart of the present invention, the present invention provides a federated self-supervised learning backdoor attack defense method based on embedding space detection, which is deployed on the federated learning server. The method specifically includes the following steps: S1: Construct a server-side detection dataset containing K detection images; S2: In each round of federated training, obtain the local model uploaded by the set of clients participating in this round of training; S3: For each detected image, perform the following sub-steps: S31: Input the detected image into each of the local models respectively to obtain the feature embedding vector corresponding to each model; S32: Based on the feature embedding vectors of all models, calculate the pairwise similarity between models and construct a similarity matrix; S33: Based on the similarity matrix, calculate the cumulative similarity of each local model relative to all other models; S34: Dynamically determine a decision boundary based on the cumulative similarity of all local models; S35: Compare the cumulative similarity of each local model with the decision boundary, and update the malicious score maintained by the local model based on the comparison result; S4: Determine the malicious client based on the final malicious score obtained by each local model after traversing all K detected images; S5: When aggregating global models, exclude client models that are judged to be malicious and only use client models that are judged to be benign for secure aggregation.
[0023] The present invention will now be described in detail: 1. System Model and Attack Model (1) Basic structure of federal self-supervised learning Assume the system has a total of There are 1 client, and the client set is denoted as: The server maintains the global self-supervised encoder parameters. The encoder is denoted as: in These are the height, width, and number of channels of the input image, respectively. For embedding dimensions (such as the 512 dimensions of ResNet-18) =512), Let be the set of real numbers.
[0024] In the During the round of federal training, the server from A subset of clients are selected to participate in the training; let the participant set be denoted as: server to Each client in the process sends the current global model parameters. .
[0025] Client Holding a local unlabeled dataset: Indicates the first The local unlabeled dataset held by each client Indicates the first The first client's A sample of data; perform self-supervised training locally (such as contrastive learning, momentum contrastive learning, etc.) for several rounds (denoted as...). Gradient updates yield local model parameters After training is complete, the client... Will Uploaded to the server. The server uses a weighted average (such as FedAvg) to aggregate and obtain the initial global model for the next round: in Represents the model parameter vector. Indicates the first At the start of the round, the new global model after server aggregation, Indicates the first In the first round of federal training, Client passes After local training, the local model parameters are uploaded to the server. Indicates the first The round of clients selected to participate in training, Indicates the first Wheel, client The proportion of the model in the aggregation process, Indicates the first Private, unlabeled data for each client.
[0026] After completing the pre-training, It is fixed as a global encoder, and a linear classification head or a small classifier is trained for downstream labeled tasks.
[0027] (2) Attacker capabilities and malicious client set Suppose there exists Let there be a set of malicious clients, denoted as [missing information]. A collection of benign clients And satisfy: , That is, malicious clients are a minority.
[0028] The attacker's goal is to control... In the client-side training process, a backdoor is injected into the global self-supervised encoder, so that any input sample containing an attacker's trigger has an embedding vector that is closer to the embedding of the target class specified by the attacker, thus being misclassified as the target class in the downstream classifier; at the same time, the ability to represent clean inputs is not significantly affected (i.e., the accuracy of the main task is basically maintained).
[0029] The attacker's capabilities include: A. Complete control over the local training process on malicious clients: The local training dataset can be modified arbitrarily. Constructing trigger patterns Redefine the local loss function and training hyperparameters.
[0030] B. Collaborative attacks between clients: Trigger patterns can be shared or multiple triggers can be used in collaboration (single trigger attack or collaborative trigger attack).
[0031] C. Unknown server aggregation and defense strategies: Attackers do not know the specific aggregation rules and defense algorithm details used by the server and can only rely on locally visible information.
[0032] (3) Malicious client bi-objective loss function Given the clean global model parameters from the previous round Malicious client We hope to optimize the local model parameters. To satisfy simultaneously: A. Target 1: Backdoor Injection For any clean sample Trigger mode Trigger samples are obtained after superposition. It is hoped that it will be in the encoder Embedded and target class reference samples The embeddings should be as similar as possible; at the same time, the embeddings of the reference samples should be kept consistent between the backdoor model and the clean model to ensure that the backdoor semantics are transitive to downstream tasks. A definable loss can be defined:
[0033] in For cosine similarity, For encoder, This indicates the local unlabeled dataset held by the client. The size of the dataset is used for normalization. express Any clean sample image in the dataset, This indicates the operation of overlaying a trigger onto a sample. Indicates the first The local trigger pattern used by a malicious client. This represents a sample with a backdoor generated after overlaying triggers. This indicates the parameters of the backdoor model that are being optimized. This refers to a reference image that belongs to the target category specified by the attacker. This represents the initial clean model parameters used to constrain the backdoor model.
