A secure aggregation method, system, and apparatus for federated learning

Abstract

This invention belongs to the field of federated learning technology, specifically relating to a secure aggregation method, system, and apparatus for federated learning. The method includes: calculating the prediction performance metrics of each local model using a validation set, comprehensively evaluating prediction accuracy, uncertainty, and gradient direction consistency to achieve coarse screening; calculating parameter importance scores based on weighted prediction performance metrics, constructing evaluation vectors for key and non-key parameters, and performing further screening; constructing an isolated forest using fuzzy parameters between thresholds, and accurately identifying covert attacks by accumulating the path lengths of multiple isolated trees; and finally aggregating all benevolent models to generate a global model. This invention, through a multi-level detection mechanism combined with consistent tracking of client behavior, can effectively defend against various types of attacks, ensuring the robustness and security of the federated learning system.

Description

Technical Field

[0001] This invention belongs to the field of secure aggregation technology for federated learning, and specifically relates to a secure aggregation method, system and apparatus for federated learning. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, is based on the idea of ​​collaboratively training and sharing a global model without aggregating the raw data from each client. This effectively solves the problem of privacy leakage and shows great application potential in fields such as finance, healthcare, and the Internet of Things.

[0003] Because the server cannot directly access or verify the client's local data and training process, and lacks effective supervision over the behavior of participating clients, malicious clients may attempt to disrupt the convergence of the global model, reduce its accuracy, or even induce specific biases in the model by uploading carefully modified model updates, ultimately causing the federated learning system to fail or create security vulnerabilities.

[0004] Most existing solutions are based on fixed rules or static analysis of single-round updates, which cannot effectively deal with the attack behavior of malicious clients that evolves over time and changes in strategies; they rely solely on the similarity or statistical characteristics of single-round updates and lack long-term tracking of the consistency of client behavior in multiple rounds of training; once an attack bypasses this layer of detection, the client will be completely exposed to risks. Summary of the Invention

[0005] The purpose of this invention is to provide a secure aggregation method for federated learning, comprising the following steps: S1. Perform forward propagation inference on the pre-trained validation set for each local model to obtain the data prediction results and upload them. Based on the data prediction results uploaded by each local model, calculate the prediction performance index of each local model, select local models whose prediction performance index is greater than the preset prediction threshold, send the global model to the selected local models, and update the parameters of the selected local models based on the global model and their respective local data. S2. Calculate the importance score of each parameter of the selected local model based on the updated parameters and prediction performance indicators of each selected local model. Parameters with an importance score greater than the upper limit of the criticality threshold are designated as critical parameters, and parameters with an importance score less than the lower limit of the criticality threshold are designated as non-critical parameters. Based on the importance scores of each parameter of the selected local model, evaluation vectors are constructed for key parameters and non-key parameters respectively; S3. Based on the evaluation vectors of each parameter of the selected local model, calculate the similarity score with the historical benign model. Use the average of all similarity scores as the similarity threshold. Selected local models with similarity scores greater than or equal to the similarity threshold are considered benign models; otherwise, they are judged as malicious models. S4. Select parameters at the same position of the target number from each benign model as a group, recursively perform random partitioning on each group of parameters, construct an isolation tree, until all parameters in the group are isolated, record the path length of the isolation tree of each benign model, sum them to obtain the total path length of each benign model, if the total path length is greater than or equal to the path threshold, it is determined to be a benign model, aggregate all benign models, and generate a new global model. S5. Iterate through S1 to S4 for a specified number of rounds. After the specified number of iterations, a new global model is obtained as the final global model.

[0006] In S4, each group of parameters is recursively randomly partitioned to construct an isolation tree until all parameters in the group are isolated. Specifically, a group of parameters is used as the root node. If the root node has only one parameter, then mark the root node as a leaf node and stop the splitting; Otherwise, randomly select a split value from the range of parameter values ​​in a set of parameters, divide the root node into a left subtree and a right subtree, and recursively perform the split. When all subtrees contain only one parameter, that parameter becomes a leaf node. The set of parameters becomes an isolated tree, and the total number of connections from the root node to the leaf node is the path length of that leaf node.

