Unmanned aerial vehicle swarm dynamic trust consensus attack defense method based on distributed machine learning

Abstract

The unmanned aerial vehicle swarm dynamic trust consensus attack defense method based on distributed machine learning proposes two parameter preprocessing modules: credibility score filter and amplitude normalization filter, which are used to identify and correct malicious parameter updates before model aggregation, and combines the traditional geometric median aggregation rule to further propose a dynamic geometric median aggregation algorithm. The dynamic geometric median aggregation algorithm balances the abnormal value elimination and parameter reweighting mechanism, significantly improves the robustness of the aggregation process to Byzantine attacks, effectively alleviates the data heterogeneity problem in distributed learning, and integrates the TSF and MNF two parameter preprocessing modules with the DGMA. The application has the beneficial effects that: the credibility score filter and amplitude normalization filter are integrated with two mechanisms, compared with the baseline method without preprocessing, can effectively suppress multi-dimensional adversarial disturbance in high-dimensional parameter space, significantly enhance the model robustness and improve the adaptability to complex attack scenarios.

Description

Technical Field

[0001] This invention relates to a defense framework algorithm, specifically to a method for defending against drone swarm dynamic trust consensus attacks based on distributed machine learning. Background Technology

[0002] With the continuous growth of machine learning models and datasets, distributed computing has become an indispensable means to improve training efficiency and mitigate security risks. Distributed machine learning achieves multi-agent collaborative optimization through a decentralized architecture, eliminating dependence on a central server and enabling efficient processing of large-scale data, thereby significantly improving the system's scalability, robustness, and computational efficiency. In recent years, advancements in distributed machine learning technology have been driving the development of multi-UAV systems towards distributed collaborative frameworks, enabling UAV swarms to operate autonomously without a central server and complete global optimization tasks, such as path planning, environmental monitoring, and target tracking, through local computation and peer-to-peer communication. Although collaborative architectures offer enormous potential for optimizing complex tasks, their open and decentralized topology also makes them vulnerable to network attacks, especially Byzantine attacks, which can disrupt the convergence of distributed machine learning solutions. Compared to traditional attacks, Byzantine attacks are highly covert and adaptable—attackers can arbitrarily tamper with or forge local model updates, severely interfering with the global aggregation process and causing significant performance degradation or even system failure. In practical multi-UAV systems, node heterogeneity, communication uncertainty, and environmental complexity further exacerbate the difficulty of detecting and defending against such attacks, making it a core research topic in the field of distributed machine learning. In distributed machine learning frameworks, aggregation rules, as the core mechanism for global model updates, fundamentally determine the system's resilience to adversarial threats and its convergence performance. While mean-based aggregation rules are widely adopted due to their high computational efficiency, their sensitivity to single points of failure severely limits system robustness. To address this, researchers have proposed various Byzantine-tolerant aggregation rules, such as coordinate median (CM), geometric median (GM), Krum, multi-Krum, and the centroid method. These methods improve upon the limitations of mean-based methods to some extent, but they still have shortcomings when dealing with 3D data or facing high-density Byzantine attacks. Specifically, the coordinate median cannot effectively capture inter-dimensional correlations or the underlying statistical characteristics of the data; multi-Krum and the centroid method set strict upper limits on the number of Byzantine nodes that can be tolerated; while the geometric median can maintain inter-dimensional correlations and improve aggregation robustness, its scalability in 3D data and fixed aggregation parameters limit its adaptability to dynamic attack patterns and heterogeneous networks.

[0003] In the paper (Byzantine-robust aggregation in federated learning empowered industrial IoT), the authors proposed a method based on Auto-weighted Geometric Median (AutoGM). This method effectively mitigates model poisoning and data poisoning attacks initiated by malicious devices by introducing a dynamic weight allocation mechanism. Experimental results show that AutoGM maintains high system performance even under extreme Byzantine attack ratios. In the paper (Genuinely distributed byzantine machine learning), the authors proposed an enhanced algorithm based on the traditional CM framework. Through the synergistic fusion of Distributed Median Contraction (DMC) and Minimum Diameter Averaging (MDA), it achieves Byzantine fault tolerance in asynchronous distributed machine learning systems. Even when up to one-third of the participating nodes exhibit Byzantine malicious behavior, the algorithm still demonstrates strong robust optimization performance. However, existing algorithms are mainly designed for static or slowly changing network environments and are difficult to cope with the highly dynamic communication link changes caused by high-speed mobility and environmental interference in three-dimensional multi-UAV systems. Current research largely focuses on Byzantine attack defense at the model or data level, neglecting spatial threats posed by attackers using forged location information. Furthermore, most existing methods employ low-dimensional scalar designs, resulting in poor convergence performance and insufficient noise modeling capabilities, making it difficult to meet the demands of high-precision, robust collaborative learning in complex dynamic environments. In distributed machine learning, the Byzantine optimization problem aims to address the robustness challenges posed by malicious nodes, ensuring stable convergence of model training even under attack. Due to the complexity and diversity of Byzantine attacks, achieving robust convergence is extremely difficult. Among existing methods, one strategy based on a "pruning" mechanism identifies and excludes information from suspicious nodes through credibility metrics, similar to the mean subsequence reduction (MSR) method in scalar systems. Common credibility metrics include model parameters, gradients, and KL divergence. However, the performance of such methods significantly degrades when the state vector dimension exceeds two dimensions. Another mainstream approach employs majority-principle aggregation mechanisms, such as Krum, Bulyan, coordinate-pruned mean, and centroid aggregation, to improve robustness by removing outliers deviating from the main cluster. However, these methods are difficult to converge in high-dimensional non-convex scenarios and lack adaptability to complex attacks.The paper (Resilientconsensus control of heterogeneous multi-UAV systems with leader of unknown input against) proposes a two-layer anti-Byzantine control framework that combines topology reconstruction and distributed protocols to achieve multi-agent collaboration. However, it has limited tolerance for Byzantine nodes and insufficient adaptability and reconstruction capabilities in dynamic attack environments, making it difficult to meet the collaborative learning requirements of three-dimensional multi-UAV systems for high dynamism and strong security. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings and defects of existing technologies by providing a method for defending against dynamic trust consensus attacks on drone swarms based on distributed machine learning.

[0005] To achieve the above objectives, this invention adopts the following technical solution: a method for defending against UAV swarm dynamic trust consensus attacks based on distributed machine learning. First, it proposes two parameter preprocessing modules: a TrustScore Filter (TSF) and a Magnitude Normalization Filter (MNF), used to identify and correct malicious parameter updates before model aggregation. Then, combining the traditional Geometric Median (GM) aggregation rule, it further proposes a Dynamic Geometric Median Aggregation algorithm. DGMA (Dynamic Gradient Descent) significantly improves the robustness of the aggregation process against Byzantine attacks through dynamic outlier removal and parameter reweighting mechanisms, and effectively alleviates the data heterogeneity problem in distributed learning. By integrating TSF (Transient Functional Preprocessing) and MNF (Multi-Functional Functional Preprocessing) modules with DGMA, a complete Byzantine attack-resistant collaborative learning framework is constructed and successfully applied to multi-target collaborative tracking tasks in 3D space. The specific contents are as follows: 1. Optimization of multi-UAV target tracking; 2. Cooperative gradient descent for global optimization; 3. Data normalization methods based on TSF and MNF; 4. Geometric median and DGMA; 5. Convergence analysis; 6. Simulation verification and result analysis.

