A Decoupled Poisoning-Resistant Robust Polymerization Method with Federated LoRA Fine-tuning

Abstract

This invention relates to the fields of federated learning, secure fine-tuning of large language models, and adversarial machine learning. It discloses a decoupled, poison-resistant, robust aggregation method for federated LoRA fine-tuning. This invention utilizes the asymmetry of LoRA matrix roles to implement a divide-and-conquer defense strategy, constructing a secure aggregation framework for edge heterogeneous federated learning. On one hand, it introduces the flexible alignment characteristics of Sinkhorn optimal transmission, effectively alleviating the problems of feature row permutation, domain offset, and representation misalignment caused by Non-IID distribution differences, significantly reducing the model misjudgment rate in heterogeneous environments. On the other hand, it uses precise reconstruction gain based on closed-form solutions to replace traditional distance metrics, accurately identifying and filtering benign heterogeneous data that positively contributes to the global model without introducing high computational overhead. This method combines geometric structure verification and utility verification, effectively resisting untargeted poisoning attacks and ensuring the robustness and generalization ability of the global model in edge heterogeneous environments.

Description

Technical Field

[0001] This invention relates to the fields of federated learning, secure fine-tuning of large language models, and adversarial machine learning, and particularly to a decoupled, poison-resistant, robust aggregation method for federated LoRA fine-tuning. Background Technology

[0002] With large language models (LLMs) like ChatGPT demonstrating their superior "emergent" capabilities, artificial intelligence has officially entered the era of large models, providing effective solutions to complex problems in fields such as natural language processing and code generation. However, mainstream cloud-based training methods are hampered by high computing costs, limited communication bandwidth, and data privacy leaks, making them difficult to adapt to the needs of large-scale deployment. Edge intelligence, by pushing the training and inference of AI models to edge devices such as smartphones and IoT gateways, significantly reduces service latency and backbone network bandwidth consumption, and ensures the localization of user privacy data at the physical level, becoming a key path to overcome these difficulties.

[0003] To adapt to the resource-constrained characteristics of edge devices, Low-Rank Adaptation (LoRA) in Parameter Efficient Fine-Tuning Technique (PEFT) has become the preferred choice for edge devices due to its advantages of fewer parameters and plug-and-play functionality. The combination of Federated Learning and LoRA (Fed-LoRA) breaks down data silos, allowing edge devices to transmit only lightweight LoRA adapter parameters, achieving a win-win situation of privacy protection and low-cost collaborative updates of the global model.

[0004] However, the Fed-LoRA architecture is vulnerable to indiscriminate data poisoning attacks in open network environments. Attackers can disrupt the global model's usability by injecting noise or tampering with labels. At the same time, the inherent severe data heterogeneity in edge scenarios can lead to significant statistical differences in model parameters, exacerbating the difficulty of defense. Although existing research has proposed various solutions, such as the Krum algorithm based on Euclidean distance to remove outliers, FLTrust based on cosine similarity for benign updates, RFA using geometric median to optimize aggregation, and FedCut using spectral analysis to remove malicious noise, and strategies such as dual architecture design, parameter freezing, and alternating updates for LoRA have made progress in adapting to heterogeneity, existing general defense methods are mostly adapted to traditional deep learning models such as CNNs. When they are directly transferred to the LoRA fine-tuning scenario of LLM, structural failures will occur. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a decoupled, anti-poisoning robust aggregation method for fine-tuning federated LoRA. This method primarily solves the technical problems of structural failures and sensitivity to data heterogeneity in existing general defense schemes when defending against untargeted data poisoning attacks, due to their inability to adapt to the low-rank dual-matrix structure of LoRA.

[0006] This invention provides a decoupled, poisoning-resistant, robust polymerization method for fine-tuning of federated LoRA, comprising the following steps: The server receives the fine-tuning parameters uploaded by each client and, using the structural characteristics of LoRA parameters, decouples the fine-tuning parameters into a set of reduced-dimensional matrices for carrying general features and a set of increased-dimensional matrices for carrying specific tasks. For the dimensionality reduction matrix, its row vectors are modeled as empirical distributions in the feature space. The Sinkhorn divergence between each client and the global reference distribution is calculated using the entropy regularization algorithm. Based on this divergence, the manifold alignment of the feature subspace is evaluated, and the first trust weight is generated. For the aforementioned dimension-upgrading matrix, a global reconstruction optimization objective based on ridge regression is constructed. A fast calculation method based on closed-form solutions is adopted to directly calculate the change in global reconstruction error after removing a specific client, i.e., the precise reconstruction gain. The utility contribution of the client to the global model is determined based on the sign of the reconstruction gain, and a second trust weight is generated accordingly. Combining the first trust weight and the second trust weight, the client's long-term reputation value is updated using an exponential moving average mechanism. After down-weighting or removing malicious nodes based on their reputation values, the reduced-dimensional matrix and increased-dimensional matrix of the remaining nodes are weighted and aggregated to complete the global model update.

