Implementation method of hierarchical adaptive federated learning

Abstract

The invention discloses an implementation method of hierarchical adaptive federated learning, which comprises the following steps of: extracting a direction deviation feature, an update strength feature and a gradient sparse feature of model gradient update uploaded by a client, performing Gaussian mixture model training on a three-dimensional feature vector, and determining the category and the identity probability of the client; and adjusting an exploration reward coefficient based on the separation degree of Gaussian mixture model clustering, determining an aggregation weight of model gradient update input by the client based on the identity probability and the exploration reward coefficient, and obtaining global model update by using the aggregation weight so as to update the global model issued to the client. And updating the Gaussian mixture model based on the updated global model in the subsequent training process. According to the method, multi-dimensional client behavior analysis and self-adaptive security protection can be provided for a federated learning system, and cooperation of hostile attack defense and effective utilization of heterogeneous data is realized from the aspects of probabilistic identity recognition and dynamic aggregation optimization.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and machine learning technology, and in particular to a method for implementing hierarchical adaptive federated learning. Background Technology

[0002] With the increasing demand for privacy protection in sensitive fields such as healthcare and connected vehicles, federated learning, as a distributed machine learning paradigm, has rapidly gained popularity. Its core advantage lies in enabling collaborative training of a global model among multiple parties without sharing raw data. However, in distributed scenarios, the coexistence of data heterogeneity and malicious attacks poses significant challenges to the effectiveness and security of federated learning.

[0003] To address this, current methods using gradient direction similarity or statistical distance to determine client trustworthiness enhance the security of federated learning. However, in practical applications, these methods cannot distinguish between malicious attack updates and benign exploratory updates from unknown data clients. Consequently, the latter are easily misjudged as low-trust updates and discarded, causing the global model to miss valuable heterogeneous data. Another current approach to improving federated learning security is based on statistical filtering, which essentially seeks aggregation centers. This approach inevitably suppresses update contributions from unknown data clients, making it difficult for the model to learn new data patterns.

[0004] In summary, the trust score dilemma is the core technical problem of existing technologies. Its essence is that the single-dimensional evaluation system is incompatible with the complex scenario of heterogeneous data and malicious attacks. This directly leads to the inability of existing technical solutions to simultaneously achieve the dual goals of effectively defending against attacks and making full use of heterogeneous data.

[0005] In view of this, the present invention is hereby proposed. Summary of the Invention

[0006] The purpose of this invention is to provide a hierarchical adaptive federated learning implementation method to construct a technical solution that can accurately distinguish between benign heterogeneous updates and malicious attacks, thereby solving the above-mentioned technical problems existing in the prior art.

[0007] The objective of this invention is achieved through the following technical solution:

[0008] An implementation method for hierarchical adaptive federated learning includes:

[0009] Extract the three-dimensional feature vector of the model gradient update uploaded by the client. The three-dimensional feature vector includes orientation deviation features, update intensity features, and gradient sparsity features.

[0010] Unsupervised clustering is performed on the three-dimensional feature vectors to train a Gaussian mixture model, and the client's category and identity probability are determined based on the trained Gaussian mixture model.

[0011] The exploration reward coefficient is adjusted based on the separation degree of the Gaussian mixture model clustering, and the exploration reward coefficient is used to determine whether to encourage or discourage the corresponding update.

[0012] Based on the identity probability and the exploration reward coefficient, the aggregate weights for the model gradient update input by the client are determined, and the global model update is obtained using the aggregate weights to update the global model sent to the client. Then, the Gaussian mixture model is updated based on the updated global model in the subsequent training process.

[0013] Preferably, the directional deviation feature is calculated by cosine similarity to determine the directional alignment between the client update and the server's trusted update, with a value ranging from -1 to 1; the update intensity feature is quantified by the L2 norm of the gradient; and the gradient sparsity feature is expressed by the ratio of the L1 norm to the L2 norm of the gradient to represent the parameter update concentration.

[0014] Preferably, the calculation method of the three-dimensional feature vector includes:

[0015] The directional deviation feature The extraction includes:

[0016] Trusted updates computed on the root dataset Based on this, the directional deviation feature is calculated using cosine similarity to determine the alignment between the client's gradient update and the reliable update. The calculation formula is as follows:

[0017] ;

[0018] The value of is between [-1, 1]. The closer its value is to 1, the more consistent the update direction is with the global optimal convergence direction; the closer its value is to -1, the more likely the update direction is to be opposite, which may indicate a malicious attack or exploration of unknown data.