[0006] Furthermore, the multi-UAV target tracking optimization specifically involves: [The text abruptly ends here, so the translation stops.] A collaborative multi-UAV system composed of several intelligent agents aims to achieve location-based... Cooperative tracking and state consistency of static targets; cooperative multi-UAV system modeled as an undirected graph. ,in, This refers to a collection of intelligent agents, i.e., drones. Represents a communication link between agents, if an undirected edge exists. This indicates that the intelligent agent Its neighboring intelligent agents They can exchange information with each other. Since each agent can obtain its own state information, therefore, for all... All have That is, each node is considered as its own neighbor; the neighbor set of agent k is defined as: Assuming the first A drone at discrete time The position is determined by the coordinate vector It indicates that at any time intelligent agent With the target location The actual distance between It can be represented as: in, Indicates from position Pointing to target The unit direction vector; assuming each UAV receives a value including distance measurements. and unit direction vector The noise observation data, namely: ,in and Let represent the measurement noise term that follows a zero-mean Gaussian distribution, with variances of and respectively. and To characterize the uncertainty of the sensor in distance and orientation observations, let: Then there is Define proxy nodes The loss function corresponding to the prediction model is a convex function: Accordingly, its convex risk function is defined as the mathematical expectation of the loss function: ,Depend on A multi-UAV network consisting of 10 UAVs employs a distributed cooperative strategy to jointly optimize and solve for the optimal parameter vector. This minimizes the following cost function: ,in, Indicates a global parameter. The total number of drones is represented by , and the optimization objective is to jointly minimize the logarithmic average risk through collaborative learning among drone nodes, thereby achieving the globally optimal parameter estimation.

[0007] Furthermore, the cooperative gradient descent method used for global optimization specifically refers to: optimal parameters Since the parameters cannot be directly obtained analytically, the Stochastic Gradient Descent (SGD) algorithm is used for iterative approximation. To achieve distributed optimization, each proxy node participates in a collaborative SGD computation framework. Through a decentralized collaborative mechanism, distributed iterative estimation of the optimal parameters is achieved. Because Byzantine attacks are highly covert, exhibit abnormal behavior, and are difficult to detect, a filtering mechanism targeting their inherent characteristics is further designed to effectively suppress the interference of such malicious nodes on the collaborative learning process, improving the system's fault tolerance, robustness, and security. This filtering mechanism aims to identify and eliminate malicious parameters suspected of being introduced by Byzantine nodes that exhibit significant abnormal characteristics during parameter updates. During the collaborative synchronous communication between proxy nodes, the filtering mechanism includes the following: , , ,in, Step size, Indicates in The instantaneous gradient at the evaluation point, Indicates the first Time Neighbor Nodes The parameters after iteration Indicates the first Time Node The result after applying the aggregated neighbor parameters. Represents aggregate functions, This represents the parameter set after TSF / MNF processing, where each filter independently processes the agent. The parameters of adjacent nodes are used to generate two parameter sets. and Each parameter set is generated by a different filtering mechanism targeting specific adversarial features, and the aggregation function... Information is collected from reliable neighboring nodes and fused with the agent's own data to update the optimal parameters.

[0008] Furthermore, the data normalization method based on TSF and MNF is specifically as follows: In order to ensure the reliable operation of the multi-UAV system under Byzantine faults, each DGMA aggregation round adopts a pre-filtering mechanism to exclude extreme outliers, thereby improving robustness and efficiency. This method uses cosine similarity to evaluate the consistency between neighboring node parameters and the local model. The sign of the cosine value reflects the directional relationship: a positive cosine value indicates high directional similarity, while a negative cosine value indicates opposite directions. Parameters with positive and negative cosine similarities indicate consistent update directions, reflecting shared feature attributes. Neighboring node parameters with negative cosine similarity to the local model may indicate optimization target divergence or environmental noise. For target tracking tasks, only parameters satisfying the cosine similarity are aggregated. The parameters of neighboring nodes ensure that the update direction of a local node is consistent with that of the majority of valid nodes. By filtering parameters with opposite directions or divergent views, this mechanism improves tracking consistency and accuracy, thereby promoting the robustness and coordination of model updates within the network. For the parameter vectors of each neighboring node... and local model parameter vector The formula for calculating cosine similarity is: Parameter set Defined as: ,in, Indicates the first time Node's neighbors parameter values With nodes Between parameter values The angle between the parameters; MNF: Byzantine nodes may transmit malicious parameters that have significant numerical deviations from the local model parameters. Directly aggregating such parameters will cause a serious deviation in the target parameter space, thereby increasing the proportion of adversarial influences in the system. This will not only weaken the robustness of the learning framework, but also severely reduce convergence performance due to the propagation of inconsistent updates. To ensure that parameter values ​​are within the effective range, MNF takes amplitude normalization as its core principle and sets a safety threshold. The following data filtering rules are used: ,in, Indicates the safe threshold distance: , This indicates the maximum deviation value of the selected attack parameters. Indicates the minimum deviation value. This represents the set of parameters after amplitude normalization. The final parameter set is composed of... The paper proposes that by combining TSF and MNF for dual data filtering, most irrelevant or anomalous parameters in adjacent nodes can be effectively removed, while the remaining parameters are constrained within a range with clear physical meaning. This not only improves the computational efficiency and running speed of the DGMA algorithm, but also reduces the injection of adversarial parameters, thereby effectively mitigating the adverse effects of such attacks on system performance and enhancing the robustness of the model against malicious perturbations.

