A Federated Learning Backdoor Defense Method Based on Gradient Consistency and Dual Unsupervised Clustering

Abstract

This invention provides a backdoor defense method for federated learning based on gradient consistency and dual unsupervised clustering, comprising: obtaining gradient updates submitted by multiple clients participating in federated learning in the current training round; for each client, predicting the gradient update of the current round based on historical global model parameters and the client's historical gradient updates; calculating the difference between the actual gradient update and the predicted gradient update of each client to generate a malicious score for the client; adaptively determining the optimal number of clusters based on the malicious scores of all clients using the Gap statistic; performing dual unsupervised clustering detection with a coarse-to-fine approach based on the optimal number of clusters: first, removing clients with high malicious scores using K-means clustering, and then removing residual malicious clients from the remaining clients using DBSCAN clustering, thus selecting benign clients; and performing federated learning global model aggregation based on the gradient updates of the selected benign clients.

Description

Technical Field

[0001] This invention belongs to the field of federated learning security technology, specifically involving a federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering. Background Technology

[0002] In federated learning frameworks, servers cannot directly access clients' local data and training processes. This privacy-preserving feature has led to the widespread application of federated learning in sensitive data scenarios such as the Internet of Things (IoT) and financial risk control. However, precisely because the server is invisible to the client's training process, malicious clients can launch model poisoning attacks by uploading tampered model parameters. Model poisoning attacks can not only specifically disrupt the convergence of the global model or implant highly covert backdoors, but also, through carefully designed parameter perturbations, make malicious updates highly similar to normal updates in statistical characteristics, thereby effectively circumventing existing defense mechanisms based on distance metrics, similarity comparisons, or statistical anomaly detection. Compared to traditional data poisoning attacks, model poisoning attacks directly affect the model parameter level, making their effects more direct and difficult to trace, and significantly more harmful. Even more seriously, model poisoning attacks can be combined with labeling backdoor attacks to form composite attack strategies, posing a serious threat to the security and reliability of federated learning systems.

[0003] Currently, researchers have proposed various defense methods against model poisoning attacks in federated learning. Mainstream defense strategies include methods based on statistical anomaly detection, model clustering analysis, trusted validation set evaluation, and robust aggregation rules. Robust aggregation rules, such as Krum, Bulyan, median coordinates, and pruned mean, use specially designed aggregation algorithms to tolerate a certain proportion of malicious clients. In addition, some methods employ principal component analysis, geometric anomaly detection, or momentum-based client reputation tracking to identify and filter malicious updates. However, these existing defense methods still have significant limitations in practical applications. First, in scenarios with a high proportion of malicious clients, the robustness of most defense methods is clearly insufficient; when the proportion of malicious clients exceeds a certain threshold, the defense effect drops sharply or even fails completely. Second, existing methods often struggle to effectively distinguish between normal gradient bias caused by highly non-independent and identically distributed (Non-IID) data and anomalous gradients introduced by malicious attacks. This can easily misclassify benign clients with unique data distribution characteristics as malicious clients, thereby impairing the performance of the global model. Furthermore, many defense methods rely on specific attack hypotheses or require additional validation data, making them poorly adaptable to diverse attack methods. A single defense method typically only targets specific types of attacks, struggling to cope with complex attack strategies. Moreover, existing methods often struggle to achieve a good balance between computational overhead, detection accuracy, and system compatibility. Some methods, while achieving high detection accuracy, suffer from high computational complexity, making them difficult to deploy on resource-constrained edge devices. Therefore, in demanding scenarios with a high proportion of malicious clients, highly heterogeneous data, and a lack of server validation sets, the limitations of existing defense methods are particularly pronounced, necessitating the development of a new defense mechanism to enhance the security and robustness of federated learning systems. Summary of the Invention