[0007] When a subtree contains parameters with the same value, each parameter with the same value is treated as a leaf node, and the parameters with different values ​​are further split.

[0008] In S4, parameters at the same position of the target number are selected as a group from each benign model. Specifically, parameters with the criticality threshold upper limit ≥ importance score ≥ criticality threshold lower limit are used as fuzzy parameters, and fuzzy parameters at the same position of the target number are selected as a group from each benign model.

[0009] In S3, based on the evaluation vectors of each parameter of the selected local model, the similarity score with the historical benign model is calculated. Specifically, assuming the current iteration is t, the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average of the evaluation vectors of all key parameters in iteration t, the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average of the evaluation vectors of the key parameters of all benign models in iteration t-1, and the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average of the evaluation vectors of the key parameters of all benign models in iteration t-2, and the three similarities are summed to obtain the key parameter similarity. Similarly, the non-critical parameter similarity of each selected local model in t iterations is obtained, and the similarity between the critical parameter similarity and the non-critical parameter similarity is summed to obtain the similarity score with the historical benign model.

[0010] The specific performance metrics for prediction in S1 are: , in, For local models Predicted performance metrics For local models Accuracy For local models Certainty For dynamic consistency parameters, , , This is the balance coefficient.

[0011] The historical local model in S3 is as follows: Let the current iteration be t. The historical benign models include all local models that have passed the screening in the current iteration, all benign models that have passed the screening in iteration t-1, and all benign models that have passed the screening in iteration t-2.

[0012] The aggregation server calculates the importance score of each parameter of the selected local models based on the updated parameters and prediction performance metrics of each selected local model, specifically: , in, For local models In the The first round of the local model One parameter, , The number of model parameters, For local models Predicted performance metrics , For the first The first round of the global model One parameter.

[0013] A secure aggregation system for federated learning, used to implement a secure aggregation method for federated learning, includes: The prediction data filtering module performs forward propagation inference on the pre-trained validation set for each local model to obtain and upload the data prediction results. Based on the data prediction results uploaded by each local model, it calculates the prediction performance index of each local model, filters local models whose prediction performance index is greater than the preset prediction threshold, sends the global model to the filtered local models, and updates the parameters of the filtered local models based on the global model and their respective local data. The first-order judgment module calculates the importance score of each parameter of the selected local model based on the updated parameters and prediction performance indicators of each selected local model. Parameters with an importance score greater than the upper limit of the criticality threshold are regarded as critical parameters, and parameters with an importance score less than the lower limit of the criticality threshold are regarded as non-critical parameters. Based on the importance scores of each parameter of the selected local model, evaluation vectors are constructed for key parameters and non-key parameters respectively; The secondary judgment module calculates the similarity score with historical benign models based on the evaluation vector of each parameter of the local model that has passed the screening. The average of all similarity scores is used as the similarity threshold. Local models that have passed the screening with a similarity score greater than or equal to the similarity threshold are considered benign models; otherwise, they are judged as malicious models. The global model acquisition module selects parameters at the same position of the target number from each benign model as a group, recursively performs random partitioning on each group of parameters, constructs an isolation tree, until all parameters in the group are isolated, records the path length of the isolation tree of each benign model, sums them to obtain the total path length of each benign model, if the total path length is greater than or equal to the path threshold, it is determined to be a benign model, aggregates all benign models, and generates a new global model; The iteration module, after a specified number of iterations, obtains a new global model as the final global model.

[0014] A secure aggregation apparatus for federated learning includes a processor and a memory, wherein the processor implements a secure aggregation method for federated learning when executing a computer program stored in the memory.