[0009] Furthermore, the geometric median and DGMA are specifically as follows: The DGMA algorithm extends the GM framework to defend against Byzantine attacks in distributed learning. In a Byzantine attack, Byzantine nodes intentionally disrupt the system by submitting tampered data. DGMA uses GM as the aggregation core, leveraging GM's inherent resistance to outlier interference and its ability to maintain estimation accuracy, thus ensuring high robustness in the face of such anomalies. GM: is the point in multidimensional space with the minimum sum of Euclidean distances to a given set of points. Formally, for a given set... Geometric median Defined as the solution to the following optimization problem: ,in, express and The geometric median, compared to the arithmetic mean, inherently possesses robustness against outliers, making it particularly suitable for adversarial scenarios where most data points cluster around a certain Euclidean distance. Within a central Euclidean sphere, GM will also lie within a concentric sphere with a radius scaled proportionally. This forms the theoretical basis for the widespread use of GM in Byzantine-tolerant distributed learning frameworks. GM, as a robust aggregation mechanism for merging gradients, resists outlier interference and ensures algorithm convergence, making it a key component in building fault-tolerant distributed systems. Despite its inherent robustness, GM is still affected by outliers. As the proportion of outliers increases, GM's performance gradually becomes unstable and its accuracy decreases. To overcome this limitation, a more flexible and robust aggregation rule, called DGMA, is proposed. This rule extends the GM framework, and its formal definition is as follows: DGMA: in Indicates the first time The node's weight satisfies: , hyperparameters To balance the smoothness of the distance term and the weight vector, the optimal weight in the above formula is... The specific form is as follows: in Represents a set The size of the sum of squares of the weights can be determined by optimizing the extreme values ​​of the problem and using the aforementioned weight terms. The proposed optimal weighting scheme effectively addresses the comprehensive challenges of information interaction and aggregation described in the above formula, significantly suppressing the impact of outliers through an adaptive weighting mechanism; weight Based on each agent and the best data point from the previous round Recalibrate the Euclidean distance between them: distance Points that are closer to the data are assigned higher weights, while points that are farther away are considered potential Byzantine outliers and their weights are reduced accordingly. This spatial weighting mechanism effectively suppresses the influence of outliers, enabling the DGMA model to achieve robust parameter estimation even under noisy or adversarial conditions. The hyperparameter λ is used to balance the relationship between "utilizing all input data" and "focusing on a high-quality subset of data, i.e., excluding outliers": when λ →∞, the model adopts a uniform weighting strategy, assigning the same weight to all points. The distance from each point to the previous best data point The distance is irrelevant, and the algorithm degenerates into a standard Gaussian mixture model (Definition 1); when λ → 0, the model forces sparsity by driving most weights to zero, retaining only local neighbor interactions, at which point only a few points are assigned significant weights, thus effectively filtering outliers; by adjusting λ, the model can achieve a balance between making full use of the data and eliminating outliers, thereby optimizing robustness under different input conditions.

[0010] Furthermore, the convergence analysis specifically involves: optimal global model parameters. It provides a solution to the global optimization problem: ,in Represents the set of normal neighbor nodes. This represents the objective function that needs to be optimized. The parameters to be optimized are represented by . The proposed DGMA algorithm aims to resist Byzantine attacks and is an efficient iterative method for minimizing the global cost function. In the presence of Byzantine attacks, the global model obtained through the DGMA algorithm is compared with the optimal global model. The distance between them always remains bounded; in each global iteration step Each proxy node Perform a local gradient update before parameter aggregation, and set the learning rate. The update rules are as follows: Assuming the number of Byzantine proxy nodes satisfy ,in It is a constant. Let be the total number of nodes in the system. Then, under attack-free conditions, the global parameters learned by the DGMA algorithm are... With optimal global parameters The deviation between them has an upper bound on probability; specifically, for any , at least The probability for all proxy nodes and all global iteration steps ,satisfy: ,in: in, The convergence factor is The total sample size of the initial dataset for all agent nodes. , Let be a positive real number, satisfying the condition for any All have , Representing the dimension of space, since The appropriate number of iterations can be obtained. As the parameter approaches infinity, the error converges to a bounded steady-state error: .

[0011] After adopting the above technical solution, the beneficial effects of the present invention are as follows: The present invention has the following advantages: 1. A parameter preprocessing framework for Byzantine anomaly detection is proposed, which integrates two mechanisms: confidence scoring filter and amplitude normalization filter. Compared with the baseline method without preprocessing, it can effectively suppress multidimensional adversarial perturbations in high-dimensional parameter space, significantly enhance the robustness of the model and improve its adaptability to complex attack scenarios. 2. The proposed dynamic geometric median aggregation algorithm has dynamic adjustment capabilities, which can resist Byzantine attacks while taking into account learning efficiency and parameter consistency. It is suitable for multi-UAV environments with highly dynamic communication links. 3. The framework proposed in this invention achieves superior performance in both tracking accuracy and anti-interference capability, and provides theoretical support and technical implementation path for the safe collaborative learning of multi-agent systems in highly dynamic and highly adversarial environments. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of the credibility scoring filter (TSF) and amplitude normalization filter (MNF) in this invention.

[0014] Figure 2 This is a schematic diagram of the average aggregation algorithm based on the SGD filter in the invention. (Green and black represent normal nodes and Byzantine nodes, respectively; red and blue represent Byzantine nodes and normal nodes, respectively).

[0015] Figure 3 This is a schematic diagram of the coordinate median aggregation algorithm based on the SGD filter in this invention. (Green and black represent normal nodes and Byzantine nodes, respectively; red and blue represent Byzantine nodes and normal nodes, respectively.)

[0016] Figure 4 This is a schematic diagram of the center point aggregation algorithm based on SGD filter in this invention (green and black represent normal nodes and Byzantine nodes, respectively, and red and blue represent Byzantine nodes and normal nodes, respectively).

[0017] Figure 5This is a schematic diagram of the dynamic geometric median aggregation algorithm based on SGD in this invention (green and black represent normal nodes and Byzantine nodes, respectively, and red and blue represent Byzantine nodes and normal nodes, respectively).

[0018] Figure 6 This is a schematic diagram of the dynamic geometric median aggregation algorithm based on SGD filter in this invention (green and black represent normal nodes and Byzantine nodes, respectively, and red and blue represent Byzantine nodes and normal nodes, respectively).

[0019] Figure 7 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the average aggregation algorithm based on the SGD filter in this invention.

[0020] Figure 8 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the coordinate median aggregation algorithm based on the SGD filter in this invention.

[0021] Figure 9 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the center point aggregation algorithm based on the SGD filter in this invention.

[0022] Figure 10 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the SGD-based dynamic geometric median aggregation algorithm in this invention.

[0023] Figure 11 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents against the target using the dynamic geometric median aggregation algorithm based on the SGD filter in this invention.

[0024] Figure 12 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking based on the SGD filter-based average aggregation algorithm in this invention.

[0025] Figure 13 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking using the coordinate median aggregation algorithm based on the SGD filter in this invention.

[0026] Figure 14 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking based on the center point aggregation algorithm of the SGD filter in this invention.

[0027] Figure 15 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking using the SGD-based dynamic geometric median aggregation algorithm in this invention.

[0028] Figure 16This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking using the dynamic geometric median aggregation algorithm based on SGD filter in this invention.

[0029] Figure 17 This is a schematic diagram of the average aggregation algorithm based on SGD filter in this invention (red and blue represent Byzantine nodes and normal nodes, respectively, and green represents the spatial trajectory of the dynamic target).

[0030] Figure 18 This is a schematic diagram of the coordinate median aggregation algorithm based on SGD filter in this invention (red and blue represent Byzantine nodes and normal nodes, respectively, and green represents the spatial trajectory of the dynamic target).

[0031] Figure 19 This is a schematic diagram of the center point aggregation algorithm based on SGD filter in this invention (red and blue represent Byzantine nodes and normal nodes, respectively, and green represents the spatial trajectory of the dynamic target).

