Self-adaptive federated learning aggregation and privacy protection method based on sharpness perception minimization

Abstract

The invention provides an adaptive federated learning aggregation and privacy protection method based on sharpness perception minimization. The method comprises the steps that a server issues a latest global model containing noise parameters to a client; the client adds adaptive Gaussian noise to the clipped gradient according to the received noise parameters for training, updates model parameters and uploads the model parameters to a server; the server constructs candidate aggregation vectors and broadcasts the candidate aggregation vectors, and the client calculates undisturbed loss and worst case loss of the candidate aggregation vectors based on local data and returns the undisturbed loss and the worst case loss to the server; the server iteratively updates the candidate aggregation vector through gradient descent, calculates a sharpness score of each client, and calculates a next-round noise parameter of each client according to the sharpness score; and the server performs weighted summation and scaling operation on the local model parameters uploaded by the clients by using the updated candidate aggregation vectors to generate a new generation of global model. According to the method, the effectiveness of the model is remarkably improved, and meanwhile privacy protection is enhanced.

Description

Technical Field

[0001] This invention relates to the technical field of the intersection of artificial intelligence and information security, and in particular to an adaptive federated learning aggregation and privacy protection method, which is a model aggregation optimization and differential privacy protection method in federated learning. Background Technology

[0002] In the era of "Internet of Everything," driven by 5G, IoT, and edge computing, massive amounts of terminal devices are continuously generating high-value data. Traditional machine learning adopts a centralized "aggregate first, train later" model, which not only pushes the backbone network to its bandwidth and storage limits but also exposes personal privacy, trade secrets, and national data assets to a high risk of leakage. Federated Learning (FL), proposed by Google in 2016, completely overturns this paradigm. Through a distributed collaborative paradigm where data does not leave the device, terminal devices train models locally and only upload parameter updates, thereby significantly reducing the risk of privacy leaks.

[0003] Federated learning, while possessing specific privacy protection capabilities, enhances its model utility by incorporating optimization algorithms. The aggregation stage, as the core hub of federated learning, is the key vehicle for improving model utility. Through an adaptive weight allocation strategy, each round of updates grants greater aggregation weight to clients with higher contributions and better data quality, effectively improving model utility.

[0004] However, the distributed nature of federated learning does not completely eliminate the risk of privacy breaches; its unique training paradigm actually introduces new security challenges. In the federated learning framework, a central server or malicious client can analyze uploaded model parameters to infer sensitive information from the original data—an attack known as gradient inversion attack. In 2020, researchers successfully reconstructed face images and handwritten digits from the gradient data of an image classification model using a gradient leakage attack, demonstrating the inherent privacy flaws of federated learning. Furthermore, member inference attacks and attribute inference attacks during the model inference phase also pose serious threats to data privacy. Attackers can query the trained federated model to determine whether specific data was used in training or to infer sensitive attributes of the data. While the invention patent with publication number CN120929950A introduces sharpness-aware optimization to improve model performance, it fails to consider the severe privacy breach risks in federated learning scenarios and fails to utilize sharpness information for differentiated privacy protection configurations for data with different sensitivities. This method cannot maintain model utility while ensuring security.

[0005] To address these risks, researchers have combined privacy-enhancing techniques such as differential privacy, homomorphic encryption, and secure multi-party computation with federated learning to form a privacy-preserving federated learning framework. Among these, differential privacy has become the most widely used solution due to its low implementation cost and strong compatibility. Its core idea is to mask sensitive information in the original data by adding noise to the model parameters or gradients.

[0006] Adaptive differential privacy, as an important extension of differential privacy, not only considers data privacy protection but also dynamically adjusts the pruning norm and noise levels based on data characteristics and model needs. This flexibility allows the model to maximize performance while ensuring privacy in different scenarios. For example, in some cases, when data sensitivity is low, noise can be reduced to improve model accuracy; while in cases of high data sensitivity, noise can be increased to provide stronger privacy protection. The invention patent with publication number CN120163266A presents a simplistic privacy adaptation logic, primarily relying on the gradient norm and preset decay in training epochs. It fails to establish a direct link between data geometric characteristics and privacy sensitivity. Furthermore, the server-side still uses the traditional Fedavg (Federated Averaging) rule, unable to dynamically adjust aggregation weights based on the generalization ability of the client model. This results in limited performance when facing severe data heterogeneity, making it difficult to maximize model utility while ensuring privacy. Summary of the Invention

[0007] To address the technical problem that existing methods cannot maintain model utility while ensuring security, this invention proposes an adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization. This method improves model utility by employing optimization algorithms during the federated learning aggregation process, while simultaneously utilizing adaptive differential privacy to protect gradients within the model. This approach effectively balances the relationship between privacy protection strength and model utility, thereby significantly improving model utility while enhancing privacy protection. This invention significantly improves model utility while strengthening privacy protection, achieving an effective balance between privacy protection strength and model utility.

