Federal learning model poisoning defense method based on rapid distillation and clustering weighting

Abstract

The invention discloses a federal learning model poisoning defense method based on rapid distillation and clustering weighting, which is applied to an Internet of Vehicles environment. The method is executed by a federal learning server, and comprises the following steps: firstly, receiving a model update vector of a vehicle node, and quickly generating a virtual model of each node by jointly optimizing a distillation process of a virtual sample and a soft label based on virtual training data; and then, calculating the deviation between the virtual model and a real update vector as a suspicious score, and performing adaptive clustering analysis to distinguish node categories according to the suspicious score. And finally, distributing differentiated aggregation weights for the nodes according to the categories and the suspicious scores, and performing weighted aggregation on the update vectors to generate a new global model. According to the method, on the premise of protecting data privacy, model poisoning attacks of malicious nodes can be effectively identified and inhibited, and the security and model convergence robustness of the Internet of Vehicles federated learning system in a non-independent identically distributed data environment are improved.

Description

A Poisoning Defense Method Based on Fast Distillation and Cluster Weighted Federated Learning Model Technical Field

[0001] This invention belongs to the field of federated learning technology, and in particular relates to a poisoning defense method for federated learning models based on rapid distillation and cluster weighting. Background Technology

[0002] With the rapid development of artificial intelligence and vehicle-to-everything (V2X) technologies, federated learning, as a distributed learning method that enables multi-node collaborative training without directly sharing raw data, has been widely applied in V2X scenarios. However, due to the characteristics of the V2X environment, such as a large number of nodes, high heterogeneity of nodes, unstable communication, and severely non-independent and identically distributed (Non-IID) data distribution, federated learning systems face complex security threats. Among these, model poisoning attacks have become a key security issue in federated learning systems.

[0003] To address the model poisoning problem in federated learning of connected vehicles, numerous studies have proposed various defense methods based on robust aggregation, such as aggregation algorithms based on Euclidean distance, statistical pruning, or median rules. These methods typically rely on the assumption of similarity between client model updates, assuming that most clients have similar data distributions and consistent model update directions. However, in model poisoning attack scenarios, the collected data from many vehicles is inconsistent, easily leading to a significant decrease in defense performance. Some studies also rely on anomaly detection based on similarity mechanisms, discarding abnormal model updates directly. While these methods can suppress the impact of malicious updates to some extent, overly aggressive rejection strategies can easily lead to misjudgments of valid model updates, thus slowing down model convergence and even causing the global model to fall into a suboptimal solution, ultimately affecting the overall model performance.

[0004] In addition, there are defense mechanisms based on global information similarity, which use global information as a trust anchor to identify or mitigate malicious model updates. This relies on the similarity between historical global models or between the global model and the local model to identify malicious vehicle nodes. However, due to the high data heterogeneity of the Internet of Vehicles (IoV), this method relying on similarity calculation is infeasible, leading to ineffective detection. On the other hand, existing defense schemes based on deep model analysis of gradient correlations typically have high computational complexity, making it difficult to meet the real-time and resource-constrained requirements of IoV environments. Therefore, a balance needs to be struck between model security and time cost. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention proposes a poisoning defense method based on rapid distillation and cluster weighting in a federated learning model, thereby resolving the issues present in the existing technologies.

[0006] To achieve the above objectives, this invention provides a federated learning model poisoning defense method based on rapid distillation and cluster weighting, applied to a federated learning system in a vehicle-to-everything (V2X) environment. The federated learning server performs the following steps: receiving model update vectors uploaded by each vehicle node participating in the current training round; performing a joint optimization of virtual samples and soft labels distillation on the model update vector of each vehicle node based on virtual training data to quickly generate a corresponding virtual model for each vehicle node; calculating the suspicious score of each vehicle node in this round based on the deviation between the virtual model and the corresponding vehicle node's model update vector; classifying vehicle node categories through adaptive clustering analysis based on the set of suspicious scores for all vehicle nodes, and assigning aggregation weights to each vehicle node according to its category and suspicious score; and weighting and aggregating all received model update vectors based on the aggregation weights to generate a new global model for this round, thus achieving robust defense against model poisoning attacks from malicious vehicle nodes.