[0007] Furthermore, the fine-tuning parameters are decoupled into a set of reduced-dimensional matrices for carrying general features and a set of increased-dimensional matrices for carrying specific tasks, specifically including: The server initializes global model parameters, freezes the pre-trained weight matrix, and initializes and distributes only two low-rank matrices, namely the dimension reduction matrix and the dimension increase matrix. In the t-th round of training, the server distributes global parameters to each client, and each client uses its local private data to perform local training, obtains the updated dimensionality reduction matrix and dimensionality increase matrix, and uploads them to the server. The server receives parameters uploaded by each client and uses the structural characteristics of LoRA to decouple the parameter stream into two independent sets: a set of reduced-dimensional matrices and a set of increased-dimensional matrices.

[0008] Furthermore, the generation of the first trust weight specifically includes: The multiple row vectors of the dimensionality reduction matrix uploaded by the client are used to construct the discrete empirical probability distribution of the client. The multiple row vectors of the global dimensionality reduction matrix obtained from the previous round of aggregation are used to construct a reference distribution; Define the squared Euclidean distance between the client distribution and the reference distribution as the transmission cost, and generate the cost matrix; The Sinkhorn algorithm is used to solve the entropy-regularized optimal transmission problem, and the Sinkhorn divergence between the client distribution and the reference distribution is obtained. The client's first trust weight is calculated based on the Sinkhorn divergence using a temperature scaling mechanism.

[0009] Furthermore, the solution to the entropy-regularized optimal transmission problem specifically includes: Set constraints on the transmission plan matrix to ensure that the total mass of each source particle in the client distribution is transported out and the total mass received by each target particle in the reference distribution meets the requirements. Calculate the total transport cost required to move the characteristic particles from the client distribution to the corresponding positions in the reference distribution; An entropy regularization term is introduced to smooth the transmission plan, and the optimal transmission plan matrix is ​​solved by an iterative algorithm.

[0010] Furthermore, the generation of the second trust weight specifically includes: Using a fixed global dimension reduction matrix and a global dimension increase matrix as a basis, we search for the optimal fine-tuning increment for the dimension increase matrix such that the increment can explain the current global update to the greatest extent. Calculate the minimum fit residuals when all clients are included; Suppose that after removing a specific client, the weights of the remaining clients are renormalized, and the remaining global update amount excluding that client is calculated. Assess the extent to which the remaining update amount is interpreted by the global subspace and calculate the reconstruction error after removing the client; Define the exact reconstruction gain for this client, which is the difference between the reconstruction error when all clients are included and the reconstruction error when this client is removed; The normalized reconstruction gain is calculated using a normalization method and mapped to the client's second trust weight using an exponential decay function.

[0011] Furthermore, the optimal fine-tuning increment is directly calculated using a closed-form solution derived by the matrix differentiation rule.

[0012] Furthermore, the degree to which the remaining update amount is interpreted by the global subspace is evaluated, and the optimal fine-tuning increment after removing the client is directly calculated using the closed-form solution derived by the matrix differentiation rule.

[0013] Furthermore, the step of updating the long-term reputation value by combining the first trust weight and the second trust weight and performing weighted aggregation specifically includes: The overall trust score for this round is calculated by combining the first trust weight and the second trust weight. Introduce a momentum mechanism to update the client's long-term reputation value using the current round of comprehensive trust scoring; Based on the comparison between the updated long-term reputation value and the preset removal threshold, a binary state determination is made for the client. Clients that are below the removal threshold are removed and refused to participate in the current and subsequent global model aggregation. For clients in active state, perform renormalized weighted aggregation on the reduced-dimensional matrix; For the upgraded matrix of clients with active status, an aggregation strategy based on a three-dimensional weighting of data volume, reputation value, and security is adopted.

[0014] Furthermore, the renormalized weighted aggregation of the dimensionality-reduced matrix of active clients specifically includes: The weights of active nodes are renormalized using the first trust weight; The global dimensionality reduction matrix is ​​updated based on the renormalized weights and the global learning rate.