[0004] To address the shortcomings and deficiencies of existing technologies, this invention provides a federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering. This invention addresses the technical problems of insufficient robustness in scenarios with a high proportion of malicious clients, and the difficulty in distinguishing between normal gradient bias caused by data heterogeneity and abnormal gradients introduced by malicious attacks, by proposing a multi-layered, adaptive malicious detection mechanism. First, based on historical global model parameters and historical gradient updates of clients, the Hessian matrix is ​​approximated using a second-order optimization method. This is combined with the current round's global model change to predict the gradient updates of each client, thus establishing a gradient consistency detection benchmark. Next, the difference between the actual gradient update and the predicted gradient update for each client is calculated, the difference is normalized, and a moving average is performed based on a preset time window to generate a time-series robust malicious score. Furthermore, the optimal number of clusters is adaptively determined using the Gap statistic, avoiding the subjectivity of manually setting the cluster number. Furthermore, this invention designs a coarse-to-fine dual unsupervised clustering detection strategy: first, high-malicious clients are eliminated using K-means clustering, and then residual malicious clients are eliminated using DBSCAN clustering, effectively reducing the false negative and false positive rates of a single clustering algorithm. When the optimal cluster size is detected to be 1, the system adaptively skips the dual clustering detection step and directly performs global model aggregation, achieving optimized utilization of computational resources. This invention, through the organic combination of gradient consistency prediction and dual clustering, significantly improves the security and robustness of federated learning systems in scenarios with high proportions of malicious clients and highly heterogeneous data, without relying on a validation set.

[0005] The specific technical solution adopted by this invention to solve its technical problem is as follows:

[0006] A federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering includes the following steps:

[0007] Retrieve gradient updates submitted by multiple clients participating in federated learning in the current training round;

[0008] For each client, the Hessian matrix is ​​approximated using a second-order optimization method based on the historical global model parameters and the client's historical gradient updates. Combined with the changes in the global model in the current round, the gradient update for the current round of the client is predicted.

[0009] The difference between the actual gradient update and the predicted gradient update for each client is calculated, the difference is normalized, and a sliding average is performed based on a preset time window to generate the malicious score for that client.

[0010] Based on the malicious scores of all clients, the optimal number of clusters is adaptively determined using the Gap statistic.

[0011] Based on the optimal number of clusters, a double unsupervised clustering detection is performed, first coarse and then fine: high malicious clients are first removed by K-means clustering, and then residual malicious clients are removed by DBSCAN clustering of the remaining clients, thus filtering out benign clients.

[0012] Based on the gradient updates of the selected benign clients, federated learning global model aggregation is performed.

[0013] Furthermore, the second-order optimization method is the L-BFGS algorithm, and the Hessian matrix is ​​the integral Hessian matrix.

[0014] Furthermore, calculating the difference between the true gradient update and the predicted gradient update specifically involves: calculating the L2 norm between the true gradient update and the predicted gradient update to form a distance vector; and normalizing the difference specifically involves: performing L1 norm standardization on the distance vector.

[0015] Furthermore, the process of adaptively determining the optimal number of clusters using the Gap statistic includes:

[0016] Iterate through the candidate cluster numbers within a preset range, and calculate the within-group sum of squares for each candidate cluster number using K-means clustering.

[0017] Generate multiple random reference distributions and calculate the expected logarithm of the sum of squares within each candidate cluster.

[0018] Calculate the Gap statistic and standard error for each candidate cluster number;

[0019] The smallest number of candidate clusters that meets the preset judgment conditions is selected as the optimal number of clusters.

[0020] Furthermore, the preset judgment condition is: the result obtained by subtracting the gap statistic of the next candidate cluster from the gap statistic of the current candidate cluster number, and adding the standard error of the next candidate cluster number, is greater than or equal to zero.

[0021] Furthermore, if the optimal number of clusters is 1, it is determined that there is no malicious client in the current training round, and the dual unsupervised clustering detection step is skipped, and the federated learning global model aggregation step is executed directly.