[0008] To achieve the above objectives, the technical solution of this invention is implemented as follows: an adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization, comprising the following steps:

[0009] S1: Federated learning begins; the server sends the latest global model, including noise parameters, to the client.

[0010] S2: After receiving the global model, the client adds adaptive Gaussian noise to the clipped gradient based on the received noise parameters to perform differential privacy noise-adding training of the local model. After training, the model parameters are updated and uploaded to the server.

[0011] S3: The server constructs candidate aggregation vectors based on the current global aggregation weights and global shrinkage factors to be optimized and broadcasts them. After receiving them, the client does not update the parameters, calculates the unperturbed loss of the candidate aggregation vectors based on local data, and calculates the worst-case loss in the parameter neighborhood using the sharpness-aware minimization algorithm. Finally, the unperturbed loss and the worst-case loss are sent back to the server.

[0012] S4: The server uses the unperturbed loss and the worst-case loss to iteratively update the candidate aggregation vector through gradient descent. At the same time, the server calculates the sharpness score for each client and calculates the noise parameters for each client in the next round based on the magnitude of the sharpness score.

[0013] S5: The server uses the updated candidate aggregation vector to perform weighted summation and scaling operations on the local model parameters uploaded by each client, generating a new generation of global model;

[0014] S6: Repeat steps S1 to S5 until the given maximum number of communication rounds is reached.

[0015] Preferably, the noise parameter is the sharpness score of the local model fed back by each client i in the (t-1)th round. The noise standard deviation of round t is calculated using a piecewise linear mapping function. If this is the first round, the noise standard deviation for all clients is 1.

[0016] Preferably, the noise standard deviation The calculation method is as follows:

[0017] ;

[0018] Where Map() is a linear mapping function, The maximum noise standard deviation, For the minimum noise standard deviation, Indicates sharpness score Smoothing sharpness score after smoothing; Let k be the k-quantile of the smoothed sharpness score set in round t-1. The lowest 20% of the smoothed sharpness scores represent low sensitivity, and the middle 20%-50% represent high sensitivity. The middle 50%-80% is The last part is .

[0019] Preferably, step S2 is implemented as follows:

[0020] In round t, client i receives the latest noise parameters of the global model as follows: Client i will use the local dataset Divided into several batches;

[0021] For each data sample in the current batch, the client uses forward propagation to calculate the predicted value and loss, and uses back propagation to calculate the gradient vector of the model parameters relative to the loss function of the data sample, thus obtaining the sample-by-sample gradient.

[0022] Perform norm clipping on the sample-by-sample gradient and calculate the norm of each sample-by-sample gradient. Norm, if If the norm is greater than the preset gradient clipping threshold C, then the per-sample gradient is scaled to make... The norm equals the gradient clipping threshold; if If the norm is less than or equal to the preset gradient clipping threshold, the per-sample gradient remains unchanged, and the clipped per-sample gradient is obtained.

[0023] Calculate the average per-sample gradient of the cropped batch and generate a Gaussian noise vector with the same dimension as the gradient. Gaussian noise vector The standard deviation of the received noise parameters Decide;

[0024] Using Gaussian noise vectors According to the preset learning rate Update local model parameters;

[0025] Repeat the above process until the preset training rounds are completed, and then upload the final updated local model parameters as output to the server.

[0026] Preferably, the sample-by-sample gradient Where x represents the current batch Input features of the data sample For loss function Noise parameters of the global model The gradient;

[0027] The clipped sample-by-sample gradient ;in, This indicates the operation of retrieving the maximum value. Represents the gradient per sample of Norm;

[0028] The Gaussian noise vector ;

[0029] Where |B| represents the number of samples in the current batch B. This indicates that the mean is 0 and the covariance matrix is... Multidimensional Gaussian noise, It is the identity matrix;

[0030] Update the local model parameters as follows: .

