Lightweight secure aggregation and adversarial backdoor defense method based on edge ai model

Abstract

The application relates to the technical field of edge computing and federated learning security, and particularly discloses a lightweight security aggregation and anti-backdoor defense method based on an edge AI model, wherein a server receives a sparse update of an edge node, performs weighted aggregation on the sparse update after hash verification, and obtains a global model; the global model is forward propagated on clean samples, sample expansion is dynamically performed until the variance of an activation value sequence converges, and the distribution of each neuron activation value is obtained; the skewness, kurtosis and median absolute deviation of the distribution are calculated, neurons with constant activation values are judged as backdoor neurons and are pruned, while field offset false positive neurons with high skewness and high kurtosis are retained, the robust average activation value of the retained neurons is calculated as a benchmark vector after pruning, and the benchmark vector is issued to the edge node; the edge node calculates the deviation between local actual activation and the benchmark and superimposes the deviation as a bias term, and then local training is started; the application can distinguish between field offset and real backdoor, avoid false pruning, and improve the security of edge federated learning.

Description

Technical Field

[0001] This invention relates to the fields of edge computing and federated learning security technology, specifically to a lightweight security aggregation and adversarial backdoor defense method based on edge AI models. Background Technology

[0002] With the rapid development of IoT and edge computing technologies, an increasing number of intelligent applications are adopting federated learning architectures. These architectures collaboratively train machine learning models across multiple edge devices, eliminating the need to upload raw data to a central server and thus protecting data privacy and security. Current technologies typically employ lightweight security aggregation techniques such as sparsity, hash commitments, and truncation to ensure data security during transmission. They also utilize small, clean datasets on the server side to perform activation analysis on the global model, pruning abnormally activated neurons to defend against backdoor attacks.

[0003] In edge federated learning scenarios, when the server relies solely on a small, clean dataset to perform activation pruning on the global model to defend against backdoor attacks, traditional activation anomaly detection methods based on mean and variance cannot distinguish between "normal feature neurons with high skewness and peak activation values ​​due to neighborhood offset" and "real backdoor neurons with activation values ​​constantly approaching zero due to missing backdoor triggers." This results in a double failure dilemma: a large number of normal feature neurons are incorrectly pruned, leading to a sharp drop in model accuracy, while genuine backdoor neurons are missed, leaving the backdoor still effective. This problem has received little attention in conventional federated learning defense research and is difficult to solve simply by increasing the number of clean samples or adjusting the variance threshold. Summary of the Invention

[0004] The purpose of this invention is to provide a lightweight security aggregation and adversarial backdoor defense method based on an edge AI model to solve the problems mentioned above.

[0005] The objective of this invention can be achieved through the following technical solutions: A lightweight security aggregation and adversarial backdoor defense method based on edge AI models includes the following steps: S1: After the server completes the secure aggregation of the local model updates uploaded by each edge node, it obtains the global model for the current round and propagates the global model forward on a set of pre-maintained clean data samples, recording the activation value of each neuron under each sample, thereby obtaining the activation value distribution corresponding to each neuron. S2: Based on the activation value distribution of each neuron, calculate the skewness statistic and kurtosis statistic of the activation value distribution, and determine the dispersion of the activation values ​​in the activation value distribution. Skewness is used to characterize the asymmetry of the distribution, and kurtosis is used to characterize the tail thickness of the distribution. S3: Based on skewness, kurtosis, and dispersion, each neuron is classified into one of the following three categories: backdoor neurons with constant activation values ​​approaching zero, neighborhood-offset false positive neurons with absolute skewness exceeding the first preset threshold and kurtosis exceeding the second preset threshold, and normal feature neurons. S4: Based on the classification results of S3, only the category of backdoor neurons is pruned, that is, its connection weight with the front and rear layers is reset to zero and invalidated, while the categories of domain-shifted false positive neurons and normal feature neurons are completely retained without any pruning. S5: The global model obtained after pruning the backdoor neurons is used as the final output of this round of federated learning and distributed to each edge node for local training in the next round. The pruned global model is used as the initialization parameter during the local training process of each edge node.