[0022] Furthermore, the process of removing clients with high malicious scores using K-means clustering is as follows: the malicious scores of all clients are clustered using the K-means algorithm, the average malicious score of each cluster is calculated, the cluster with the higher average malicious score is marked as a malicious class, and all clients corresponding to the malicious class are removed.

[0023] Furthermore, the DBSCAN clustering method for removing residual malicious clients involves: using the DBSCAN algorithm to cluster the remaining clients after K-means clustering, retaining the clients corresponding to the core clusters in the clustering results, and removing all clients corresponding to non-core clusters and noise points.

[0024] And a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described above.

[0025] A non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0026] Compared to existing technologies, this invention and its preferred scheme effectively establish a benchmark for malicious detection by constructing a gradient consistency prediction mechanism based on historical global model parameters and client historical gradient updates. This significantly improves the ability to identify carefully designed parameter perturbation attacks and avoids the shortcomings of traditional static statistical feature-based detection methods that are easily circumvented. The optimal number of clusters is adaptively determined using Gap statistics, eliminating the subjectivity and uncertainty of manually setting the number of clusters. This allows cluster detection to be dynamically adjusted according to the actual distribution of malicious clients, enhancing the adaptability and accuracy of the detection. The innovative coarse-to-fine dual unsupervised clustering strategy, through the organic combination of K-means clustering and DBSCAN clustering, fully leverages the complementary advantages of the two clustering algorithms. This strategy can quickly eliminate obviously high-malicious-score clients while precisely identifying residual, hidden malicious clients, effectively reducing the false negative and false positive rates of a single clustering algorithm. The introduction of a moving average mechanism based on a preset time window for temporal smoothing of malicious scores enhances the robustness of the detection system to accidental gradient fluctuations and avoids potential misjudgments in single-round detection. An adaptive skip mechanism, which detects that the optimal number of clusters is 1, enables intelligent optimization of computational resources, improving system efficiency while ensuring security. Overall, this invention, without relying on a validation set, significantly enhances the security and robustness of federated learning systems in scenarios with high rates of malicious clients and highly heterogeneous data through the synergistic effect of gradient consistency prediction and dual clustering. Attached Figure Description

[0027] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0028] Figure 1 This is a general framework diagram of an embodiment of the present invention. Detailed Implementation

[0029] To make the features and advantages of the present invention more apparent and understandable, specific embodiments are described below in detail:

[0030] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0031] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0032] The purpose of this invention is to provide a backdoor defense method for federated learning based on gradient consistency and dual unsupervised clustering, thereby improving the security of federated learning systems in model poisoning attack scenarios. This method utilizes the consistency of the iteration direction of normal clients in each round and the inconsistency of the iteration direction of malicious clients for defense. First, the L-BFGS algorithm is used to predict the gradient of the client. Then, the pre-... The average Euclidean distance between the actual gradient and the predicted gradient is used as the malicious score. Finally, the malicious scores are classified using K-means and DBSCAN algorithms to eliminate suspicious clients. This invention can effectively reduce the success rate of backdoor attacks and significantly improve the robustness and security of federated learning.

[0033] This invention calculates the consistency of the client's own model update process and quantifies it into a malicious score. Then, K-means clustering is used to perform preliminary detection on the malicious score, filtering out a large number of malicious clients. Finally, the DBSCAN method is used to perform fine-tuning on the filtered clients. The multiple detection strategy reduces the false negative rate and has good performance in scenarios with a large number of malicious clients.

[0034] Compared with existing technologies, this invention can effectively reduce the success rate of backdoor attacks, significantly improve the detection rate of malicious clients, and significantly enhance the robustness and security of federated learning.

[0035] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0036] like Figure 1As shown in the figure, this invention illustrates the complete process from local training on the client side, model update and upload, malicious detection on the server, and global model aggregation. This embodiment provides a federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering. Its implementation process specifically includes the following steps:

[0037] Step S1: Obtain client model update;

[0038] Step S2: Calculate the prediction model update;

[0039] Step S3: Calculate the client model update consistency metric and calculate the malicious score;

[0040] Step S4: Determine the optimal number of clusters using the Gap statistic;

[0041] Step S5: Use the dual unsupervised clustering methods of K-means and DBSCAN to detect potential malicious clients;

[0042] Step S6: Perform federated learning model aggregation based on the selected benign clients.