[0015] Compared with the prior art, the beneficial effects of this application are as follows: This invention uses the predictive performance metrics calculated in S1 as prior weights and incorporates them into the parameter importance scoring in S2. This mechanism allows models with high accuracy, moderate uncertainty, and alignment with the global model direction to receive higher weights in subsequent key parameter identification, while effectively suppressing the parameter importance of models with abnormal performance. This information reuse mechanism not only improves detection accuracy but also makes the scoring process adaptive, dynamically adjusting the focus based on the model's performance on benchmark data, avoiding reliance on a single static rule.

[0016] In S3, this invention achieves cross-round consistency verification of client behavior by calculating the similarity score between the current local model's evaluation vector and the average of the historical multi-round model evaluation vectors. For a malicious client to continuously bypass detection across multiple rounds, its model updates must maintain a high degree of consistency with the statistical distribution of historical benign models throughout multiple iterations. This significantly increases the attacker's time cost and strategy complexity, effectively suppressing attackers' attempts to evade detection through gradual drifting or periodic switching of attack strategies.

[0017] This invention selects importance scores in S4 to construct an isolated forest based on fuzzy parameters. These fuzzy parameters are neither so critical as to be deliberately optimized by malicious models, nor so insignificant as to lack information, thus enabling them to more sensitively reflect subtle anomalies in the model. By constructing multiple isolated trees and accumulating the total path length of each model update, this invention can effectively identify backdoor attacks that covertly tamper with the parameter space. This is because such attacks often cause the model to produce minor anomalies that deviate from the normal distribution on a few non-critical parameters, and these anomalies will manifest as significantly shortened path lengths in the isolated forest.

[0018] Therefore, this invention designs a progressive detection mechanism. First, it uses a validation set to quickly evaluate the model's accuracy, uncertainty, and gradient direction consistency, filtering out obviously malicious models with minimal computational overhead. Then, it constructs an evaluation vector based on parameter importance scores weighted by prediction performance metrics, further identifying anomalous models through similarity clustering. Finally, it selects fuzzy parameters between thresholds to construct an isolated forest, leveraging the shorter path length of anomalous data points in the isolated trees to accurately identify well-disguised covert attacks. The detection is progressive and complementary, ensuring that even if one level is bypassed, subsequent levels can still effectively intercept attacks, achieving a defense-in-depth effect. Detailed Implementation

[0019] To further understand the content of this invention, the invention will be described in detail with reference to the embodiments.

[0020] This invention relates to a secure aggregation method for federated learning, comprising the following steps: S1. Perform forward propagation inference on the pre-trained validation set for each local model to obtain the data prediction results and upload them. Based on the data prediction results uploaded by each local model, calculate the prediction performance index of each local model, select local models whose prediction performance index is greater than the preset prediction threshold, send the global model to the selected local models, and update the parameters of the selected local models based on the global model and their respective local data.

[0021] Specifically, this application maintains a small-scale pre-trained validation set, which consists of publicly available data from each participant or small sample data owned by the server, and does not contain sensitive privacy information.

[0022] Each local model performs a forward propagation inference on the validation set, calculates the prediction result for each sample, and uploads it. The aggregation server calculates the prediction performance metrics for each model based on the prediction results uploaded by each local model. , in, For local models Predicted performance metrics For local models Accuracy For local models Certainty For dynamic consistency parameters, , , This is the balance coefficient.

[0023] Preferably, in this application .

[0024] Local models are ranked according to their prediction performance metrics, and those with prediction performance metrics greater than a preset prediction threshold are selected as candidate models for this round of aggregation.

[0025] The global model is sent to the candidate models, and each candidate model is trained using its own dataset. Specifically: , in For the local model in round t, For learning rate, For the local model in round t-1 In local dataset The loss gradient on.

[0026] The parameters are updated based on the global model and their respective local data. The aggregation server receives the parameter updates uploaded by each candidate model. Specifically, the parameter update process is as follows: , in Let n be the global model in round t, and n be the total number of candidate models selected in round t. This refers to the amount of local data for the local model. This is the sum of the data volume of all local models.

