Space perception local differential privacy protection method for unmanned aerial vehicle federated learning

Abstract

The application discloses a kind of spatial perception local differential privacy protection methods for unmanned aerial vehicle federated learning, belong to unmanned aerial vehicle network security and privacy protection technical field. Including: S1, construct unsupervised representation model in unmanned aerial vehicle client, complete local training, extract model parameter update increment;S2, the three-dimensional flight trajectory point of unmanned aerial vehicle is mapped to continuous topological density field, based on normalized topological density dynamic distribution point-level basic privacy budget, and aggregation is obtained Client-level privacy budget;S3, according to the noise reference calibration of client-level privacy budget, obtain the noisy model update that satisfies (epsilon, delta) -LDP constraint;S4, noisy model update is uploaded to federated server for aggregation, synchronously update global model parameters, and carry out comprehensive evaluation. By using the method, combined with spatial trajectory density dynamic distribution privacy budget, through hierarchical heterogeneous disturbance, privacy protection and model utility are considered, and unmanned aerial vehicle spatial heterogeneous scene is adapted.

Description

Technical Field

[0001] This invention relates to the field of UAV network security and privacy protection technology, and in particular to a Spatially-Aware Local Differential Privacy (SA-LDP) protection method for UAV federated learning. Background Technology

[0002] With the widespread application of drone swarm technology in aerial surveillance, urban inspection, and environmental perception, the demand for collaborative modeling of massive distributed aerial data continues to grow. Federated learning, as a distributed machine learning paradigm, allows drone clients to train models locally, uploading only model parameters or gradient updates to the server. This can, to some extent, prevent the direct leakage of raw aerial data and is well-suited to the distributed deployment characteristics of drone networks. However, influenced by flight path planning and task area distribution, drone flight trajectories exhibit significant clustering biases, resulting in aerial data displaying strong spatial non-independent and identically distributed characteristics. This characteristic further exacerbates the privacy leakage risk under the federated learning framework. Drone swarms are vulnerable to various privacy attacks, such as Membership Inference Attack (MIA) and Deep Leakage from Gradients (DLG), posing a serious challenge to data security.

[0003] Current privacy protection schemes for federated learning mostly rely on local differential privacy as their core mechanism, achieving privacy protection by injecting random noise into model updates. Existing technologies, such as federated learning schemes based on personalized privacy protection, hierarchical budget allocation schemes addressing gradient leakage, client-level differential privacy methods based on sparse model perturbation, adaptive sparse federated learning schemes for UAV networks, and local differential privacy frameworks based on adaptive segmentation mechanisms, have all optimized the balance between privacy protection strength and model utility. However, none of these schemes incorporate the 3D spatial topology information of the UAV scenario into their privacy protection mechanisms. They generally employ a globally uniform noise injection strategy, failing to perceive the differences in privacy risks across different spatial regions. This easily leads to insufficient privacy protection strength in high-risk isolated areas with sparse trajectories and excessive noise injection in low-risk areas with dense trajectories. Furthermore, under the spatially non-independent and identically distributed data characteristics, indiscriminate high-intensity isotropic noise further amplifies the data distribution shift effect, weakening the feature extraction capability of the global model and increasing the difficulty of model convergence. Furthermore, most existing adaptive differential privacy schemes ignore the intrinsic relationship between model parameter updates and 3D spatial context, making it difficult to achieve accurate spatially aware privacy budget allocation and unable to effectively adapt to the spatially heterogeneous network environment of drone swarms. Summary of the Invention

[0004] The purpose of this invention is to provide a spatially perceptive local differential privacy protection method for UAV federated learning, thereby solving the aforementioned technical problems.