[0032] Figure 20 This is a schematic diagram of the dynamic geometric median aggregation algorithm based on SGD in this invention (red and blue represent Byzantine nodes and normal nodes, respectively, and green represents the spatial trajectory of the dynamic target).

[0033] Figure 21 This is a schematic diagram of the dynamic geometric median aggregation algorithm based on SGD filter in this invention (red and blue represent Byzantine nodes and normal nodes, respectively, and green represents the spatial trajectory of the dynamic target).

[0034] Figure 22 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the average aggregation algorithm based on the SGD filter in this invention.

[0035] Figure 23 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the coordinate median aggregation algorithm based on the SGD filter in this invention.

[0036] Figure 24 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the center point aggregation algorithm based on the SGD filter in this invention.

[0037] Figure 25 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents to the target using the SGD-based dynamic geometric median aggregation algorithm in this invention.

[0038] Figure 26 This is a schematic diagram illustrating the real-time adversarial tracking distance of all ordinary agents against the target using the dynamic geometric median aggregation algorithm based on the SGD filter in this invention.

[0039] Figure 27This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking based on the SGD filter-based average aggregation algorithm in this invention.

[0040] Figure 28 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking using the coordinate median aggregation algorithm based on the SGD filter in this invention.

[0041] Figure 29 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking based on the center point aggregation algorithm of the SGD filter in this invention.

[0042] Figure 30 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking using the SGD-based dynamic geometric median aggregation algorithm in this invention.

[0043] Figure 31 This is a schematic diagram of the average coordinates of all ordinary agents in real-time adversarial tracking using the dynamic geometric median aggregation algorithm based on SGD filter in this invention. Detailed Implementation

[0044] See Figure 1 As shown, the technical solution adopted in this specific implementation is as follows: First, two parameter preprocessing modules are proposed: a Trust Score Filter (TSF) and a Magnitude Normalization Filter (MNF), which are used to identify and correct malicious parameter updates before model aggregation. Combined with the traditional Geometric Median (GM) aggregation rule, a Dynamic Geometric Median Aggregation (DGMA) algorithm is further proposed. DGMA significantly improves the robustness of the aggregation process against Byzantine attacks through a dynamic balancing mechanism of outlier removal and parameter reweighting, and effectively alleviates the data heterogeneity problem in distributed learning. By integrating the TSF and MNF parameter preprocessing modules with DGMA, a complete anti-Byzantine attack collaborative learning framework is constructed and successfully applied to multi-target collaborative tracking tasks in three-dimensional space. The specific content is as follows: 1. Optimization of multi-UAV target tracking, specifically: Depend on A collaborative multi-UAV system composed of several intelligent agents aims to achieve location-based... Cooperative tracking and state consistency of static targets; cooperative multi-UAV system modeled as an undirected graph. ,in, This refers to a collection of intelligent agents, i.e., drones. Represents a communication link between agents, if an undirected edge exists. This indicates that the intelligent agent Its neighboring intelligent agents They can exchange information with each other. Since each agent can obtain its own state information, therefore, for all... All have That is, each node is considered as its own neighbor; the neighbor set of agent k is defined as: Assuming the first A drone at discrete time The position is determined by the coordinate vector It indicates that at any time intelligent agent With the target location The actual distance between It can be represented as: in, Indicates from position Pointing to target The unit direction vector; assuming each UAV receives a value including distance measurements. and unit direction vector The noise observation data, namely: ,in and Let represent the measurement noise term that follows a zero-mean Gaussian distribution, with variances of and respectively. and To characterize the uncertainty of the sensor in distance and orientation observations, let: Then there is Define proxy nodes The loss function corresponding to the prediction model is a convex function: Accordingly, its convex risk function is defined as the mathematical expectation of the loss function: ,Depend on A multi-UAV network consisting of 10 UAVs employs a distributed cooperative strategy to jointly optimize and solve for the optimal parameter vector. This minimizes the following cost function: in, Indicates a global parameter. The total number of drones is represented by , and the optimization objective is to jointly minimize the logarithmic average risk through collaborative learning among drone nodes, thereby achieving the globally optimal parameter estimation.

[0045] 2. Cooperative gradient descent is used for global optimization, specifically for finding the optimal parameters. Since the parameters cannot be directly obtained analytically, the Stochastic Gradient Descent (SGD) algorithm is used for iterative approximation. To achieve distributed optimization, each proxy node participates in a collaborative SGD computation framework. Through a decentralized collaborative mechanism, distributed iterative estimation of the optimal parameters is achieved. Because Byzantine attacks are highly covert, exhibit abnormal behavior, and are difficult to detect, a filtering mechanism targeting their inherent characteristics is further designed to effectively suppress the interference of such malicious nodes on the collaborative learning process, improving the system's fault tolerance, robustness, and security. This filtering mechanism aims to identify and eliminate malicious parameters suspected of being introduced by Byzantine nodes that exhibit significant abnormal characteristics during parameter updates. During the collaborative synchronous communication between proxy nodes, the filtering mechanism includes the following: in, Step size, Indicates in The instantaneous gradient at the evaluation point, Indicates the first Time Neighbor Nodes The parameters after iteration Indicates the first Time Node The result after applying the aggregated neighbor parameters. Represents aggregate functions, This represents the parameter set after TSF / MNF processing, where each filter independently processes the agent. The parameters of adjacent nodes are used to generate two parameter sets. and Each parameter set is generated by a different filtering mechanism targeting specific adversarial features, and the aggregation function... Information is collected from reliable neighboring nodes and fused with the agent's own data to update the optimal parameters.

[0046] 3. Data normalization method based on TSF and MNF; specifically: To ensure the reliable operation of the multi-UAV system under Byzantine fault conditions, each DGMA aggregation round employs a pre-filtering mechanism to exclude extreme outliers, thereby improving robustness and efficiency. This method uses cosine similarity to evaluate the consistency between neighboring node parameters and the local model. The sign of the cosine value reflects the directional relationship: a positive cosine value indicates high directional similarity, while a negative cosine value indicates opposite directions. Parameters with positive and negative cosine similarities indicate consistent update directions, reflecting shared feature attributes. Neighboring node parameters with negative cosine similarity to the local model may indicate optimization target divergence or environmental noise. For target tracking tasks, only parameters satisfying the cosine similarity are aggregated. The parameters of neighboring nodes ensure that the update direction of a local node is consistent with that of the majority of valid nodes. By filtering parameters with opposite directions or divergent views, this mechanism improves tracking consistency and accuracy, thereby promoting the robustness and coordination of model updates within the network. For the parameter vectors of each neighboring node... and local model parameter vector The formula for calculating cosine similarity is: Parameter set Defined as: ,in, Indicates the first time Node's neighbors parameter values With nodes Between parameter values The angle between the parameters; MNF: Byzantine nodes may transmit malicious parameters that have significant numerical deviations from the local model parameters. Directly aggregating such parameters will cause a serious deviation in the target parameter space, thereby increasing the proportion of adversarial influences in the system. This will not only weaken the robustness of the learning framework, but also severely reduce convergence performance due to the propagation of inconsistent updates. To ensure that parameter values ​​are within the effective range, MNF takes amplitude normalization as its core principle and sets a safety threshold. The following data filtering rules are used: in Indicates the safe threshold distance: , This indicates the maximum deviation value of the selected attack parameters. Indicates the minimum deviation value. This represents the set of parameters after amplitude normalization. The final parameter set is composed of... Give; By jointly applying TSF and MNF for dual data filtering, most irrelevant or anomalous parameters in adjacent nodes can be effectively removed, while the remaining parameters are constrained within a physically meaningful range. This not only improves the computational efficiency and running speed of the DGMA algorithm but also reduces the injection of adversarial parameters, thereby effectively mitigating the adverse effects of such attacks on system performance and enhancing the model's robustness against malicious perturbations. The effectiveness of the aforementioned preprocessing filter was subsequently verified in different scenarios.

