Poisoning attack defense method in privacy protection federated learning without threshold

Abstract

This invention presents a threshold-free, privacy-preserving federated learning poisoning attack defense method, addressing the technical problems of intermediate information leakage, difficulty in distinguishing between benign and malicious updates, and difficulty in adapting to high-attack-ratio scenarios. The implementation includes: initialization; training and uploading parameters; secure K-means clustering on the server and threshold-free filtering based on benchmark gradients; server aggregation and dynamic benchmark updates; and updating the number of clusters. This invention uses a multi-party secure computation extension protocol to protect client gradient privacy in cluster-based federated learning poisoning attack defense. It designs a robust defense strategy of multi-cluster partitioning and combination filtering, performs secure K-means clustering, and securely compares different cluster combinations with server benchmark gradients. It does not require a preset malicious user ratio threshold and adaptively filters out benign update sets, achieving a balance between security, robustness, and scalability. It is applicable to federated learning systems involving a large number of heterogeneous entities, such as smart cities and connected vehicles.

Description

Technical Field

[0001] This invention belongs to the fields of artificial intelligence and machine learning, and mainly involves privacy protection and defense against federated learning poisoning attacks. Specifically, it is a threshold-free privacy-preserving method for defending against federated learning poisoning attacks, which can be applied to credit risk control, medical image analysis, smart retail, and other fields. Background Technology

[0002] Driven by the digital wave, data has become the fifth core factor of production after land, labor, capital, and technology, and a key foundation for the development of artificial intelligence and deep learning technologies. The widespread application of multi-source heterogeneous data in finance, healthcare, and the Internet of Things has significantly unleashed its potential value. However, with the continuous expansion of data scale, privacy breaches and security governance issues are becoming increasingly serious. Traditional centralized machine learning requires aggregating scattered data to a central server for training, a process that significantly increases the risk of data leakage during transmission and storage, leading to numerous privacy and security incidents. In response, the EU's General Data Protection Regulation (GDPR), the US California Consumer Privacy Act, and my country's Cybersecurity Law, Data Security Law, and Personal Information Protection Law have been successively introduced, imposing strict requirements on data use and privacy protection. Despite the continuous improvement of the legal framework, the risk of single-point failure in centralized data storage remains difficult to avoid, and frequent large-scale data breaches further exacerbate the data silo problem, severely restricting the effective utilization of multi-source data by artificial intelligence.

[0003] To achieve cross-domain collaboration while ensuring privacy, Google proposed Federated Learning, a distributed machine learning paradigm, in 2017. Federated Learning follows the fundamental principle of "data stays put, model moves," meaning that the original training data remains locally on each participating client and is not centrally collected or shared. During training, the server only sends the global model parameters for the current round to the clients. Each client independently trains its model or calculates gradients based on its local data and uploads the resulting model parameters or gradient vectors to the server. The server aggregates the local updates from multiple clients without accessing any of the original data, forming a new global model for the next iteration. Federated Learning mitigates the privacy risks associated with centralized storage of original data to some extent and has quickly become a research hotspot in privacy computing. However, Federated Learning is not inherently secure. On one hand, the model parameters or gradients trained locally by users are essentially compressed representations of their local data. Attackers can reconstruct user privacy data using gradient inversion or membership inference, potentially leaking sensitive information. On the other hand, the open, distributed architecture of Federated Learning makes the system highly vulnerable to poisoning attacks such as data poisoning and model poisoning, severely compromising the reliability of the global model. Therefore, federated learning faces risks to privacy and robustness. Effectively identifying anomalous model updates from participants without compromising their gradient privacy is a significant challenge.

[0004] To address the robustness issue, Wu et al. proposed MODEL in 2024. This model employs a truth-finding-based evaluation method to measure the credibility of local model updates on each client. Based on the truth-finding metric, the model introduces a clustering filtering mechanism to divide the local model into benign and malicious clusters to identify potential anomalous updates, thus resisting novel optimization attacks without pre-setting a malicious client ratio. However, this method is based on binary classification, and the selection of the cluster containing benign users still requires a majority rule, implicitly assuming that the majority of clients are benign. Furthermore, it is only applicable to relatively lenient non-independent and identically distributed scenarios, and struggles to distinguish between benign and malicious clients in stringent non-independent and identically distributed environments. Simultaneously, current clustering-based robust aggregation methods in federated learning, relying on low-dimensional scores or plaintext features for defense, introduce the risk of intermediate information leakage, limiting further improvements in the security, robustness, and scalability of federated learning.

[0005] In summary, existing federated learning techniques still face several challenges: First, attacks such as gradient inversion and membership inference may reconstruct user privacy data, threatening the system's privacy and security. Second, poisoning attacks, such as data poisoning and model poisoning, can significantly compromise the robustness of the global model. Furthermore, existing robust aggregation methods based on clustering typically rely on preset thresholds for the proportion of malicious clients, limiting their scalability in complex environments. In non-independent and identically distributed scenarios, it is difficult to effectively distinguish between benign and malicious client updates, further weakening the defense effect. Simultaneously, defense methods based on low-dimensional scoring or plaintext features also pose a risk of information leakage, making it difficult to meet stringent security requirements. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the existing technology and propose a thresholdless privacy-preserving federated learning poisoning attack defense method based on multi-party secure computation. This method aims to improve the security, robustness and scalability of federated learning, specifically by achieving thresholdless federated learning poisoning attack defense under full-process privacy protection.

[0007] This invention is a threshold-free, privacy-preserving federated learning poisoning attack defense method, comprising the following steps:

[0008] The federal learning system includes authoritative institutions ,server ,server as well as There are 1 client, each with its own private data and local model. The client trains its local model based on the global model and its local private data.

[0009] (1) Initialize the federated learning system, two servers , Obtaining the baseline update parameter share: Authoritative institution Initial global model Distributed to all clients participating in training as the starting point for local model updates. Subsequently, for each client... , , Randomly generate a seed And send it to the corresponding client and server. .then, The initial benchmark updates are obtained by training on a small but high-quality trusted dataset. And split it into two additive secret shared shares: Share One Shared share two And send them to the server respectively. and The two servers then receive the baseline update parameter share. Afterwards, The initial number of clusters in the system and the threshold of the Kappa coefficient Configure the initial settings. The value is used as the starting parameter for subsequent secure clustering, and is used in subsequent communication rounds based on the global model. The training results are updated on the client side.

[0010] (2) Start local model training and upload the addition secret shared parameter share: Enter the federated learning round iteration, each client trains the local model, and the client Holding its local private dataset ; in the In round-robin communication, the client Based on the global model from the previous round and local datasets Perform local training and calculate the corresponding gradient updates. Subsequently, the client uses a random seed generated by a trusted institution. As input to the pseudo-random generator, a random number of length is generated. random vectors Based on this random vector, the client updates the local gradient. Split into two shared shares of the addition secret: Share One Shared share two .because The client already has a share of local updates, so the client only needs to allocate the second share. Send to server .