[0027] Step S1 of this application is a preliminary judgment process that can be achieved with only one forward propagation and a small validation set. It can complete the task well with minimal resource consumption and provide a foundation for subsequent judgments.

[0028] S2. Calculate the importance score of each parameter of the selected local model based on the updated parameters and prediction performance indicators of each selected local model. Parameters with an importance score greater than the upper limit of the criticality threshold are designated as critical parameters, and parameters with an importance score less than the lower limit of the criticality threshold are designated as non-critical parameters. Based on the importance scores of each parameter of the selected local models, evaluation vectors are constructed for key parameters and non-key parameters respectively.

[0029] Furthermore, the aggregation server calculates the importance score of each parameter of the selected local models based on the updated parameters and prediction performance metrics of each selected local model, specifically: , in, For local models In the The first round of the local model One parameter, , The number of model parameters, For local models Predicted performance metrics , For the first The first round of the global model One parameter, when When the value is large, The more important it is, the better.

[0030] Parameters with importance scores greater than the upper limit of the criticality threshold are designated as critical parameters, while parameters with importance scores less than the lower limit of the criticality threshold are designated as non-critical parameters.

[0031] Based on the importance scores of each parameter in the selected local model, evaluation vectors are constructed for key parameters and non-key parameters, denoted as . and Used to mark the positions of critical and non-critical parameters: , , in, As a key parameter, This is a non-critical parameter and can be changed according to the actual scenario.

[0032] This invention uses the predictive performance metrics calculated in S1 as prior weights and incorporates them into the parameter importance scoring in S2. This mechanism allows models with high accuracy, moderate uncertainty, and alignment with the global model direction to receive higher weights in subsequent key parameter identification, while effectively suppressing the parameter importance of models with abnormal performance. This information reuse mechanism not only improves detection accuracy but also makes the scoring process adaptive, dynamically adjusting the focus based on the model's performance on benchmark data, avoiding reliance on a single static rule.

[0033] S3. Based on the evaluation vectors of each parameter of the selected local model, calculate the similarity score with the historical benign model. Use the average of all similarity scores as the similarity threshold. Select local models with similarity scores greater than or equal to the similarity threshold as benign models; otherwise, they are judged as malicious models.

[0034] Specifically, let the current iteration be t. The historical benign models include all local models that passed the screening in the current iteration, all benign models that passed the screening in iteration t-1, and all benign models that passed the screening in iteration t-2.

[0035] Based on the evaluation vectors of each parameter of the selected local model, the similarity score with the historical benign model is calculated. Specifically, assuming the current iteration is t, the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average value of all key parameter evaluation vectors in iteration t, the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average value of the evaluation vectors of the key parameter of all benign models in iteration t-1, and the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average value of the evaluation vectors of the key parameter of all benign models in iteration t-2, and the three similarities are summed to obtain the key parameter similarity. Similarly, the non-critical parameter similarity of each selected local model in t iterations is obtained, and the similarity between the critical parameter similarity and the non-critical parameter similarity is summed to obtain the similarity score with the historical benign model.

[0036] Furthermore, the formula can be expressed as: , in, , , This indicates the number of local models selected in the current round. , , For the first A set of benign model updates. and All are the first A set of benign model updates, by Data obtained from rounds.

[0037] Then, the similarity threshold is calculated: , like If it is a benign model, it is considered a malicious model; otherwise, it is considered a malicious model. Furthermore, it is worth noting that if... and If the value is less than 1, then the corresponding variable is 0.

[0038] In S3, this invention achieves cross-round consistency verification of client behavior by calculating the similarity score between the current local model's evaluation vector and the average of the historical multi-round model evaluation vectors. For a malicious client to continuously bypass detection across multiple rounds, its model updates must maintain a high degree of consistency with the statistical distribution of historical benign models throughout multiple iterations. This significantly increases the attacker's time cost and strategy complexity, effectively suppressing attackers' attempts to evade detection through gradual drifting or periodic switching of attack strategies.