[0006] As a further aspect of the present invention: obtaining the activation value distribution corresponding to each neuron specifically includes: The initial activation value sequence for each neuron is obtained using a first number of samples, and the variance of the initial activation value sequence is calculated. When the variance is greater than a preset threshold, new clean data samples are added sequentially and the activation value sequence is updated until the rate of change of the variance is lower than the preset threshold. The converged sequence of activation values ​​is used as the activation value distribution of neurons.

[0007] As a further aspect of the present invention: obtaining the global model for the current round specifically includes: The server receives local model updates uploaded by each edge node. Each local model update is sparsified, retaining only the first scale parameter with the largest magnitude, and is accompanied by a hash commitment value generated based on the first scale parameter. After the server verifies the consistency between each hash commitment value and the corresponding sparse update, it performs a weighted sum of all sparse updates according to the element position to obtain the aggregate update tensor. The server performs truncation on each element in the aggregate update tensor, cutting off element values ​​that exceed the preset range to the boundary value; The server adds the previous round's global model to the truncated aggregate update tensor to obtain the current round's global model.

[0008] As a further aspect of the present invention: the calculation of the skewness statistic and kurtosis statistic of the activation value distribution specifically includes: The activation value sequence of each neuron is arranged in ascending order of numerical value to obtain an ordered sequence; Extract the first quartile, median, and third quartile from the ordered sequence, and calculate the skewness estimate of the ordered sequence based on the three quartiles; Calculate the difference between the 90th and 10th percentiles of the ordered sequence, and divide the difference by the difference between the 75th and 25th percentiles to obtain the kurtosis estimate. The absolute deviation of the median of the ordered sequence is used as the degree of dispersion of the activation value.

[0009] As a further aspect of the present invention: S3 specifically includes: Calculate the median of the activation value sequence for each neuron, and calculate the absolute difference between each activation value and the median one by one. If all absolute differences are less than the preset minimum value, the neuron is determined to be a backdoor neuron with activation values ​​that are constant and close to zero. For the remaining neurons that were not identified as backdoor neurons, their absolute skewness and kurtosis are calculated. When the absolute skewness exceeds the first preset threshold and the kurtosis exceeds the second preset threshold, they are identified as neighborhood offset false positive neurons. Neurons that fail to meet any of the criteria are classified as normal characteristic neurons.

[0010] As a further aspect of the present invention: S4 specifically includes: Obtain the index list of neurons identified as backdoor neurons, and iterate through each neuron in the index list; Set all forward and backward connection weights of each backdoor neuron to zero. For each backdoor neuron that is set to zero, calculate the weight norm of each output channel in the layer preceding it, and set the channels with norms less than the third preset threshold to zero along with the backdoor neuron. The global model after the zeroing operation is completed is output as the pruning result.

[0011] As a further aspect of the present invention: the calculation of the weight norm of each output channel in the layer containing the backdoor neuron specifically includes: Obtain the output channel index of each zeroed backdoor neuron in its layer, and extract the weight vector corresponding to the index from the layer weight tensor; Calculate the Euclidean norm of each weight vector as the weight norm of the corresponding output channel; then, compare the weight norm with a fourth preset threshold, and mark the output channel with a norm less than the fourth preset threshold as a weakly connected channel. The connection weights of the previous layer's output feature map corresponding to the weak connection channel are simultaneously set to zero.

[0012] As a further aspect of the present invention: S5 specifically includes: The server calculates the average activation value of each retained neuron in the global model after pruning on clean data samples, and obtains the activation baseline vector. The server will send the pruned local model and the activation reference vector to each edge node. Before local training, each edge node uses local data to calculate the actual average activation value of each retained neuron and calculates the deviation between the actual average activation value and the corresponding value in the activation baseline vector. The deviation is then used as a bias term and superimposed on the output of the corresponding neuron. Local training begins with the local model after the bias term is superimposed as the initialization parameters.