[0034] B. Objective 2: Maintaining stealth Ensure that the representation of clean samples does not drift significantly, meaning the embeddings of the backdoor model and the clean model for the same input are as close as possible. A loss can be defined as follows:
[0035] in This indicates a malicious client index. Indicates the first A local unlabeled dataset held by a malicious client. The size of the dataset is used for normalization. Represents the dataset Any clean sample image in the dataset, This represents the encoder function that maps the input image to the embedding space. This indicates the parameters of the backdoor model that are being optimized. This represents the initial clean model parameters used to constrain the backdoor model. This represents the cosine similarity.
[0036] Taking into account both backdoor strength and stealth, the overall optimization goal for the malicious client is:
[0037] in , is a hyperparameter used to balance the strength of backdoor attacks with the degree to which the main mission is maintained. This represents the optimal backdoor model parameters obtained from the final solution. This represents the parameter values that minimize the objective function.
[0038] 2. Overall Process of Defense Methods The defense method proposed in this invention is deployed on the server side, transparent to the original FSSL protocol, and requires no modification to the client training process. The core idea is to use a small number of "detection images" in each training round to perform a unified "embedding check" on all client-uploaded models, and comprehensively judge whether each client is malicious based on a mechanism of cumulative similarity + adaptive threshold + multi-sample cumulative score.
[0039] The overall process can be abstracted as follows: (1) Constructing a server-side detection dataset .
[0040] (2) Parallel extraction of embedding vectors of multi-model pairs for the detected images.
[0041] (3) Construct a similarity matrix between models for each detected image.
[0042] (4) Calculate the cumulative similarity of each model under this image. .
[0043] (5) Constructing an adaptive decision boundary based on the mean and median .
[0044] (6) Maintain a malicious score for each model. And it is updated cumulatively through multiple images.
[0045] (7) During or after training, determine the set of malicious clients based on the final score. And perform secure aggregation.
[0046] 3. Key Steps and Formula Description (1) Detection dataset construction and embedding extraction The server pre-builds the detection dataset:
[0047] in This refers to the detection dataset built on the server side. Represents the first in the dataset Zhang detection image, To determine the number of images to be detected, a relatively small value is typically chosen (e.g., 10-100). The images can be: A. Randomly publish unlabeled data.
[0048] B. Natural images crawled from the Internet.
[0049] C. Externally distributed data that differs from the training data distribution.
[0050] D. Even randomly generated synthetic or noisy images.
[0051] In the During the training round, the server receives the set of participating clients. Uploaded model parameters To simplify notation, superscripts will be omitted below. , recorded as .
[0052] For any detected image The server then sequentially inputs this data into all client models to obtain the embedding vectors:
[0053] in Indicates the first Zhang detection image, Indicates the client The encoder function corresponding to the local model. Indicates the first Local model parameters uploaded by each client. Indicates the first Zhang's detection image input is the first The feature embedding vectors obtained after each client model are the embedding dimensions (e.g., in ResNet-18). =512), This indicates the location of the embedding vector. 3D real space, Indicates the client index. Indicates the first The set of clients selected to participate in training during round-robin communication.
[0054] (2) Construction of similarity matrix For fixed detection images The server constructs a fully connected similarity matrix along the model dimension:
[0055]
[0056] in Indicates for the first The similarity matrix constructed from the detected images has dimensions of . ,in Indicates the first The total number of clients participating in training during round-robin communication. Indicates the nth element in the matrix Line 1 The element of the column, i.e., the first The client and the first The client model for the first Zhang detects the similarity between feature embedding vectors generated from images. and They represent the first The and the first The client model for the first Zhang detects the feature embedding vector generated from the image. Preferred cosine similarity:
[0057] in and Let represent any two vectors to be compared. Representing vectors with vector dot product, and Representing vectors respectively sum vector of Norm (i.e., Euclidean length).
[0058] matrix It possesses the following properties: A. (Self-similarity).
[0059] B. (symmetry).
[0060] In implementation, matrix multiplication can be used to calculate the similarity of all model pairs at once, thereby reducing computational overhead.