[0019] The update intensity feature The extraction includes:

[0020] The model gradient uploaded by the client is updated to The update intensity feature is determined by quantifying the magnitude of client updates using the L2 norm of the gradient, and its calculation formula is as follows:

[0021] ;

[0022] Update strength characteristics of malicious clients The value is abnormally high, and the update intensity feature corresponding to the unknown data client is unknown. The value is abnormally low, indicating an update intensity characteristic corresponding to a benign client. This is within a reasonable range;

[0023] The gradient sparsity feature The extraction includes:

[0024] The gradient sparsity feature is determined by the ratio of the L1 norm to the L2 norm, and its calculation formula is as follows:

[0025] ;

[0026] Gradient sparsity features corresponding to malicious clients Low values ​​indicate gradient sparsity characteristics between benign clients and clients with unknown data. The value is too high.

[0027] Preferably, the process of training the Gaussian mixture model includes:

[0028] A Gaussian mixture model containing three clusters is initialized based on a clustering algorithm, and the corresponding model training is completed by inputting the three-dimensional feature vector. The three clusters correspond to three types of clients, including malicious clients, clients with unknown data, and benign clients.

[0029] Preferably, the process of determining the client's category is implemented through automatic clustering labeling, and includes:

[0030] Based on the cluster center values ​​sorted according to the update intensity feature, three types of clusters are automatically labeled: the cluster with the highest update intensity is a malicious client cluster, the cluster with the lowest is an unknown data client cluster, and the intermediate cluster is a benign client cluster.

[0031] Preferably, the process of determining the identity probability includes:

[0032] The identity probability vector of each client is obtained by calculating the posterior probability of the Gaussian mixture model, representing the probabilities of benign, unknown, and malicious data, respectively.

[0033] Preferably, the process of adjusting the exploration reward coefficient uses a global profile coefficient to measure the cluster separation, and this process includes:

[0034] Calculate the average distance between each client sample and other client samples within the same cluster, as well as the average distance to the nearest client sample from a different cluster, to determine the silhouette coefficient of a single client sample;

[0035] The average of all sample contour coefficients is calculated as the global contour coefficient, and its value ranges from negative one to one.

[0036] The exploration reward coefficient is determined based on the global profile coefficient.

[0037] Preferably, the process of determining the exploration reward coefficient based on the global contour coefficient adjustment includes:

[0038] Based on the global contour coefficient, the exploration reward coefficient is adjusted using a pre-set first threshold and a second threshold, wherein:

[0039] When the global contour coefficient is greater than the first threshold, the exploration reward coefficient is increased to encourage exploration updates;

[0040] When the global contour coefficient is less than the second threshold, the exploration reward coefficient is reduced to decrease the risk of attack.

[0041] When the global contour coefficient is between the first threshold and the second threshold, the default exploration reward coefficient is used to balance safety and efficiency.

[0042] Preferably, the method for determining the global contour coefficient includes:

[0043] For each sample Calculate the average distance between it and other client samples within the same cluster. and the average distance to all client samples from the nearest heterogeneous cluster. And calculate the silhouette coefficient of a single client sample. for:

[0044] ;

[0045] The average of the silhouette coefficients of all client samples is used as the global silhouette coefficient, which ranges from -1 to 1. A higher value indicates a better clustering effect and a clearer client identity.

[0046] Preferably, the aggregate weight The calculation formula is:

[0047] ;

[0048] in, This represents the probability vector of a benign client's identity. To correct the linear unit, when Output 0 when the time is right; For the identity probability vector of the unknown data client; The exploration reward coefficient for the unknown data client has a value range of [0.4, 0.6].

[0049] global model update The calculation formula is:

[0050] ;

[0051] in, This is for updating the model gradient uploaded by the client, where N is the number of clients.

[0052] Compared with existing technologies, the hierarchical adaptive federated learning implementation method provided by this invention addresses heterogeneous data and malicious attacks. It utilizes a three-dimensional feature fusion model of gradient direction bias, update intensity, and gradient sparsity, combined with a Gaussian mixture model to achieve probabilistic representation of client identity. Coupled with probabilistic trust-gated aggregation and a dynamic exploration reward adjustment mechanism based on silhouette coefficients, it accurately distinguishes between benign updates, benign exploration updates of unknown data, and malicious attack updates. This constructs a federated learning scheme that can accurately distinguish between benign heterogeneous updates and malicious attacks, and possesses dynamic adaptability. It can effectively resist various attacks while fully utilizing heterogeneous data, providing a distributed machine learning solution that balances security and generalization capabilities for sensitive fields such as connected vehicles. Furthermore, this invention exhibits excellent versatility and scalability, supporting multiple model architectures. Its linear computational complexity ensures efficiency during large-scale client deployments, demonstrating optimal defense performance on real-world datasets in medical and connected vehicle scenarios. Attached Figure Description