[0005] To achieve the above objectives, this invention provides a spatially perceptual local differential privacy protection method for UAV federated learning, comprising the following steps: S1. Build an unsupervised representation model based on momentum contrast learning on the drone client, complete local training using local aerial photography private dataset, and extract model parameters to update incrementally; S2. Map the three-dimensional flight trajectory points of the UAV to a continuous topological density field, calculate the normalized topological density, dynamically allocate the point-level basic privacy budget based on the normalized topological density, and aggregate to obtain the client-level privacy budget. S3. Based on the client-level privacy budget, noise baseline calibration is performed. Different intensities of heterogeneous Gaussian noise are injected into the backbone network and projection space of the model to obtain a noisy model update that satisfies the (ε,δ)-LDP (Local Differential Privacy) constraint, where ε is the privacy budget parameter and δ is the relaxation parameter. S4. Upload the noisy model updates of each drone client to the federated server for aggregation, synchronously update the global model parameters, and conduct a comprehensive evaluation from three dimensions: member inference attack defense effect, gradient depth leakage attack defense effect, and model classification utility.

[0006] Therefore, the spatially perceptual local differential privacy protection method for UAV federated learning described above has the following beneficial effects: 1. Achieve precise privacy protection based on spatial differentiation: Identify spatial privacy risks by quantifying the topological density of the UAV's 3D trajectory, dynamically allocate differentiated privacy budgets, and adopt a low quantile aggregation strategy to ensure the protection strength of high-risk isolated areas. This not only makes up for the protection gap of the globally uniform noise addition strategy, but also avoids excessive noise injection in low-risk areas, adapting to the spatially heterogeneous deployment environment of UAVs.

[0007] 2. Balancing privacy and model performance: A hierarchical heterogeneous perturbation mechanism is adopted to inject strong perturbations into the privacy-sensitive projection space to resist feature leakage, and attenuation noise is applied to the backbone network to retain the basic feature extraction capability. Under the premise of satisfying the (ε,δ)-LDP constraint, the model performance degradation caused by noise in non-independent and identically distributed scenarios is alleviated, and the model retrieval accuracy and convergence stability are improved.

[0008] 3. Possesses complete theoretical support and comprehensive defense capabilities: Based on the multivariate anisotropic Gaussian mechanism, it provides theoretical guarantees for the update level (ε,δ)-LDP and derives the upper bound of convergence error in non-convex optimization scenarios; this method can simultaneously and effectively suppress the inference advantage of member inference attacks and destroy the reconstruction conditions of gradient depth leakage attacks, achieving an efficient balance between privacy security and model usability.

[0009] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0010] Figure 1 This is a diagram illustrating the overall framework of the spatially perceptive local differential privacy protection method for UAV federated learning according to the present invention. Figure 2 This is a schematic diagram illustrating the Attack Success Rate (ASR) of different densities against MIA attacks according to the present invention. Figure 3 This is a schematic diagram of the three-dimensional coordinates and corresponding budget distribution of the present invention; Figure 4 This is a line graph showing the average training loss of each scheme in this invention; Figure 5 This is a line graph showing the Top-1 accuracy of each solution in this invention. Figure 6 This is a line graph showing the Top-5 accuracy of each solution in this invention. Figure 7 The following are ASR line graphs for various schemes of the present invention; Figure 8 The above is a scatter plot of Top-1 accuracy and ASR for each scheme of the present invention; Figure 9 This is a comparison chart of DLG visual reconstruction results under various defense mechanisms of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages disclosed in the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present invention and are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout.

[0012] It should be noted that the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, such as a process, method, system, product, or server that includes a series of steps or units, not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or device.

[0013] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0014] like Figures 1-9 As shown, the present invention provides a spatially perceptual local differential privacy protection method for UAV federated learning, comprising the following steps: S1. Local Model Reconstruction and Training: This step is executed locally on each drone client, constructing an unsupervised representation model based on Momentum Contrast (MoCo) learning. The model is trained using a local private aerial photography dataset, and parameter updates are extracted and incremented. Specifically, this includes: S11. Constructing the basic feature encoder: The lightweight object detection network LEAF-YOLO is selected as the basic architecture to adapt to the computational resource limitations of UAV edge devices; the supervisory detection head used for object prediction in the original network is removed, and the backbone network and feature pyramid structure are retained as the feature encoder. The parameter set of the backbone network is denoted as... For the input aerial images The feature encoder uses an encoding function. (·) Output the corresponding semantic representation And satisfy ,in, Represents the real number field. Specify the dimension of the feature vector output by the encoder.