[0007] Optionally, a fast distillation process for jointly optimizing virtual samples and soft labels based on virtual training data is performed, including: maintaining an optimizable distillation knowledge set for each vehicle node, the distillation knowledge set including virtual samples, corresponding virtual labels, and learning rate parameters; initializing a model to be distilled with the global model parameters from the previous round; iteratively updating the parameters of the model to be distilled and synchronously updating the distillation knowledge set in reverse with the optimization objective of minimizing the difference between the update direction generated by the model to be distilled and the update vector direction of the corresponding vehicle node model; when the iteration meets a preset termination condition, the updated model to be distilled is used as the virtual model.

[0008] Optionally, preprocessing is performed before the federated learning iterative training begins. This preprocessing constructs common distillation information for the distillation process, including: initializing a common initial distillation knowledge set; performing the distillation process for each vehicle node in a batch of vehicle nodes based on the initial distillation knowledge set to obtain the local distillation knowledge of each node; and weighting and aggregating all local distillation knowledge according to the proportion of local data of each vehicle node to generate the common distillation information. The common distillation information serves as the initialization basis for the distillation knowledge set of each vehicle node in subsequent training rounds.

[0009] Optionally, the suspicious score of each vehicle node can be obtained by calculating the normalized Euclidean distance between the virtual model and the normalized model update vector of the corresponding vehicle node.

[0010] Optionally, the method further includes an adaptive acceleration mechanism: during the distillation iteration of a vehicle node, if the suspicious score calculated based on the current intermediate result is lower than a preset threshold, the subsequent distillation iteration of the vehicle node is terminated; if the suspicious score of a vehicle node is lower than the threshold in multiple consecutive rounds, the number of distillation iterations performed on the corresponding vehicle node is reduced to the maximum number of iterations in subsequent rounds.

[0011] Optionally, the process of distinguishing vehicle node categories through adaptive clustering analysis includes: analyzing the set of suspicious scores using the Gap Statistics method to determine the optimal number of clusters; if the optimal number of clusters is greater than 1, then using the K-Means algorithm to divide all vehicle nodes into a corresponding number of clusters based on the suspicious scores; and identifying the cluster containing the most vehicle nodes as a subset of benign vehicle nodes.

[0012] Optionally, the process of assigning aggregation weights to each vehicle node based on its category and suspicious score includes: for vehicle nodes belonging to the subset of benign vehicle nodes, allocating aggregation weights according to their suspicious scores and a first weight calculation rule; and for vehicle nodes not belonging to the subset of benign vehicle nodes, allocating aggregation weights according to their suspicious scores and a second weight calculation rule.

[0013] Optionally, the first weight calculation rule includes: multiplying the complement of the weight adjustment factor by the ratio of the suspicious score of a single node to the sum of the suspicious scores of all nodes in the subset of benign vehicle nodes.

[0014] Optionally, the second weight calculation rule includes: multiplying the weight adjustment factor by the reciprocal of the total number of nodes, and then multiplying the resulting product by the ratio of the suspicious score of a single node to the sum of the suspicious scores of all nodes.

[0015] Optionally, if the optimal number of clusters determined by Gap Statistics is no greater than 1, then the standard federated average algorithm is used to assign aggregation weights to all nodes.

[0016] Compared with the prior art, the present invention has the following advantages and technical effects: Through a rapid distillation process based on virtual training data, the server can effectively reconstruct and approximate the local training features of vehicle nodes without accessing their original local data, thereby generating a reliable virtual model for evaluation, fundamentally solving the contradiction between privacy protection and security defense.

[0017] This invention utilizes the discrepancy score calculated between the virtual model and the real update vector, combined with the adaptive clustering mechanism of GapStatistics and K-Means, to accurately distinguish between benign and malicious nodes, and applies differentiated aggregation weights to nodes of different categories. This mechanism effectively suppresses the impact of malicious model updates, while avoiding the loss of effective information and model convergence fluctuations that may be caused by simple removal.

[0018] This invention significantly improves the inherent robustness of federated learning systems against targeted attacks (such as backdoor attacks) and non-targeted attacks, ensuring stable convergence and reliable performance of the global model under conditions of malicious nodes and highly non-independent and identically distributed data. Attached Figure Description

[0019] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application. In the drawings: Figure 1 is a system defense framework diagram of an embodiment of the present invention; Figure 2 is a system structure diagram of an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0022] Example 1, as shown in Figure 1, provides a poisoning defense method for federated learning models based on fast distillation and cluster weighting. The method includes: 1. Construction of a poisoning model in a vehicle-to-everything (V2X) federated learning system. The system environment model includes a vehicle node model, roadside unit and wireless communication model, server-side global aggregation model, and attacker model. By modeling the non-independent and identically distributed characteristics of vehicle local data, the model update transmission process, and the attacker's poisoning behavior on model updates, system-level support is provided for subsequent distillation synthesis, suspicious assessment, and robust aggregation.