[0043] As a preferred implementation, step S2 involves calculating the prediction model update, specifically including the following steps:

[0044] Step S2A1: Obtain the global model difference in round t. ;

[0045] Step S2A2: Calculate the integral Hessian matrix. ;

[0046] Among them, due to The integral Hessian matrix is ​​complex in structure and its dimensions are consistent with those of the model parameters. Directly calculating its exact value would result in extremely high computational and storage costs, making it difficult to implement in large-scale federated learning scenarios. Therefore, this invention uses the L-BFGS algorithm to approximate the integral Hessian matrix, obtaining approximate Hessian matrix terms. ;

[0047] Step S2A3, Calculation Client gradient Predicted gradient The specific formula for calculation is as follows:

[0048] .

[0049] As a preferred implementation, step S3 involves calculating the malicious score, specifically including the following steps:

[0050] Step S3A1: Calculate the Euclidean distance vector between the client's predicted gradient and the true gradient. The specific formula is as follows:

[0051]

[0052] Step S3A2, convert the vector Perform data preprocessing: ;

[0053] Step S3A3, calculate the first Client in round of iteration Malicious scores The specific formula is as follows:

[0054]

[0055] in, The average standardized Euclidean distance of the client over the past k iterations. The sliding window size is used to calculate the number of consecutive historical training rounds for malicious scores.

[0056] As a preferred implementation, step S4 uses the Gap statistic to determine the optimal number of clusters, specifically including the following steps:

[0057] Step S4A1: For each possible number of clusters ( E represents the preset maximum number of candidate clusters, i.e., the upper limit of the number of clusters traversed by the Gap statistic. The malicious scores of the client are clustered using the K-means algorithm, and the within-group sum of squares W under the clustering result is calculated. e The specific formula is as follows:

[0058]

[0059] in, Indicates the first All samples in each cluster, Indicates the first The center point of each cluster.

[0060] Step S4A2, Generate The next random reference distribution generates a dataset with the same dimensions as the actual dataset but a random distribution, performs the same clustering operation on it, and calculates the expected logarithm of the corresponding within-group sum of squares. The specific formula is as follows:

[0061]

[0062] in, Indicates the first ( The sum of squares within groups under a random reference distribution.

[0063] Step S4A3: Calculate the Gap statistic, using the following formula:

[0064]

[0065] Step S4A4: Calculate the standard error of the Gap statistic. The specific formula is as follows:

[0066]

[0067] Step S4A5: Select "satisfied" The first The value is used to calculate the optimal number of clusters;

[0068] Step S4A6: If the optimal cluster number is... This indicates that there are no malicious attackers within the federated learning process, all clients are normal clients, and the training process can continue. If this is the case, it indicates the presence of a suspicious attacker within the system, requiring dual unsupervised clustering detection.

[0069] As a preferred implementation, in step S5, when step S4 determines that the optimal number of clusters e is greater than 1, the following dual unsupervised clustering detection steps are performed:

[0070] Step S5A1: Use the K-means method to perform preliminary clustering of the client's malicious scores, and calculate the average malicious score in each cluster. Mark the cluster with the higher average malicious score as the malicious class, and mark the cluster with the lower average malicious score as the normal class.

[0071] Step S5A2: Remove malicious clients from the federated learning process and retain the remaining clients as potential normal clients;

[0072] Step S5A3: Use DBSCAN clustering on the filtered clients marked as normal, retain the core clusters in the clustering results, and identify and remove the clients corresponding to non-core clusters and noise points as malicious clients.