[0015] Furthermore, the upscaling matrix for clients in an active state is aggregated using a three-dimensional weighted strategy based on data volume, reputation value, and security, specifically including: Calculate the overall aggregation weight for this round, which is determined by the proportion of the original data, the updated long-term reputation value, and the second trust weight for this round. Normalize the aggregate weights; The global dimension-upgrading matrix is ​​updated based on the normalized comprehensive weights and the global learning rate.

[0016] Compared with existing technologies, the technical solution provided by this invention has the following advantages: This invention utilizes the asymmetry of the LoRA matrix role to implement a divide-and-conquer defense strategy and constructs a secure aggregation framework for edge heterogeneous federated learning. On the one hand, it introduces the flexible alignment characteristics of Sinkhorn optimal transmission, effectively alleviating the problems of feature row permutation, domain offset, and representation misalignment caused by Non-IID distribution differences, and significantly reducing the model misjudgment rate in heterogeneous environments. On the other hand, it uses accurate reconstruction gain based on closed-form solutions to replace traditional distance metrics, accurately identifying and screening benign heterogeneous data that contributes positively to the global model without introducing high computational overhead. This method combines geometric structure verification and utility verification, which can effectively resist untargeted poisoning attacks and ensure the robustness and generalization ability of the global model in edge heterogeneous environments. Attached Figure Description

[0017] Figure 1 A flowchart of a decoupled, poisoning-resistant, robust polymerization method with fine-tuned LoRA provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the overall framework provided for an embodiment of the present invention; Figure 3The following is a flowchart illustrating a decoupled, poisoning-resistant, robust polymerization method with fine-tuned LoRA as provided in this embodiment of the invention. Detailed Implementation

[0018] The following detailed description of a specific embodiment of the present invention is provided in conjunction with the accompanying drawings. However, it should be understood that the scope of protection of the present invention is not limited to the specific embodiment.

[0019] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the technical solution of this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0020] The present invention will be described below through several specific embodiments. To keep the following description of the embodiments clear and concise, detailed descriptions of known functions and components may be omitted. When any component of an embodiment of the present invention appears in more than one drawing, the component may be represented by the same reference numerals in each drawing.

[0021] Please refer to Figure 1 Embodiment 1 of the present invention is as follows: A decoupled anti-poisoning robust aggregation method for fine-tuning LoRA is proposed. This embodiment is a divide-and-conquer defense model based on the low-rank parameter physical structure of LoRA. By using the idea of ​​matrix semantic decoupling, the federated defense process is decomposed into two sub-problems: general feature consistency verification and specific task utility verification. Then, a momentum-based long-term reputation mechanism is embedded into the aggregation process to improve the robustness and generalization performance of the global model in edge heterogeneous environments.