[0047] 4. Geometric Median and DGMA; specifically: The DGMA algorithm extends the GM framework to defend against Byzantine attacks in distributed learning. In a Byzantine attack, Byzantine nodes intentionally disrupt the system by submitting tampered data. DGMA uses GM as its aggregation core, leveraging GM's inherent resistance to outlier interference and its ability to maintain estimation accuracy, thus ensuring the algorithm remains highly robust to such anomalies. 1) GM: Geometric Median, also known as the Fermat-Weber point, is the point in multidimensional space that minimizes the sum of Euclidean distances to a given set of points. Formally, for a given set... Geometric median Defined as the solution to the following optimization problem: in, express and The geometric median, compared to the arithmetic mean, inherently possesses robustness against outliers, making it particularly suitable for adversarial scenarios where most data points cluster around a certain Euclidean distance. If the GM is located within a central Euclidean sphere, then the GM will also be located within a concentric sphere with a radius scaled by a fixed ratio. This forms the theoretical basis for the widespread use of the GM in the Byzantine-tolerant distributed learning framework. As a robust aggregation mechanism, the GM is used to merge gradients. By resisting outlier interference and ensuring algorithm convergence, the GM has become a key component in building fault-tolerant distributed systems. Although GM possesses inherent robustness, it is still affected by the presence of outliers. As the proportion of outliers increases, the performance of GM gradually becomes unstable and its accuracy decreases. To overcome this limitation, a more flexible and robust aggregation rule, called DGMA, is proposed. This rule extends the GM framework, and its formal definition is as follows: 2) DGMA: (1) where Indicates the first time The node's weight satisfies: , hyperparameters To balance the smoothness of the distance term and the weight vector, the optimal weight in the above formula is... The specific form is as follows: in Represents a set Size; By optimizing the extreme values ​​of the problem and the aforementioned weight terms, the upper bound of the sum of squared weights can be obtained as follows: The proposed optimal weighting scheme effectively addresses the comprehensive challenges of information interaction and aggregation described in equation (1), and significantly suppresses the influence of outliers through an adaptive weighting mechanism. Weight Based on each agent and the best data point from the previous round Recalibrate the Euclidean distance between them: distance Points that are closer to each other are assigned higher weights, while points that are farther away are considered potential Byzantine outliers and their weights are reduced accordingly. This spatial weighting mechanism effectively suppresses the influence of outliers, enabling the DGMA model to achieve robust parameter estimation even under noisy or adversarial conditions. The hyperparameter λ is used to balance the relationship between "utilizing all input data" and "focusing on a high-quality subset of data, i.e., excluding outliers." As λ → ∞, the model adopts a uniform weighting strategy, assigning the same weights to all points. The distance from each point to the previous best data point The distance is irrelevant, and the algorithm degenerates into a standard Gaussian mixture model. When λ → 0, the model forces sparsity by driving most weights to zero, preserving only local neighbor interactions. At this point, only a few points are assigned significant weights, thus effectively filtering outliers. By adjusting λ, the model can achieve a balance between making full use of the data and eliminating outliers, thereby optimizing robustness under different input conditions.

[0048] 5. Convergence analysis; specifically: Optimal global model parameters It provides a solution to the global optimization problem: in Represents the set of normal neighbor nodes. This represents the objective function that needs to be optimized. The parameters to be optimized are represented by . The proposed DGMA algorithm aims to resist Byzantine attacks and is an efficient iterative method for minimizing the global cost function. In the presence of Byzantine attacks, the global model obtained through the DGMA algorithm is compared with the optimal global model. The distance between them always remains bounded; First, we state the assumptions and establish several key lemmas, then formally express and prove the main theoretical results.

[0049] The following assumptions are made: Assumption 1: Assume that all agents share a common minimum value. And satisfy the orthogonality condition Global cost function yes Strongly convex and differentiable, i.e.: Where parameters , The inner product is represented by strong convexity, which guarantees that the cost function has a unique minimum point. In distributed systems, agents typically operate based on shared optimal parameters. Collaborative completion of shared tasks is a common scenario in applications where agents have the same data distribution, such as federated learning, drone swarm control, and distributed target tracking.

[0050] Assumption 2: Global objective function exist Differentiable in (spatial dimension) and possessing a continuous L-Lipschitz gradient, i.e.: Lipsitz constant Furthermore, the empirical risk function is Continuous. Specifically, there exists a constant. , so that for any The following conditional probabilities hold true: in express A joint dataset of agents, {.} represents probability. and It means yes about and gradient, It is a low probability value.

[0051] Assumption 3: The expected risk function is in the globally optimal model. gradient at It is bounded; furthermore, arbitrary gradient differences It also possesses boundedness. Specifically, it has positive constants. and Such that for any unit vector inner product Obtain the parameter as and It follows a sub-exponential distribution. Simultaneously, there are normal numbers. and > 0, such that for any and any unit vector Standardized difference Obtain the parameter as and The exponential distribution of . Formally, for all satisfying and In the case of: in The unit sphere is defined as follows: , (.) indicates expectation.

[0052] Assumption 4: The initial holding size of each proxy node is dataset This dataset is composed of data from a distribution. Elements sampled independently , , … Composition. Dataset Each data element within the dataset is independent of the others, and the datasets of all proxy nodes are independently and identically sampled from the same distribution. .

[0053] Lemma 1: For any number of Byzantine proxy nodes, let For the first The agent node at the _ ... The local gradient of the step, for all Its relationship with global gradient estimation The distance between them satisfies the following node-by-node constraints: in, , Indicates the first The agent node at the _ The local gradient after step aggregation Indicates the first The neighboring node is at the _th ... The local gradient of the step. Before performing parameter aggregation in Algorithm 1, the DGMA method first performs the following weighted aggregation step: Lemma 2: Assuming Assumption 1 holds, if the learning rate is set to... , where parameters satisfy Then for all satisfying The number of global iterations holds for the following inequality: Lemma 3: Given that Assumption 2 holds, for any The following two deviation bounds are defined: in Represents model parameters The dimension. If the condition is met. and , Let the size of the dataset be denoted by , then the following two probability inequalities hold simultaneously: with at least The probability of the initial dataset The empirical gradient and the expected gradient in the optimal model The deviation at point satisfies: in Representing data points exist The stochastic gradient at that point.