[0053] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A schematic diagram illustrating the implementation process of the method provided in this embodiment of the invention;

[0055] Figure 2 This is a schematic diagram illustrating the implementation process of the probabilistic identity modeling and probabilistic trust gating aggregation stage of the method provided in this embodiment of the invention. Detailed Implementation

[0056] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the specific content of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments, which do not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0057] First, the following explanations are provided for the terms that may be used in this article:

[0058] The term "and / or" means that either or both can be achieved simultaneously. For example, X and / or Y means that it includes both "X" or "Y" as well as the three cases of "X and Y".

[0059] The terms "comprising," "including," "containing," "having," or other similar semantic descriptions should be interpreted as non-exclusive inclusion. For example, including a technical feature element (such as raw material, component, ingredient, carrier, dosage form, material, size, part, component, mechanism, device, step, process, method, reaction conditions, processing conditions, parameter, algorithm, signal, data, product or article of manufacture, etc.) should be interpreted as including not only the expressly listed technical feature element, but also other technical feature elements that are not expressly listed and are well-known in the art.

[0060] The term "composed of" excludes any technical features not expressly listed. When used in a claim, it closes the claim to exclude all technical features other than those expressly listed, except for associated conventional impurities. If the term appears only in a clause of a claim, it limits the claim to the elements expressly listed in that clause; elements recited in other clauses are not excluded from the overall claim.

[0061] Unless otherwise explicitly specified or limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this document according to the specific circumstances.

[0062] When concentration, temperature, pressure, size, or other parameters are expressed as numerical ranges, such ranges should be understood to specifically disclose all ranges formed by any pairing of upper limits, lower limits, or preferred values ​​within that range, regardless of whether the range is explicitly stated; for example, if the numerical range "2 to 8" is stated, then that range should be interpreted to include ranges such as "2 to 7", "2 to 6", "5 to 7", "3 to 4 and 6 to 7", "3 to 5 and 7", "2 and 5 to 7", etc. Unless otherwise stated, the numerical ranges described herein include both their endpoints and all integers and fractions within that range.

[0063] The terms “center,” “longitudinal,” “lateral,” “length,” “width,” “thickness,” “upper,” “lower,” “front,” “back,” “left,” “right,” “vertical,” “horizontal,” “top,” “bottom,” “inner,” “outer,” “clockwise,” and “counterclockwise” indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience and simplification of description and do not imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this document.

[0064] This invention aims to construct a hierarchical adaptive federated learning security framework. Specifically, it constructs a hierarchical adaptive federated learning framework oriented towards heterogeneous data and malicious attacks, enabling the security of the federated learning system while fully utilizing heterogeneous data (especially unknown data) to improve the generalization ability of the global model. After the client uploads model updates, multi-dimensional feature extraction, probabilistic identity modeling, and adaptive aggregation can be performed on the updates, achieving synergistic optimization of malicious attack defense and effective utilization of unknown data.

[0065] The implementation of this invention can include four core stages: gradient 3D feature extraction, probabilistic identity modeling based on Gaussian mixture models, probabilistic trust-gated aggregation, and dynamic exploration reward adjustment; wherein:

[0066] (1) Gradient 3D Feature Extraction

[0067] By fusing three-dimensional features—gradient direction deviation, update intensity, and gradient sparsity—to create a comprehensive model that fully characterizes client update behavior;

[0068] (2) Probabilistic identity modeling based on Gaussian mixture model

[0069] A Gaussian mixture model is introduced to perform unsupervised clustering of 3D features, outputting the posterior probability of the client being benign, unknown, or malicious, replacing the traditional hard decision rule; the three types of clusters are automatically labeled by the update intensity of the cluster centers, and the corresponding processing does not require manual intervention.

[0070] (3) Probability-trust-gated aggregation stage

[0071] An aggregate weighting formula was adopted that integrates identity probability, directional trust, and exploration reward. Among them, the weight of benign clients is determined by identity probability and directional similarity, the weight of unknown data clients is determined by identity probability and exploration reward coefficient, and malicious clients are naturally suppressed due to their extremely low probability of both.