[0022] like Figure 1 As shown in this embodiment, a decoupled, poisoning-resistant, robust polymerization method with federated LoRA fine-tuning includes the following steps: S1. The server receives the fine-tuning parameters uploaded by each client and uses the structural characteristics of LoRA parameters to decouple the fine-tuning parameters into a set of reduced-dimensional matrices carrying general features and a set of increased-dimensional matrices carrying specific tasks. Specifically, the core logic of LoRA fine-tuning is to approximate the effect of full-parameter fine-tuning through the product of low-rank matrices A (d×r) and B (r×d). Matrix A is responsible for mapping high-dimensional input features to a low-dimensional subspace, mainly capturing low-level common features shared across clients; matrix B is responsible for mapping low-dimensional features back to a high-dimensional space, mainly adapting to the personalized features of local specific data (such as exclusive category features in different client datasets). This step decouples the complex full-parameter defense problem through physical structure decomposition into two lower-dimensional, more feature-defined subspace detection problems, laying the foundation for subsequent divide-and-conquer defense, while avoiding misjudgment of benign heterogeneous data in full-parameter detection. S2. For the dimensionality reduction matrix, its row vectors are modeled as empirical distributions in the feature space. The Sinkhorn divergence between each client and the global reference distribution is calculated using the entropy regularization algorithm. Based on this divergence, the manifold alignment of the feature subspace is evaluated, and the first trust weight is generated. Specifically, the row vectors of the dimensionality reduction matrix A correspond to the feature vectors of the low-dimensional feature subspace. The consistency of the row vector distribution of the A matrix of each client directly reflects the degree of alignment of the general features. If a client engages in poisoning behavior, the row vector distribution of its A matrix will deviate significantly from the global reference distribution, resulting in an increase in Sinkhorn divergence. This step introduces an entropy regularization algorithm to solve the problems of high computational complexity and difficulty in adapting to edge devices in traditional optimal transmission. At the same time, through the flexible measurement characteristics of Sinkhorn divergence, misjudgments caused by feature row permutation in Non-IID scenarios are avoided, ensuring that the general features of benign heterogeneous data can be correctly identified. S3. For the aforementioned dimension-upgraded matrix, construct a global reconstruction optimization objective based on ridge regression; use a fast calculation method based on closed-form solutions to directly calculate the change in global reconstruction error after removing a specific client, i.e., the precise reconstruction gain; determine the utility contribution of the client to the global model based on the sign of the reconstruction gain, and generate a second trust weight accordingly. Specifically, the core function of the upgraded matrix B is to adapt to the local specific task. Its utility value lies in whether it can help the global model better fit the global data distribution. Traditional distance measurement methods have difficulty distinguishing between benign heterogeneous B matrices and malicious poisoning B matrices. The core advantage of the accurate reconstruction gain proposed in this step is that it can quickly calculate the utility contribution of the client to the global reconstruction without iterative optimization. It can accurately identify malicious poisoning clients (whose B matrices will lead to an increase in global reconstruction error) and retain benign heterogeneous B matrices that make a positive contribution to the global model, thus avoiding the decline in generalization performance caused by excessive defense. S4. Combining the first trust weight and the second trust weight, the client's long-term reputation value is updated using the exponential moving average mechanism. After de-weighting or removing malicious nodes based on the reputation value, the reduced-dimensional matrix and increased-dimensional matrix of the remaining nodes are weighted and aggregated to complete the global model update. Specifically, the introduction of the exponential moving average mechanism is mainly used to resist intermittent poisoning attacks. Malicious clients may evade single detection by alternating between "pretending to be benign" and "maliciously poisoning" the client. Long-term reputation values ​​can accumulate the client's historical performance, ensuring that only clients that consistently contribute benign parameters over a long period can obtain high trust weights. At the same time, the differentiated weighted aggregation strategy for matrices A and B ensures the consistency of global general features while retaining the effectiveness of local personalized features, further improving the robustness and generalization performance of the global model in edge heterogeneous environments. In this embodiment, a decoupling strategy based on structural characteristics is applied to eliminate the adaptation failure of traditional general defense schemes to low-rank parameters of LoRA, ensuring that benign heterogeneous data can be more fairly integrated into the global model. The new structure-aware defense model uses Sinkhorn divergence and precise reconstruction gain to extract geometric consistency features and task utility features from the parameters, respectively. It uses a dual verification mechanism to separate actual benign updates from potential poisoning noise, thereby enhancing the model's ability to identify untargeted poisoning attacks and further improving the model's security aggregation performance.

[0023] Embodiment 2 of the present invention is as follows: Based on the above embodiment 1, in the decoupling anti-poisoning robust aggregation method of federated LoRA fine-tuning in this embodiment, the present invention is based on the following assumption: the "general consensus features" and "personalized task features" in the LoRA fine-tuning parameters can be semantically decoupled from the physical structure of the dimension reduction matrix (A) and the dimension increase matrix (B); wherein the dimension reduction matrix mainly captures the underlying features shared across clients, while the dimension increase matrix mainly adapts to local specific data.

[0024] In step S1 of the above embodiment, the uploading parameters are decoupled, which specifically includes the following steps: S1-1. Before training, the server initializes the global model parameters: for LoRA fine-tuning, the pre-trained weights are frozen. Only two low-rank matrices are initialized and distributed: a dimensionality reduction matrix. (Gaussian initialization) and the increased-dimensional matrix (Initialized to a zero matrix); where d is the input dimension and r is the rank of LoRA.

[0025] S1-2, In the t-th round of training, the server distributes global parameters to each client: Client k uses its local private data Perform E rounds of local training to obtain updated parameters. and During local training, the client only updates and Two low-rank matrices are used, and the pre-trained weights are kept frozen, effectively reducing the computational and communication overhead on the client side. Simultaneously, an L2 regularization term is introduced into the local loss function to prevent local overfitting and ensure the updated weights are optimized. and It can balance local fitting and global consistency.