[0015] S12. Constructing the projection head and mapping it to Z-Space: A projection head composed of a multilayer perceptron (MLP) is cascaded at the output of the feature encoder. The parameter set of the projection head is denoted as... The semantic features output by the encoder are mapped to a normalized low-dimensional latent projection space using a projection function, and this normalized low-dimensional latent projection space is denoted as Z-Space, thus obtaining the projected features. The mapping formula is: ; in, For the feature encoder on the input image Extracted semantic representations , Represents the real number field. The dimension of the feature vector output by the encoder. For projection function, for Norms; mitigating representation collapse and sample memory problems caused by the spatial long-tail data distribution of UAVs by normalizing the projection space.

[0016] S13, based on infoNCE Loss-based local training: Based on the momentum contrastive learning framework, this approach reduces the Z-space distance between positive sample features and decreases the similarity between features in the positive and negative sample queues. During local training, the model parameters on the client side are denoted as... This invention brings the positive sample queue closer together. The distance of the feature in Z-Space, and its reduction relative to the capacity. negative sample queue Similarity between negative samples, construct infoNCE The loss function is used for local model iterative training. info The formula for calculating the NCE loss function is: ; in, for infoNCE The value of the loss function, For temperature coefficient, To query the projected features of a sample, These are the projected features of positive sample keys. The capacity of the negative sample queue. This is the index identifier for the positive sample key. This is the traversal index in the negative sample queue. The first negative sample in the queue Projected features of negative samples, For summation, The function is exponential. Due to the spatial clustering of UAV trajectories, local private datasets often exhibit long-tailed or single-class distributions, which can easily lead to a large number of false negative samples in the local negative sample queue, causing semantic shifts in the local feature space. This method relies on the global communication mechanism of federated learning to synchronously introduce heterogeneous data semantic priors through subsequent global model aggregation, thereby alleviating the trend of representation collapse.

[0017] S14. Extract model parameter update increments After completing the local training for the current round, extract the difference in model parameters before and after this round of training to obtain the model parameter update increment. This is used for subsequent privacy disruptions and federal uploads.

[0018] S2. Dynamic Spatial Awareness Privacy Budget Allocation: This step transforms the topological information of the UAV's 3D flight trajectory into a basis for privacy budget allocation. It generates a spatially adaptive privacy budget by quantifying the trajectory topological density, ultimately aggregating it to obtain a client-level privacy budget. Specifically, this includes: S21. Definition of 3D Trajectory Point Cloud: The spatial trajectory of a UAV within a specific flight cycle is defined as a discrete set of 3D point clouds, with a single trajectory point denoted as... ,in , , These are the coordinates of the trajectory points on the x-axis, y-axis, and z-axis, respectively. It is the transpose symbol; S22. Coordinate Weighting and Standardization: Considering the difference in maneuverability of UAVs in the horizontal and vertical directions, an altitude weighting coefficient is introduced. Combined with spatial weighting matrix The altitude axis is scaled, and then the weighted coordinates are independently standardized using the Z-score standardization method to eliminate the dimensional differences between horizontal range and vertical altitude, resulting in standardized trajectory points. ; S23. Calculate the absolute spatial density: Construct a KD-Tree nearest neighbor topology graph in the normalized space, calculate the expected distance between each trajectory point and its nearest neighbor set, and define the absolute spatial density. The calculation formula is: ; in, For standardized trajectory points The expected distance to its nearest neighbor set, To prevent the calculation of overflow smoothing terms, Represents the complete set consisting of the density values ​​of all trajectory points; S24. Generate normalized topological density: Construct a truncation operator using the 5% and 95% quantiles of the density distribution to eliminate the interference of outlier drift points on the density distribution. Then, map the truncated absolute spatial density to a normalized topological density with values ​​ranging from 0 to 1. The calculation formula is: ; in, For truncation operators based on the 5th and 95th percentiles, This represents the 0.05 quantile of the absolute spatial density set. This represents the 0.95 quantile of the absolute spatial density set. The closer the value is to 0, the more isolated the sampling area of ​​the corresponding trajectory point is, and the higher the risk of privacy leakage.