[0039] S4. Select parameters at the same position of the target number from each benign model as a group. Recursively perform random partitioning on each group of parameters to construct an isolation tree until all parameters in the group are isolated. Record the path length of the isolation tree of each benign model and sum them to obtain the total path length of each benign model. If the total path length is greater than or equal to the path threshold, it is determined to be a benign model. Aggregate all benign models to generate a new global model.

[0040] Specifically, parameters with a criticality threshold upper limit ≥ importance score ≥ criticality threshold lower limit are used as fuzzy parameters, and fuzzy parameters at the same position of the target number are selected as a group from each benign model.

[0041] This grouping is because if an attack has already passed S3's filtering, further in-depth judgment based on their fuzzy parameters can accurately filter malicious clients, and further in-depth judgment can be made on models that know S3's judgment rules.

[0042] Using a set of parameters as the root node, if the root node contains only one parameter, then mark the root node as a leaf node and stop the splitting; otherwise, randomly select a splitting value within the range of parameter values ​​in the set of parameters, divide the root node into a left subtree and a right subtree, and recursively execute the splitting. When all subtrees contain only one parameter, that parameter becomes a leaf node, and the set of parameters becomes an isolated tree. The total number of connections from the root node to the leaf node is the path length of that leaf node.

[0043] Furthermore, the path length of each model update in each isolated tree is recorded, that is, the path length from the root node to the leaf node. : , in, For local models In the Group parameters, Leaf node For the left subtree, For the right subtree, summing the results yields the total path length for each model update, denoted as . Let there be K parameters in group p.

[0044] .

[0045] Then, the mean of the total path length updated for each model is calculated. , Furthermore, when a subtree contains parameters with the same value, each parameter with the same value is treated as a leaf node, and the parameters with different values ​​are further divided.

[0046] The principle for this step is that malicious attacks are easier to isolate, and the isolated tree path will be shorter, while benevolent models are difficult to isolate, and the path lengths are roughly the same.

[0047] Therefore, if the total path length is greater than or equal to the path threshold, it is determined to be a benevolent model, and all benevolent models are aggregated to generate a new global model.

[0048] Meanwhile, aggregation server computing and ,in, Indicates the first A collection of benign models. The aggregation server will... , This serves as a consistency detection mechanism for inputting historical information into subsequent training rounds, enabling the tracking and evaluation of long-term client behavior.

[0049] This invention selects importance scores in S4 to construct an isolated forest based on fuzzy parameters. These fuzzy parameters are neither so critical as to be deliberately optimized by malicious models, nor so insignificant as to lack information, thus enabling them to more sensitively reflect subtle anomalies in the model. By constructing multiple isolated trees and accumulating the total path length of each model update, this invention can effectively identify backdoor attacks that covertly tamper with the parameter space. This is because such attacks often cause the model to produce minor anomalies that deviate from the normal distribution on a few non-critical parameters, and these anomalies will manifest as significantly shortened path lengths in the isolated forest.

[0050] S5. Iterate through S1 to S4 for a specified number of rounds. After the specified number of iterations, a new global model is obtained as the final global model.

[0051] This invention designs a progressive detection mechanism. First, it uses a validation set to quickly evaluate the model's accuracy, uncertainty, and gradient direction consistency, filtering out obviously malicious models with minimal computational overhead. Then, it constructs an evaluation vector based on parameter importance scores weighted by prediction performance metrics, further identifying anomalous models through similarity clustering. Finally, it selects fuzzy parameters between thresholds to construct an isolated forest, leveraging the shorter path length of anomalous data points within the isolated trees to accurately identify well-disguised covert attacks. The detection is progressive and complementary, ensuring that even if one level is bypassed, subsequent levels can still effectively intercept attacks, achieving a defense-in-depth effect.