[0026] S1-3. The server receives parameters uploaded by K clients and uses the structural characteristics of LoRA to decouple the parameter stream into two independent sets: Set of dimensionality reduction matrices: ; Set of matrices of increased dimensions: ; The parameter decoupling process requires no additional feature extraction or transformation operations; it directly separates based on the physical structure of the LoRA parameters, resulting in extremely low computational overhead and making it suitable for large-scale federated client scenarios. After decoupling... and They are used for subsequent general feature consistency verification and specific task utility verification, respectively. The two verification processes are independent of each other and executed in parallel, further improving defense efficiency.

[0027] In this embodiment, the stability and consistency of the decoupling results are ensured through a clear parameter initialization strategy and decoupling steps. The complex full-parameter defense problem is transformed into two detection problems in two lower-dimensional and more clearly defined subspaces, which not only reduces the computational complexity of the defense algorithm but also improves the accuracy of subsequent detection. At the same time, the parameter decoupling process is fully compatible with the original LoRA fine-tuning process, without requiring significant modifications to the client training logic, and has good compatibility and scalability.

[0028] Please refer to Figures 2 to 3 Embodiment 3 of the present invention is as follows: Based on the above embodiment one, a dual detection mechanism targeting different matrix characteristics is constructed, specifically including the following steps: S2-1, The matrix of client k of row vectors Constructed as a discrete empirical probability distribution : , in, For Diclare measurement, This indicates that the probability mass is completely concentrated in the center of gravity. Location; The probability mass of each feature particle.

[0029] S2-2, Combine the global matrix from the previous round of aggregation. r row vectors Construct a reference distribution : , in, This indicates that the probability mass is completely concentrated in the center of gravity. Location.

[0030] S2-3, Calculate client distribution The i-th characteristic particle is transported to the reference distribution. The geometric cost of the j-th feature particle, generating Cost matrix The element in the i-th row and j-th column is: , Among them, the cost matrix Each element represents a definition of the future. One of the feature vectors is moved to The cost of one of the positions.

[0031] S2-4. Find an optimal transmission plan matrix. Its elements represent What proportion of the i-th particle is allocated to The j-th particle, optimal The result is obtained by minimizing the weighted sum of total handling cost and planned entropy: , Here, ε is the regularization coefficient (ε>0), which can transform the optimal transport problem into a convex optimization problem that can be solved efficiently.

[0032] S2-4-1、 The two stochastic matrix constraints are as follows, and together they ensure that the transmission plan is a complete and quality-assured redistribution scheme: , , in, Represents a set of elements that are all 1. 3D column vector, Representation matrix Multiply by vector , representing client distribution The entire mass of each source particle i was transported out and exactly used up; Similarly, reference distribution The total mass received by each target particle j in the process is exactly equal to .

[0033] S2-4-2. Calculate the geometric cost or loss required to "move" a feature i from client k to a reference feature j, i.e., the total transmission cost: , S2-4-3. To address the high computational complexity of traditional optimal transmission methods, this step introduces an entropy regularization term. This transforms linear programming into a fast-solvable convex optimization problem. It also changes the probability distribution of the transmission plan P from a discrete 'point-to-point' hard matching to a more uniform and smooth 'soft matching', that is, it allows... The distribution is more even: , S2-5. After convergence through the Sinkhorn iterative algorithm, the distribution... and Entropy regularization optimal transmission loss value The result can be obtained by substituting the optimal solution into the objective function. , S2-6. In order to eliminate the bias caused by sample autocorrelation (i.e. (When the time distance is not zero), to ensure that the metric truly reflects the geometric difference, calculate the biased Sinkhorn divergence. As the final measure of feature consistency: , in and The above Sinkhorn iterative algorithm yields the costs of client-side self-matching and global self-matching, respectively.

[0034] S2-7. Calculate client k based on Sinkhorn divergence using a temperature scaling mechanism. First Trust Weights of the Matrix : , in is the temperature hyperparameter used to control the sensitivity to outliers; K is the total number of clients participating in this round of training.

[0035] In this example, step S3 further includes: By utilizing the precise reconstruction gain based on closed-form solutions, benign heterogeneous data with positive utility contributions are identified. The specific steps are as follows: S3-1. Restore the scattered low-rank update parameters from each client to a unified-dimensional parameter update quantity on the server side, and use it as the benchmark for subsequent consistency checks: , in, The original weights of client j (proportional to the amount of data): , (where j is the amount of data for client j) and satisfies the constraints. .