[0019] S25, Point-level Basic Privacy Budget Mapping: The preset range of the system's global privacy budget is... The normalized topological density is obtained through the Sigmoid mapping function. Smooth transition to point-level basic privacy budget To avoid abrupt changes in privacy budgets in adjacent spatial areas, the calculation formula is as follows: ; in, The minimum privacy budget set for the system. The maximum privacy budget set for the system, To control the hyperparameters of the mapping steepness, The median of the density distribution. The truncation operator is used to constrain the mapping result to... Within the interval, the lower the density of the region, the smaller the privacy budget is allocated, and the higher the intensity of the injected noise, thus achieving strong privacy protection in high-risk areas.

[0020] S26. Client-level Privacy Budget Aggregation: Since a client may contain multiple trajectory points or multiple sets of aerial photography samples in a single communication, if the arithmetic mean is directly used for budget aggregation, the privacy budget corresponding to a few sensitive samples located in high-risk isolated areas may be diluted by a large number of samples in dense areas. Therefore, a low quantile aggregation strategy is introduced, using the 10th percentile of the local point-level budget set as the client-level privacy budget for the drone. The calculation formula is: ; in, For the first A point-level privacy budget set for all local trajectory points of a drone client. The number of samples in the local dataset. The function is used to calculate the 10th percentile. This aggregation strategy avoids diluting the protection needs of a small number of high-risk isolated samples by densely packed samples, and prioritizes the protection strength of high-risk areas.

[0021] S3. Hierarchical Heterogeneous Differential Privacy Perturbation: This step, based on the client-level privacy budget, performs differentiated Gaussian noise injection on different network layers of the model, ensuring that the model update satisfies the (ε,δ)-local differential privacy constraint, where ε is the privacy budget parameter and δ is the relaxation parameter. Specifically, this includes: S31. Model update sensitivity pruning: Uses a preset maximum threshold. Incremental update of model parameters Execute global Norm pruning restricts the magnitude of model updates within a threshold range, resulting in a pruned update amount that satisfies sensitivity constraints, thus providing a theoretical basis for differential privacy protection.

[0022] S32, Reference Noise Intensity Calibration: Based on Client-Level Privacy Budget Minimum noise scaling factor of the backbone network Based on the Gaussian difference privacy mechanism, a reverse calibration of the reference noise is performed to obtain the standard deviation of the reference Gaussian noise. The calculation formula is: ; in, It is a logarithmic function.

[0023] S33. Hierarchical Heterogeneous Gaussian Noise Injection: Gaussian noise of different intensities is injected into the backbone network parameters and projection head parameters respectively to obtain the noisy model update after hierarchical heterogeneous perturbation. The random noise injected into different network layers... Follows the following distribution: ; in, This represents the noise scaling factor for the projection space. It is the identity matrix. Indicates a Gaussian distribution. This is a single network parameter element; the mechanism differentiates the perturbation intensity of different network layers through heterogeneous scaling factors, and the present invention sets the noise figure of the projection space. To inject relatively stronger disturbance noise into the projection head; at the same time, the noise figure of the backbone network is set. This involves injecting attenuated protective noise into the basic feature extraction layer, thereby controlling the risk of feature leakage while maintaining the basic feature extraction capability as much as possible.

[0024] S4. Federated Aggregation and Comprehensive Performance Evaluation: This step completes the aggregation and update of the federated model, and evaluates the comprehensive performance of the method from three dimensions: the effectiveness of defending against member inference attacks, the effectiveness of defending against gradient depth leakage attacks, and the utility of model classification. The specific implementation process is as follows: First, federated model aggregation is performed: each drone client uploads its noisy model update after privacy perturbation to the central federated server. The server uses a federated average aggregation algorithm to weight and aggregate the updates from multiple clients to obtain the updated global model parameters, and then distributes the global parameters to all drone clients to start the next round of federated training iteration.