[0023] II. Fast Distillation Feature Synthesis Method. The server initializes a virtual model based on the previous round of global model and combines the model update vector uploaded by the client with distillation knowledge to perform fast distillation feature synthesis. By jointly optimizing virtual samples, soft labels, and distillation parameters, a distillation synthesis model that can approximate the client's real training behavior is generated. At the same time, a distillation preprocessing stage is introduced to construct common distillation information, thereby accelerating the distillation process and reducing computational complexity.

[0024] III. Suspicious Score Calculation and Adaptive Distillation Acceleration Mechanism. The server uses the distillation synthesis model, client model update vectors, and global model parameters to calculate the suspicious score for each client, quantifying the credibility of the client model update. Simultaneously, the server dynamically adjusts the iterative process of distillation synthesis based on the suspicious score feedback. When a preset threshold condition is met, distillation is terminated early or the number of subsequent iterations is reduced, thereby improving the overall system efficiency while ensuring the defense effect.

[0025] IV. Gas-KMeans Clustering Weighted Aggregation Method. The server uses the Gas-KMeans clustering method based on the set of suspicious client scores to adaptively determine the number of clusters and distinguish between benign and suspicious clients. Weighting coefficients are assigned to each client based on the clustering results, and weighted aggregation is performed on the model update to generate a new round of global model, thereby effectively suppressing the impact of model poisoning attacks on the federated learning training process.

[0026] The specific details of implementing the above steps are as follows: Stage (1): Construction of poisoning model in the Internet of Vehicles (IoV) federated learning system; This embodiment constructs a federated learning model poisoning defense system for Internet of Vehicles (IoV) scenarios, the structure of which is shown in Figure 2. The system environment model mainly includes vehicle node model, roadside unit and wireless communication model, server-side global aggregation model, attacker model and overall system process model.

[0027] 1. Vehicle Node Model (Client Model); In the Internet of Vehicles (IoV), there are a large number of vehicle nodes with local data collection and computing capabilities. Each node is denoted as... Each vehicle collects data through sensors, cameras, radar, and traffic signals to train a local model. .

[0028] Each vehicle node maintains its local dataset: ;in, This indicates the input sample data. This indicates the corresponding tag.

[0029] Due to significant differences in geographical location, traffic conditions, and time periods among vehicle nodes, the local data of each node exhibits a high degree of non-independent identically distributed (Non-IID) characteristics, resulting in a significant shift in the data distribution among different vehicles.

[0030] In each round of federated learning, each vehicle performs several rounds of local training, calculating local gradients or model update amounts: ;in, Represents the vehicle node in the t-th round of training. The generated local model update vector; Represents the vehicle node in the t-th round of training. The generated local model.

[0031] 2. Roadside Unit and Wireless Communication Model (RSU & V2X Communication): Vehicle nodes and the central server communicate via Roadside Units (RSUs) using V2X technology, including V2I, V2V, and V2X links.

[0032] In the model of this invention, the RSU mainly performs the following functions: a) Receiving vehicle model updates: The RSU receives the local model update vector uploaded by the vehicle node. a) Cache temporarily; b) Forward to central server: RSU securely transmits the collected client update vectors to the central server for subsequent rapid distillation processing and suspicion calculation; c) Distribute global model updates: RSU receives the global model aggregated by the server and broadcasts it to each vehicle node via downlink.

[0033] By introducing RSU, intermediate communication latency and link instability are mitigated, while avoiding frequent direct communication between vehicle nodes and the server.

[0034] 3. Server-Side Global Aggregation Model (FL Server Aggregation Model): The central server periodically selects a subset of nodes from the participating vehicle nodes as the client set for the current round using RSU (Real-Time Units), and the number of these nodes is denoted as . The total number of vehicles in the system is ,in After receiving the local model update vectors from all participating clients in round t, the server performs a model aggregation operation: ;in, Represents the aggregation rules of the model; This represents the global model in the t-th round of federated learning training. Unlike the FedAvg aggregation method used in traditional federated learning, this embodiment introduces a clustering weighted aggregation mechanism based on suspicion scores in subsequent stages to dynamically adjust the aggregation weights updated by each client, thereby suppressing the impact of malicious nodes on the global model.