[0073] This embodiment calculates the consistency of the client's own model update process and quantifies it into a malicious score. Then, K-means clustering is used to perform preliminary detection on the malicious score, filtering out a large number of malicious clients. Finally, the DBSCAN method is used to perform fine-tuning on the filtered clients. The multiple detection strategy reduces the false negative rate and has good performance in scenarios with a large number of malicious clients.

[0074] Based on the same inventive concept, this invention also provides a computer device, comprising: one or more processors, and a memory for storing one or more computer programs; the programs include program instructions, and the processor executes the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, used to implement one or more instructions, specifically for loading and executing one or more instructions stored in a computer storage medium to implement the above-described method.

[0075] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, performs the above-described method. This storage medium can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0076] It should be noted that, unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

[0078] This invention is not limited to the preferred embodiment described above. Anyone inspired by this invention can derive various other forms of federated learning backdoor defense methods based on gradient consistency and dual unsupervised clustering. All equivalent variations and modifications made within the scope of the claims of this invention shall fall within the scope of this invention.

Claims

1. A federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering, characterized in that, Includes the following steps: Retrieve gradient updates submitted by multiple clients participating in federated learning in the current training round; For each client, the Hessian matrix is ​​approximated using a second-order optimization method based on the historical global model parameters and the client's historical gradient updates. Combined with the changes in the global model in the current round, the gradient update for the current round of the client is predicted. The difference between the actual gradient update and the predicted gradient update for each client is calculated, the difference is normalized, and a sliding average is performed based on a preset time window to generate the malicious score for that client. Based on the malicious scores of all clients, the optimal number of clusters is adaptively determined using the Gap statistic. Based on the optimal number of clusters, a double unsupervised clustering detection is performed, first coarse and then fine: high malicious clients are first removed by K-means clustering, and then residual malicious clients are removed by DBSCAN clustering of the remaining clients, thus filtering out benign clients. Based on the gradient updates of the selected benign clients, federated learning global model aggregation is performed.

2. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 1, characterized in that: The second-order optimization method is the L-BFGS algorithm, and the Hessian matrix is ​​the integral Hessian matrix.

3. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 1, characterized in that: The calculation of the difference between the true gradient update and the predicted gradient update specifically involves: calculating the L2 norm between the true gradient update and the predicted gradient update to form a distance vector; the normalization of the difference specifically involves: performing L1 norm standardization on the distance vector.

4. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 1, characterized in that: The process of adaptively determining the optimal number of clusters using the Gap statistic includes: Iterate through the candidate cluster numbers within a preset range, and calculate the within-group sum of squares for each candidate cluster number using K-means clustering. Generate multiple random reference distributions and calculate the expected logarithm of the sum of squares within each candidate cluster. Calculate the Gap statistic and standard error for each candidate cluster number; The smallest number of candidate clusters that meets the preset judgment conditions is selected as the optimal number of clusters.

5. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 4, characterized in that: The preset judgment condition is: the result obtained by subtracting the gap statistic of the next candidate cluster from the gap statistic of the current candidate cluster number, and adding the standard error of the next candidate cluster number, is greater than or equal to zero.

6. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 4, characterized in that: If the optimal number of clusters is 1, it is determined that there is no malicious client in the current training round, and the dual unsupervised clustering detection step is skipped, and the federated learning global model aggregation step is executed directly.

7. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 1, characterized in that: The specific method for removing clients with high malicious scores using K-means clustering is as follows: The K-means algorithm is used to cluster the malicious scores of all clients, the average malicious score of each cluster is calculated, the cluster with the higher average malicious score is marked as the malicious class, and all clients corresponding to the malicious class are removed.

8. The federated learning backdoor defense method based on gradient consistency and dual unsupervised clustering according to claim 1, characterized in that: The DBSCAN clustering method for removing residual malicious clients involves: using the DBSCAN algorithm to cluster the remaining clients after K-means clustering, retaining the clients corresponding to the core clusters in the clustering results, and removing all clients corresponding to non-core clusters and noise points.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 8.

Images