[0025] Subsequently, a performance evaluation was conducted across three dimensions: (1) Evaluation of the effectiveness of defense against member reasoning attacks: Member reasoning attacks are modeled as a binary hypothesis testing problem based on model parameters. Attackers construct member reasoning decision functions. And its value is ,in, express Dimension This represents the total dimension of the model after expanding all parameters involved in the inference, and is then used to infer the specific aerial sample. Does it belong to the first Private training set for each drone client Define the attacker's target model parameters The inference advantage is The calculation formula is: ; in, The aerial photograph samples are to be judged. For the first A private training set for each drone client. Let the probability function be used; without a defensive mechanism, overfitting of the model to isolated samples may lead to... Therefore, one of the core optimization objectives of the defense algorithm of this invention is to reduce the attacker's inference advantage by spatially adaptively adding noise, making it as close as possible to the level of random guessing. The inference advantage is used to measure the attacker's inference ability, and the closer the value is to 0, the better the defense effect.

[0026] (2) Evaluation of the defense effect against gradient depth leakage attack: The gradient depth leakage attack is modeled as a non-convex optimization problem based on gradient matching. After the attacker intercepts the noisy update uploaded by the client, it is converted into an equivalent single-step gradient by combining the known local learning rate. Suppose the attacker intercepts noisy updates uploaded by the drone node in a specific round. Since the local parameter update amount actually includes the learning rate With the cumulative effect of local multi-step training, if the attacker knows the local learning rate and other hyperparameters, the intercepted model updates can be approximately converted into equivalent single-step gradients. The attacker iteratively optimizes the solution to obtain the forged image, minimizing the difference between the gradient of the forged image and the captured gradient under the current global model. The attacker's optimization objective is: ; in, The optimal forged image reconstructed by the attacker. For the first Global model parameters of the wheel, The gradient of the loss function with respect to the model parameters. for The square of the norm, For total variational prior regularization, These are the regularization weight coefficients. For the attacker, a fake input aerial image to be optimized. This indicates the solution that minimizes the objective function. The peak signal-to-noise ratio (PSNR) and structural similarity index measure (SSIM) are used to quantify the quality of the reconstructed image. The lower the value, the less privacy is compromised and the better the defense effect of this method.

[0027] (3) Evaluation of model classification utility: The Top-1 retrieval accuracy, Top-5 retrieval accuracy and training loss convergence curve are used as model utility indicators to verify the model availability of this method under privacy protection constraints.

[0028] To verify the effectiveness of this method, a simulation experimental environment was constructed to conduct comparative verification: Dataset: Given the common lack of 3D spatial context in existing public datasets, this invention constructs an experimental dataset based on a high-resolution city model (City Sample) from Unreal Engine. This dataset contains 5000 high-resolution aerial images and their corresponding 30,000+ 3D flight trajectory points. To simulate the topological clustering effect of drone networks, the system first uses the K-Means clustering algorithm to divide all trajectory points into 15 geographical blocks in 3D space, and then binds each block to one of 15 virtual drone clients. Within each client, image samples are divided into a local training set, validation set, and test set in an 8:1:1 ratio to ensure the independence of local model evaluation.

[0029] Comparison Method: This invention compares SA-LDP with several existing adaptive defense schemes, including Uniform DP, FedSMP, FedAS, FedMSBA, P3Fed, and APM. Simultaneously, a no-defense baseline (without any deployed defenses) is used as an approximate upper bound for model utility and a reference for privacy leakage risk, to evaluate the trade-off between model performance and privacy protection of different defense mechanisms.

[0030] Configuration: All experiments were deployed on a deep learning workstation equipped with an NVIDIA RTX 4090 GPU, and the software environment was built based on the PyTorch 2.1 framework.