[0072] (4) Adjustment of dynamic exploration rewards

[0073] The cluster separation of Gaussian mixture model clustering is quantified by the silhouette coefficient, and the exploration reward coefficient is dynamically adjusted. For example, a high reward coefficient is used to encourage exploration when the separation is high, a low reward coefficient is used to ensure safety when the separation is low, and a default reward coefficient is used to balance efficiency and safety when the separation is moderate.

[0074] Furthermore, referring to Figure 1 As shown, the processing steps of a hierarchical adaptive federated learning implementation method provided in this embodiment of the invention may include the following steps:

[0075] (I) Gradient 3D Feature Extraction Stage

[0076] Extract the three-dimensional feature vector of the model gradient update uploaded by the client. The three-dimensional feature vector may include orientation deviation features, update intensity features, and gradient sparsity features.

[0077] Specifically, after inputting the client set, based on the model gradient updates uploaded by the clients, three-dimensional core features characterizing the update behavior are extracted to comprehensively distinguish between benign updates, unknown data exploration updates, and malicious attack updates. The extracted three-dimensional feature vectors may include:

[0078] (1) Characteristics of directional deviation

[0079] This feature can calculate the degree of directional alignment between client updates and server trusted updates using cosine similarity, with a value ranging from negative one to one, to reflect the potential contribution of the update to the convergence of the global model.

[0080] (2) Update intensity features

[0081] This feature uses the L2 norm of the gradient to quantify the update magnitude. Malicious attack updates usually show abnormally high values, unknown data updates usually show abnormally low values, while benign updates usually fall within a reasonable range.

[0082] (3) Gradient sparsity feature

[0083] This feature characterizes the concentration of parameter updates by the ratio of the gradient L1 norm to the L2 norm. The range of values ​​is related to the dimension of the model parameters. Malicious attack updates show low values ​​because they need to centrally modify key parameters, while benign and unknown data updates naturally disperse and show high values.

[0084] (II) Probabilistic Identity Modeling Stage Based on Gaussian Mixture Model

[0085] Unsupervised clustering is performed on the three-dimensional feature vectors to train a Gaussian mixture model, and the client's category and identity probability are determined based on the trained Gaussian mixture model.

[0086] That is, unsupervised clustering is performed on the extracted three-dimensional features to output the posterior probabilities of three types of clients, namely benign clients, unknown data clients and malicious clients, replacing the traditional hard decision rules.

[0087] The specific processing procedures at this stage may include:

[0088] (1) Initialization and training of Gaussian mixture model

[0089] The corresponding training process for the Gaussian mixture model includes: initializing a Gaussian mixture model containing three clusters based on a clustering algorithm, and inputting the three-dimensional feature vector to complete the corresponding model training. The three clusters correspond to three types of clients, including malicious clients, clients with unknown data, and benign clients.

[0090] Specifically, in each round of communication, a Gaussian mixture model containing three clusters (corresponding to three types of clients) is initialized based on a clustering algorithm. Then, the three-dimensional feature vectors extracted above are input to complete the corresponding model training. The training process includes: using the full covariance matrix to adapt to the ellipsoidal data distribution, setting the convergence threshold and the maximum number of iterations, and adding a regularization term to ensure numerical stability.

[0091] (2) Automatic cluster labeling

[0092] The process of determining the category of the client can be achieved through automatic cluster labeling, that is, based on the cluster center value sorting of the update intensity feature, three types of clusters are automatically labeled, including: the cluster with the highest update intensity of the cluster center is the malicious client cluster, the lowest is the unknown data client cluster, and the intermediate cluster is the benign client cluster. The process does not require manual intervention.

[0093] (3) Identity probability output

[0094] The process of determining the identity probability includes: calculating the identity probability vector of each client through the posterior probability of the Gaussian mixture model, which represents the probability of benign, unknown data, and malicious, respectively, and the sum of the three is one, so as to flexibly handle scenarios with ambiguous boundaries.

[0095] (III) Probability-trust-gated aggregation stage

[0096] In this stage, aggregate weights are designed based on identity probability to achieve personalized contribution evaluation, and weighted aggregation is used to obtain global model updates;

[0097] Specifically, in this stage, the exploration reward coefficient is adjusted based on the separation of the Gaussian mixture model clustering, and the exploration reward coefficient is used to determine whether to encourage or not to update accordingly; and the aggregation weight of the model gradient update input by the client is determined based on the identity probability and the exploration reward coefficient, and the global model update is obtained using the aggregation weight to update the global model sent to the client, and then the Gaussian mixture model is updated based on the updated global model in the subsequent training process to achieve the corresponding federated learning;

[0098] The processing steps in this probabilistic trust-gated aggregation phase may include:

[0099] (1) Calculation of dynamic clustering reward aggregation weight

[0100] The aggregated weights combine identity probability, directional trust, and exploration reward. The modified linear unit ensures that benign clients contribute weights only when the direction is correct, and the exploration reward coefficient provides the base weights for clients with unknown data.