[0052] A secure aggregation system for federated learning, used to implement a secure aggregation method for federated learning, includes: The prediction data filtering module performs forward propagation inference on the pre-trained validation set for each local model to obtain and upload the data prediction results. Based on the data prediction results uploaded by each local model, it calculates the prediction performance index of each local model, filters local models whose prediction performance index is greater than the preset prediction threshold, sends the global model to the filtered local models, and updates the parameters of the filtered local models based on the global model and their respective local data. The first-order judgment module calculates the importance score of each parameter of the selected local model based on the updated parameters and prediction performance indicators of each selected local model. Parameters with an importance score greater than the upper limit of the criticality threshold are regarded as critical parameters, and parameters with an importance score less than the lower limit of the criticality threshold are regarded as non-critical parameters. Based on the importance scores of each parameter of the selected local model, evaluation vectors are constructed for key parameters and non-key parameters respectively; The secondary judgment module calculates the similarity score with the historical local models based on the evaluation vector of each parameter of the selected local models. The average of all similarity scores is used as the similarity threshold. Selected local models with similarity scores greater than or equal to the similarity threshold are considered benign models; otherwise, they are judged as malicious models. The global model acquisition module selects parameters at the same position of the target number from each benign model as a group, recursively performs random partitioning on each group of parameters, constructs an isolation tree, until all parameters in the group are isolated, records the path length of the isolation tree of each benign model, sums them to obtain the total path length of each benign model, if the total path length is greater than or equal to the path threshold, it is determined to be a benign model, aggregates all benign models, and generates a new global model; The iteration module, after a specified number of iterations, obtains a new global model as the final global model.

[0053] A secure aggregation apparatus for federated learning includes a processor and a memory, wherein the processor implements a secure aggregation method for federated learning when executing a computer program stored in the memory.

Claims

1. A secure aggregation method for federated learning, characterized in that, Includes the following steps: S1. Perform forward propagation inference on the pre-trained validation set for each local model to obtain the data prediction results and upload them. Based on the data prediction results uploaded by each local model, calculate the prediction performance index of each local model, select local models whose prediction performance index is greater than the preset prediction threshold, send the global model to the selected local models, and update the parameters of the selected local models based on the global model and their respective local data. The specific performance metrics for prediction in S1 are: ， in, For local models Predicted performance metrics For local models Accuracy For local models Certainty For dynamic consistency parameters, , , This is the balance coefficient; S2. Calculate the importance score of each parameter of the selected local model based on the updated parameters and prediction performance indicators of each selected local model. Parameters with an importance score greater than the upper limit of the criticality threshold are designated as critical parameters, and parameters with an importance score less than the lower limit of the criticality threshold are designated as non-critical parameters. Based on the importance scores of each parameter of the selected local model, evaluation vectors are constructed for key parameters and non-key parameters respectively; S3. Based on the evaluation vectors of each parameter of the selected local model, calculate the similarity score with the historical benign model. Use the average of all similarity scores as the similarity threshold. Selected local models with similarity scores greater than or equal to the similarity threshold are considered benign models; otherwise, they are judged as malicious models. S4. Select parameters at the same position of the target number from each benign model as a group, recursively perform random partitioning on each group of parameters, construct an isolation tree, until all parameters in the group are isolated, record the path length of the isolation tree of each benign model, sum them to obtain the total path length of each benign model, if the total path length is greater than or equal to the path threshold, it is determined to be a benign model, aggregate all benign models, and generate a new global model. In S4, parameters at the same position of the target number are selected as a group from each benign model. Specifically, parameters with the criticality threshold upper limit ≥ importance score ≥ criticality threshold lower limit are used as fuzzy parameters, and fuzzy parameters at the same position of the target number are selected as a group from each benign model. S5. Iterate through S1 to S4 for a specified number of rounds. After the specified number of iterations, a new global model is obtained as the final global model.