[0031] Verification using comparison methods: (1) Verification of the correlation between spatial density and privacy risk: To verify the quantitative correlation between 3D spatial topological density and member reasoning risk, this invention, without deploying any defense measures, divides the CitySample dataset into three independent verification groups—low density, medium density, and high density—based on the 3D density of trajectory points. The white-box MIA sensitivity test results are as follows: Figure 2 As shown, throughout the entire federated training cycle, the mean ASR of the low-density region was consistently higher than that of the medium- and high-density regions, with a peak ASR of 63.53%. In contrast, the ASR of the medium- and high-density groups fluctuated between 51% and 56%, closer to the 50% random guess level. This result indicates that isolated samples in sparse spatial domains typically possess stronger visual uniqueness and spatial long-tail characteristics, making them more susceptible to over-memorization by deep representation networks, thus exhibiting a higher risk of privacy leakage. These results validate the rationale for using spatial density as a proxy variable for privacy risk.

[0032] (2) Comparison of utility and privacy performance: The results of the privacy budget spatial distribution obtained based on density allocation are as follows Figure 3 As shown in the figure, regions with higher density are typically allocated larger privacy budgets, corresponding to weaker perturbation strengths and relatively relaxed privacy protections; the yellow areas in the figure represent high-density regions. The loss convergence curves and retrieval accuracy curves of each scheme during 100 rounds of federated training are shown in the figure. Figures 4 to 6 As shown, while No-Defense achieved a peak Top-1 accuracy of 80.4%, it faces a high risk of privacy leakage. When a globally unified noise mechanism is introduced, high-intensity isotropic noise can overwhelm the effective gradient directions, leading to significant underfitting of the model, with the highest Top-1 accuracy reaching only 51.7%. In contrast, the SA-LDP mechanism proposed in this invention, by applying attenuating perturbations to the backbone network, better preserves the model's basic feature extraction capabilities, achieving a Top-1 accuracy of up to 68.9%, significantly outperforming the traditional unified noise scheme, and its convergence curve is smoother.

[0033] Regarding the effectiveness of MIA defense, Figure 7 The paper demonstrates the dynamic change of ASR (Advanced Situational Rate) in MIA (Multi-Level Analysis) across communication rounds. The ASR of the No-Defense global model gradually increases with training, reaching a maximum of 70.3%, indicating that the model has developed significant feature memory for the training data. Uniform DP (Unified DP) can suppress the ASR and maintain it around 55%. In contrast, the SA-LDP mechanism proposed in this invention controls the ASR between 54.1% and 61.8% in the later stages of training, keeping the attacker's inference advantage at a low level close to random guessing.

[0034] To further measure the overall ability to balance privacy and utility, Figure 8A utility-privacy two-dimensional scatter plot was constructed. While Uniform DP offers some privacy protection, its highest Top-1 accuracy is only 51.7%, significantly compromising model usability. Furthermore, schemes such as FedMSBA and FedSMP, while suppressing ASR, also face a utility bottleneck where accuracy struggles to exceed 40%. In contrast, SA-LDP achieves higher retrieval accuracy while maintaining an effective privacy protection boundary, thus achieving a more engineering-approved balance between privacy and utility while ensuring deep network usability. The performance metrics of the final models for each scheme are shown in Table 1.

[0035] Table 1: Comparison of retrieval accuracy and ASR of the final model

[0036] (3) Comparison of DLG gradient leakage defense effects. At the micro level, Table 2 shows the comparison of gradient fidelity and signal-to-noise ratio of each defense scheme in the backbone network and projection space. The traditional Uniform DP noise-adding strategy reduces the backbone network fidelity to 0.0016 and the signal-to-noise ratio to -55.9004 dB, which explains the significant decrease in its model classification performance at the micro level. In contrast, APM has higher cosine fidelity in the backbone network and projection space, at 0.9901 and 0.9869 respectively, and the signal-to-noise ratio remains in the positive range, indicating that the perturbation of the gradient direction by this mechanism is relatively limited. The SA-LDP mechanism proposed in this invention achieves differentiated perturbation at different network layers. Specifically, in the projection space, which is responsible for calculating the contrastive loss and is more privacy-sensitive, the gradient fidelity is suppressed to 0.0036, approaching zero and exhibiting random fluctuations, resulting in a signal-to-noise ratio (SNR) of -46.8886 dB, with perturbation strength comparable to Uniform DP. However, in the backbone network layers responsible for general feature extraction, the gradient fidelity remains at 0.016, and the SNR is improved by approximately 20 dB compared to Uniform DP. This asymmetric perturbation control demonstrates the effectiveness of SA-LDP in balancing retrieval accuracy and attack resistance at the micro-gradient level.