[0011] (3) The server performs secure K-means clustering on the local model updates uploaded by the client: the client updates are randomly downsampled before malicious clustering filtering. Specifically, assuming a downsampling rate... ,from Random sampling index set in dimensional coordinates ,in For any satisfy .server and Update from the client accordingly and benchmark updates Extract the corresponding dimension from the middle to obtain Dimensional downsampling update and .

[0012] After obtaining the gradient update uploaded by the client and completing the downsampling, the server performs secure K-means clustering on the client update within a multi-party secure computation framework.

[0013] (3a) Selecting initial cluster centers: The server first randomly selects from the client index set. Different indexes The corresponding downsampling update is used as the initial cluster center. .

[0014] (3b) Client clustering assignment via distance calculation: in the first... In the round clustering iteration, for each client The server first updates the client. With each cluster center Calculate the safe Euclidean distance After obtaining the client corresponding distance vector Then, the server further determined the relationship with the client. index of nearest cluster center Subsequently, the client index... The set of indices to be added to the corresponding cluster Step (3b) is executed sequentially for all clients until the current round of clustering assignment is completed.

[0015] (3c) Cluster center update: After completing the cluster assignment for all clients, the server updates the cluster center for each cluster. center The update yields new cluster centers. .

[0016] (3d) Iterative completion of safe K-means clustering: The above processes of "distance calculation - cluster assignment - center update" (3b) and (3c) are executed iteratively until the cluster assignment results no longer change, thus obtaining the first... Clustering results of wheels To achieve safe K-means clustering.

[0017] (4) The server performs threshold-free screening of cluster combinations based on the baseline gradient: The server first constructs all non-empty cluster subsets based on the clustering results obtained in step (3). This non-empty cluster subset is also called a cluster combination. For each cluster combination, its corresponding combination aggregation gradient is calculated. Let the first... The cluster centers of each cluster in the downsampling space are: Then cluster combination The central gradient is expressed as , , The server then calculates the cluster centers for each cluster. Reference baseline gradient maintained by the server Euclidean distance between Based on the safe distance results, the server selects the index corresponding to the cluster combination closest to the baseline gradient from all cluster combinations. and index Corresponding cluster combinations The union of all client clusters is considered as the set of benign clients in the current communication round. .

[0018] (5) The server aggregates and dynamically updates the baseline for benign clients: after identifying benign cluster sets Then, the server performs a safe average aggregation of the corresponding gradients to update the reference gradient. Then, the server calculates the L2 norm of the baseline update and the benign client update. and Safe pruning is performed on benign updates to obtain ,in The scaling factor is securely calculated and the vector scaling operation is performed within the additive secret shared domain, ensuring that the magnitude of the pruned update does not exceed the L2 norm of the baseline gradient. Afterward, the server aggregates the pruned benign client updates to obtain the global aggregation result. After obtaining the global aggregation result for the current round, the server... and Update the corresponding model shares respectively and The data is sent to each client. The client then reconstructs the received model update share locally as the starting point for the next round of model updates.

[0019] (6) The client updates the decision on the number of clusters to obtain the number of clusters in the next round: in order to dynamically adjust the number of clusters. After each round of aggregation, the benign clients from the previous round calculate the Kappa coefficient based on the global model and their own local updates. This is used to quantify the adaptability of the current clustering granularity to clustering quality and model aggregation effect. The higher the value, the more reasonable the current clustering granularity; if If the value is too low, it suggests that the number of clusters needs to be increased. To more precisely characterize the differences in client updates. After obtaining each client's... Then, the client determines the threshold. Generate a vote The server collects votes from all benign clients. The number of clusters in the next round is updated based on the majority principle. Return to step (2) to enter the next round of local model training process, and repeat the process to ensure that each round of training breaks through the threshold limit, achieves poisoning attack defense in non-independent and identically distributed scenarios, and takes into account privacy protection. This is a threshold-free privacy-protected federated learning poisoning attack defense.

[0020] This invention addresses the risk of intermediate information leakage inherent in existing federated learning methods that rely on clustering-based poisoning attack defenses based on low-dimensional scores or plaintext features. Furthermore, it addresses the shortcomings of existing methods in Non-IID scenarios, where benign updates are highly heterogeneous, and the insufficient robustness of binary classification defenses in high-attack scenarios, including difficulties in distinguishing between benign and malicious updates and adapting to high-attack-proportion scenarios. This invention provides end-to-end privacy protection for client gradients through multi-party secure computation. It utilizes a robust defense strategy of multi-cluster partitioning and combination filtering to adaptively select benign update sets without a threshold. By introducing the Kappa coefficient as a feedback mechanism, it dynamically adjusts the number of clusters, thus adapting to different levels of non-independent and identically distributed scenarios.

[0021] Compared with the prior art, the present invention has the following advantages:

[0022] (1) Privacy protection is achieved throughout the entire computation and communication process: This invention utilizes the extended protocol of multi-party secure computation to enable the client gradient to participate in the computation in a secret sharing form in all stages such as local training, cluster analysis and aggregation computation, avoiding the exposure of plaintext gradients and intermediate statistical information, and achieving privacy protection throughout the entire process of defense against poisoning attacks in cluster-based federated learning. While ensuring robust clustering and screening effects, it also achieves data invisibility throughout the entire process from training and clustering to aggregation, effectively preventing client privacy leakage and ensuring the security of user privacy.

[0023] (2) Not dependent on fixed thresholds, effectively adapting to high-proportion poisoning attack scenarios: This invention first compares the clustering combination updated by the client with the server's baseline gradient, adaptively identifies and filters out the benign client set whose statistical characteristics are closest to the real data distribution, and dynamically updates the baseline gradient based on the filtering results. This breaks through the current situation where existing clustering-based defense schemes rely on fixed thresholds, effectively adapts to high-proportion poisoning attack scenarios, and improves scalability and stability in unknown or high-proportion attack scenarios.

[0024] (3) Improved robustness of cluster-based federated learning poisoning attack defense in non-independent and identically distributed scenarios: This invention improves the robustness of cluster-based federated learning poisoning attack defense in non-independent and identically distributed scenarios by performing security measures in the downsampling space. Clustering constructs multiple clusters, and the aggregation results of different cluster combinations are compared with the server's baseline gradient for privacy and security, selecting the benign update set. Furthermore, this invention incorporates an adaptive clustering granularity adjustment mechanism, introducing the Kappa coefficient as a feedback mechanism. The number of clusters is dynamically adjusted based on the consistency of model training reflected by the Kappa coefficient, adapting to different degrees of non-independent and identically distributed scenarios, effectively improving the robustness of the federated learning system. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating the implementation of the present invention. Detailed Implementation

[0026] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0027] Example 1: Federated learning suffers from privacy leaks, and its open, distributed architecture is vulnerable to poisoning attacks such as data poisoning and model poisoning, severely impacting the reliability of the global model. Existing clustering-based federated learning poisoning attack defense methods implicitly assume that most clients are benign, limiting their identification capabilities in demanding non-independent, identically distributed scenarios. Furthermore, defense methods relying on plaintext features still carry the risk of intermediate information leakage. To address this, this invention researches and explores a method that protects privacy from federated learning poisoning attacks without requiring a threshold.