[0013] As a further aspect of the present invention: the process of constructing the activation reference vector is as follows: For each retained neuron, obtain the sequence of activation values ​​of the retained neuron on all clean data samples, and calculate the median of the activation value sequence; Calculate the absolute difference between each activation value and the median, and remove activation values ​​whose absolute difference exceeds the fifth preset threshold as outliers. The arithmetic mean of the remaining activation values ​​after removing outliers is calculated to obtain the robust average activation value of the neuron. The robust average activation values ​​of all retained neurons are arranged in neuron index order to form the activation baseline vector.

[0014] The beneficial effects of this invention are: (1) Through dynamic sample expansion and higher-order statistical analysis, this invention can accurately distinguish backdoor neurons from false positive neurons caused by neighborhood offset when the number of clean data samples is limited and there is an offset from the distribution of edge node data. This avoids the accidental pruning of normal feature neurons, so that the global model can maintain its original accuracy in scenarios such as defect detection of heterogeneous components, and effectively remove backdoors.

[0015] (2) This invention processes weak connection channels of adjacent layers simultaneously when pruning backdoor neurons, and automatically aligns the activation distribution of edge nodes before local training by activating the reference vector and the local bias compensation mechanism, thereby reducing the model performance loss caused by pruning and reducing the number of communication rounds in subsequent rounds. It is suitable for edge federated learning environments with limited computing power. Attached Figure Description

[0016] The invention will now be further described with reference to the accompanying drawings.

[0017] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a flowchart illustrating the process of obtaining the global model in this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 As shown, this invention is a lightweight security aggregation and adversarial backdoor defense method based on an edge AI model, comprising the following steps: S1: After the server completes the secure aggregation of the local model updates uploaded by each edge node, it obtains the global model for the current round and propagates the global model forward on a set of pre-maintained clean data samples, recording the activation value of each neuron under each sample, thereby obtaining the activation value distribution corresponding to each neuron. S2: Based on the activation value distribution of each neuron, calculate the skewness statistic and kurtosis statistic of the activation value distribution, and determine the dispersion of the activation values ​​in the activation value distribution. Skewness is used to characterize the asymmetry of the distribution, and kurtosis is used to characterize the tail thickness of the distribution. S3: Based on skewness, kurtosis, and dispersion, each neuron is classified into one of the following three categories: backdoor neurons with constant activation values ​​approaching zero, neighborhood-offset false positive neurons with absolute skewness exceeding the first preset threshold and kurtosis exceeding the second preset threshold, and normal feature neurons. S4: Based on the classification results of S3, only the category of backdoor neurons is pruned, that is, its connection weight with the front and rear layers is reset to zero and invalidated, while the categories of domain-shifted false positive neurons and normal feature neurons are completely retained without any pruning. S5: The global model obtained after pruning the backdoor neurons is used as the final output of this round of federated learning and distributed to each edge node for local training in the next round. The pruned global model is used as the initialization parameter during the local training process of each edge node.

[0020] Please see Figure 2 As shown, in S1, after the server securely aggregates the local model updates uploaded by each edge node, it obtains the global model for the current round. The global model is then forward-propagated across a set of pre-maintained clean data samples, recording the activation value of each neuron in each sample, thus obtaining the activation value distribution for each neuron. Specifically, this includes: The process of building a global model: The server receives local model updates uploaded by each edge node. After completing local training, each edge node sorts the parameters in its local model update according to their absolute values, retains only the top 10% of parameters with the largest absolute values, and sets the remaining parameters to zero, resulting in a sparse update. Simultaneously, the edge node uses a secure hash algorithm to calculate a hash value for the non-zero parameters in the sparse update and their position indices, serving as a hash commitment value. This sparse update, along with the hash commitment value, is then uploaded to the server.

[0021] After receiving the sparse updates and corresponding hash promises uploaded by all edge nodes, the server recalculates the hash value of the sparse update uploaded by each edge node using the same secure hash algorithm, and compares the calculated hash value with the hash promise value uploaded by the node. If they match, it confirms that the sparse update has not been tampered with during transmission; if they do not match, the update of that node is discarded.