[0037] Table 2: Comparison of Gradient Fidelity and Signal-to-Noise Ratio of Each Defense Scheme in Backbone Network and Projection Space

[0038] At the macroscopic visual level, Table 3 and Figure 9This paper presents the quantitative evaluation and visualization results of DLG visual reconstruction. Without defensive measures, the average SSIM of the attacker's reconstructed image reaches 0.8700, and the PSNR is 28.88 dB, indicating a serious risk of visual information leakage from the shared, unperturbed model updates. After introducing defensive mechanisms, the reconstruction results of most baseline schemes appear visually as disordered noise, with an SSIM close to 0. The proposed SA-LDP, while maintaining a certain fidelity of the backbone network, interferes with the convergence path of the DLG optimization process by injecting main perturbation noise into the projection space. The average PSNR of its reconstructed image decreases to 4.97 dB, and the SSIM decreases to 0.0045. These results demonstrate that directional perturbation of the deep feature projection space can effectively suppress pixel-level privacy leakage while preserving the gradient evolution capability of the backbone network.

[0039] Table 3: Quantitative Evaluation of DLG Visual Reconstruction

[0040] Experimental results show that the method of the present invention can significantly improve the model retrieval accuracy and converge more smoothly compared with the globally unified noise addition scheme. At the same time, it can effectively suppress the success rate of MIA attacks and greatly reduce the image reconstruction quality of DLG attacks. It achieves a better balance between privacy protection capabilities and model utility and is suitable for the spatially heterogeneous network environment of UAV swarms.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A spatially perceptive local differential privacy protection method for UAV federated learning, characterized in that, Includes the following steps: S1. Build an unsupervised representation model based on momentum contrast learning on the drone client, complete local training using local aerial photography private dataset, and extract model parameters to update incrementally; S2. Map the 3D flight trajectory points of the UAV to a continuous topological density field, calculate the normalized topological density, dynamically allocate the point-level basic privacy budget based on the normalized topological density, and aggregate to obtain the client-level privacy budget; wherein, the calculation of the normalized topological density specifically includes: The spatial trajectory of the UAV during its flight cycle is defined as a discrete three-dimensional point cloud set, and a single trajectory point is denoted as . ,in , , These are the coordinates of the trajectory points on the x-axis, y-axis, and z-axis, respectively. It is the transpose symbol; Introducing a height weighting coefficient Combined with spatial weighting matrix The height axis is scaled, and then the weighted coordinates are independently standardized using the Z-score standardization method to obtain the standardized trajectory points; Construct a KD-Tree nearest neighbor topology graph in the normalized space, calculate the expected distance between each trajectory point and its nearest neighbor set, and define the absolute spatial density. The calculation formula is: ； in, For standardized trajectory points The expected distance to its nearest neighbor set, To prevent the calculation of overflow smoothing terms, Represents the complete set consisting of the density values ​​of all trajectory points; Finally, a truncation operator is constructed using the 5% and 95% quantiles of the density distribution to remove outlier drift points and map the absolute spatial density to a normalized topological density. ; Dynamic allocation of privacy budgets specifically includes: Given a range of system privacy budget values The normalized topological density is obtained through the Sigmoid mapping function. Smooth transition to point-level basic privacy budget The calculation formula is: ； in, To control the hyperparameters of the mapping steepness, The median of the density distribution. The truncation operator is used to constrain the mapping result to... Within the interval, It is an exponential function; A low quantile aggregation strategy is adopted, and the 10th percentile of the point-level privacy budget corresponding to all local trajectory points is taken as the client-level privacy budget of the current drone client. The calculation formula is: ； in, For the first A point-level privacy budget set for all local trajectory points of a drone client. The number of samples in the local dataset. The function to calculate the 10th percentile; S3. Based on the client-level privacy budget, noise baseline calibration is performed. Different intensities of heterogeneous Gaussian noise are injected into the backbone network and projection space of the model to obtain a noisy model update that satisfies the (ε,δ)-LDP constraint. S4. Upload the noisy model updates from each drone client to the federated server for aggregation, synchronize the global model parameters, and conduct a comprehensive evaluation.

2. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 1, characterized in that, S1 specifically includes: S11. Select the lightweight object detection network LEAF-YOLO as the basic architecture, remove its supervised detection head, and retain the backbone network and feature pyramid structure as the feature encoder. The parameter set of the feature encoder is denoted as... ; S12. A projection head composed of a multilayer sensing mechanism is cascaded after the feature encoder. The parameter set of the projection head is denoted as... The semantic features output by the encoder are mapped to a normalized low-dimensional latent projection space using a projection function, and this normalized low-dimensional latent projection space is denoted as Z-Space, thus obtaining the projected features. The mapping formula is: ； in, For the feature encoder on the input image Extracted semantic representations , Represents the real number field. The dimension of the feature vector output by the encoder. For projection function, for Norm; S13. Based on the momentum contrastive learning framework, this method constructs a system by narrowing the distance between positive sample features in Z-space and reducing the similarity between features in the positive and negative sample queues. infoNCE The loss function is used for iterative model training locally. S14. After completing local training, extract the model parameters for the current round and update the increment. Used for federal uploads.

3. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 1, characterized in that, Normalized topological density The calculation formula is: ； in, For truncation operators based on the 5th and 95th percentiles, This represents the 0.05 quantile of the absolute spatial density set. It is the 0.95 quantile value of the absolute spatial density set.

4. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 1, characterized in that, S3 specifically includes: S31, Using the maximum threshold Incremental update of model parameters Execute global Norm-based clipping yields the clipping update amount that satisfies the sensitivity constraint; S32, Based on client-level privacy budget Minimum noise scaling factor of the backbone network Perform a reverse calibration of the reference noise to obtain the standard deviation of the reference Gaussian noise. ; S33. Gaussian noise of different intensities is injected into the backbone network parameters and projection head parameters respectively to obtain the noisy model update after hierarchical heterogeneous perturbation; among which, random noise is injected into different network layers. Follows the following distribution: ； in, This represents the noise scaling factor for the projection space. It is the identity matrix. For the backbone network parameter set, For the projection head parameter set, This indicates a Gaussian distribution.

5. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 4, characterized in that, Standard deviation of reference Gaussian noise The calculation formula is: ； in, The relaxation parameter in (ε,δ)-LDP It is a logarithmic function.

6. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 1, characterized in that, The comprehensive evaluation in S4 includes three dimensions: defense effectiveness against member inference attacks, defense effectiveness against gradient depth leakage attacks, and model classification utility. Specifically, the evaluation of defense effectiveness against member inference attacks is as follows: Membership inference attacks are modeled as a binary hypothesis testing problem based on model parameters, defining the attacker's targets for the model parameters. The inference advantage is The calculation formula is: ； in, For member inference decision function, The aerial photograph samples are to be judged. For the first A private training set for each drone client. Let be a probability function.

7. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 6, characterized in that: The specific evaluation of the defense effectiveness against gradient depth leak attacks is as follows: The gradient depth leakage attack is modeled as a non-convex optimization problem based on gradient matching, and the attacker's optimization objective is: ； in, The optimal forged image reconstructed by the attacker. For the first Global model parameters of the wheel, The gradient of the loss function with respect to the model parameters. For the intercepted equivalent single-step gradient, for The square of the norm, For total variational prior regularization, These are the regularization weight coefficients. For the attacker, a fake input aerial image to be optimized. This indicates the solution that minimizes the objective function. .

8. The spatially perceptive local differential privacy protection method for UAV federated learning according to claim 2, characterized in that: infoNCE The formula for calculating the loss function is: ； in, for infoNCE The value of the loss function, For temperature coefficient, To query the projected features of a sample, These are the projected features of positive sample keys. The capacity of the negative sample queue. This is the index identifier for the positive sample key. This is the traversal index in the negative sample queue. The first negative sample in the queue Projected features of negative samples, This is the summation symbol.

Images