[0028] This invention is a threshold-free, privacy-preserving federated learning poisoning attack defense method. See [link to related documentation]. Figure 1 , Figure 1 The flowchart of the present invention includes the following steps:

[0029] This invention is an improvement on poisoning attack defense based on clustering-based federated learning, and the federated learning system used includes authoritative institutions. ,server ,server as well as One client, Responsible for initializing the federated learning system, server and The responsible unit is responsible for selecting healthy clients, while the client is responsible for training the model locally and uploading the model parameters.

[0030] (1) Initialize the federated learning system, two servers , Obtaining the baseline update parameter share: Authoritative institution Initial global model Distributed to all participants in the training One client serves as the starting point for local model updates. Subsequently, for each client... , , Randomly generate a seed And send it to the corresponding client and server. .then, The initial benchmark updates are obtained by training on a small but high-quality trusted dataset. And split it into two additive secret shared shares: Share One Shared share two And send them to the server respectively. and The two servers then receive the baseline update parameter share. Afterwards, The initial number of clusters in the system and the threshold of the Kappa coefficient Configure the initial settings. As the starting parameters for subsequent secure clustering, and based on the global model in subsequent communication rounds. Training results are updated on the client side. Benchmark update. This system establishes objective criteria for judging malicious behavior, enabling the identification of benign updates using pre-set thresholds without manual intervention, effectively solving the scalability limitations imposed by threshold restrictions in traditional defense solutions. Simultaneously, by splitting the baseline update into additive secret shares, it ensures that plaintext model parameters are not exposed to the server, facilitating subsequent filtering of malicious clients while maintaining privacy. This is achieved by pre-setting the initial cluster size. and Kappa coefficient threshold The system is endowed with the ability to dynamically perceive non-independent and identically distributed data, and can adaptively adjust the clustering granularity based on the consistency index, thereby ensuring the safety of the model while preserving the diversity characteristics of good user data to the greatest extent.

[0031] (2) Start local model training and upload the addition secret shared parameter share: Enter the federated learning round iteration, each client trains the local model, and the client Holding its local private dataset In the first In round-robin communication, the client Based on the global model from the previous round and local datasets Perform local training and calculate the corresponding gradient updates. Subsequently, the client uses a random seed generated by a trusted institution. As input to the pseudo-random generator, a random number of length is generated. random vectors Based on this random vector, the client updates the local gradient. Split into two shared shares of the addition secret: Share One Shared share two ;because The client already has a share of local updates, so the client only needs to allocate the second share. Send to server This invention employs an additive secret-sharing mechanism based on random seeds to split model updates across two servers. This not only achieves strict privacy isolation by transforming the original gradient into two independent random shares, ensuring that a single server cannot snoop on user data, but also utilizes a shared seed to reconstruct the mask shares locally on the server side, eliminating the need to transmit data to one of the servers. This reduces client communication overhead without compromising security, thus balancing privacy and communication efficiency.

[0032] (3) The server performs secure K-means clustering on the local model updates uploaded by the client: the client updates are randomly downsampled before malicious clustering filtering. Specifically, assuming a downsampling rate... ,from Random sampling index set in dimensional coordinates ,in For any satisfy .server and Update from the client accordingly and benchmark updates Extract the corresponding dimension from the middle to obtain Dimensional downsampling update and Downsampling is often used in federated learning to mitigate the curse of dimensionality caused by high-dimensional updates. On the one hand, the dimension of the update vector directly determines the overhead of calculating the safe distance; on the other hand, the concentration of distances in high-dimensional space can easily lead to benign updates being misjudged as malicious updates, while reducing the dimensionality helps improve the accuracy of robust aggregation and poisoning attack detection.

[0033] After obtaining the gradient update uploaded by the client and completing the downsampling, the server performs secure K-means clustering on the client update within a multi-party secure computation framework. The detailed clustering process is as follows:

[0034] (3a) Selecting initial cluster centers: The server first randomly selects from the client index set. Different indexes The corresponding downsampling update is used as the initial cluster center. .

[0035] (3b) Client clustering assignment via distance calculation: in the first... In the round clustering iteration, for each client The server first updates the client. With each cluster center Calculate the safe Euclidean distance After obtaining the client corresponding distance vector Then, the server further determined the relationship with the client. index of nearest cluster center Subsequently, the client index... The set of indices to be added to the corresponding cluster Step (3b) is executed sequentially for all clients until the current round of clustering assignment is completed.

[0036] (3c) Cluster center update: After completing the cluster assignment for all clients, the server updates the cluster center for each cluster. center The update yields new cluster centers. .

[0037] (3d) Iterative completion of safe K-means clustering: The above processes of "distance calculation - cluster assignment - center update" (3b) and (3c) are executed iteratively until the cluster assignment results no longer change, thus obtaining the first... Clustering results of wheels To achieve safe K-means clustering.

[0038] Secure K-means clustering achieves a deep integration of privacy protection and poisoning attack defense by processing gradient shares within a multi-party secure computation framework. The server can accurately complete complex Euclidean distance calculations and cluster assignments without knowing the client's original plaintext updates, ensuring that the data is "usable but not visible" and protecting the client's data privacy from being leaked.

[0039] (4) The server performs threshold-free screening of cluster combinations based on the baseline gradient: The server first constructs all non-empty cluster subsets based on the clustering results obtained in step (3). This non-empty cluster subset is also called a cluster combination. For each cluster combination, its corresponding combination aggregation gradient is calculated. Let the first... The cluster centers of each cluster in the downsampling space are: Then cluster combination The central gradient is expressed as , , The server then calculates the cluster centers for each cluster. Reference baseline gradient maintained by the server Euclidean distance between Based on the safe distance results, the server selects the index corresponding to the cluster combination closest to the baseline gradient from all cluster combinations. and index Corresponding cluster combinations The union of all client clusters is considered as the set of benign clients in the current communication round. This invention constructs a virtual gradient approximating the IID through cross-cluster recombination updates. It leverages the complementarity between benign updates to create a highly concentrated consistency trend in the parameter space. This mechanism significantly amplifies the identification features of malicious attacks because any cluster combination containing attack samples disrupts this statistical balance, causing the synthesized result to deviate significantly from the benign reference set. This transforms traditional absolute distance determination into more accurate relative trend matching. This invention not only fundamentally eliminates the dependence of defense algorithms on manually preset thresholds but also improves the system's accuracy in distinguishing between benign and malicious updates in large-scale heterogeneous data environments.