[0036] S3-2, Find a matrix Optimal fine-tuning increment (Corresponding to the optimization variable Z in the formula), to ensure matrix invertibility during subsequent closed-form solution differentiation and to prevent overfitting, an objective function containing a Frobenius norm regularization term (ridge regression form) is constructed: , in, This represents the fine-tuning variable to be solved, i.e., the amount of correction needed based on the current global matrix B; The global matrix of the previous round , The global matrix of the previous round ; The Frobenius norm (matrix norm) is used to measure the magnitude of the reconstruction error. This represents the regularization coefficient, which is a preset hyperparameter.

[0037] S3-2-1. Since the rank r of LoRA is usually extremely small, and to avoid executing expensive iterative optimization algorithms on the server side, this invention utilizes matrix differentiation rules to directly derive the analytical solution of the above convex optimization problem, thereby achieving fast computation: , in, Meanwhile, the matrix derivative is derived as follows: 1) First define the ridge regression loss function (in mathematical derivation, we cannot directly differentiate the symbol arg min; we must first define the loss function). By minimizing the loss function The optimal fine-tuning increment can then be solved. The two formulas are mathematically identical; they describe the same optimization problem, but with different emphases. , To simplify the derivation, let the target residual matrix be... (This is a constant matrix), at which point the objective function simplifies to the standard ridge regression form: , Using the properties of Frobenius norm Expand the objective function: , , Utilizing the cyclic property of traces Merge intermediate items: , 2) Find the partial derivative with respect to matrix Z: using matrix calculus formulas and Take the partial derivative with respect to Z: , 3) Since our objective function is convex, finding the point where the derivative is zero guarantees the solution with the global minimum error. Therefore, we solve by setting the gradient to zero: Let The normal equation is obtained as follows: , Factor out the common factor Z: , in It is an identity matrix.

[0038] 4) Obtaining the closed-form solution: Multiply the equation twice on the right by the inverse matrix to obtain the formula: , Substituting X back gives: .

[0039] S3-3. Calculate the minimum fit residual when all clients are included. This error quantifies the consistency between the overall update of the current client set and the global historical model structure: , S3-4. To evaluate the impact of client k on the global model, assume it is removed. In this case, the weights of the remaining clients need to be readjusted to maintain a sum of 1. The new weights of client j (j≠k) are calculated as follows: , S3-5. Based on the renormalized weights, calculate the remaining global update amount excluding client k. : , S3-6 Similarly, we want to assess the remaining update volume. Can it be better interpreted by the global subspace? The optimization objectives are as follows: , S3-6-1. Using the same derivation logic as in step S3-2-1, directly calculate the optimal fine-tuning increment after removing client i based on the closed-form solution: , S3-7. Calculate the reconstruction error after removing client k: , S3-8. Define the exact reconstruction gain GoR(k) for client k: , Among them, if (Significantly positive value): This means that after removing client k, the system's reconstruction error decreases significantly. Physically, this implies a severe conflict between the update direction of client k and the group consensus; if or This indicates that removing the client did not improve the error or even increased it. This suggests that the updates of client k are consistent with the group or contributed necessary heterogeneous information.

[0040] S3-9. Calculate the normalized reconstruction gain of client k using the Min-Max normalization method to eliminate fluctuations in error values ​​between different training epochs. Then, map the normalized gain to the client k using an exponential decay function. The second trust weight of the matrix in round t : , in, It is a sensitivity coefficient, used to adjust the algorithm's ability to identify anomalies and the severity of the penalty. It is a tiny constant that prevents the denominator from being zero.

[0041] In this embodiment, a structure-aware divide-and-conquer defense strategy is proposed. For reduced-dimensional matrices, the flexible alignment characteristics of Sinkhorn optimal transmission are utilized to solve the misjudgment problem caused by feature row permutation in Non-IID scenarios, ensuring the manifold consistency of the feature subspace. For increased-dimensional matrices, precise reconstruction gain based on closed-form solutions is used to replace traditional distance metrics, accurately identifying benign heterogeneous data with positive utility contributions without incurring high iterative computation costs. This method combines geometric structure verification with utility verification, effectively resisting structural failures that occur in poisoning attacks.

[0042] Embodiment four of the present invention is as follows: Based on the above embodiment three, the reputation value is updated according to the weight update of each matrix, and malicious clients are identified and screened, specifically including the following steps: S4-1. Calculate the overall trust score for client k in this round. : , in, It is a numerical stability constant to prevent the denominator from being zero.

