A malicious edge server cooperative detection and defense method for split federated learning
By dividing the intermediate model into multiple sub-intermediate models in split federated learning and combining a collaborative defense mechanism of client reports and cloud detection, the problem of model theft and poisoning attacks on edge servers is solved, enabling accurate location and defense against malicious edge servers and improving the security and stability of the system.
Patent Information
- Application Number
- CN202611080671.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-21
- Publication Date
- 2026-08-25
AI Technical Summary
In split federated learning, edge servers may perform model theft and model poisoning attacks, and it is difficult to accurately locate malicious edge servers in a multi-edge server collaborative training path. Existing methods have high computational and communication overhead and are difficult to apply to resource-constrained clients.
The intermediate model is further divided into multiple sub-intermediate models and deployed in different edge server groups. The client performs lightweight anomaly detection, and the cloud server performs further verification. Combined with reputation value management and identification of disguised malicious servers, a collaborative defense mechanism combining client reports and cloud detection is implemented.
It reduces the risk of client data being reconstructed, accurately locates malicious edge servers, improves the security and stability of the split federated learning system, and reduces computational and communication overhead.
Smart Images
Figure CN122640239A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of federated learning, split learning, and network security technology, and in particular to a method for collaborative detection and defense of malicious edge servers for split federated learning. Background Technology
[0002] Split-Federated Learning, a distributed model training method combining split learning and federated learning, enables collaborative model training without directly sharing the client's original data. Specifically, the client typically retains local data and parts of the model's structure, edge servers handle the computationally intensive intermediate model training tasks, and cloud servers handle global model aggregation. Compared to traditional federated learning, split-federated learning reduces the computational and storage burden on clients, allowing resource-constrained clients to participate in large-scale deep model training.
[0003] Existing split-federated learning methods typically divide the model into client-side and server-side models, or further employ a U-shaped split-federated learning structure, where the client retains both the head and tail of the model, while the edge servers are only responsible for training the intermediate parts. This structure can reduce the exposure of label information and parts of the model structure, thus improving privacy protection during training to some extent. Furthermore, to reduce the risk of a single edge server obtaining complete intermediate model information, the intermediate model can be further divided into multiple sub-intermediate models and deployed in different edge server groups.
[0004] However, the introduction of edge servers also exposes split federated learning to new security risks. Edge servers have access to intermediate features, gradient information, or some model parameters during training. If an attacker gains control of an edge server, it may use this information to reconstruct client data and launch a model theft attack; it may also upload incorrect parameters, forged gradients, or stochastic gradients during forward or backward propagation, thereby launching a model poisoning attack, leading to a decline in global model performance or even training failure.
[0005] Existing security measures mainly include encrypted computation, trusted execution environments, anomaly parameter detection, and robust aggregation. While these methods can enhance training security to some extent, they still suffer from significant computational overhead, high communication costs, and difficulty in locating specific malicious edge servers in split federated learning scenarios. Especially when the intermediate model is divided into multiple sub-intermediate models and deployed to multiple edge server groups, a training path typically involves multiple edge servers. Any malicious edge server can potentially affect the entire training path, making the detection and localization of malicious behavior even more challenging.
[0006] Therefore, defending against malicious edge servers in split federation learning still faces the following challenges:
[0007] 1. First, edge servers may infer client data through intermediate features, gradients, or model parameters, thereby launching model theft attacks. Existing methods often rely on encryption or trusted hardware for protection, but these methods typically incur significant computational and communication overhead, making them unsuitable for large-scale training scenarios involving resource-constrained clients.
[0008] 2. Secondly, in a multi-sub-intermediate model split structure, although a single edge server may struggle to obtain complete intermediate model information, a malicious edge server can still influence model training by uploading incorrect gradients, stochastic gradients, or abnormal intermediate parameters. Since a single training path involves multiple edge servers, the cloud server cannot directly determine which specific edge server generated the malicious behavior.
[0009] 3. Third, malicious edge servers may behave normally during the detection phase but perform malicious updates during the actual training phase, thereby evading regular detection mechanisms. Existing methods lack continuous identification and reputation constraint mechanisms for such disguised malicious edge servers, making it difficult to guarantee the long-term security of the split federated learning system during multiple rounds of training. Summary of the Invention
[0010] The technical problem this invention aims to solve is: addressing the issues of potential model theft and poisoning attacks by edge servers in existing split federated learning systems, as well as the difficulty in accurately locating malicious edge servers in multi-edge server collaborative training paths. This invention provides a collaborative detection and defense method for malicious edge servers in split federated learning. This method can detect, locate, and eliminate malicious edge servers during the training process while reducing the risk of client data reconstruction, thereby improving the security and stability of the split federated learning system.