[0040] (5) The server aggregates and dynamically updates the baseline for benign clients: after identifying benign cluster sets Then, the server performs a safe average aggregation of the corresponding gradients to update the reference gradient. Then, the server calculates the L2 norm of the baseline update and the benign client update. and Safe pruning is performed on benign updates to obtain ,in The scaling factor is securely calculated and the vector scaling operation is performed within the additive secret shared domain, ensuring that the magnitude of the pruned update does not exceed the L2 norm of the baseline gradient. Afterward, the server aggregates the pruned benign client updates to obtain the global aggregation result. After obtaining the global aggregation result for the current round, the server... and Update the corresponding model shares respectively and The data is sent to each client, which then reconstructs the received model update share locally as the starting point for the next round of model updates.

[0041] (6) The client updates the decision on the number of clusters to obtain the number of clusters in the next round: in order to dynamically adjust the number of clusters. After each round of aggregation, the benign clients from the previous round calculate the Kappa coefficient based on the global model and their own local updates. This is used to quantify the adaptability of the current clustering granularity to clustering quality and model aggregation effect. The higher the value, the more reasonable the current clustering granularity; if If the value is too low, it suggests that the number of clusters needs to be increased. To more precisely characterize the differences in client updates. After obtaining each client's... Then, the client determines the threshold. Generate a vote The server collects votes from all benign clients. The number of clusters in the next round is updated based on the majority principle. In scenarios involving non-independent and identically distributed clusters, a fixed number of clusters often fails to balance model diversity with defense accuracy. Too few clusters can lead to benign users with unique data distributions being averaged out or misjudged as attackers, while too many clusters increase computational overhead. This invention introduces the Kappa coefficient as a consistency metric, allowing the system to objectively perceive whether the current clustering is sufficient to accurately represent the distribution characteristics of benign data. When the Kappa coefficient decreases, benign clients automatically trigger the next round of clustering increases through a distributed voting mechanism, adaptively subdividing coarse clusters into more compact and purer subclusters. This dynamic adjustment mechanism effectively prevents benign data from being mistakenly identified due to insufficient clustering granularity, significantly reducing the false positive rate.

[0042] Return to step (2) to enter the next round of local model training process, and repeat the process repeatedly to ensure that each round of training breaks through the threshold limit, achieves poisoning attack defense in non-independent and identically distributed scenarios, and takes into account privacy protection. This is a threshold-free privacy-preserving federated learning poisoning attack defense.

[0043] The threshold-free privacy-preserving federated learning poisoning attack defense method of the present invention includes the following steps: initializing the federated learning system, two servers... , The process involves obtaining a baseline update parameter share; starting local model training and uploading the addition secret shared parameter share; the server performing secure K-means clustering on the local model updates uploaded by the client; the server performing threshold-free screening of cluster combinations based on the baseline gradient; the server aggregating benign clients and dynamically updating the baseline; and the client making a decision on the number of clusters to obtain the next round of cluster counts. This invention, based on multi-party secure computation, performs secure clustering in the downsampling space and compares the aggregation results of multiple cluster combinations with the server's baseline gradient for privacy and security, adaptively identifying statistically benign update sets, thus achieving robust defense without needing to preset a malicious client proportion threshold. Furthermore, by introducing a feedback adjustment mechanism based on the Kappa coefficient, the clustering granularity is adaptively adjusted to effectively adapt to client distribution characteristics under different Non-IID levels.

[0044] This invention provides a comprehensive technical solution that addresses the risks of intermediate information leakage, difficulties in distinguishing between benign and malicious updates, and challenges in adapting to high-attack-ratio scenarios, inherent in existing cluster-based poisoning attack defense methods that rely on low-dimensional scoring or plaintext features in federated learning. To address the lack of end-to-end privacy protection in existing cluster-based poisoning attack defense methods, this invention proposes using multi-party secure computation to protect the privacy of client-side gradients. Furthermore, to address the issues of highly heterogeneous benign updates under Non-IID conditions and insufficient robustness of binary classification defense methods in high-attack-ratio scenarios, this invention proposes a robust defense strategy based on multi-cluster partitioning and combined screening, which performs secure computation in the downsampling space. Clustering is performed, and the aggregation results of different cluster combinations are compared with the server's baseline gradient for privacy and security. Beneficial update sets are adaptively selected without the need for a preset threshold for the proportion of malicious users. Furthermore, this invention incorporates an adaptive clustering granularity adjustment mechanism, introducing the Kappa coefficient as a feedback mechanism to dynamically adjust the number of clusters based on the consistency of model training. This adapts to different levels of non-independent and identically distributed scenarios, balancing security, robustness, and scalability.

[0045] Example 2: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Example 1, the initial round of benchmark updates is obtained by training a small but high-quality trusted dataset as described in step (1) of this invention. .

[0046] The small but high-quality reliable dataset consists of 100 samples randomly selected from the index of the test set. The test set used is the training set of the MNIST handwritten digit grayscale image dataset. The number of target categories corresponding to this training set is [not specified]. The numbers are 0 to 9, and there are a total of 60,000 images, each with a pixel size of [missing information]. There are 6000 images for each target category. The test set can be varied depending on the specific dataset chosen. A model approximating IID can be trained using a small but high-quality, reliable dataset, and the selection of benign updates based on this model can avoid the limitations of the threshold.

[0047] The trusted dataset was trained using a convolutional neural network, which consisted of two convolutional layers and three fully connected layers: the first convolutional layer contained 6... Convolutional kernels, activated by BatchNorm and ReLU, and Max pooling; the second convolutional layer contains 16... The convolutional kernels are also normalized, ReLU activated, and pooled. The three-layer fully connected network has 120 neurons in the first layer, 84 neurons in the second layer, and the last layer outputs 10 classes. Through the local perception of the convolutional kernels and the hierarchical structure, convolutional neural networks can automatically capture complex spatial features in data, ensuring that the global model maintains excellent classification or recognition accuracy when dealing with highly heterogeneous client data.

[0048] In this invention, the baseline update for the initial rounds is obtained by training on a small but high-quality trusted dataset. By calculating the relative distance between clusters and combinations, and selecting the cluster combination with the smallest distance as the set for benign updates, the threshold setting can be avoided, ensuring the adaptability of the invention in scenarios with high attack ratios.

[0049] Example 3: Threshold-free privacy-preserving federated learning poisoning attack defense method. Same as Examples 1-2, the method described in step (1) of this invention... Client , , The initial number of clusters in the system and the threshold of the Kappa coefficient Configure the settings.

[0050] Initialize the client population in the federated learning system and select the number of clients. To better demonstrate the adaptability of the present invention, a greater number of feasible methods were selected. To simulate a federated learning system.