2. The secure aggregation method for federated learning according to claim 1, characterized in that, In S4, each group of parameters is recursively randomly partitioned to construct an isolation tree until all parameters in the group are isolated. Specifically, a group of parameters is used as the root node. If the root node has only one parameter, then mark the root node as a leaf node and stop the splitting; Otherwise, randomly select a split value from the range of parameter values ​​in a set of parameters, divide the root node into a left subtree and a right subtree, and recursively perform the split. When all subtrees contain only one parameter, that parameter becomes a leaf node. The set of parameters becomes an isolated tree, and the total number of connections from the root node to the leaf node is the path length of that leaf node.

3. The secure aggregation method for federated learning according to claim 2, characterized in that, When a subtree contains parameters with the same value, each parameter with the same value is treated as a leaf node, and the parameters with different values ​​are further split.

4. The secure aggregation method for federated learning according to claim 1, characterized in that, In S3, based on the evaluation vectors of each parameter of the selected local model, the similarity score with the historical benign model is calculated. Specifically, assuming the current iteration is t, the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average of the evaluation vectors of all key parameters in iteration t, the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average of the evaluation vectors of the key parameters of all benign models in iteration t-1, and the cosine similarity between the evaluation vector of the key parameter of each selected local model in iteration t and the average of the evaluation vectors of the key parameters of all benign models in iteration t-2, and the three similarities are summed to obtain the key parameter similarity. Similarly, the non-critical parameter similarity of each selected local model in t iterations is obtained, and the similarity between the critical parameter similarity and the non-critical parameter similarity is summed to obtain the similarity score with the historical benign model.

5. A secure aggregation method for federated learning according to claim 1, characterized in that, The historical benign model in S3 is as follows: Assuming the current iteration is t, the historical benign model includes all local models that have passed the screening in the current iteration, all benign models that have passed the screening in iteration t-1, and all benign models that have passed the screening in iteration t-2.

6. The secure aggregation method for federated learning according to claim 1, characterized in that, The aggregation server calculates the importance score of each parameter of the selected local models based on the updated parameters and prediction performance metrics of each selected local model, specifically: ， in, For local models In the The first round of the local model One parameter, , The number of model parameters, For local models Predicted performance metrics , For the first The first round of the global model One parameter.

7. A secure aggregation system for federated learning, used to implement the secure aggregation method for federated learning as described in any one of claims 1-6, characterized in that, include: The prediction data filtering module performs forward propagation inference on the pre-trained validation set for each local model to obtain and upload the data prediction results. Based on the data prediction results uploaded by each local model, it calculates the prediction performance index of each local model, filters local models whose prediction performance index is greater than the preset prediction threshold, sends the global model to the filtered local models, and updates the parameters of the filtered local models based on the global model and their respective local data. The first-order judgment module calculates the importance score of each parameter of the selected local model based on the updated parameters and prediction performance indicators of each selected local model. Parameters with an importance score greater than the upper limit of the criticality threshold are regarded as critical parameters, and parameters with an importance score less than the lower limit of the criticality threshold are regarded as non-critical parameters. Based on the importance scores of each parameter of the selected local model, evaluation vectors are constructed for key parameters and non-key parameters respectively; The secondary judgment module calculates the similarity score with historical benign models based on the evaluation vector of each parameter of the local model that has passed the screening. The average of all similarity scores is used as the similarity threshold. Local models that have passed the screening with a similarity score greater than or equal to the similarity threshold are considered benign models; otherwise, they are judged as malicious models. The global model acquisition module selects parameters at the same position of the target number from each benign model as a group, recursively performs random partitioning on each group of parameters, constructs an isolation tree, until all parameters in the group are isolated, records the path length of the isolation tree of each benign model, sums them to obtain the total path length of each benign model, if the total path length is greater than or equal to the path threshold, it is determined to be a benign model, aggregates all benign models, and generates a new global model; The iteration module, after a specified number of iterations, obtains a new global model as the final global model.

8. A secure aggregation device for federated learning, characterized in that, It includes a processor and a memory, wherein the processor implements a secure aggregation method for federated learning as described in any one of claims 1-6 when executing a computer program stored in the memory.

Images