[0031] Preferably, step S3 is implemented as follows:

[0032] The server is based on the global aggregate weight that needs to be optimized on the client side. and global contractility factor The local model parameters uploaded by each client are weighted and combined to generate candidate aggregation vectors. And broadcast it to the selected clients;

[0033] The client receives the candidate aggregation vector. Then, the unperturbed loss is calculated locally using the loss function and the local dataset. and loss gradient ;

[0034] The client uses the loss gradient The steepest upward direction is calculated and used as the added perturbation. ;

[0035] The client utilizes a sharpness-aware minimization algorithm to select candidate aggregation vectors. Add a perturbation with a defined direction Calculate the worst-case loss ;

[0036] The client will calculate the unperturbed loss. and worst-case loss Send it back to the server.

[0037] Preferably, the candidate aggregation vector is: Where m represents the total number of clients participating in this round of aggregation; This represents the global aggregate weight corresponding to the local model parameters of client i. Indicates the global contraction factor;

[0038] The undisturbed loss ;

[0039] The loss gradient ;in, Local dataset representing client i

[0040] The disturbance: ;in, Indicates the disturbance radius. Represents the loss gradient L2 norm, To represent a very small constant;

[0041] The worst-case loss .

[0042] Preferably, the server receives the undisturbed loss returned by each client. and worst-case loss Construct a global weight optimization objective function The optimization problem is as follows:

[0043] ;

[0044] in, The base weight for client i, To balance the hyperparameters of the flattening and anchoring terms;

[0045] The global contraction factor is iteratively updated using the gradient descent method. and global aggregate weight This continues until convergence, yielding the optimal value in round t. and global aggregate weight .

[0046] Preferably, the server calculates the sharpness score of client i in round t based on the bad-case loss and the unperturbed loss. ;

[0047] Server's sharpness score Smoothing is performed to obtain a smoothing sharpness score. ;

[0048] The server collects the current smoothness sharpness scores from all clients, sorts them from smallest to largest, and dynamically allocates the noise parameters for the next round based on the position of the smoothness sharpness score in the distribution of scores across all clients. ;

[0049] The server utilizes the optimal global shrinkage factor. and optimal relative weight vector Local model parameters for each client We obtain the next-generation global model parameters by performing weighted summation and global scaling. ;

[0050] The server will generate next-generation global model parameters Update to the current system's global model and increase the communication rounds by 1.

[0051] Preferably, the sharpness score This is the difference between the worst-case loss and the unperturbed loss, and ;

[0052] The smoothing process uses an exponential moving average, and the smoothing sharpness score is: ;in, ∈[0,1) is the smoothing factor; Let i be the smoothness sharpness score of client i after smoothing in round t-1.

[0053] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention significantly improves model utility and privacy security within the federated learning framework. First, this invention abandons the reliance on server-side proxy datasets found in existing technologies (such as FEDLAW), replacing proxy loss with client-cooperative computation of Sharpness-Aware Minimization (SAM) loss. Based on this, it adaptively identifies clients with high generalization ability and assigns them higher weights, while simulating the regularization process through a global weight reduction effect, strongly guiding the global model to converge to a wider and flatter region of the loss terrain. Second, this invention innovatively establishes a mapping relationship between the geometric characteristics of the loss terrain and data sensitivity. By using sharpness scores as a sensitivity proxy index, it achieves adaptive differential privacy protection, intelligently assigning high-intensity noise to high-risk clients with unique data distributions and located in sharp regions to mask their features, while assigning low-intensity noise to low-risk clients with ordinary data distributions and located in flat regions to retain effective gradient information. This invention enhances privacy protection while improving model utility, effectively balancing the relationship between privacy protection strength and model utility. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart of the present invention.

[0056] Figure 2 This is a framework diagram of the present invention.