[0051] Initialize the number of clusters To avoid an excessively large initial number of clusters This leads to excessively high computational complexity in clustering and an excessively low initial number of clusters. This results in insufficient granularity, causing benign clients to be assigned to malicious clusters.

[0052] When the selected dataset is MNIST, the threshold of the Kappa coefficient. When the Kappa coefficient is less than the threshold If the value is too high, it indicates poor consistency; the current clustering granularity is insufficient to characterize data differences, and more clusters need to be added. If the value is above the threshold, it means the current clustering granularity is sufficient to characterize the heterogeneous data from the client; to reduce the overhead of clustering, the number of clusters needs to be reduced. To adapt to different scenarios, the threshold for the Kappa coefficient is set when the selected dataset is CIFAR-10. By setting a threshold for the Kappa coefficient, the number of clusters can be dynamically adjusted to adapt to different levels of non-independent and identically distributed scenarios.

[0053] In this invention, an adaptive adjustment mechanism is constructed using the Kappa coefficient. By monitoring cluster consistency in real time and triggering distributed incremental clustering when the index declines, this mechanism can refine fuzzy macroscopic divisions into high-purity microscopic subclusters. This not only solves the problem of benign data false positives caused by insufficient clustering granularity but also achieves an optimal balance between computational overhead and defense effectiveness.

[0054] Example 4: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-3, the baseline update method described in step (1) of this invention is as follows. Split into two shared portions of the addition secret: Share One Shared share two The calculation formula is:

[0055] ;

[0056] ;

[0057] ;

[0058] in Indicates from The random number selected above, Indicates uniform random sampling. Represents the ring of integers.

[0059] In this invention, the benchmark is updated. Splitting the data into two additive, secret-shared shares avoids the privacy leaks associated with traditional servers using a plaintext model. This is achieved by using an integer ring... Uniform random sampling Using this as a mask, the original weight information is transformed into two seemingly random shares, ensuring that no single participant can reconstruct the true data if the other share is missing, thus achieving information-theoretic security. This design not only makes it possible to perform multi-party secure computations without decryption, allowing defense mechanisms to perform poisoning detection blindly, but also cleverly hides the system's defense baseline, preventing attackers from seeing the specific values ​​of the baseline updates, thereby greatly increasing the difficulty of constructing adaptive attacks.

[0060] Example 5: Threshold-free privacy-preserving federated learning poisoning attack defense method. Same as Examples 1-4, the client described in step (2) of this invention. Based on the global model from the previous round and local datasets Perform local training and calculate the corresponding gradient updates. .

[0061] Each client Image dataset As a local model The input is forward-propagated to obtain the predicted label set for all images. Then, the cross-entropy loss function is used to... and calculate loss value Then through For model parameters partial derivatives Thus, the first Client in round communication Local gradient update .

[0062] Example 6: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-5, the client in step (2) of this invention updates the local gradient. Split into two shared shares of the addition secret: Share One Shared share two The calculation formula is:

[0063] ;

[0064] ;

[0065] in, It is a pseudo-random number generator that can generate numbers based on a random seed. Generate random vectors.

[0066] Unlike traditional methods that directly upload complete plaintext model parameters, this invention employs additive secret sharing to upload gradient update shares to the server. This ensures that sensitive model update information is transformed into two mutually exclusive shared shares as soon as it leaves the client. This approach not only achieves information-theory-level privacy protection at the mathematical level but also prevents user data from being leaked during transmission or aggregation.

[0067] Example 7: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-6, the server updates the client as described in step (3b) of this invention. With each cluster center Calculate the safe Euclidean distance The calculation steps include:

[0068] (3b.1) Triple generation: and Co-generate a set of triples , and ,in, and For from the arithmetic domain The elements are randomly selected from the given information, and the three are distributed between the two servers in an additive secret sharing manner, satisfying the relation... .

[0069] (3b.2) Reveal and Plaintext value: server calculate , ,server calculate , ;server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value.

[0070] (3b.3) Server Calculate distance share: calculate And calculate part of the sum .

[0071] (3b.4) Server Calculate distance share: calculate And calculate part of the sum .

[0072] This server and The safe Euclidean distance is calculated as follows:

[0073] , .

[0074] In this invention, by introducing Beaver triples to assist in additive secret sharing computation, the server can accurately calculate the distance between the client's local update and the cluster center without knowing the client's specific gradient content or the specific value of the cluster center. This completely eliminates the risk of user model leakage caused by data comparison during the defense process and ensures that the distance calculation in the encrypted domain is completely consistent with the plaintext calculation result.

[0075] Example 8: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-7, in step (3b) of this invention, after calculating the distance in the client clustering assignment through distance calculation, the server determines the distance between the client and the client. index of nearest cluster center The calculation steps are as follows:

[0076] (3b.5) Initialize minimum value and index: Minimum value and index are initialized to , ;

[0077] Secondly, Execute in a loop:

[0078] (3b.6) Reveal and The plaintext value: Secondly, Randomly select a positive integer As And calculate the local share. , Randomly select a positive integer As And calculate the local share. ,server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value.

[0079] (3b.7) Reveal Symbol: server Calculate its output share ,server calculate .Then, and Jointly expose .

[0080] (3b.8) Minimum value index update: Update the minimum value based on the comparison results. Update index .

[0081] Repeat steps (3b.6) through (3b.8) until... The loop ends, finally and The index of the minimum value .

[0082] In this invention, the SecArgmin algorithm can accurately locate the cluster center index closest to the client without revealing the specific numerical value, and complete the client clustering assignment process by iteratively.

[0083] Example 9: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-8, the server described in step (3c) of this invention applies a method to each cluster. center The update yields new cluster centers. The calculation formula is:

[0084] ;

[0085] in, Indicates the number of clustering iterations Wheel of Time Cluster centers of each cluster. This indicates that in the clustering iteration... Round A set of client indexes for each cluster. Indicating in the federal learning period Wheel Client The local training gradient after downsampling.

[0086] In this invention, the server can directly access the secret sharing share without decrypting the gradient data. Linear summation and averaging operations are performed to achieve precise evolution of cluster centers within the encrypted domain. Unlike traditional methods that directly calculate plaintext model parameters, this design, which focuses on shared share calculations, ensures that even during multiple rounds of iterative updates to cluster centers to capture the latest data distribution characteristics, the server can never obtain any plaintext information about the user's original gradients. This maintains the extremely high privacy strength of federated learning while giving the defense system the ability to dynamically track and identify malicious distribution biases.

[0087] Example 10: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-9, in step (4) of this invention, the server calculates the corresponding combination aggregation gradient for each cluster combination. The calculation formula is:

[0088] ;

[0089] in, Represents cluster combination The combined aggregate gradient, Represents cluster combination The number of Chinese clients Indicates the t-th round. Cluster centers.