[0054] At least The probability, gradient difference function exist The empirical gradient on and the standardized deviation of its expected value satisfy: in Representing data points exist The stochastic gradient at that point.

[0055]

[0056] Lemma 4: If all of Hypotheses 1 through 3 are true, and the parameter set satisfies ,in Let be a positive integer. Given any... If the conditions are met and Then the following probability inequality holds: in, , , , .

[0057] Theorem 1: If all of Assumptions 1 through 4 are true, then in each global iteration step... Each proxy node Perform a local gradient update before parameter aggregation, and set the learning rate. The update rules are as follows: Assuming the number of Byzantine proxy nodes satisfy ,in It is a constant. Let be the total number of nodes in the system. Then, under attack-free conditions, the global parameters learned by the DGMA algorithm are... With optimal global parameters The deviation between them has an upper bound on probability; specifically, for any , at least The probability for all proxy nodes and all global iteration steps ,satisfy: in: in, The convergence factor is The total sample size of the initial dataset for all agent nodes. , Let be a positive real number, satisfying the condition for any All have , Representing the dimension of space, since The appropriate number of iterations can be obtained. As the parameter approaches infinity, the error converges to a bounded steady-state error: .

[0058] 6. Simulation verification and result analysis.

[0059] While centroid aggregation performs well with low Byzantine attack rates, when the attack rate rises to 40%, mean aggregation, geometric median (GM), and centroid aggregators all fail to achieve acceptable model accuracy. For completeness, the mean aggregation, median (CM), and centroid aggregation methods are formally defined below.

[0060] Median of coordinates: Given a set of vectors The median of its coordinates is defined as a vector. , its first Each component satisfies: The median operator med(·) is computed independently for each scalar component along the corresponding dimension of all vectors. Indicates the first The first vector Each component.

[0061] Average value: Given a set of vectors Its mean vector is defined as , its first Each component is given by the following formula: in, The first term represents the mean vector of the results. One portion, Represents the set of elements. The first vector Each component.

[0062] Center point: Given a set of points If point The following condition must be met: for any containing closed semi-space All have ,in Represents a point set Falling into a closed semi-space The number of points within is called... for A central point. This property shows that any point containing a central point... The closed half-space contains at least middle Data points.

[0063] Technical defect analysis: The aforementioned aggregation methods all exhibited insufficient robustness and accuracy degradation in the high-proportion Byzantine attack experimental scenario designed in this invention: although median and mean aggregation theoretically possess a certain degree of outlier suppression capability, their upper limit of perturbation resistance is limited, failing to cope with malicious node attacks of up to 40%; while centroid aggregation can provide strong security under specific conditions, under the settings of this system, its convergence speed is slow, the final model accuracy is low, and the overall performance cannot meet the requirements of highly reliable distributed learning. The experimental results show that although some aggregation rules theoretically possess attack resistance potential, their actual effectiveness must be rigorously verified through targeted experiments. This highlights the limitations of existing technologies in dealing with complex network dynamics and new security threats, further confirming the necessity and innovation of the Dynamic Gradient Aggregation Mechanism (DGMA) proposed in this invention.

[0064] We propose a method... A mobile adaptive network composed of several agents, which track the location through cooperation. Target location in space The target can be a static target or a target that evolves dynamically in real time. Agents in the network update their own states by aggregating information about the target's position changes and the state parameters of their neighboring agents, thus achieving efficient target tracking. This scheme not only verifies the system's flexibility and real-time response capabilities but also highlights the importance of achieving accurate tracking in multi-dimensional space.

[0065] 6.1 Background Consider a swarm network of 50 intelligent agents (drones), with 40% being Byzantine nodes, operating in three-dimensional Euclidean space. The system aims to estimate the location of an unknown target through a distributed cooperative mechanism. , Represents three-dimensional space. For optimization... Establish the following objective function: (2) In each iteration cycle In this process, each intelligent agent can obtain its own location. ,speed and acceleration After the preprocessing phase, the agent receives data from its neighboring nodes. Location and speed Subsequently, the acceleration is iteratively updated according to the following rules: (3) in The speed of the network centroid is represented. , and The parameter is non-negative, and the function is defined as follows: in, Represents the desired acceleration vector. It is a proportionality factor used to constrain the acceleration amplitude during target tracking.

[0066] In equation (3), the first term is the displacement correlation function of the agent, used to adjust its velocity; the second term is used to control the adjustment of the agent's acceleration, making it consistent with the average velocity vector in the neighborhood. Subsequently, the agent updates its position and velocity information according to the following equation: in This represents the time step. For computational speed, each agent needs to obtain the target position estimate optimized by equation (2). Center of mass velocity Solve the following optimization problem: (4) Finally, the acceleration is calculated using the velocity estimate optimized by equation (4). (Center of mass acceleration) The following optimization problems can be solved: .

[0067] 6.2 Static Dual-Target Adversarial Tracking In our extended simulation, a network of 50 agents was considered, operating within a three-dimensional region of [0,10] × [0, 10] × [0, 10]. This system, comprising 40% Byzantine agents, significantly improved attack strength compared to previous studies

[17]

[37] . The target location for a normal UAV was set as follows: = (10, 10, 10), while the Byzantine node is designed to maliciously track bits. The static false targets introduce a novel adversarial scenario. The regression vectors of each agent are initialized using a uniform covariance matrix: ,in , It is a 3×3 identity matrix. The distance measurement noise follows a variance of... The position, velocity, and acceleration are all Gaussian distributions ∈ [1, 2]. The update step size for position, velocity, and acceleration is set to... In addition, the parameters are set as follows: , , , ,and For any normal intelligent agent When the proportion of Byzantine agents reaches 40%, the DGMA algorithm can ensure that the system achieves elastic convergence.

[0068] The parameter preprocessing module introduced for evaluation (see [link]) Figure 1 To understand the necessity of SGD and the effectiveness of the proposed DGMA algorithm under a 20-Byzantine node attack, we conducted a series of experiments and analyses. This study employs various aggregation rules, including filtered average, filtered centroid method, filtered center point method, unfiltered DGMA, and filtered DGMA, to execute the SGD algorithm, aiming to achieve the target position for each agent. ,speed and acceleration The accuracy of the estimate. In adversarial attack scenarios, the Byzantine agent is given incorrect static target location information. It continuously broadcasts its real-time estimated target position and velocity to all normal agents. This malicious behavior aims to disrupt the ability of normal nodes to accurately track the real static target position ψ. Figures 2-6 As shown, after 200 tracking iterations, the final deployment of the agent is displayed: green asterisks indicate the accurately tracked target locations, while black triangles mark the locations of malicious static targets. Under attack, only the DGMA algorithm can achieve effective dual-target tracking simultaneously; its convergence to the target process is as follows... Figure 2 As shown. Figures 7-11 This demonstrates the normal intelligent agents throughout the tracking process. The real-time distance between the target location and the target location is expressed by the formula. The calculation yielded the result. Figures 12-16 This displays the average real-time coordinates of all normal nodes, calculated using the formula shown below: in It represents Average position They represent position parameters respectively. of Position. This metric can serve as a robustness indicator for evaluating overall tracking performance. Comparative experiments, combining the aforementioned aggregation rules with parametric filters within the SGD optimization framework, demonstrate that the DGMA algorithm achieves robust convergence under Byzantine attacks, maintaining stable model training performance even with 40% malicious agents. The experiments further validate the critical impact of the pre-aggregation parametric filter on the results, confirming its indispensability within this proposal framework.