[0035] 4. Attacker Model: To construct a complete system poisoning model, this embodiment limits the attacker's capabilities as follows: the number of malicious vehicle nodes that the attacker can control is [number missing]. ,and Attackers can partially or completely manipulate the local training process and upload updates of the controlled nodes. Attack methods include: Untargeted Attack: By constructing abnormal gradients, the model convergence process is disrupted, causing the global model accuracy to continuously decline; Targeted Attack: Such as backdoor attacks, by implanting triggers, the model outputs the attacker's expected incorrect results under specific input conditions, and may even occasionally cause a certain degree of accuracy decline.

[0036] Specific attack methods that attackers can execute include scaling attacks, label flipping attacks, direction reversal attacks, and semantic or pixel-level backdoor attacks.

[0037] The attacker's goal can be formally represented as: ;② ; where ① indicates that the input sample contains a backdoor trigger. The model output was manipulated by the attacker to represent the target label. ; ② indicates a clean data distribution Above, model prediction results With real labels Inconsistency leads to a decrease in overall classification accuracy. )decline.

[0038] 5. System Overall Workflow Model: Based on the above sub-models, this invention constructs a complete federated learning defense process for the Internet of Vehicles, including: a) The server initializes the global model and broadcasts it to vehicle nodes via RSU; b) Each vehicle node performs local training and generates model update vectors; c) Malicious nodes may upload constructed abnormal or malicious updates; d) After receiving updates from the client, the server performs fast distillation synthesis and suspiciousness scoring calculation; e) The server performs robust aggregation based on the clustering weighting mechanism of Gap-Statistics and K-Means; f) The aggregated global model is again distributed to vehicle nodes via RSU; g) The above process is repeated until model training is completed.

[0039] 6. System optimization objective modeling; Under ideal conditions without considering attacks, the global optimization objective of the IoV-FL system is: ;in, Represents vehicle node Local model parameters In local dataset The loss function on.

[0040] This embodiment analyzes, identifies, and suppresses abnormal behavior during the model update process, enabling the optimization process to converge stably even in the presence of malicious nodes, thereby obtaining a robust optimal global model.

[0041] Stage (2): Rapid distillation feature synthesis method; This stage is used to extract the feature information contained in the client model update without accessing the client's original training data, and to quickly generate a virtual distillation synthesis model, providing a basis for subsequent suspicion assessment.

[0042] 1. Distillation-Synth Mechanism: In the distillation-synth process, this embodiment not only updates the parameters of the virtual synthesis model, but also incorporates the virtual sample data, virtual labels, and learning rate parameters used in the distillation process into the set of optimizable variables, thereby enhancing the ability of the distillation-synth model to extract approximate information of local features on the client side.

[0043] Specifically, distilling local knowledge sets Defined as: During the distillation process, this local knowledge set The three types of variables are jointly optimized through backpropagation, rather than being fixed, as follows: ; ; ;in, , , These represent the update step size corresponding to the virtual sample, virtual label, and learning rate, respectively. This refers to the loss function used during distillation training. This represents a virtual model under given distillation variables.

[0044] Through the above joint optimization method, the virtual samples, soft labels, and learning rate parameters gradually approximate the gradient feature distribution implicit in the real client training process.

[0045] In the t-th round of federated learning, for any client First, initialize the client-side local knowledge set used for distillation. : By using a recursive update method between different training rounds, the local information of distillation is preserved, thereby avoiding the additional computational overhead caused by re-initialization in each round.

[0046] Subsequently, the server initializes the virtual model using the global model from the previous round: Based on this, the model update vector uploaded by the client is combined. Utilize local knowledge sets The virtual model is trained through M distillation iterations. During the m-th distillation iteration, a classification loss function is used. Perform gradient updates on the virtual model: ;in, It is the learning rate of the virtual model for M distillation iterations.

[0047] After updating the virtual model parameters, calculate the normalized mean squared error loss function between the current virtual model update direction and the client's actual update direction: The symbol “^” indicates that the vector is normalized to eliminate the impact of scale differences between different client models.