[0022] The server performs a weighted sum of all validated sparse updates based on the parameters' positions within the model. The weight of each edge node is determined by the proportion of its local training samples to the total number of validated nodes. Specifically, for each parameter position, the server multiplies all non-zero parameter values ​​at that position by the weight of the corresponding node and sums the results to obtain an aggregated update value. This process is repeated for all parameter positions to form the aggregated update tensor.

[0023] The server truncates each element in the aggregation update tensor. A truncation boundary value of 1 is set. If the value of an element is greater than 1, it is modified to 1; if the value of an element is less than -1, it is modified to -1; the remaining values ​​remain unchanged.

[0024] The server retrieves the global model obtained from the previous training round, adds each parameter value in the global model to the corresponding value in the truncated aggregate update tensor, and obtains the global model for the current round.

[0025] The process of obtaining the neuron activation value distribution: The server maintains a pre-collected set of clean data samples, initially consisting of 10 samples. The global model for the current round is forward-propagated across these 10 clean data samples, recording the activation value output by each neuron for each sample. For each neuron, its activation values ​​across the 10 samples are arranged in sample order to form an initial activation value sequence.

[0026] For each neuron's initial activation value sequence, the server calculates the variance of the sequence. The calculation method is as follows: first, calculate the arithmetic mean of all activation values ​​in the sequence; then, calculate the square of the difference between each activation value and the mean; sum all the squared values ​​and divide by the sequence length to obtain the variance value.

[0027] A preset variance threshold of 0.01 is set. If the calculated variance is greater than 0.01, the server sequentially adds new clean data samples, one sample at a time, and appends the activation value of the new sample to the end of the sequence, updating the activation value sequence. After each addition of a sample, the variance of the current sequence is recalculated, and the rate of change between the current variance and the previous variance is calculated. This rate of change is the absolute value of the difference between the current variance and the previous variance divided by the previous variance. A preset threshold for the rate of change is set to 0.05. New samples are continuously added until the rate of change of variance is lower than 0.05, at which point the sequence is considered to have converged.

[0028] The converged activation value sequence is used as the final activation value distribution for the neuron. If the initial variance is less than or equal to 0.01, no more samples are added, and the initial activation value sequence is used directly as the activation value distribution.

[0029] In S2, based on the activation value distribution of each neuron, the skewness and kurtosis statistics of the activation value distribution are calculated, and the dispersion of the activation values ​​in the distribution is determined. Skewness is used to characterize the asymmetry of the distribution, and kurtosis is used to characterize the tail thickness of the distribution. Specifically, this includes: For each neuron's activation value sequence obtained in S2, the server first rearranges all activation values ​​in the sequence in ascending order to obtain an ordered sequence. If there are duplicate values ​​in the sequence, the number of times they appear is retained.

[0030] The server extracts three positional parameters from the ordered sequence: the first quartile, the median, and the third quartile. The first quartile is the value at the quarter-th position of the ordered sequence; if this position is not an integer, the average of the values ​​at the two adjacent positions is used. The median is the value at the half-th position of the ordered sequence. The third quartile is the value at the three-quarters position of the ordered sequence. Subsequently, the server calculates the skewness estimate of the neuron's activation value distribution based on these three quartiles. Specifically, the calculation method is as follows: first, calculate the difference between the third quartile and the median; then, calculate the difference between the median and the first quartile; then, subtract the latter from the former; finally, divide the resulting difference by the difference between the third quartile and the first quartile to obtain the skewness estimate.

[0031] The server further calculates the 90th and 10th percentiles of the ordered sequence. The 90th percentile is the value located at the 9 / 10th position of the ordered sequence, and the 10th percentile is the value located at the 1 / 10th position. If the corresponding position is not an integer, the average of the values ​​at adjacent positions is used. Then, the difference between the 90th and 10th percentiles is calculated and recorded as the first difference. Next, the difference between the 75th and 25th percentiles is calculated and recorded as the second difference. The 75th percentile is the third quartile, and the 25th percentile is the first quartile. Finally, the first difference is divided by the second difference to obtain the kurtosis estimate of the neuron's activation value distribution.