[0069] 6.3 Dynamic Target Tracking To comprehensively verify and evaluate the robustness of the algorithm, we further investigated its performance in dynamic, time-varying target tracking scenarios. Using time-varying targets enables UAVs to track desired trajectories, more accurately simulating real-world application scenarios. The motion trajectory of the dynamic target is described by the following mathematical formula: in, This represents the number of iteration steps. The parameters are set as follows: spiral radius = spiral height = 10, spiral turns = 2. The distance measurement noise follows a Gaussian distribution with variance... .

[0070] like Figures 17-21 As shown, after 200 iterations, the final deployment state of all agents is displayed. The solid green line represents the target trajectory visualization over time, and the green asterisk indicates the target's real-time location. Analysis of the agent deployment configurations reveals that in a network environment where malicious agents account for up to 40%, the DGMA algorithm demonstrates excellent real-time adversarial tracking capabilities. This algorithm also exhibits significant robustness against Byzantine attacks in complex cluster network environments. Figures 22-26 The figure illustrates the trend of distance change between any normal agent and the target during motion, while the learning accuracy, measured by the average formula, is shown in the figure. Figures 27-31 As shown.

[0071] This study demonstrates that, under such adversarial conditions, the DGMA algorithm is the only method capable of effectively tracking and converging node behavior to their respective goals. The robustness of DGMA highlights its superior performance in maintaining system stability and reliability even when facing significant challenges from malicious nodes. This fully demonstrates the potential of DGMA as a key solution for enhancing network resilience against Byzantine attacks, showcasing its exceptional ability to efficiently achieve target alignment.

[0072] The above description is only used to illustrate the technical solution of the present invention and is not intended to limit it. Any other modifications or equivalent substitutions made by those skilled in the art to the technical solution of the present invention, as long as they do not depart from the spirit and scope of the technical solution of the present invention, should be covered within the scope of the claims of the present invention.

Claims

1. A method for defending against dynamic trust consensus attacks by drone swarms based on distributed machine learning, characterized by: First, two parameter preprocessing modules are proposed: a Trustworthiness Score Filter (TSF) and an Amplitude Normalization Filter (MNF), used to identify and correct malicious parameter updates before model aggregation. Combining this with the traditional Geometric Median (GM) aggregation rule, a Dynamic Geometric Median Aggregation Algorithm (DGMA) is further proposed. DGMA significantly improves the robustness of the aggregation process against Byzantine attacks through a dynamic balancing mechanism of outlier removal and parameter reweighting, and effectively alleviates the data heterogeneity problem in distributed learning. By integrating the TSF and MNF parameter preprocessing modules with DGMA, a complete Byzantine attack-resistant collaborative learning framework is constructed and successfully applied to multi-target collaborative tracking tasks in 3D space. The specific details are as follows: 1) Optimization of multi-UAV target tracking; 2) Cooperative gradient descent is used for global optimization; 3) Data normalization methods based on TSF and MNF; 4) Geometric median and DGMA; 5) Convergence analysis; 6) Simulation verification and result analysis.

2. The method for defending against UAV swarm dynamic trust consensus attacks based on distributed machine learning according to claim 1, characterized in that: The optimization of multi-UAV target tracking specifically includes: Depend on A collaborative multi-UAV system composed of several intelligent agents aims to achieve location-based... Cooperative tracking and state consistency of static targets; cooperative multi-UAV system modeled as an undirected graph. ,in, This refers to a collection of intelligent agents, i.e., drones. Represents a communication link between agents, if an undirected edge exists. This indicates that the intelligent agent Its neighboring intelligent agents They can exchange information with each other. Since each agent can obtain its own state information, therefore, for all... All have That is, each node is considered as its own neighbor; the neighbor set of agent k is defined as: Assuming the first A drone at discrete time The position is determined by the coordinate vector It indicates that at any time intelligent agent With the target location The actual distance between It can be represented as: in, Indicates from position Pointing to target The unit direction vector; assuming each UAV receives a value including distance measurements. and unit direction vector The noise observation data, namely: ,in and Let represent the measurement noise term that follows a zero-mean Gaussian distribution, with variances of and respectively. and To characterize the uncertainty of the sensor in distance and orientation observations, let: Then there is Define proxy nodes The loss function corresponding to the prediction model is a convex function: Accordingly, its convex risk function is defined as the mathematical expectation of the loss function: ,Depend on A multi-UAV network consisting of 10 UAVs employs a distributed cooperative strategy to jointly optimize and solve for the optimal parameter vector. This minimizes the following cost function: in, Indicates a global parameter. The total number of drones is represented by , and the optimization objective is to jointly minimize the logarithmic average risk through collaborative learning among drone nodes, thereby achieving the globally optimal parameter estimation.

3. The method for defending against UAV swarm dynamic trust consensus attacks based on distributed machine learning according to claim 1, characterized in that: The cooperative gradient descent method used for global optimization is specifically as follows: Optimal parameters Since the parameters cannot be directly obtained analytically, the Stochastic Gradient Descent (SGD) algorithm is used for iterative approximation. To achieve distributed optimization, each proxy node participates in a collaborative SGD computation framework. Through a decentralized collaborative mechanism, distributed iterative estimation of the optimal parameters is achieved. Because Byzantine attacks are highly concealed and exhibit anomalous behavior that is difficult to detect, a filtering mechanism targeting their inherent characteristics is further designed to effectively suppress the interference of such malicious nodes on the collaborative learning process, improving the system's fault tolerance, robustness, and security. This filtering mechanism aims to identify and eliminate malicious parameters suspected of being introduced by Byzantine nodes that exhibit significant anomalous characteristics during parameter updates. During the collaborative synchronous communication between proxy nodes, the filtering mechanism includes the following: in, Step size, Indicates in The instantaneous gradient at the evaluation point, Indicates the first Time Neighbor Nodes The parameters after iteration Indicates the first Time Node The result after applying the aggregated neighbor parameters. Represents aggregate functions, This represents the parameter set after TSF / MNF processing, where each filter independently processes the agent. The parameters of adjacent nodes are used to generate two parameter sets. and Each parameter set is generated by a different filtering mechanism targeting specific adversarial features, and the aggregation function... Information is collected from reliable neighboring nodes and fused with the agent's own data to update the optimal parameters.