[0057] Figure 3 This is a graph showing the trend of the accuracy of the present invention versus other methods as a function of training rounds. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] like Figure 1As shown, this invention provides a technical solution: an adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization, aiming to improve model utility while enhancing privacy protection. The steps are as follows: Federated learning begins; the server sends a global model containing specific noise parameters to the client; the client performs localized differential privacy-enhanced training using its local dataset; the server generates candidate aggregation models and sends them down; the client uses the sharpness-aware minimization algorithm to calculate the local unperturbed loss and worst-case loss and sends them back; the server optimizes the global aggregation weights and shrinkage factor based on the returned loss values, and simultaneously calculates the loss flattening difference between each client, dynamically adjusting the noise parameters for the next round; the server performs weighted aggregation based on the optimized global aggregation weights, shrinkage factor, and local model; the above steps are repeated until a given maximum number of communication rounds is reached. This invention significantly improves model utility while enhancing privacy protection, achieving an effective balance between privacy protection strength and model utility. Specific implementation steps are as follows:

[0060] S1: Federated learning begins, and the server sends the latest global model containing specific noise parameters to the client.

[0061] Specifically, the specific noise parameter refers to the model sharpness score provided by each client in the previous round of feedback, as determined by the server. The noise standard deviation is calculated using a piecewise linear mapping function. If this is the first round, set the noise standard deviation for all clients to 1.

[0062] As an example, Figure 2 This paper demonstrates the training framework of the proposed method in a real-world application scenario. The dataset used in the experiment is CIFAR-10, short for Canadian Institute for Advanced Research - 10classes, a widely used color image dataset in the field of computer vision. This dataset contains 60,000 RGB color images of size 32×32, covering 10 categories: airplanes, cars, birds, cats, deer, dogs, frogs, horses, boats, and trucks. The dataset is divided into training and testing sets according to its purpose. The training set contains 50,000 images, and the testing set contains 10,000 images. The number of images for each category is equal in the training and testing sets, i.e., each category corresponds to 5,000 training images and 1,000 test images.

[0063] This experiment simulates the joint training of a global model (CNN) by various clients under the coordination of the server. The optimizers of each client all use stochastic gradient descent (SGD) to verify the classification performance of the global model on CIFAR-10.

[0064] S2: After receiving the global model, the client adds adaptive Gaussian noise to the clipped gradient based on the received noise parameters to perform differential privacy noise-adding training of the local model. After training, the model parameters are updated and uploaded to the server.

[0065] Specifically, in round t, client i receives the latest global model parameters as follows: The client will use the local dataset The dataset is divided into several batches, and each batch B contains the minimum number of samples in the batch.

[0066] Furthermore, for each data sample in the current batch, the client locally calculates the predicted value and loss using forward propagation, and calculates the gradient vector of the model parameters relative to the loss function of the data sample using backpropagation, obtaining the sample-by-sample gradient, as shown in the following formula:

[0067] ;

[0068] Where x is the input feature of the current sample, For loss function For global model parameters gradient, This represents the gradient per sample.

[0069] Furthermore, for the sample-by-sample gradient Perform norm clipping operation and compute the gradient for each sample. Norm, if If the norm is greater than the preset gradient clipping threshold C, then the sample-by-sample gradient is scaled to make it... The norm is equal to the gradient clipping threshold, if If the norm is less than or equal to the preset gradient clipping threshold, the per-sample gradient is kept unchanged, thus obtaining the clipped per-sample gradient, as shown in the following formula:

[0070] ;

[0071] in, This indicates the operation of retrieving the maximum value. Represents the gradient per sample of The norm and gradient clipping threshold C are initially set to 1.0, and then the range can be finely adjusted up and down according to the accuracy of the validation set.

[0072] Then calculate the batch average gradient (the gradient of each sample after cropping all B samples in the current batch). (This can be obtained by summing and dividing by the batch size |B|), and generating a Gaussian noise vector with the same dimension as the gradient. The standard deviation of the Gaussian noise vector is determined by the specific noise parameter received in step S1. The decision is made using the following formula:

[0073] ;

[0074] Where |B| represents the number of samples in batch B. This indicates that the mean is 0 and the covariance matrix is... Multidimensional Gaussian noise, This is an identity matrix with dimensions consistent with the gradient. This noise term prevents attackers from inferring any training sample from the published gradient; it provides quantifiable privacy guarantees even when gradients are publicly shared, while adjusting specific noise parameters. A fine balance can be struck between "privacy budget" and "model accuracy".

[0075] Finally, the Gaussian noise vector is used. According to the preset learning rate Update the local model parameters using the following formula:

[0076] ;

[0077] Because Gaussian noise was introduced during the update, the learning rate was adjusted to suppress the negative impact of noise on model convergence. It usually needs to be set to a small value, such as 0.001.