[0048] Next, using the loss function To optimize the objective, stochastic gradient descent (SGD) is used on the local knowledge set. Perform backpropagation updates: The above process continues iterating until m = M, or stops when a certain condition (discussed below) is met, ultimately yielding a distillation synthesis model that approximates the client's local feature information. 2. Preprocessing Stage: Accelerated Distillation Synthesis Mechanism; To further reduce the computational complexity of the distillation synthesis process and improve the system's real-time performance, this invention introduces a preprocessing stage before the complete distillation synthesis mechanism. This is equivalent to pre-constructing shared distillation information across clients at t=0. .

[0049] Distillation common information initialization: First, randomly initialize virtual samples and corresponding labels to construct an initial distillation knowledge set: ; Generate local distillation information based on the distillation synthesis mechanism; initialize the distillation knowledge set Input the Distill-Synth mechanism to generate local distillation information for the corresponding client: Distillation common information weighted aggregation; The server performs weighted aggregation of distillation information based on the number of local samples from each vehicle client to construct shared distillation common information among clients: ;in, Indicates client The number of local samples, This represents the total number of client samples that participated in the update. Indicates client Local distillation information.

[0050] 3. Description of the overall process of rapid distillation synthesis; During system operation, the distillation feature synthesis module prioritizes the above preprocessing stage, utilizing the distillation synthesis mechanism to construct shared distillation information. This serves as an accelerated starting point for subsequent distillation. Subsequently, during the formal federated learning training phase, the server combines... By updating the model gradient vector uploaded by the client, a complete distillation synthesis mechanism is executed to quickly generate a virtual distillation synthesis model. This significantly reduces computational overhead while ensuring effective defense.

[0051] Generate a virtual distillation synthesis model This will serve as input to the next stage of the suspiciousness assessment and clustering weighting module, used to identify potential model poisoning behaviors.

[0052] Phase (3): Suspicious score calculation and adaptive distillation acceleration mechanism; In this phase, the credibility of the client model update will be quantitatively evaluated based on the results of distillation synthesis, and the subsequent clustering weighted aggregation process will be guided accordingly. At the same time, the distillation process will be adaptively accelerated through suspicious score feedback.

[0053] 1. Suspicious score calculation mechanism; the server utilizes a virtual distillation synthesis model generated in the previous stage. By combining the model update vector uploaded by the client with the previous round of global model, a suspicious score is calculated for each client.

[0054] For the client in the t-th round of training Its suspicious score is defined as: ;in: This represents a virtual model obtained through rapid distillation synthesis; Indicates client Uploaded local model update vector; This represents the result after normalizing the update vector; This represents the parameters of the global model in the previous round.

[0055] The suspicious score determines whether the updates uploaded by the client deviate from the normal model training trajectory by comparing the consistency between the distillation synthesis model and the client updates.

[0056] When the client is a benign node, its uploaded model updates have a high degree of consistency with the distillation-synthesized model in the parameter space, resulting in a relatively concentrated (similar) distribution of their suspicious scores. However, when the client is a malicious node, its uploaded updates often deviate from the normal training direction, making it difficult for the distillation-synthesized model to approximate the model, thus producing more extreme suspicious scores with larger amplitudes, which often cannot be clustered (similar) with the suspicious scores of benign clients.

[0057] 2. The significance and stability design of suspicious scores: To eliminate the influence of different model sizes and training rounds, this invention uses normalized Euclidean distance as a metric, giving suspicious scores the following characteristics: Scale independence: unaffected by changes in model parameter dimensions and gradient magnitude; Cross-client comparability: suspicious scores calculated by different clients in the same round can be directly used for cluster analysis; Robustness to Non-IID data: unlike focusing on specific data distributions, the core of the distillation synthesis model lies in presenting the update direction. This design fundamentally reduces the possibility of misjudgment in Non-IID scenarios.

[0058] 3. A distillation acceleration mechanism based on doubt score feedback; while completing the doubt score calculation, the present invention further utilizes the doubt score to adaptively control the distillation synthesis process to reduce the overall computational overhead.

[0059] Specifically, the system presets a suspicious score threshold γ for different application scenarios or datasets. When a client meets the following criteria during the distillation synthesis process: If the current distillation synthesis model is determined to be able to approximate the client's update characteristics well, the distillation iteration process of the current client is immediately terminated to avoid unnecessary calculations.

[0060] 4. Adaptive distillation iteration number adjustment strategy; To further improve long-term operating efficiency, this invention introduces a dynamic adjustment mechanism for the number of distillation iterations based on historical doubt scores.