[0101] Furthermore, the exploration reward coefficient can be dynamically adjusted based on the separation of Gaussian mixture model clustering to balance safety and exploration efficiency during training. Specifically, a global silhouette coefficient can be used to measure cluster separation. The method for determining this global silhouette coefficient can include: first, calculating the average distance between each client sample and other client samples within the same cluster, as well as the average distance to the nearest client sample from a different cluster, to obtain the silhouette coefficient of a single client sample; then, the corresponding global silhouette coefficient can be determined by averaging the silhouette coefficients of all client samples, and the value of this global silhouette coefficient can range from -1 to 1.

[0102] The process of determining the exploration reward coefficient based on the corresponding global profile coefficient adjustment can be achieved by adjusting the exploration reward coefficient using two pre-set thresholds (a first threshold and a second threshold, where the first threshold is greater than the second threshold). This includes: when the global profile coefficient is greater than the first threshold, the cluster separation is high and the identity is clear, so a higher exploration reward coefficient is used to encourage exploration; when the global profile coefficient is less than the second threshold, the clusters overlap and the identity is ambiguous, so a lower exploration reward coefficient is used to reduce the risk of attack; when the global profile coefficient is between the two thresholds, a default exploration reward coefficient is used to balance security and efficiency.

[0103] (2) Global update aggregation

[0104] First, the gradients on the client side are normalized. Then, the aggregate update is calculated by weighted summation. The server uses this update to optimize the global model and then distributes it to the client to enter the next round of training.

[0105] The implementation of this invention provides multi-dimensional client behavior analysis and adaptive security protection for federated learning systems. From two core levels—probabilistic identity recognition and dynamic aggregation optimization—it achieves synergy between malicious attack defense and effective utilization of heterogeneous data (including unknown data). This implementation is adaptable to various data scenarios, including independent and identically distributed (IOD) and non-independent and IOD, and supports various model architectures such as traditional CNNs, ResNet, and Vision Transformer (ViT). It can resist classic attacks such as label flipping and model scaling, as well as new and advanced attacks such as adaptive attacks and PoiSAFL. Experimental results show that the average model error rate of this invention under adaptive attacks is only 22.9%, significantly lower than the 30.8% error rate of the existing best solution, SafeFL. The misclassification rate for benign unknown data clients is reduced from 35.5% to 5.2%, while the identification rate for malicious clients reaches 96.5%. Moreover, the technical solution provided by this invention maintains high efficiency and stability even in large-scale client scenarios.

[0106] To facilitate a further understanding of the embodiments of the present invention, the implementation process of the embodiments of the present invention will be described in detail below with reference to specific application examples.

[0107] The hierarchical adaptive federated learning implementation method provided in this embodiment of the invention may include the following processing steps in specific applications:

[0108] (I) Three-dimensional core feature (i.e. three-dimensional feature vector) extraction stage

[0109] Input the model gradient update uploaded by the client We extract three-dimensional core features that can characterize update behavior to comprehensively distinguish between benign updates, unknown data exploration updates, and malicious attack updates, thereby providing basic feature support for subsequent identity modeling.

[0110] The extraction of the corresponding three-dimensional core features may include:

[0111] (1) Characteristics of directional deviation Extraction of )

[0112] Trusted updates obtained by the server based on the root dataset Based on this, the directional deviation feature is determined by calculating the directional alignment between the client's gradient update and the reliable update using cosine similarity. The calculation formula is as follows:

[0113] ;

[0114] The value of this feature ranges from [-1, 1]. The closer the value is to 1, the more consistent the update direction is with the global optimal convergence direction, and the greater the potential contribution. The closer the value is to -1, the more likely the direction is opposite, which may be due to malicious attacks or exploration of unknown data.