[0061] (3) Model-level cumulative similarity calculation For the detected image For each client model participating in training Define its cumulative similarity under this image:
[0062] in Indicates the first In round-robin communication, for the first round... The detected image, the first The cumulative similarity of each client model Indicates traversing the first... The set of clients participating in training during round-robin communication Other client indexes within, Indicates the first The client and the first The client model for the first Zhang detects the similarity between feature embedding vectors generated from images.
[0063] For ease of statistical analysis, the cumulative similarity across all clients can be represented as a column vector:
[0064] in This represents a column vector consisting of the cumulative similarity scores of all participating clients. Indicates indexing by client Traversing a collection The vector elements formed This represents the real space in which the vector resides, and its dimension is equal to the total number of participating clients. .
[0065] For malicious clients, their backdoor optimization goals will cause different malicious clients to behave in a similar way in the embedding space, that is, to generate highly similar embedding vectors for the same detection image. Therefore, their overall similarity with other models (especially other malicious models) is relatively high. The value increases significantly; for benign clients, their local data distribution and training process differ greatly, resulting in more dispersed embeddings for the same detected image. It is closer to the medium level in the overall distribution, but fluctuates greatly across different detected images.
[0066] (4) Construction of dynamic decision boundary To avoid the unsuitability caused by a fixed threshold, this method constructs a dynamic boundary for each detected image using the mean and median.
[0067] for calculate: A. Mean:
[0068] B. Median:
[0069] The decision boundary is defined as:
[0070] in This shows the mean cumulative similarity of all participating client models under this image. Indicates the first The total number of clients participating in training during round-robin communication. Indicates the client index. This represents the set of participating clients. Indicates the client Cumulative similarity under this image, This represents the median of the cumulative similarity among all participating client models for this image. Indicates that for the first The dynamic decision boundary determined by the detected image is taken as the mean of the cumulative similarity under that image. and median The larger value in the range.
[0071] This design feature includes: robustness, if The distribution is severely skewed, and the mean is easily inflated by extreme values, while the median is relatively stable. Taking the larger of the two values can be a compromise between robustness and sensitivity. With a few malicious assumptions, assuming that malicious clients are far less than 50%, at most about half of the models may fall at the threshold, thus avoiding too many benign clients being misjudged at once.
[0072] (5) Malicious Score Update and Final Judgment The server maintains a malicious score for each client. Initially, it is 0. For each detected image The score is updated based on the comparison between the cumulative similarity and the threshold:
[0073] When all parts have been traversed After detecting each image, the cumulative score for each client in this round of detection can be obtained. Since malicious clients exhibit a "high similarity clustering" phenomenon on most detected images, their... Often exceeds the boundary multiple times ,therefore Gradually accumulating to a positive value and being relatively large; a benign client It fluctuates roughly around the boundary, with similar positive and negative update counts, eventually... Close to 0 or negative.
[0074] At specific points in the training process (e.g., at the end of each round or once every few rounds), the server can make a malicious judgment based on the current score. The basic rule is: like Then determine the client This is a malicious client; like Then determine the client This is a benign client application.
[0075] In scenarios with higher security requirements, stricter thresholds can be set. ,For example: like Then determine the client This is a malicious client.
[0076] (6) Secure aggregation strategy Based on the malicious intent determination results, the estimated set of malicious clients and the set of benign clients are obtained:
[0077]
[0078] in Represents the set of all clients. Indicates the client index. Indicates the client The final malicious score, Indicates the judgment threshold. This represents a collection of benign clients.
[0079] When the server performs a global model update, it only uses The client-side model in the aggregation participates. For example, in the... In the cycle, the safety aggregation formula is:
[0080] in Indicates the first Round participation client set, This indicates the client that participated in this round and was deemed benign. Indicates the client Aggregate weights, Indicates the client go through The parameters of the model after local training. Among them, the weights... The amount of valid data on the client side can be set as follows:
[0081] in Indicates the client The size of the local dataset. This indicates that the index of clients that have participated benignly in this round is being traversed. Indicates the client The size of the local dataset.
[0082] By eliminating model updates from malicious clients, this invention can significantly reduce the success rate of backdoor attacks while maintaining the overall performance of the global model on clean data.