[0078] Repeat the above steps until the preset local training rounds are completed, and then upload the final updated local model parameters as output to the server.

[0079] S3: The server constructs candidate aggregation vectors based on the current global aggregation weights and global shrinkage factors to be optimized and broadcasts them. After receiving them, the client does not update the parameters, calculates the unperturbed loss of the candidate aggregation vectors based on local data, and uses the first-order approximation of the sharpness-aware minimization (SAM) algorithm to calculate the worst-case loss in the parameter neighborhood. Finally, the scalar values ​​of the unperturbed loss and the worst-case loss are sent back to the server.

[0080] Specifically, the server bases the optimization on the current global aggregate weight. and global contractility factor The local model parameters uploaded by each client in step S2 are weighted and combined to generate candidate aggregation vectors. And broadcast it to the selected clients, as shown in the following formula:

[0081] ;

[0082] Where m represents the total number of clients participating in this round of aggregation. This represents the global aggregate weight corresponding to the local model parameters of the i-th client. This represents the global shrinkage factor, used to adjust the overall scaling of the model parameters after weighted aggregation.

[0083] The client receives the candidate aggregation vector. Then, the loss function for the unperturbed model parameters on the local dataset is calculated locally as the unperturbed loss. and loss gradient The formula is as follows:

[0084] ;

[0085] ;

[0086] in, Local dataset representing client i

[0087] Furthermore, the client, based on the loss gradient Calculate the steepest direction of ascent. Taking this as the direction of the added perturbation, the formula is as follows:

[0088] ;

[0089] in, This represents the disturbance radius, which is typically set to 0.05. Represents the loss gradient The L2 norm (i.e., the magnitude of the vector). This represents a very small numerical stability constant, typically set to 10. -8 Its function is to prevent the denominator from being zero.

[0090] After determining the perturbation direction, the client uses the Sharpness-Aware Minimization (SAM) algorithm to select candidate aggregation vectors. Add a perturbation with a defined direction This allows for the calculation of the worst-case loss. The formula is as follows:

[0091] ;

[0092] Finally, the client will calculate the unperturbed loss. and worst-case loss Send it back to the server.

[0093] S4: The server utilizes the unperturbed loss. and worst-case loss The global aggregation weights and shrinkage factor are updated iteratively through gradient descent. At the same time, the server calculates the difference between the worst-case loss and the unperturbed loss for each client as a sharpness score. The noise parameters for the next round of each client are calculated based on the sharpness score.

[0094] Specifically, the server receives the undisturbed loss returned by each client in step S3. and worst-case loss Construct a global weight optimization objective function The formula is as follows:

[0095] ;

[0096] in, The base weight for client i (set according to the proportion of client data volume). To balance the hyperparameters of the flattening and anchoring terms, they are typically set to 2. The global shrinkage factor is then iteratively updated using gradient descent. and relative weight vector Continue until convergence, obtaining the optimal value for that round. and global aggregate weight .

[0097] Furthermore, the server calculates the sharpness score of client i in this round. The sharpness score Defined as the difference between the worst-case loss and the unperturbed loss:

[0098] ;

[0099] The calculated sharpness score Afterwards, the server scores the sharpness. Smoothing is performed, and the smoothing sharpness score is calculated using the exponential moving average (EMA). The formula is as follows:

[0100] ;

[0101] in, ∈[0,1) is the smoothing factor. The smoothness sharpness score for the i-th client after smoothing in the previous round (round t-1).

[0102] Finally, the server collects the current smoothness and sharpness scores from all clients. Sort them from smallest to largest. The server scores them based on smoothness and sharpness. The position (quantile) of the score distribution across all clients is used to dynamically allocate noise parameters for the next round. .set up The k-quantile of the score set for this round, and the smoothing sharpness score. The lowest 20% is considered low sensitivity, and 20%-50% is considered high sensitivity. 50%-80% are The last part is The formula is as follows:

[0103] ;

[0104] Where Map is the mapping function. The maximum noise standard deviation, Indicates smoothness and sharpness score exist The client-side sharpness score between them is linearly mapped to... The noise intensity range.

[0105] The linear mapping function is defined as follows:

[0106] ;

[0107] Where x refers to the current smoothness sharpness score. , Indicates the corresponding quantile interval. This indicates the corresponding noise intensity range.