[0090] In this invention, the aggregation gradient of different cluster combinations is calculated. This method cleverly constructs near-independent and identically distributed virtual gradients through cross-cluster recombination, fundamentally solving the problem of scattered and difficult-to-identify benign sample features in non-independent and identically distributed scenarios. This mechanism, through the complementarity between benign updates, forms a highly concentrated and consistent trend in the parameter space, transforming the originally ambiguous absolute distance judgment into a more accurate relative trend matching. Since any cluster combination containing malicious samples will inevitably disrupt this statistical equilibrium, causing its synthesis result to deviate significantly from the benign reference set, this method greatly amplifies the recognizability of attack features, enabling the system to maintain an extremely low false recognition rate even under complex distribution interference. It solves the problem of traditional defense schemes struggling to distinguish between benign and malicious updates in non-independent and identically distributed scenarios, ensuring the robustness and accuracy of the defense mechanism in various heterogeneous data environments.

[0091] This invention provides end-to-end privacy protection for client gradients based on multi-party secure computation, avoiding the risk of intermediate information leakage associated with traditional defense methods based on low-dimensional scoring or plaintext features. Furthermore, through a robust defense strategy of multi-cluster partitioning and combination screening, it performs secure clustering in the downsampling space and compares the aggregation results of different cluster combinations with the server's baseline gradient for privacy and security. Without the need to preset a threshold for the proportion of malicious users, it adaptively selects a benign update set, thereby improving the robustness of federated learning against poisoning attacks.

[0092] Example 11: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-10, the server in step (4) of this invention calculates each cluster combination center. Reference baseline gradient maintained by the server Euclidean distance between The calculation steps are as follows:

[0093] (4.1) Triple generation: First, in the offline phase, and Co-generate a set of triples , and ,in, and For from the arithmetic domain The elements are randomly selected from the given information, and the three are distributed between the two servers in an additive secret sharing manner, satisfying the relation... .

[0094] (4.2) Reveal and Plaintext value: Then during the online phase, the server calculate , ,server calculate , ;server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value.

[0095] (4.3) Server Calculate distance share: Calculate its share And calculate part of the sum .

[0096] (4.4) Server Calculate distance share: calculate And calculate part of the sum .

[0097] In this invention, the server calculates the cluster combination center for each cluster. Reference baseline gradient maintained by the server Euclidean distance between This provides a secure measurement method for cross-cluster recombination defense logic, enabling a significant amplification of malicious features without disclosing sensitive information. The server can quantify the deviation between the synthesized virtual gradient and the benign reference trend without ever touching the plaintext data, verifying whether the high consistency trend exhibited by benign updates after recombination has been disrupted. This mechanism transforms the traditional, data-distribution-sensitive absolute distance determination into a more accurate relative trend matching, ensuring that any cluster combination containing attack samples will expose significant deviations in encrypted computation due to the disruption of statistical equilibrium. While rigorously protecting user privacy, it improves the accuracy and robustness of the system in identifying poisoning attacks in complex, non-independent, and identically distributed environments.

[0098] Example 12: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-11, in step (4) of this invention, the server selects the index corresponding to the cluster combination closest to the baseline gradient from all cluster combinations. The calculation steps are as follows:

[0099] (4.5) Initialize minimum value and index: The minimum value and index are initialized to 0. , .

[0100] Secondly, Execute in a loop:

[0101] (4.6) Reveal and Plaintext value: Randomly select a positive integer As And calculate the local share. , Randomly select a positive integer As And calculate the local share. ,server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value;

[0102] (4.7) Reveal Symbol: server Calculate its output share And the server calculate ;Then, and Jointly expose .

[0103] (4.8) Minimum value update: Update the minimum value Update the index of the minimum value. .

[0104] Repeat steps (4.6) through (4.8) until... The loop ends, and finally the server... and The index of the minimum value , The corresponding client cluster union is considered as the set of benign clients in the current communication round. .

[0105] In this invention, the server selects the index corresponding to the cluster combination closest to the baseline gradient from all cluster combinations. Without revealing the specific distance values, the clustering combination with the smallest deviation from the benign reference gradient is precisely identified through multi-party secure calculations, ultimately determining the set of benign clients in this round of communication. This not only completely eliminates the risk of leakage during the defense decision-making stage, but also transforms the traditional absolute distance judgment into a more accurate relative trend matching by selecting the combination with the highest consistency. This ensures that the system can still accurately remove malicious attack samples from complex non-independent and identically distributed data without the need to preset a fixed threshold.

[0106] Example 13: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-12, the server in step (5) of this invention performs security trimming on benign updates to obtain... The calculation steps include:

[0107] (5.1) Initialize random numbers: First, the server Choose a random positive number As ,server Choose a random positive number As .

[0108] (5.2) Exposure Plaintext value: and Collaborative computing , and jointly expose .

[0109] (5.3) The server calculates the clipping factor share: Calculate share one , Calculate share two .

[0110] (5.4) Clipping Gradient Update : and Collaborative computing and The product of is used to calculate . .

[0111] In this invention, by securely revealing the ratio and calculating the pruning gradient update within the encrypted domain, it is ensured that even within a benign set, no single node will affect the global model due to its excessively large gradient magnitude. This not only protects privacy but also further solidifies the consistent distribution trend constructed through cross-cluster recombination. It not only effectively blocks covert poisoning using gradient explosion but also ensures that the final aggregated global update more purely reflects the complementarity between benign samples.

[0112] Example 14: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-13, the server in step (5) of this invention provides a reference gradient. Updates and aggregation of trimmed, well-functioning clients The calculation formula is:

[0113] ;

[0114] ;

[0115] in, This represents a collection of benign clients. Indicates modulo, express The reference gradient of the wheel, Indicates the first federal learning Wheel model update, Indicating in the federal learning period Wheel Client The local training gradient, Indicating in the federal learning period Wheel Client The gradient after shearing.

[0116] In this invention, the server references the gradient. The updates enable dynamic adaptation of the defense mechanism, effectively preventing overfitting of future rounds' selection of benign updates to the initial baseline update. The federated learning system can capture the distribution drift during the actual training process in each round, ensuring that the reference standard is always aligned with the real benign trend, thereby reducing the misclassification rate in non-independent and identically distributed scenarios.

[0117] Example 15: Threshold-free privacy-preserving federated learning poisoning attack defense method. Similar to Examples 1-14, in step (6) of this invention, the client updates the clustering number to obtain the next round of clustering number. The benign client in the previous round calculates the Kappa coefficient based on the global model and its own local update, and the client generates votes. The server collects votes from all benign clients. The number of clusters in the next round is updated based on the majority principle. The implementation steps include:

[0118] (6.1) Calculation of Kappa coefficient: Let The total number of samples, To predict the number of samples that match the true class, observational consistency is: ;set up For a set of categories, For the real category The sample proportion For prediction as a category The proportion of, then the expected consistency is This yields the client's Kappa coefficient. ;

[0119] (6.2) Client-side poll generation:

[0120] ;

[0121] (6.3) Next round of cluster number update:

[0122] ;

[0123] in, Indicates the first federal learning Client in round of iteration Kappa coefficient, express Threshold of value, Indicates the first federal learning The number of clusters in each iteration.