[0115] (2) Update intensity features ( Extraction of )

[0116] The L2 norm of the gradient is used to quantify the magnitude of client updates in order to determine the corresponding update strength features. Its calculation formula can be:

[0117] ;

[0118] In order to dominate the aggregation process and cause disruptive effects, malicious clients often artificially amplify the gradient norm, leading to... The values ​​are abnormally high; while for unknown data clients, the local optimizer (such as Adam) or regularization terms will suppress the update step size to avoid catastrophic forgetting, thus affecting the update strength feature. Typically exhibits abnormally low values; update intensity characteristics corresponding to benign clients. This is within a reasonable range;

[0119] (3) Gradient sparsity characteristics Extraction of )

[0120] The ratio of the L1 norm to the L2 norm of the gradient is used to characterize the concentration of parameter updates, thereby determining the gradient sparsity feature. Its calculation formula can be:

[0121] ;

[0122] In particular, malicious attacks, in order to ensure the destructive effect, require concentrated modification of key model parameters, resulting in highly concentrated gradient updates and gradient sparsity. The value is low; updates from benign clients and unknown data clients are naturally dispersed, thus exhibiting gradient sparsity. The value is too high; this gradient sparsity feature utilizes the attacker's camouflage dilemma to have anti-forgery properties, that is: if an attacker tries to disguise a malicious update as a benign update that conforms to the global optimization direction, the original attack vector must be adjusted and diluted to fit the characteristics of a benign update, and this process will directly weaken the core destructive power of the attack; when the attack energy is diluted to a sufficiently low level, its malicious effect is completely eliminated and the attack directly fails; conversely, if the camouflage is not thorough, its abnormal features will be identified and filtered by the model detection mechanism, and ultimately the attack purpose will also fail.

[0123] (II) Probabilistic Identity Modeling Stage Based on Gaussian Mixture Model

[0124] At this stage, the input is the set of gradient three-dimensional feature vectors (or simply three-dimensional feature vectors) obtained through extraction. By using unsupervised clustering and automatic labeling, the posterior probability of each client being a benign client, an unknown data client, or a malicious client is output, replacing the traditional hard decision rule and improving the accuracy and flexibility of identity recognition.

[0125] The processing at this stage may include:

[0126] (1) Initialization and training of Gaussian mixture model

[0127] In each round of communication, a Gaussian mixture model containing three clusters (corresponding to three types of clients) is initialized based on the k-means++ algorithm, and the number of clusters is set. Furthermore, a full covariance matrix is ​​used to adapt to the ellipsoidal data distribution; then, the three-dimensional feature vectors of all clients are input into the model for online training, so as to update the clustering parameters through the expectation-maximization (EM) algorithm;

[0128] (2) Automatic cluster labeling

[0129] Based on updated intensity features The cluster center values ​​are sorted, and the three types of clusters are automatically labeled, including: cluster center... The highest is a malicious client cluster ( The lowest is the unknown data client cluster ( The intermediate clusters are benign client clusters ( The processing requires no manual intervention and adapts to dynamic changes in data distribution;

[0130] (3) Identity probability output

[0131] Specifically, the identity probability vector of each client can be calculated using the posterior probability of a Gaussian mixture model. Correspondingly These correspond to the probabilities of benign, unknown, and malicious data, respectively, and satisfy the following conditions: The corresponding probabilistic output can flexibly handle scenarios with ambiguous boundaries, avoiding misjudgment problems caused by hard decision-making.

[0132] (III) Calculating aggregate weights and determining the global model update stage

[0133] During this phase, the input client gradient is updated. and the corresponding probability of identity Combined with the dynamically adjusted exploration reward coefficient Calculate personalized aggregation weights and perform weighted aggregation to obtain global model updates, thereby achieving synergy between suppressing malicious attacks and effectively utilizing heterogeneous data;

[0134] The processing at this stage may include:

[0135] (1) Calculation of aggregate weights

[0136] The corresponding aggregation weight integrates three key factors: identity probability, directional trust level, and exploration reward. The calculation formula can be:

[0137] ;

[0138] in, This represents the probability vector of a benign client's identity. To correct the linear unit, when Output 0 at the time to ensure that benign clients only contribute weight when the update direction is correct; For the identity probability vector of the unknown data client; The exploration reward coefficient for clients dealing with unknown data is set to a default value of 0.5 (determined through parameter sensitivity analysis, the optimal range is between [0.4, 0.6]); the specific logic for determining the aggregation weight includes: the weight of a benign client is determined by its identity credibility. With direction correctness Jointly determined; the weight of unknown data clients is determined by identity trustworthiness. With exploration reward coefficient The decision ensures that contributions are retained even if there is a significant deviation in direction; malicious clients, due to... and All are extremely low. When the value is close to 0, its aggressive behavior is naturally suppressed.