[0043] S4-2. To provide sustained resistance against intermittent poisoning, a momentum mechanism, namely a forgetting factor, is introduced. Using this round of comprehensive trust scoring Update client k's long-term reputation value : , in, For client k, consider its historical reputation in the previous round; As a forgetting factor, it ensures that building credibility requires long-term, stable, and good performance.

[0044] S4-3. To ensure the purity of global model aggregation and reduce unnecessary computational overhead, the system performs a binary state determination on the client based on the updated reputation value: , in, The threshold for removal is a preset reputation lower limit; clients with a status of "Banned" will be removed, and their uploaded A and B matrices will not participate in the aggregation of round t and subsequent rounds; "Active" indicates that the client has a good historical performance.

[0045] S4-4. Perform renormalized weighted aggregation on the dimensionality reduction matrix of the client in the Active state to ensure that the global feature extractor always remains at the center of the benign feature manifold.

[0046] Furthermore, the specific execution steps of the weighting strategy for matrix A in S4-4 are as follows: S4-4-1, Utilizing the first trust weight in round t Update the global dimensionality reduction matrix. First, renormalize the weights of active nodes: , S4-4-2, Then perform the aggregation of matrix A: = , in, This is the global learning rate on the server side, used to control the step size of the global model in the parameter space and prevent overly aggressive updates.

[0047] S4-5. For the upgraded matrix, a three-dimensional weighting strategy of "data volume - reputation - security" is adopted. This "multiplication mechanism" constitutes multiple lines of defense.

[0048] Furthermore, the specific execution steps of the weighting strategy for matrix B in S4-5 are as follows: S4-5-1 Calculate the overall aggregate weight for round t. This weight is determined by the proportion of the original data. Updated long-term reputation And the second trust weight in this round Joint decision: , in The weights of the original data are usually defined as follows: ,in This represents the number of local data samples for client k.

[0049] S4-5-2, Next, the overall weighting Normalization yields : , S4-5-3, Then perform the aggregation of matrix B: , in, S4-4-2 is the server-side global learning rate, used to control the step size of the global model in the parameter space and prevent overly aggressive updates.

[0050] In this embodiment, a dynamic defense mechanism based on long-term reputation is established, a momentum mechanism is introduced to evaluate the long-term reliability of the client, and a three-dimensional weighted strategy of "multiplication mechanism" is adopted to form a multi-layered defense, which ensures the security of the model while preserving the generalization ability of the model to the greatest extent.

[0051] The above inventions are merely a few specific embodiments of the present invention. However, the embodiments of the present invention are not limited thereto, and any variations that can be conceived by those skilled in the art should fall within the protection scope of the present invention.

Claims

1. A decoupled, poison-resistant, robust polymerization method with fine-tuned LoRA, characterized in that, Includes the following steps: The server receives the fine-tuning parameters uploaded by each client and, using the structural characteristics of LoRA parameters, decouples the fine-tuning parameters into a set of reduced-dimensional matrices for carrying general features and a set of increased-dimensional matrices for carrying local personalized tasks. For the dimensionality reduction matrix, its row vectors are modeled as empirical distributions in the feature space. The Sinkhorn divergence between each client and the global reference distribution is calculated using the entropy regularization algorithm. Based on this divergence, the manifold alignment of the feature subspace is evaluated, and the first trust weight is generated. The generation of the first trust weight specifically includes constructing the discrete empirical probability distribution of the client from multiple row vectors of the dimensionality reduction matrix uploaded by the client, constructing the reference distribution from multiple row vectors of the global dimensionality reduction matrix after the previous round of aggregation, defining the squared Euclidean distance between the client distribution and the reference distribution as the transmission cost, generating a cost matrix, solving the entropy regularized optimal transmission problem through the Sinkhorn algorithm to obtain the Sinkhorn divergence between the client distribution and the reference distribution, and calculating the client's first trust weight based on the Sinkhorn divergence through a temperature scaling mechanism. For the aforementioned dimension-upgrading matrix, a global reconstruction optimization objective based on ridge regression is constructed. A fast calculation method based on closed-form solutions is adopted to directly calculate the change in global reconstruction error after removing any client, i.e., the precise reconstruction gain. The positive or negative value of the reconstruction gain is used to determine the utility contribution of the client to the global model, and a second trust weight is generated accordingly. The generation of the second trust weight specifically includes fixing the global dimensionality reduction matrix and the global dimensionality increase matrix as a basis, finding the optimal fine-tuning increment for the dimensionality increase matrix such that the increment can explain the current global update to the greatest extent, calculating the minimum fitting residual with all clients included, assuming that after removing any client, renormalizing the weights of the remaining clients, calculating the remaining global update without the client, evaluating the degree to which the remaining update is explained by the global subspace, calculating the reconstruction error after removing the client, defining the precise reconstruction gain of the client, the difference between the reconstruction error with all clients included and the reconstruction error after removing the client, calculating the normalized reconstruction gain using a normalization method, and mapping it to the second trust weight of the client using an exponential decay function; Combining the first trust weight and the second trust weight, the client's long-term reputation value is updated using an exponential moving average mechanism. After removing malicious nodes based on the reputation value, the reduced-dimensional matrix and the increased-dimensional matrix of the remaining nodes are weighted and aggregated to complete the global model update.