[0108] S5: The server uses the global aggregation weights and global shrinkage factor learned in step S4 to perform weighted summation and scaling operations on the local model parameters uploaded by each client in step S2, generating a new generation of global model after the end of this round of communication.

[0109] Specifically, the server obtains the optimal global contraction factor obtained through gradient descent iterative optimization in step S4. and global aggregate weight and the set of local model parameters uploaded by each participating client in step S2. .

[0110] Furthermore, the server utilizes the optimal global shrinkage factor. and optimal relative weight vector The next-generation global model parameters are obtained by weighted summation and global scaling of the local model parameters of each client. The formula is as follows:

[0111] ;

[0112] Finally, the server will generate the next-generation global model parameters. Update to the current system's global model and increment the communication round counter t by 1.

[0113] S6: Repeat steps S1 to S5 until the given maximum number of communication rounds is reached, which is usually set to 200 rounds.

[0114] like Figure 3 As shown, the algorithm of this invention compares with the classic FedAvg aggregation framework and the fixed-noise DP-FedAvg. In FedAvg, the server first randomly selects a portion of clients and distributes a global model. Then, the models trained locally by the clients are uploaded to the server. The server performs a weighted average of the uploaded model parameters based on the amount of data (or preset weights) of each client to generate a new global model. In contrast, after the clients train locally, the gradients are first clipped using the L2 norm, and then noise is added to the clipped gradients before they are uploaded to the server for weighted averaging. In implementation, there are 10 clients in each round, and the program runs for 200 rounds. In this case, the client training rounds are 5, and the added noise is set to Gaussian noise. The program is run three times under the same experimental conditions.

[0115] Experimental results demonstrate that the method proposed in this invention has significant advantages in balancing privacy protection and model utility. Specifically, DP-FedAvg suffers severe damage to model utility due to its fixed noise mechanism, with accuracy stagnating at around 61%. In contrast, while the method proposed in this invention introduces privacy protection, its accuracy is significantly higher than DP-FedAvg thanks to its sharpness-aware adaptive noise allocation strategy, achieving a peak level comparable to the noise-free baseline FedAvg (approximately 68%). More importantly, FedAvg exhibits a significant performance decline in the later stages of training (approximately after 75 epochs), indicating a weakening of its generalization ability; while the algorithm proposed in this invention maintains extremely high stability in the later stages without performance degradation. This fully demonstrates that the algorithm proposed in this invention significantly improves the model's generalization ability and robustness while ensuring privacy security, effectively balancing the relationship between privacy protection strength and model utility.

[0116] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization, characterized in that, Includes the following steps: S1: Federated learning begins; the server sends the latest global model, including noise parameters, to the client. S2: After receiving the global model, the client adds adaptive Gaussian noise to the clipped gradient based on the received noise parameters to perform differential privacy noise-adding training of the local model. After training, the model parameters are updated and uploaded to the server. S3: The server constructs candidate aggregation vectors based on the current global aggregation weights and global shrinkage factors to be optimized and broadcasts them. After receiving them, the client does not update the parameters, calculates the unperturbed loss of the candidate aggregation vectors based on local data, and calculates the worst-case loss in the parameter neighborhood using the sharpness-aware minimization algorithm. Finally, the unperturbed loss and the worst-case loss are sent back to the server. S4: The server uses the unperturbed loss and the worst-case loss to iteratively update the candidate aggregation vector through gradient descent. At the same time, the server calculates the sharpness score for each client and calculates the noise parameters for each client in the next round based on the magnitude of the sharpness score. S5: The server uses the updated candidate aggregation vector to perform weighted summation and scaling operations on the local model parameters uploaded by each client, generating a new generation of global model; S6: Repeat steps S1 to S5 until the given maximum number of communication rounds is reached.

2. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 1, characterized in that, The noise parameter is the sharpness score of the local model fed back by each client i in the (t-1)th round. The noise standard deviation of round t is calculated using a piecewise linear mapping function. If this is the first round, the noise standard deviation for all clients is 1.

3. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 2, characterized in that, The noise standard deviation The calculation method is as follows: ； Where Map() is a linear mapping function. The maximum noise standard deviation, For the minimum noise standard deviation, Indicates sharpness score Smoothing sharpness score after smoothing; Let k be the k-quantile of the smoothed sharpness score set in round t-1. The lowest 20% of the smoothed sharpness scores represent low sensitivity, and the middle 20%-50% represent high sensitivity. The middle 50%-80% is The last part is .

4. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 2 or 3, characterized in that, The implementation method of step S2 is as follows: In round t, client i receives the latest noise parameters of the global model as follows: Client i will use the local dataset Divided into several batches; For each data sample in the current batch, the client uses forward propagation to calculate the predicted value and loss, and uses back propagation to calculate the gradient vector of the model parameters relative to the loss function of the data sample, thus obtaining the sample-by-sample gradient. Perform norm clipping on the sample-by-sample gradient and calculate the norm of each sample-by-sample gradient. Norm, if If the norm is greater than the preset gradient clipping threshold C, then the per-sample gradient is scaled to make... The norm equals the gradient clipping threshold; if If the norm is less than or equal to the preset gradient clipping threshold, the per-sample gradient remains unchanged, and the clipped per-sample gradient is obtained. Calculate the average per-sample gradient of the cropped batch and generate a Gaussian noise vector with the same dimension as the gradient. Gaussian noise vector The standard deviation of the received noise parameters Decide; Using Gaussian noise vectors According to the preset learning rate Update local model parameters; Repeat the above process until the preset training rounds are completed, and then upload the final updated local model parameters as output to the server.

5. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 4, characterized in that, The sample-by-sample gradient Where x represents the current batch. Input features of the data sample For loss function Noise parameters of the global model The gradient; The clipped sample-by-sample gradient ;in, This indicates the operation of retrieving the maximum value. Represents the gradient per sample of Norm; The Gaussian noise vector ; Where |B| represents the number of samples in the current batch B. This indicates that the mean is 0 and the covariance matrix is... Multidimensional Gaussian noise, It is the identity matrix; Update the local model parameters as follows: .

6. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 5, characterized in that, The implementation method of step S3 is as follows: The server is based on the global aggregate weight that needs to be optimized on the client side. and global contractility factor The local model parameters uploaded by each client are weighted and combined to generate candidate aggregation vectors. And broadcast it to the selected clients; The client receives the candidate aggregation vector. Then, the unperturbed loss is calculated locally using the loss function and the local dataset. and loss gradient ; The client uses the loss gradient The steepest upward direction is calculated and used as the added perturbation. ; The client utilizes a sharpness-aware minimization algorithm to select candidate aggregation vectors. Add a perturbation in a defined direction Calculate the worst-case loss ; The client will calculate the unperturbed loss. and worst-case loss Send it back to the server.

7. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 6, characterized in that, The candidate aggregation vector: Where m represents the total number of clients participating in this round of aggregation; This represents the global aggregate weight corresponding to the local model parameters of client i. Indicates the global contraction factor; The undisturbed loss ; The loss gradient ;in, Local dataset representing client i The disturbance: ;in, Indicates the disturbance radius. Represents the loss gradient L2 norm, To represent a very small constant; The worst-case loss .

8. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 6 or 7, characterized in that, The server receives the unperturbed loss returned by each client. and worst-case loss Construct a global weight optimization objective function The optimization problem is as follows: ； in, The base weight for client i, To balance the hyperparameters of the flattening and anchoring terms; The global contraction factor is updated iteratively using the gradient descent method. and global aggregate weight This continues until convergence, yielding the optimal value in round t. and global aggregate weight .

9. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 8, characterized in that, The server calculates the sharpness score of client i in round t based on the bad-case loss and the unperturbed loss. ; Server's sharpness score Smoothing is performed to obtain a smoothing sharpness score. ; The server collects the current smoothness sharpness scores from all clients, sorts them from smallest to largest, and dynamically allocates the noise parameters for the next round based on the position of the smoothness sharpness score in the distribution of scores across all clients. ; The server utilizes the optimal global shrinkage factor. and optimal relative weight vector Local model parameters for each client We obtain the next-generation global model parameters by performing weighted summation and global scaling. ; The server will generate next-generation global model parameters Update to the current system's global model and increase the communication rounds by 1.

10. The adaptive federated learning aggregation and privacy protection method based on sharpness-aware minimization according to claim 9, characterized in that, The sharpness score This is the difference between the worst-case loss and the unperturbed loss, and ; The smoothing process uses an exponential moving average, and the smoothing sharpness score is: ;in, ∈[0,1) is the smoothing factor; Let i be the smoothness sharpness score of client i after smoothing in round t-1.

Images