[0139] In the process of calculating the aggregation weight, the exploration reward coefficient Adjustments are made based on cluster separation, i.e., the exploration reward coefficient is dynamically adjusted based on the input Gaussian mixture model clustering results and 3D feature vectors, according to the corresponding cluster separation. To balance safety and learning efficiency during training and adapt to dynamic changes in training status; furthermore, a global silhouette coefficient is used to measure the compactness and separation of Gaussian mixture model clustering (referred to as cluster separation); that is, for each client sample Calculate the average distance between it and other client samples within the same cluster. and the average distance to all client samples from the nearest heterogeneous cluster. The formula for the silhouette coefficient of a single client sample is:

[0140] ;

[0141] The corresponding global profile coefficient can be calculated by averaging the profile coefficients of all client samples. Its value ranges from [-1, 1]. The higher the value, the better the clustering effect and the clearer the client identity.

[0142] The exploration reward coefficient should be adjusted accordingly based on the global contour coefficient. The processing may include: presetting two contour coefficient thresholds. (First threshold) and (Second threshold); when the global contour coefficient At that time, the cluster separation degree is high, the client identity is clear, and a higher exploration reward coefficient is adopted. Encourage the exploration of unknown data; when At this time, cluster overlap and identity ambiguity exist, so a lower exploration reward coefficient is used. Reduce the risk of attack; when At that time, the default exploration reward coefficient is used. Balancing security and learning efficiency;

[0143] (2) Global update aggregation

[0144] First, update the gradient on the client side. Normalization is performed to eliminate the impact of scale differences on the aggregation effect; then, based on the calculated aggregation weights, the normalized gradients of all clients are summed using a weighted average; finally, the weighted sum is divided by the total weights to obtain the final global model update, the calculation formula of which is as follows:

[0145] ;

[0146] Furthermore, after the server uses this global model to update and optimize the global model, it can distribute the new global model to each client and enter the next training cycle.

[0147] The above-described embodiments of the present invention have at least the following advantages in specific applications:

[0148] The implementation of this invention can accurately distinguish between benign updates, unknown data exploration updates, and malicious attack updates by fusing three-dimensional features of gradient direction, intensity, and sparsity, thereby fundamentally solving the "trust score dilemma" and ensuring the effective use of heterogeneous data. The corresponding trust score dilemma refers to the dilemma of setting a trust threshold when screening clients based on trust scores. If the threshold is too high, some benign clients will be misjudged, reducing model performance; if the threshold is too low, malicious clients will be let go, leading to attack risks.

[0149] This invention employs a Gaussian mixture model to achieve probabilistic identity representation, replacing the traditional hard decision method. This allows for stable recognition accuracy even in scenarios with dynamically changing data distributions and ambiguous boundaries. It also adapts to mixed environments of independent and identically distributed (i.i.d.) and non-independent i.i.d. environments without performance loss.

[0150] The embodiments of this invention also employ a dynamic exploration reward adjustment mechanism, which quantifies the cluster separation degree based on the contour coefficient and adaptively balances security and learning efficiency. When facing advanced attacks with perfect camouflage, the implementation of the embodiments of this invention can reduce the error rate by 11.7% compared with the fixed parameter scheme, demonstrating significant advantages in defense robustness.

[0151] The embodiments of the present invention also have excellent versatility and scalability; and the linear computational complexity of the solution can ensure efficiency when deploying large-scale clients and supports multiple model architectures; in addition, it shows the best defense performance on real-world scenario datasets such as medical and vehicle networking, with the attack success rate (ASR) as low as 1.0%.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that the above embodiments can be implemented by software, or by using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of the above embodiments can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.), including several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0153] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims. The information disclosed in the background section is intended only to enhance the understanding of the overall background technology of the present invention and should not be construed as an admission or implication in any way that such information constitutes prior art known to those skilled in the art.

Claims

1. An implementation method of layered federated learning, characterized in that, The method comprises the following steps: extracting a three-dimensional feature vector of a model gradient update uploaded by a client, the three-dimensional feature vector comprising a direction deviation feature, an update intensity feature and a gradient sparsity feature; performing unsupervised clustering processing on the three-dimensional feature vector to train a Gaussian mixture model, and determining the category of the client and the identity probability thereof based on the Gaussian mixture model obtained through the training; adjusting an exploration reward coefficient based on the separation degree of the Gaussian mixture model clustering, the exploration reward coefficient being used to determine whether the corresponding update is encouraged or not; determining the aggregation weight of the model gradient update input by the client based on the identity probability and the exploration reward coefficient, and obtaining a global model update by using the aggregation weight to update the global model issued to the client, and then updating the Gaussian mixture model based on the updated global model in the subsequent training process.