[0124] The dynamic clustering quantity update algorithm of this invention quantifies the predictive consistency between the local updates of benign clients and the global model by calculating the Kappa coefficient, accurately determining whether the current clustering size is sufficient to cope with the current data distribution characteristics or attack intensity. Utilizing the majority vote principle of benign sets to determine the next round of clustering quantity improves the system's fault tolerance for evaluation biases of individual nodes, ensuring that the clustering granularity is always optimal and avoiding defense failures or accidental damage to benign nodes due to static parameter settings. This dynamic feedback logic enhances the objectivity and robustness of defense decisions in complex, non-independent, and identically distributed environments.

[0125] In summary, this invention presents a threshold-free, privacy-preserving federated learning poisoning attack defense method. It addresses the risks of intermediate information leakage inherent in existing cluster-based poisoning attack defense methods that rely on low-dimensional scoring or plaintext features, as well as the difficulties in distinguishing between benign and malicious updates and adapting to high-attack-proportion scenarios. The implementation includes: initializing the federated learning system; obtaining baseline update parameter shares for both servers; starting local model training and uploading the additive secret shared parameter shares; the server performing secure K-means clustering on the local model updates uploaded by the client; the server performing threshold-free screening of cluster combinations based on the baseline gradient; the server aggregating benign clients and dynamically updating the baseline; and the client updating the cluster count to obtain the next round of cluster counts.

[0126] This invention proposes using a multi-party secure computation extension protocol to protect client gradient privacy in cluster-based federated learning poisoning attack defense. It also designs a robust defense strategy involving multi-cluster partitioning and combination filtering, and performs secure computation in the downsampling space. Clustering is performed, and the aggregation results of different cluster combinations are compared with the server baseline gradient for privacy and security. Without the need to preset a threshold for the proportion of malicious users, a benign update set is adaptively selected.

[0127] This invention protects client privacy throughout the entire secure multi-party computation process. It constructs a virtual gradient approximating IID through multi-cluster partitioning and combination filtering of robust defense strategies. Leveraging the complementarity between benign updates, it exhibits a highly concentrated consistency trend in the parameter space, significantly amplifying the identification features of malicious attacks and improving the robustness of the federated learning system in non-independent distribution scenarios. Furthermore, through dynamic updates of the server baseline, it breaks through threshold limitations, improving the system's adaptability in scenarios with high attack ratios.

[0128] This invention is applicable to federated learning scenarios where privacy is sensitive, data distribution is heterogeneous, and the number of malicious clients launching poisoning attacks is variable. Specifically, this invention can be widely applied in the medical and health field for medical image analysis and joint diagnostic model training among multiple medical institutions; in the financial field for cross-institutional user behavior modeling and credit risk control, anti-fraud analysis; and in smart terminal and IoT scenarios for distributed model training and secure model updates. It is also suitable for federated learning systems involving a large number of heterogeneous entities, such as smart cities, connected vehicles, and the industrial internet. While effectively resisting data poisoning and model poisoning attacks, it achieves end-to-end privacy protection for model parameters and intermediate calculation results, and maintains good robustness and system scalability under conditions of non-independent and identically distributed data.

Claims

1. A threshold-free, privacy-preserving federated learning poisoning attack defense method, characterized in that, Includes the following steps: The federal learning system includes authoritative institutions ,server ,server as well as Each client Each client has its own private data and local model; (1) Initialize the federated learning system, two servers , Obtaining the baseline update parameter share: Authoritative institution Initial global model Distribute to all clients participating in training as the starting point for local model updates; Subsequently, for each client , , Randomly generate a seed And send it to the corresponding client and server. ;then, The initial benchmark updates are obtained by training on a small but high-quality trusted dataset. And split it into two additive secret shared shares: Share One Shared share two And send them to the server respectively. and ;after, The initial number of clusters in the system and the threshold of the Kappa coefficient Configure the initial settings. The value is used as the starting parameter for subsequent secure clustering, and is used in subsequent communication rounds based on the global model. Update the training results on the client side; (2) Start local model training and upload the addition secret shared parameter share: Enter the federated learning round iteration, each client trains the local model, and the client Holding its local private dataset ; in the In round-robin communication, the client Based on the global model from the previous round and local datasets Perform local training and calculate the corresponding gradient updates. ; Subsequently, the client uses a random seed generated by a trusted institution. As input to the pseudo-random generator, a random number of length is generated. random vectors Based on this random vector, the client updates the local gradient. Split into two shared shares of the addition secret: Share One Shared share two ;because The client already has a share of local updates, so the client only needs to allocate the second share. Send to server ; (3) The server performs secure K-means clustering on the local model updates uploaded by the client: the client updates are randomly downsampled before malicious clustering filtering; specifically, assuming a downsampling rate of ,from Random sampling index set in dimensional coordinates ,in For any satisfy ;server and Update from the client accordingly and benchmark updates Extract the corresponding dimension from the middle to obtain Dimensional downsampling update and ; After obtaining the gradient update uploaded by the client and completing the downsampling, the server performs secure K-means clustering on the client update under a multi-party secure computation framework. (3a) Selecting initial cluster centers: The server first randomly selects from the client index set. Different indexes The corresponding downsampling update is used as the initial cluster center. ; (3b) Client clustering assignment via distance calculation: in the first... In the round clustering iteration, for each client The server first updates the client. With each cluster center Calculate the safe Euclidean distance ; in obtaining the client corresponding distance vector Then, the server further determined the relationship with the client. index of nearest cluster center ; Subsequently, the client index The set of indices to be added to the corresponding cluster ; Execute this process sequentially on all clients until the current round of clustering assignment is complete; (3c) Cluster center update: After completing the cluster assignment for all clients, the server updates the cluster center for each cluster. center The update yields new cluster centers. ; (3d) Iterative completion of safe K-means clustering: The above process of "distance calculation - cluster assignment - center update" is executed iteratively until the cluster assignment result no longer changes, thus obtaining the 3rd... Clustering results of wheels Complete secure K-means clustering; (4) The server implements threshold-free screening of cluster combinations based on the baseline gradient: The server first constructs all non-empty cluster subsets based on the clustering results. This non-empty cluster subset is also called a cluster combination. For each cluster combination, its corresponding combination aggregation gradient is calculated. Let the first The cluster centers of each cluster in the downsampling space are: Then cluster combination The central gradient is expressed as , , ; Subsequently, the server calculates the cluster centers for each cluster combination. Reference baseline gradient maintained by the server Euclidean distance between Based on the safe distance results, the server selects the index corresponding to the cluster combination closest to the baseline gradient from all cluster combinations. ; and index Corresponding cluster combinations The union of all client clusters is considered as the set of benign clients in the current communication round. ; (5) The server aggregates and dynamically updates the baseline for benign clients: after identifying benign cluster sets Then, the server performs a safe average aggregation of the corresponding gradients to update the reference gradient. Then, the server calculates the L2 norm of the baseline update and the benign client update. and Safe pruning is performed on benign updates to obtain ,in In the additive secret shared domain, the scaling factor is securely calculated and the vector scaling operation is performed to ensure that the magnitude of the pruned update does not exceed the L2 norm of the baseline gradient. Then, the server aggregates the pruned benign client updates to obtain the global aggregation result. ; After obtaining the global aggregation result for the current round, the server and Update the corresponding model shares respectively and The data is sent to each client; the client then reconstructs the received model update share locally as the starting point for the next round of model updates. (6) The client updates the decision on the number of clusters to obtain the number of clusters in the next round: After each round of aggregation, the benign client of the previous round calculates the Kappa coefficient value based on the global model and its own local update. This is used to quantify the adaptability of the current clustering granularity to clustering quality and model aggregation effect; The higher the value, the more reasonable the current clustering granularity; after obtaining the data for each client... Then, the client determines the threshold. Generate a vote The server collects votes from all benign clients. The number of clusters in the next round is updated based on the majority principle. Return to step (2) to enter the next round of local model training process, and repeat the process to ensure that each round of training breaks through the threshold limit, achieves poisoning attack defense in non-independent and identically distributed scenarios, and takes into account privacy protection. This is a threshold-free privacy-protected federated learning poisoning attack defense.

2. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, The addition secret shared share mentioned in step (1): Share 1 Share Two The generation method is as follows: ； ； ； in Represents the set of real numbers. Representing dimension, Indicates uniform random sampling. Represents the ring of integers.

3. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (2), the addition of secret shared shares and The specific steps include: (2.1) Generation of shared shares: Using random seeds distributed by a trusted institution As input to the pseudo-random generator, it generates a pseudo-random mask vector with the same dimension as the gradient vector. The first secret share Directly set to the pseudo-random mask vector, i.e. ; (2.2) Generation of Shared Shares: Secret Shared Shares The value is set as the local gradient update vector minus the pseudo-random mask vector, i.e. .

4. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (3b), the server first updates the client clustering assignment via distance calculation. With each cluster center Calculate the safe Euclidean distance , The implementation steps include: (3b.1) Triple generation: and Co-generate a set of triples , and ,in, and For from the arithmetic domain The elements are randomly selected from the given information, and the three are distributed between the two servers in an additive secret sharing manner, satisfying the relation... ; (3b.2) Reveal and Plaintext value: server calculate , ,server calculate , ;server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value; (3b.3) Server Calculate distance share: calculate And calculate part of the sum ; (3b.4) Server Calculate distance share: calculate And calculate part of the sum ; This server and The safe Euclidean distance is calculated as follows: 。 5. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (3b), after calculating the distance in the client clustering assignment, the server determines the client's location. index of nearest cluster center The implementation steps include: (3b.5) Initialize minimum value and index: Minimum value and index are initialized to , ; Secondly, Execute in a loop: (3b.6) Reveal and The plaintext value: Secondly, Randomly select a positive integer As And calculate the local share. , Randomly select a positive integer As And calculate the local share. ,server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value; (3b.7) Reveal Symbol: server Calculate its output share ,server calculate .Then, and Jointly expose ; (3b.8) Minimum value index update: Update the minimum value based on the comparison results. Update the index of the minimum value. ; Repeat steps (3b.6) through (3b.8) until... The loop ends, finally and The index of the minimum value .

6. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (4), the corresponding clustering gradient is calculated for each cluster combination. The calculation formula is: ； in, Represents cluster combination The combined aggregate gradient, Represents cluster combination The number of Chinese clients Indicates the t-th round. Cluster centers.

7. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (4), the server calculates the cluster combination center for each cluster. , Reference baseline gradient maintained by the server Euclidean distance between The specific calculation steps include: (4.1) Triple generation: First, in the offline phase, and Co-generate a set of triples , and ,in, and For from the arithmetic domain The elements are randomly selected from the given information, and the three are distributed between the two servers in an additive secret sharing manner, satisfying the relation... ; (4.2) Reveal and Plaintext value: Then during the online phase, the server calculate , ,server calculate , ;server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value; (4.3) Server Calculate distance share: Calculate its share And calculate part of the sum ; (4.4) Server Calculate distance share: calculate And calculate part of the sum ; This server and The safe Euclidean distance is calculated as follows: 。 8. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (4), after calculating the distance among all cluster combinations, the server selects the index corresponding to the cluster combination closest to the reference gradient. The specific calculation steps include: (4.5) Initialize minimum value and index: The minimum value and index are initialized to 0. , ; Secondly, Execute in a loop: (4.6) Reveal and Plaintext value: Randomly select a positive integer As And calculate the local share. , Randomly select a positive integer As And calculate the local share. ,server and Each holds two secret shared inputs to be calculated for the multiplication. and Both parties first calculate the difference in share between the input and the Beaver triple based on their respective holdings. Subsequently, the two parties revealed through an interactive collaboration and The plaintext value; (4.7) Reveal Symbol: server Calculate its output share And the server calculate ;Then, and Jointly expose ; (4.8) Minimum value update: Update the minimum value based on the comparison results. Update the index of the minimum value. ; Repeat steps (4.6) through (4.8) until... The loop ends, finally and The index of the minimum value , The corresponding client cluster union is considered as the set of benign clients in the current communication round. .

9. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, In step (5), the server performs security trimming on the benign update to obtain... The specific calculation steps include: (5.1) Initialize random numbers: First, the server Choose a random positive number As ,server Choose a random positive number As ; (5.2) Exposure Plaintext value: and Collaborative computing , and jointly expose ; (5.3) The server calculates the clipping factor share: Calculate share one , Calculate share two ; (5.4) Clipping Gradient Update : and Collaborative computing and The product of is used to calculate . .

10. The threshold-free privacy-preserving federated learning poisoning attack defense method according to claim 1, characterized in that, Step (6) involves the client updating the cluster count to obtain the next round of cluster counts. The implementation steps include: (6.1) Calculation of Kappa coefficient: Let The total number of samples, To predict the number of samples that match the true class, observational consistency is: ;set up For a set of categories, For the real category The sample proportion For prediction as a category The proportion of, then the expected consistency is This yields the client's Kappa coefficient. ; (6.2) Client-side poll generation: ； (6.3) Next round of cluster number update: ； in, Indicates the first federal learning Client in round of iteration Kappa coefficient, express Threshold of value, Indicates the first federal learning The number of clusters in each iteration.

Images