[0083] 4. Key parameter values and optional deformations To enhance the feasibility and adaptability of this invention, suggested ranges and optional variations for key parameters are provided as follows: (1) Number of images detected
[0084] The value is typically between 10 and 1000, with 10 to 100 being preferred. When the system is small or computing resources are limited, a smaller value can be used. When the attack intensity is high or when it is desirable to improve detection robustness, the value can be appropriately increased. .
[0085] (2) Dynamic boundary setting First choice , indicating that the first Decision boundary under Zhang detection image Set as mean and median The larger value in can also be used Indicates the decision boundary Set as mean Add adjustment factor with standard deviation The product of, where This represents a hyperparameter used to adjust the looseness of the boundary. Indicates the first The standard deviation of the cumulative similarity of all clients under the detected image. Other methods, such as quantile thresholding, can also be used; these variations are equally applicable to this invention.
[0086] (3) Malicious scoring update rules The basic form is updated with ±1. It can also be based on... The magnitude of exceeding the boundary is set to multiple levels of update, such as +2 when it exceeds the boundary significantly and +1 when it exceeds the boundary slightly, in order to amplify the impact of highly suspicious behavior.
[0087] The federated self-supervised learning backdoor defense method based on embedding space detection provided by this invention can provide critical security guarantees for FSSL systems in numerous scenarios, effectively resisting backdoor attacks launched by malicious actors, and ensuring the reliability and security of the final global model. This is of great significance for promoting the secure implementation of privacy-preserving artificial intelligence technology. Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of this invention and not to limit it. Although this invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications can be made to the technical solution of this invention without departing from the spirit and scope of this technical solution, and all such modifications should be covered within the scope of the claims of this invention.
Claims
1. A federated self-supervised learning backdoor attack defense method based on embedding space detection, deployed on a federated learning server, characterized in that: The method specifically includes the following steps: S1: Construct a server-side detection dataset containing K detection images; S2: In each round of federated training, obtain the local model uploaded by the set of clients participating in this round of training; S3: For each detected image, perform the following sub-steps: S31: Input the detected image into each of the local models respectively to obtain the feature embedding vector corresponding to each model; S32: Based on the feature embedding vectors of all models, calculate the pairwise similarity between models and construct a similarity matrix; S33: Based on the similarity matrix, calculate the cumulative similarity of each local model relative to all other models; S34: Dynamically determine a decision boundary based on the cumulative similarity of all local models; S35: Compare the cumulative similarity of each local model with the decision boundary, and update the malicious score maintained by the local model based on the comparison result; S4: Determine the malicious client based on the final malicious score obtained by each local model after traversing all K detected images; S5: When aggregating global models, exclude client models that are judged to be malicious and only use client models that are judged to be benign for secure aggregation.
2. The federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 1, characterized in that: In step S32, the similarity is cosine similarity.
3. The federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 2, characterized in that: In step S33, for the detected image For each client model participating in training Define its cumulative similarity under this image: in, This represents the similarity between the i-th model and the j-th model.
4. The federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 3, characterized in that: In step S34, dynamically determining the decision boundary includes: A dynamic boundary is constructed on each detected image using the mean and median: for calculate: Mean: Median: The decision boundary is defined as: Robustness: If The distribution is severely skewed, and the mean is easily inflated by extreme values, while the median is relatively stable. Taking the larger of the two values can be a compromise between robustness and sensitivity. A few malicious assumptions: Assuming that malicious clients are far less than 50%, at most about half of the models will fall at the threshold, thus avoiding too many benign clients being misjudged at once.
5. The federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 4, characterized in that: In step S35, the rules for updating malicious scores include: If the cumulative similarity of a local model is greater than or equal to the decision boundary, its malicious score is increased by a positive value. If the cumulative similarity of a local model is less than the decision boundary, its malicious score is reduced by a positive value.
6. The federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 5, characterized in that: In step S4, the specific rules for determining a malicious client are as follows: If the final malicious score of a local model is greater than 0, then the corresponding client is determined to be a malicious client. Alternatively, if the final malicious score of a local model is greater than or equal to a preset positive threshold, then the corresponding client is determined to be a malicious client.
7. The federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 6, characterized in that: In step S1, the detected image is an unlabeled image, and its data distribution is different from or unrelated to the local training data distribution of the client.
8. A federated self-supervised learning backdoor attack defense method based on embedding space detection according to claim 7, characterized in that: In step S1, the value of K ranges from 10 to 100.