[0032] The server calculates the median absolute deviation of the ordered sequence as the degree of dispersion of the neuron's activation value distribution. The specific calculation steps are as follows: First, calculate the absolute difference between each activation value and the median in the ordered sequence, that is, subtract the median from each activation value and take the absolute value to obtain a set of absolute differences; then, reorder this set of absolute differences in ascending order of value, and take the median of the sorted sequence. This median is the median absolute deviation.

[0033] In S3, based on skewness, kurtosis, and dispersion, each neuron is classified into one of the following three categories: backdoor neurons with constant activation values ​​approaching zero, neighborhood-offset false positive neurons with absolute skewness exceeding a first preset threshold and kurtosis exceeding a second preset threshold, and neurons with normal features, specifically including: For each neuron's activation value sequence obtained in S2, the server first calculates the median of the sequence. The median is determined as follows: after sorting the activation value sequence in ascending order, the value in the middle of the sequence is taken; if the sequence length is even, the average of the two middle values ​​is taken. Then, the server calculates the absolute difference between each activation value and the median, i.e., subtracting the median from each activation value and taking the absolute value. A preset minimum value is set, which is 0.0001. If the absolute difference between all activation values ​​and the median in the sequence is less than 0.0001, the neuron is determined to be a backdoor neuron with activation values ​​constantly approaching zero; otherwise, proceed to the next step.

[0034] For the remaining neurons not identified as backdoor neurons, the server retrieves the absolute skewness and kurtosis estimate of the neuron calculated in S2. A first preset threshold is set to 2.0, and a second preset threshold is set to 5.0. The server determines whether the absolute skewness of the neuron is greater than 2.0 and whether the kurtosis estimate is greater than 5.0. If both conditions are met, the neuron is determined to be a neighborhood-offset false positive neuron; otherwise, the process proceeds to the next step.

[0035] Neurons that fail to meet both of the above criteria—that is, neither backdoor neurons with activation values ​​constantly approaching zero, nor neighborhood-biased false-positive neurons with an absolute skewness greater than 2.0 and a kurtosis estimate greater than 5.0—are classified as normal feature neurons. Normal feature neurons include neurons with nearly symmetrical activation value distributions and tail thickness within the normal range, as well as neurons with skewed activation value distributions or abnormal kurtosis but not simultaneously exceeding two thresholds. After completing the above classification, the server obtains a category label for each neuron, which is used for selective pruning in subsequent steps.

[0036] In S4, based on the classification results of S3, only neurons classified as backdoor neurons are pruned, meaning their connection weights with the preceding and following layers are reset to zero and disabled. Neurons classified as neighborhood-shifted false positives and neurons with normal features are retained without any pruning. Specifically, this includes: The server retrieves the indices of all neurons identified as backdoor neurons in step three, constructing an index list. Following the order in the index list, each backdoor neuron is retrieved one by one. For the currently retrieved backdoor neuron, the server locates the network layer in the global model and sets all forward connection weights (connections from this neuron to the next layer) and all backward connection weights (connections from the previous layer to this neuron) to zero. After this zeroing operation, the backdoor neuron no longer participates in subsequent forward and backward propagation.

[0037] For each backdoor neuron that has been set to zero, the server further processes the layer immediately preceding it. Let's say the backdoor neuron is in layer L; then its immediate preceding layer is layer L-1. The server obtains the weight vector for each output channel in layer L, where each output channel corresponds to a neuron in layer L. For layer L, its weight tensor is a three-dimensional or four-dimensional array, where each output channel corresponds to a weight vector. The server calculates the Euclidean norm of the weight vector for each output channel. The specific calculation method is as follows: Suppose the weight vector of a certain output channel contains... Let there be n elements, denoted as the first element, the second element, ..., the third element. If the element is an element, then the Euclidean norm of the weight vector is calculated according to the following formula: ; in, This represents the weight vector of the output channel. , , ..., These are the weight values ​​in the vector. This is the calculated Euclidean norm.