4. The method for defending against dynamic trust consensus attacks by drone swarms based on distributed machine learning according to claim 1, characterized in that: The data normalization method based on TSF and MNF is as follows: To ensure the reliable operation of the multi-UAV system under Byzantine fault conditions, each DGMA aggregation round employs a pre-filtering mechanism to exclude extreme outliers, thereby improving robustness and efficiency. This method uses cosine similarity to evaluate the consistency between neighboring node parameters and the local model. The sign of the cosine value reflects the directional relationship: a positive cosine value indicates high directional similarity, while a negative cosine value indicates opposite directions. Parameters with positive and negative cosine similarities indicate consistent update directions, reflecting shared feature attributes. Neighboring node parameters with negative cosine similarity to the local model may indicate optimization target divergence or environmental noise. For target tracking tasks, only parameters satisfying the cosine similarity are aggregated. The parameters of neighboring nodes ensure that the update direction of a local node is consistent with that of the majority of valid nodes. By filtering parameters with opposite directions or divergent views, this mechanism improves tracking consistency and accuracy, thereby promoting the robustness and coordination of model updates within the network. For the parameter vectors of each neighboring node... and local model parameter vector The formula for calculating cosine similarity is: Parameter set Defined as: ,in, Indicates the first time Node's neighbors parameter values With nodes Between parameter values The included angle; MNF: Byzantine nodes may transmit malicious parameters that have significant numerical deviations from the local model parameters. Directly aggregating such parameters will cause a serious deviation in the target parameter space, thereby increasing the proportion of adversarial influences in the system. This will not only weaken the robustness of the learning framework, but also severely reduce convergence performance due to the propagation of inconsistent updates. To ensure that parameter values ​​are within the valid range, MNF uses amplitude normalization as its core principle and sets a safety threshold. The following data filtering rules are used: in Indicates the safe threshold distance: , This indicates the maximum deviation value of the selected attack parameters. Indicates the minimum deviation value. This represents the set of parameters after amplitude normalization. The final parameter set is composed of... Give; By combining TSF and MNF for dual data filtering, most irrelevant or anomalous parameters in adjacent nodes can be effectively removed, while the remaining parameters are constrained to a range with clear physical meaning. This not only improves the computational efficiency and running speed of the DGMA algorithm, but also reduces the injection of adversarial parameters, thereby effectively mitigating the adverse effects of such attacks on system performance and enhancing the robustness of the model against malicious perturbations.

5. The method for defending against UAV swarm dynamic trust consensus attacks based on distributed machine learning according to claim 1, characterized in that: The geometric median and DGMA are specifically: The DGMA algorithm extends the GM framework to defend against Byzantine attacks in distributed learning. In a Byzantine attack, Byzantine nodes intentionally disrupt the system by submitting tampered data. DGMA uses GM as its aggregation core, leveraging GM's inherent resistance to outlier interference and its ability to maintain estimation accuracy, thus ensuring the algorithm remains highly robust to such anomalies. 1) GM: It is the point in multidimensional space that minimizes the sum of Euclidean distances to a given set of points. Formally, for a given set... Geometric median Defined as the solution to the following optimization problem: in, express and The geometric median, compared to the arithmetic mean, inherently possesses robustness against outliers, making it particularly suitable for adversarial scenarios where most data points cluster around a certain Euclidean distance. If the GM is located within a central Euclidean sphere, then the GM will also be located within a concentric sphere with a radius scaled by a fixed ratio. This forms the theoretical basis for the widespread use of the GM in the Byzantine-tolerant distributed learning framework. As a robust aggregation mechanism, the GM is used to merge gradients. By resisting outlier interference and ensuring algorithm convergence, the GM has become a key component in building fault-tolerant distributed systems. Although GM possesses inherent robustness, it is still affected by the presence of outliers. As the proportion of outliers increases, the performance of GM gradually becomes unstable and its accuracy decreases. To overcome this limitation, a more flexible and robust aggregation rule, called DGMA, is proposed. This rule extends the GM framework, and its formal definition is as follows: 2) DGMA: (1) in Indicates the first time The node's weight satisfies: , hyperparameters To balance the smoothness of the distance term and the weight vector, the optimal weight in the above formula is... The specific form is as follows: in, Represents a set Size; By optimizing the extreme values ​​of the problem and the aforementioned weight terms, the upper bound of the sum of squared weights can be obtained as follows: The proposed optimal weighting scheme effectively addresses the comprehensive challenges of information interaction and aggregation described in equation (1), and significantly suppresses the influence of outliers through an adaptive weighting mechanism. Weight Based on each agent and the best data point from the previous round Recalibrate the Euclidean distance between them: distance Points that are closer to each other are assigned higher weights, while points that are farther away are considered potential Byzantine outliers and their weights are reduced accordingly. This spatial weighting mechanism effectively suppresses the influence of outliers, enabling the DGMA model to achieve robust parameter estimation even under noisy or adversarial conditions. The hyperparameter λ is used to balance the relationship between "utilizing all input data" and "focusing on a high-quality subset of data, i.e., excluding outliers." As λ→∞, the model adopts a uniform weighting strategy, assigning the same weight to all points. The distance from each point to the previous best data point The distance is irrelevant, and the algorithm degenerates into a standard Gaussian mixture model (Definition 1); When λ→0, the model forces sparsity by driving most weights to zero, preserving only local neighbor interactions. At this point, only a few points are assigned significant weights, thus effectively filtering outliers. By adjusting λ, the model can achieve a balance between making full use of the data and eliminating outliers, thereby optimizing robustness under different input conditions.

6. The method for defending against dynamic trust consensus attacks by drone swarms based on distributed machine learning according to claim 1, characterized in that: The convergence analysis specifically includes: Optimal global model parameters It provides a solution to the global optimization problem: in, Represents the set of normal neighbor nodes. This represents the objective function that needs to be optimized. The parameter to be optimized is represented by . The DGMA algorithm is designed to resist Byzantine attacks and is an efficient iterative method for minimizing the global cost function. In the presence of a Byzantine attack, the global model obtained through the DGMA algorithm is compared to the optimal global model. The distance between them always remains bounded; In each global iteration step Each proxy node Perform a local gradient update before parameter aggregation, and set the learning rate. The update rules are as follows: Assuming the number of Byzantine proxy nodes satisfy ,in It is a constant. Let be the total number of nodes in the system. Then, under attack-free conditions, the global parameters learned by the DGMA algorithm are... With optimal global parameters The deviation between them has an upper bound on probability; specifically, for any , at least The probability for all proxy nodes and all global iteration steps ,satisfy: in: in, The convergence factor is The total sample size of the initial dataset for all agent nodes. , Let be a positive real number, satisfying the condition for any All have , Representing the dimension of space, since The appropriate number of iterations can be obtained. As the parameter approaches infinity, the error converges to a bounded steady-state error: .

Images