2. The method of claim 1, wherein, The direction deviation feature is the alignment degree of the direction of the client update and the server trusted update calculated by cosine similarity, and the value range is between negative one and one; the update intensity feature is the update amplitude quantified by the L2 norm of the gradient; and the gradient sparsity feature is the parameter update concentration expressed by the ratio of the L1 norm to the L2 norm of the gradient.

3. The method of claim 2, wherein, The calculation method of the three-dimensional feature vector comprises the following steps: The direction deviation feature The extraction includes: Trustworthy updates computed with root dataset As a baseline, the degree of alignment of the client gradient update with the direction of the trustworthy update is computed as the direction bias feature by cosine similarity, with the formula: ； The value range of is between [-1, 1], and the closer the value is to 1, the more consistent the update direction is with the global optimal convergence direction; the closer the value is to -1, the more likely the update direction is opposite, indicating a possible malicious attack or unknown data exploration; The update intensity feature The extraction includes: The model gradient uploaded by the client is updated as The update strength feature is determined by the amplitude of the L2 norm quantization of the gradient, and the calculation formula is as follows: ； Update intensity features corresponding to malicious clients Update intensity features corresponding to unknown data clients exhibiting unusually high values Update intensity features corresponding to benign clients exhibiting unusually low values then lie in a reasonable interval The gradient sparsity feature The extraction includes: the gradient sparsity feature is determined by the ratio of the L1 norm to the L2 norm of the gradient, and the calculation formula is: ； Gradient sparsity feature corresponding to malicious clients Gradient sparsity feature corresponding to benign clients and unknown data clients Gradient sparsity feature corresponding to benign clients and unknown data clients 4. The method according to claim 1, 2 or 3, characterized in that, The processing process of training the Gaussian mixture model comprises the following steps: initializing the Gaussian mixture model containing three clusters based on a clustering algorithm, and inputting the three-dimensional feature vector to complete the corresponding model training, wherein the three clusters correspond to three types of clients, including malicious clients, unknown data clients and benign clients.

5. The method of claim 4, wherein, The processing process of determining the category of the client is realized by automatic labeling of clustering, and comprises the following steps: sorting the cluster center values based on the update intensity feature, and automatically labeling three types of clusters, including the cluster center update intensity of the highest being the malicious client cluster, the lowest being the unknown data client cluster, and the intermediate cluster being the benign client cluster.

6. The method of claim 5, wherein, The determination process of the identity probability comprises the following steps: obtaining the identity probability vector of each client by calculating the posterior probability of the Gaussian mixture model, which respectively represents the probabilities of being benign, unknown data and malicious.

7. The method of claim 1, 2, or 3, wherein, In the processing process of adjusting the exploration reward coefficient, the global contour coefficient is used to measure the clustering separation degree, and the processing process comprises the following steps: calculating the average distance of each client sample to other client samples in the same cluster and the average distance to the nearest different cluster client sample to determine the contour coefficient of a single client sample; calculating the average value of all sample contour coefficients as the global contour coefficient, and the value range is between negative one and one; adjusting and determining the exploration reward coefficient based on the global contour coefficient.

8. The method of claim 7, wherein, The processing process of adjusting and determining the exploration reward coefficient based on the global contour coefficient comprises the following steps: based on the global contour coefficient, adjusting the exploration reward coefficient by using the first threshold value and the second threshold value set in advance, wherein: when the global contour coefficient is greater than the first threshold value, the exploration reward coefficient is increased to encourage exploration update; When the global silhouette coefficient is less than a second threshold, the exploration reward coefficient is reduced to reduce the attack risk; When the global silhouette coefficient is between the first threshold and the second threshold, a default exploration reward coefficient is adopted to balance safety and efficiency.

9. The method of claim 7, wherein, The determination manner of the global silhouette coefficient comprises: For each sample , the average distance to other client samples within the same cluster , and the average distance to all client samples in the nearest out-of-cluster cluster , are computed and the silhouette coefficient for the individual client sample is computed as: ​ ； The average value of the silhouette coefficients of all client samples is taken as the global silhouette coefficient, which is in the range of [-1, 1], and the higher the value is, the better the clustering effect is and the clearer the client identity is.

10. The method of claim 1, 2, or 3, wherein, the aggregated weights The formula for calculating the aggregated weights is: ； wherein, is the identity probability vector of a benign client; is a rectified linear unit that outputs 0 when is the identity probability vector of a benign client; is the identity probability vector of an unknown data client; is the exploration reward coefficient of an unknown data client, taking a value in the interval [0.4, 0.6]. The global model update The calculation formula is: ； wherein, is the model gradient update uploaded by the client, and N is the number of clients.

Images