[0038] The server performs the above calculations on all output channels of layer L to obtain the weight norm for each output channel. Subsequently, the server calculates the arithmetic mean of these weight norms as the adaptive baseline. Let layer L have a total of... There are n output channels, and the weight norms of each channel are denoted as the first norm, the second norm, ..., the third norm, respectively. The arithmetic mean of the norm is calculated using the following formula: ; in, Represents the arithmetic mean. , , ..., The weight norm for each output channel, This represents the total number of output channels.

[0039] The server sets a preset scaling factor, which has a value of 0.5. The arithmetic mean is multiplied by this preset scaling factor to obtain a dynamic threshold. The server compares the weight norm of each output channel with the dynamic threshold. If the weight norm of an output channel is less than the dynamic threshold, the output channel is marked as a weakly connected channel. For output channels marked as weakly connected channels, the server obtains the corresponding backdoor neuron (i.e., the neuron with the same index as the output channel in layer L) and sets both the backdoor neuron and its forward and backward connection weights to zero.

[0040] Furthermore, for each weak connection channel, the server further processes the connection weights of the output feature maps in layer L-1 that are connected to that channel. Specifically, the server locates all output feature maps in layer L-1 that correspond to the weak connection channel (i.e., neurons in layer L-1 whose connections point to that weak connection channel in layer L), and sets the connection weights corresponding to these output feature maps to zero. After completing all the above zeroing operations, the server outputs the processed global model as the pruning result for subsequent steps.

[0041] In S5, the global model obtained after pruning the backdoor neurons is used as the final output of this round of federated learning and distributed to each edge node for local training in the next round. The pruned global model is used as initialization parameters during the local training process at each edge node, specifically including: After completing the pruning operation in step four, the server obtains the global model after pruning backdoor neurons. The server calculates the robust average activation value of each retained neuron in the pruned global model on the clean data samples and arranges the robust average activation values ​​of all retained neurons in neuron index order to form an activation baseline vector. The specific calculation method is as follows: For each retained neuron, the server obtains the activation value sequence of that neuron on all clean data samples. The length of this sequence is equal to the total number of clean data samples. First, the median of the sequence is calculated, that is, the value in the middle position after sorting the activation values ​​in the sequence from smallest to largest. If the sequence length is even, the average of the two middle values ​​is taken. Then, the absolute difference between each activation value and the median is calculated one by one, that is, each activation value minus the median and the absolute value is taken. A fifth preset threshold is set to 0.5 times the median, that is, the median multiplied by 0.5. If the absolute difference between an activation value and the median is greater than the fifth preset threshold, the activation value is judged as an outlier and removed from the sequence. For the remaining activation values ​​after removing outliers, calculate their arithmetic mean, which is obtained by summing all remaining activation values ​​and dividing by the number of remaining activation values. The result is the robust average activation value of that neuron. Perform the above operation on all preserved neurons in sequence to obtain the robust average activation value of each preserved neuron. Arrange them in index order to form the activation baseline vector.

[0042] The server sends the global model (with backdoor neurons pruned) output from step four, along with the activation reference vectors calculated above, to each edge node. During the sending process, the server packages the parameters of the global model layer by layer and appends the activation reference vectors as additional data after the model parameters, ensuring that the data received by each edge node contains complete model parameters and the corresponding activation reference vectors.

[0043] After receiving the pruned global model and activation baseline vector from the server, each edge node first performs forward propagation on the global model using its local training data before starting the next round of local training. This calculates the actual average activation value of each retained neuron on the local data in this batch. Specifically, for each retained neuron, the edge node sums the activation values ​​of that neuron across all local training samples and divides this sum by the total number of local samples to obtain the actual average activation value. Then, for each retained neuron, the edge node calculates the deviation between the actual average activation value and the robust average activation value at the corresponding position in the activation baseline vector, i.e., subtracting the robust average activation value from the actual average activation value to obtain the deviation value. The edge node uses this deviation value as a bias term and adds it to the forward propagation output of that neuron, i.e., adding the deviation value to the original output value of that neuron. After completing the bias addition for all retained neurons, the edge node uses the biased global model as its initialization parameters and starts the next round of local training. During local training, this bias term remains effective in the forward propagation of each training batch until the end of the current round of local training.