2. The decoupled, poison-resistant, robust polymerization method with fine-tuned federated LoRA as described in claim 1, characterized in that, The fine-tuning parameters are decoupled into a set of reduced-dimensional matrices for carrying general features and a set of increased-dimensional matrices for carrying local personalized tasks, specifically including: The server initializes global model parameters, freezes the pre-trained weight matrix, and initializes and distributes only two low-rank matrices, namely the dimension reduction matrix and the dimension increase matrix. In the t-th round of training, the server distributes global parameters to each client, and each client uses its local private data to perform local training, obtains the updated dimensionality reduction matrix and dimensionality increase matrix, and uploads them to the server. The server receives parameters uploaded by each client and uses the structural characteristics of LoRA to decouple the parameter stream into two independent sets: a set of reduced-dimensional matrices and a set of increased-dimensional matrices.

3. The decoupled, poison-resistant, robust polymerization method for fine-tuning of federated LoRA as described in claim 1, characterized in that, The solution to the entropy-regularized optimal transmission problem specifically includes: Set constraints on the transmission plan matrix to ensure that the total mass of each source particle in the client distribution is transported out and the total mass received by each target particle in the reference distribution meets the requirements. Calculate the total transport cost required to move the characteristic particles from the client distribution to the corresponding positions in the reference distribution; An entropy regularization term is introduced to smooth the transmission plan, and the optimal transmission plan matrix is ​​solved by an iterative algorithm.

4. The decoupled, poison-resistant, robust polymerization method with fine-tuned federated LoRA as described in claim 1, characterized in that, The optimal fine-tuning increment is directly calculated using a closed-form solution derived by matrix differentiation.

5. The decoupled, poisoning-resistant, robust polymerization method with fine-tuned federated LoRA as described in claim 4, characterized in that, The degree to which the remaining update amount is interpreted by the global subspace is evaluated, and the optimal fine-tuning increment after removing the client is directly calculated using the closed-form solution derived by the matrix differentiation rule.

6. The decoupled, poison-resistant, robust polymerization method with fine-tuned federated LoRA as described in claim 1, characterized in that, The steps of updating the long-term reputation value by combining the first trust weight and the second trust weight and performing weighted aggregation specifically include: The overall trust score for this round is calculated by combining the first trust weight and the second trust weight. Introduce a momentum mechanism to update the client's long-term reputation value using the current round of comprehensive trust scoring; Based on the comparison between the updated long-term reputation value and the preset removal threshold, a binary state determination is made for the client. Clients that are below the removal threshold are removed and refused to participate in the current and subsequent global model aggregation. For clients in active state, perform renormalized weighted aggregation on the reduced-dimensional matrix; For the upgraded matrix of clients with active status, an aggregation strategy based on a three-dimensional weighting of data volume, reputation value, and security is adopted.

7. The decoupled, poison-resistant, robust polymerization method for fine-tuning of federated LoRA as described in claim 6, characterized in that, The renormalized weighted aggregation of the dimensionality-reduced matrix for active clients specifically includes: The weights of active nodes are renormalized using the first trust weight; The global dimensionality reduction matrix is ​​updated based on the renormalized weights and the global learning rate.

8. The decoupled, poison-resistant, robust polymerization method with fine-tuned federated LoRA as described in claim 7, characterized in that, The upgraded matrix for clients in an active state is aggregated using a three-dimensional weighted strategy based on data volume, reputation value, and security, specifically including: Calculate the overall aggregation weight for this round, which is determined by the proportion of the original data, the updated long-term reputation value, and the second trust weight for this round. Normalize the aggregate weights; The global dimension-upgrading matrix is ​​updated based on the normalized comprehensive weights and the global learning rate.

Images