[0061] If a client's suspicious score is consistently below a threshold in multiple consecutive training rounds... The system will then automatically reduce the maximum number of iterations M required for the next round of distillation synthesis, specifically as follows: Where N is the preset iteration decay step size.

[0062] This mechanism enables benign clients to complete distillation synthesis at a lower computational cost in subsequent training rounds, while maintaining high detection accuracy for suspicious clients.

[0063] Stage (4): Gas-KMeans clustering weighted aggregation method; This stage is based on the client suspicious score set calculated in the previous stage, and performs adaptive clustering and weighted aggregation on the client model update, so as to ensure that the positive update dominates the aggregation result while suppressing the impact of potential malicious update on the global model.

[0064] 1. Adaptively determine the number of clusters based on Gap Statistics; the server first sets up the set of suspicious scores of all clients participating in updating during the t-th round of training; The Gap Statistics() method can automatically determine the minimum number of clusters required for optimal clustering. Specifically, it is expressed as: This step avoids manually setting the number of clusters, allowing the clustering process to adapt to different attack intensities and client distributions.

[0065] 2. Suspicious score clustering based on K-Means; when When the score is greater than 1, the server uses the K-Means clustering algorithm to cluster the set of suspicious scores, dividing the clients into groups. Non-overlapping subsets: ;in, 3. Benign Client Subset Identification; Based on the assumption in federated learning that at least half of the clients are benign nodes, the server selects the subset with the largest number in the clustering results as the benign client set: This set is considered the most reliable source of client updates in the current round.

[0066] 4. Initial weight calculation; for benign subsets The initial weights of the clients are calculated by normalizing their own doubt scores, and an adjustment factor β is introduced to balance the influence of benign and non-benign clients: ;in, [0,1] represents the weighted hyperparameters.

[0067] For those that do not belong to a benign subset For clients, the weights are allocated using a decay-weighted strategy: This design ensures that the contributions of non-benign clients to the global model are significantly reduced, but not completely discarded, thereby improving the stability of the system in boundary cases.

[0068] 5. Weight Normalization and Weight Array Construction: The server normalizes the initial weights of all clients to generate the final weight array used for aggregation. 6. Weighted aggregation and special case handling; the server uses the weight array... The client model updates are weighted and aggregated to generate a new global model: When the result calculated by the Gap-Statistics algorithm satisfies If the server determines that the current distribution of suspicious scores does not have a clear clustering structure, it will directly use the standard federated average aggregation method: .

[0069] This invention identifies the local training habits of each vehicle node in a vehicle-to-everything (V2X) network and utilizes a fast distillation module to extract virtual update features from the client without accessing the original data, thereby quantifying the suspiciousness score assessment of each vehicle's update vector. Simultaneously, it automatically determines the number of clusters using Gap-Statistics and assigns different aggregation weights to client updates using a cluster weighting mechanism, suppressing malicious updates and enhancing benign updates. This invention effectively utilizes the fast distillation module to reconstruct the client's virtual update features under conditions of high non-independent identically distributed (Non-IID) data and a high proportion of malicious vehicles. By reconstructing these features without accessing the original data, it quantifies the suspiciousness score assessment of each vehicle's update vector, improves the federated learning model's defense capabilities against targeted and untargeted attacks, reshapes the update trajectory of the global model (aggregation mechanism), and evaluates the strategy's effectiveness by comparing it with a baseline model, ensuring the real-time performance, robustness, and effectiveness of the current defense framework.

[0070] This invention introduces a Gas-KMeans clustering weighted aggregation mechanism, which can adaptively distinguish between benign and potentially malicious client updates; maintain global model convergence stability under conditions of high malicious node ratio and Non-IID; avoid "one-size-fits-all" elimination of non-beneficial clients, thus improving robustness; and flexibly adjust the system's security and convergence speed by combining the parameter β.

[0071] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A poisoning defense method based on a federated learning model using rapid distillation and cluster weighting, characterized in that, A federated learning system applied in a vehicle-to-everything (V2X) environment comprises the following steps performed by a federated learning server: receiving model update vectors uploaded by each vehicle node participating in the current training round; performing a joint optimization of virtual sample and soft label distillation process on the model update vector of each vehicle node based on virtual training data to quickly generate a corresponding virtual model for each vehicle node; calculating the doubt score of each vehicle node in this round based on the deviation between the virtual model and the corresponding vehicle node model update vector; and classifying vehicle node categories through adaptive clustering analysis based on the set of doubt scores for all vehicle nodes, and assigning aggregation weights to each vehicle node according to its category affiliation and doubt score. The received model update vectors are weighted and aggregated based on the aggregation weight to generate a new global model for this round, thereby achieving robust defense against model poisoning attacks on malicious vehicle nodes.