[0044] The working principle of this invention is as follows: The server receives local model updates uploaded by each edge node after sparsification and hash commitment. After hash verification, the updates are weighted and truncated according to the number of samples, and then added to the previous round's global model to obtain the current round's global model. The current global model is used to record activation values ​​for each neuron on the initial 10 clean samples. If the variance of the activation value sequence is greater than 0.01, the number of samples is dynamically increased until the variance change rate is less than 0.05, thus obtaining the activation value distribution of each neuron. For each distribution, the activation values ​​are sorted, and the first quartile, median, and third quartile are extracted to calculate the skewness estimate. The difference between the 90th and 10th percentiles is divided by the difference between the 75th and 25th percentiles to obtain the kurtosis estimate, and the absolute deviation of the median is calculated as the degree of dispersion. If the absolute difference between the activation value and the median of a neuron is less than 0.0001, it is judged as a backdoor neuron; otherwise, if the absolute difference is less than 0.0001, it is considered a backdoor neuron. If the value is greater than 2.0 and the kurtosis estimate is greater than 5.0, it is judged as a neighborhood-biased false positive neuron; otherwise, it is judged as a normal feature neuron. Only backdoor neurons are pruned, their connection weights are reset to zero, and the Euclidean norm of the weight vector of each output channel of their layer is calculated. If the norm of a certain channel is less than 0.5 times the arithmetic mean of the norms of all channels in that layer, the connection weights of the adjacent previous layer corresponding to that channel are simultaneously set to zero. After pruning, the robust average activation value of each retained neuron on clean samples is calculated (after removing outliers that deviate from the median by more than 0.5 times the median and taking the arithmetic mean), which constitutes the activation baseline vector and is sent to each edge node along with the pruned global model. After receiving it, each edge node uses local data to calculate the actual average activation value of each retained neuron, calculates the deviation between it and the corresponding value of the activation baseline vector, and uses it as a bias term to be superimposed on the neuron output. The model with the superimposed bias is used to initialize the next round of local training.

[0045] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A lightweight security aggregation and adversarial backdoor defense method based on an edge AI model, characterized in that, Includes the following steps: S1: After the server completes the secure aggregation of the local model updates uploaded by each edge node, it obtains the global model for the current round and propagates the global model forward on a set of pre-maintained clean data samples, recording the activation value of each neuron under each sample, thereby obtaining the activation value distribution corresponding to each neuron. S2: Based on the activation value distribution of each neuron, calculate the skewness statistic and kurtosis statistic of the activation value distribution, and determine the dispersion of the activation values ​​in the activation value distribution. Skewness is used to characterize the asymmetry of the distribution, and kurtosis is used to characterize the tail thickness of the distribution. S3: Based on skewness, kurtosis, and dispersion, each neuron is classified into one of the following three categories: backdoor neurons with constant activation values ​​approaching zero, neighborhood-offset false positive neurons with absolute skewness exceeding the first preset threshold and kurtosis exceeding the second preset threshold, and normal feature neurons. S4: Based on the classification results of S3, only the category of backdoor neurons is pruned, that is, its connection weight with the front and rear layers is reset to zero and invalidated, while the categories of domain-shifted false positive neurons and normal feature neurons are completely retained without any pruning. S5: The global model obtained after pruning the backdoor neurons is used as the final output of this round of federated learning and distributed to each edge node for local training in the next round. The pruned global model is used as the initialization parameter during the local training process of each edge node.

2. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 1, characterized in that, The process of obtaining the activation value distribution for each neuron specifically includes: The initial activation value sequence for each neuron is obtained using a first number of samples, and the variance of the initial activation value sequence is calculated. When the variance is greater than a preset threshold, new clean data samples are added sequentially and the activation value sequence is updated until the rate of change of the variance is lower than the preset threshold. The converged sequence of activation values ​​is used as the activation value distribution of neurons.

3. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 1, characterized in that, Obtaining the global model for the current round specifically includes: The server receives local model updates uploaded by each edge node. Each local model update is sparsified, retaining only the first scale parameter with the largest magnitude, and is accompanied by a hash commitment value generated based on the first scale parameter. After the server verifies the consistency between each hash commitment value and the corresponding sparse update, it performs a weighted sum of all sparse updates according to the element position to obtain the aggregate update tensor. The server performs truncation on each element in the aggregate update tensor, cutting off element values ​​that exceed the preset range to the boundary value; The server adds the previous round's global model to the truncated aggregate update tensor to obtain the current round's global model.

4. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 1, characterized in that, The calculation of the skewness and kurtosis statistics of the activation value distribution specifically includes: The activation value sequence of each neuron is arranged in ascending order of numerical value to obtain an ordered sequence; Extract the first quartile, median, and third quartile from the ordered sequence, and calculate the skewness estimate of the ordered sequence based on the three quartiles; Calculate the difference between the 90th and 10th percentiles of the ordered sequence, and divide the difference by the difference between the 75th and 25th percentiles to obtain the kurtosis estimate. The absolute deviation of the median of the ordered sequence is used as the degree of dispersion of the activation value.

5. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 1, characterized in that, S3 specifically includes: Calculate the median of the activation value sequence for each neuron, and calculate the absolute difference between each activation value and the median one by one. If all absolute differences are less than the preset minimum value, the neuron is determined to be a backdoor neuron with activation values ​​that are constant and close to zero. For the remaining neurons that were not identified as backdoor neurons, their absolute skewness and kurtosis are calculated. When the absolute skewness exceeds the first preset threshold and the kurtosis exceeds the second preset threshold, they are identified as neighborhood offset false positive neurons. Neurons that fail to meet any of the criteria are classified as normal characteristic neurons.

6. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 1, characterized in that, S4 specifically includes: Get the index list of neurons identified as backdoor neurons, and iterate through each neuron in the index list; Set all forward and backward connection weights of each backdoor neuron to zero. For each backdoor neuron that is set to zero, calculate the weight norm of each output channel in the layer preceding it, and set the channels with norms less than the third preset threshold to zero along with the backdoor neuron. The global model after the zeroing operation is completed is output as the pruning result.

7. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 6, characterized in that, The calculation of the weight norm of each output channel in the layer containing the backdoor neuron specifically includes: Obtain the output channel index of each zeroed backdoor neuron in its layer, and extract the weight vector corresponding to the index from the layer weight tensor. Calculate the Euclidean norm of each weight vector as the weight norm of the corresponding output channel; then, compare the weight norm with a fourth preset threshold, and mark the output channel with a norm less than the fourth preset threshold as a weakly connected channel. The connection weights of the previous layer's output feature map corresponding to the weak connection channel are simultaneously set to zero.

8. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 1, characterized in that, S5 specifically includes: The server calculates the average activation value of each retained neuron in the global model after pruning on clean data samples, and obtains the activation baseline vector. The server will send the pruned global model and the activation baseline vector to each edge node. Before local training, each edge node uses local data to calculate the actual average activation value of each retained neuron and calculates the deviation between the actual average activation value and the corresponding value in the activation baseline vector. The deviation is then used as a bias term and superimposed on the output of the corresponding neuron. Local training then begins with the global model after the bias term is superimposed as the initialization parameters.

9. The lightweight security aggregation and adversarial backdoor defense method based on an edge AI model according to claim 8, characterized in that, The process of constructing the activation reference vector is as follows: For each retained neuron, obtain the sequence of activation values ​​of the retained neuron on all clean data samples, and calculate the median of the activation value sequence; Calculate the absolute difference between each activation value and the median, and remove activation values ​​whose absolute difference exceeds the fifth preset threshold as outliers. The arithmetic mean of the remaining activation values ​​after removing outliers is calculated to obtain the robust average activation value of the neuron. The robust average activation values ​​of all retained neurons are arranged in neuron index order to form the activation baseline vector.

Images