2. The poisoning defense method based on rapid distillation and cluster weighted federated learning model according to claim 1, characterized in that, A rapid distillation process based on virtual training data, jointly optimizing virtual samples and soft labels, is performed, including: maintaining an optimizable distillation knowledge set for each vehicle node, the distillation knowledge set containing virtual samples, corresponding virtual labels, and learning rate parameters; initializing a model to be distilled using the global model parameters from the previous round; iteratively updating the parameters of the model to be distilled while simultaneously updating the distillation knowledge set in reverse, with the optimization objective of minimizing the difference between the update direction generated by the model to be distilled and the update vector direction of the corresponding vehicle node model; and when the iteration meets a preset termination condition, using the updated model to be distilled as the virtual model.

3. The poisoning defense method based on rapid distillation and cluster weighted federated learning model according to claim 2, characterized in that, Before the federated learning iterative training begins, preprocessing is performed to construct common distillation information for the distillation process. This preprocessing includes: initializing a common initial distillation knowledge set; based on the initial distillation knowledge set, performing the distillation process for each vehicle node in a batch of vehicle nodes to obtain the local distillation knowledge of each node; and weighting and aggregating all local distillation knowledge according to the proportion of local data of each vehicle node to generate the common distillation information. The common distillation information serves as the initialization basis for the distillation knowledge set of each vehicle node in subsequent training rounds.

4. The poisoning defense method based on rapid distillation and cluster weighted federated learning model according to claim 1, characterized in that, The suspicion score of each vehicle node is obtained by calculating the normalized Euclidean distance between the virtual model and the normalized model update vector of the corresponding vehicle node.

5. The poisoning defense method based on rapid distillation and cluster weighted federated learning model according to claim 2, characterized in that, The method also includes an adaptive acceleration mechanism. During the distillation iteration of a vehicle node, if the suspicious score calculated based on the current intermediate result is lower than a preset threshold, the subsequent distillation iteration of the vehicle node is terminated. If the suspicious score of a vehicle node is lower than the threshold in multiple consecutive rounds, the number of distillation iterations for the corresponding vehicle node is reduced to the maximum number of iterations in subsequent rounds.

6. The poisoning defense method based on rapid distillation and cluster weighted federated learning model according to claim 1, characterized in that, The process of distinguishing vehicle node categories through adaptive clustering analysis includes: analyzing the set of suspicious scores using the Gap Statistics method to determine the optimal number of clusters; if the optimal number of clusters is greater than 1, then using the K-Means algorithm to divide all vehicle nodes into a corresponding number of clusters based on the suspicious scores; and identifying the cluster containing the most vehicle nodes as a subset of benign vehicle nodes.

7. The poisoning defense method based on rapid distillation and cluster weighted federated learning model according to claim 6, characterized in that, The method of assigning aggregation weights to each vehicle node based on category and suspicious score includes: for vehicle nodes belonging to the subset of benign vehicle nodes, allocating aggregation weights according to their suspicious scores and a first weight calculation rule; for vehicle nodes not belonging to the subset of benign vehicle nodes, allocating aggregation weights according to their suspicious scores and a second weight calculation rule.

8. The poisoning defense method based on rapid distillation and cluster weighting federated learning model according to claim 7, characterized in that, The first weight calculation rule includes: multiplying the complement of the weight adjustment factor by the ratio of the suspicious score of a single node to the sum of the suspicious scores of all nodes in the subset of benign vehicle nodes.

9. The poisoning defense method based on rapid distillation and cluster weighting federated learning model according to claim 7, characterized in that, The second weight calculation rule includes: multiplying the weight adjustment factor by the reciprocal of the total number of nodes, and then multiplying the resulting product by the ratio of the suspicious score of a single node to the sum of the suspicious scores of all nodes.

10. The poisoning defense method based on rapid distillation and cluster weighting federated learning model according to claim 6, characterized in that, If the optimal number of clusters determined by Gap Statistics is no greater than 1, then the standard federated average algorithm is used to assign aggregation weights to all nodes.

Images