[0011] To address the aforementioned technical problems, the present invention proposes the following technical solution: a collaborative detection and defense method for malicious edge servers oriented towards split federated learning, comprising the following steps:
[0012] S1, the cloud server initializes the global model and divides the global model into a head model, an intermediate model and a tail model; wherein, the head model and the tail model are deployed on the client, and the intermediate model is further divided into multiple sub-intermediate models, which are deployed in different edge server groups respectively;
[0013] S2, at the beginning of each training round, the client selects training data from the local dataset and selects edge servers from different edge server groups to form the training path for the current round;
[0014] S3, the client inputs the training data into the head model for forward propagation to obtain intermediate features, and sends the intermediate features to each edge server in sequence according to the current round of training path. Each edge server continues to perform forward propagation using its sub-intermediate model. The last edge server returns the output result to the client, and the client then obtains the model output through the tail model.
[0015] S4, the client calculates the training loss based on the model output and corresponding data labels, and performs backpropagation in the order of tail model, multiple sub-intermediate models and head model; during the backpropagation process, each edge server calculates and transmits gradients in turn, and the client receives the edge-side gradients returned by the edge servers in the training path.
[0016] S5, the client selects local validation data from the current round of training data, inputs the local validation data into the previous round of global model, calculates the local reference gradient corresponding to the edge gradient position, and determines whether there is a suspected malicious edge server in the current round of training path based on the gradient similarity or gradient deviation between the edge gradient and the local reference gradient.
[0017] S6. When the client determines that there is a suspected malicious edge server in the current training path, the client sends a malicious report to the cloud server. The malicious report includes the current training path information, local verification data and training round information.
[0018] S7. After receiving the malicious report, the cloud server calculates the cloud reference gradient based on the local verification data and constructs a detection training path. The detection training path retains the edge server to be detected and replaces other edge servers in the current round of training path with edge servers with higher credibility in the corresponding edge server group.
[0019] S8, the cloud server performs verification training based on the detection training path, obtains the detection gradient generated by the edge server to be detected, and calculates the gradient similarity or gradient deviation between the detection gradient and the cloud reference gradient, and identifies malicious edge servers based on the calculation results.
[0020] S9, the cloud server reduces the reputation value of malicious edge servers based on the identification results, or removes them from the candidate set of subsequent training paths, and excludes the model parameters uploaded by malicious edge servers when aggregating the global model to obtain the next round of global model.
[0021] Furthermore, in step S1, the intermediate model is divided into at least two sub-intermediate models, each sub-intermediate model corresponds to an edge server group, and different edge server groups are responsible for training different sub-intermediate models.
[0022] Furthermore, in step S2, the current round of training path is composed of an edge server selected by the client from each edge server group, so that a training process passes through multiple edge servers that are responsible for different sub-intermediate models in sequence.
[0023] Furthermore, in step S5, the local verification data is a subset selected by the client from the current round of training data, and the amount of local verification data is less than the amount of current round of training data, so as to reduce the detection overhead on the client side.
[0024] Furthermore, in steps S5 and S8, the gradient similarity is calculated using cosine similarity, Euclidean distance similarity, Jaccard similarity, or a combination thereof.
[0025] Furthermore, when the gradient similarity or gradient deviation between the edge-side gradient and the local reference gradient meets the preset client reporting conditions, the client sends a malicious report to the cloud server; otherwise, the client does not send a malicious report.
[0026] Furthermore, in step S7, when constructing the detection training path, the cloud server detects the edge servers in the current round of training path one by one; during each detection, one edge server to be detected is retained, and the other edge servers are replaced with edge servers in the corresponding edge server group that have higher reputation values or fewer reports.
[0027] Further, in step S8, the cloud server calculates the similarity of the gradients of one or more layers in the sub-intermediate model that the edge server to be detected is responsible for, and determines the final detection result based on the maximum value, minimum value, average value or weighted average value.
[0028] Furthermore, in step S9, the cloud server maintains a reputation value for each edge server; when an edge server is identified as a malicious edge server, its reputation value is reduced; when the reputation value of an edge server is lower than or equal to a preset removal threshold, the edge server is removed from the candidate set of subsequent training paths.
[0029] Furthermore, following step S8, a step of detecting spoofed malicious edge servers is included. A spoofed malicious edge server refers to an edge server that performs normal training during the cloud detection phase but uploads abnormal gradients or abnormal model parameters during the actual training process. The cloud server requires the reported edge server to upload the gradients of the sub-intermediate model it is responsible for training during subsequent training, and compares the similarity of the sub-intermediate model gradients with the detection gradients obtained based on local validation data. When the gradient similarity or gradient deviation between the two meets preset deep recognition conditions, the edge server is determined to be a spoofed malicious edge server, and its reputation value is reduced or it is removed from the database.
[0030] Furthermore, in step S9, the cloud server performs a weighted average of the header model parameters, tail model parameters uploaded by the client, and sub-intermediate model parameters uploaded by edge servers that are not identified as malicious, to obtain the next round of global model.
[0031] Compared with the prior art, the advantages of the present invention are as follows:
[0032] 1. This invention further divides the intermediate model in split federated learning into multiple sub-intermediate models and deploys them to different edge server groups, making it difficult for a single edge server to obtain the complete intermediate model structure, complete intermediate features and complete gradient information, thereby increasing the cost of model theft attacks and reducing the risk of client data being reconstructed.
[0033] 2. This invention employs a collaborative defense mechanism combining client-side reporting and cloud-based detection. The client performs lightweight anomaly detection on the training path based on local reference gradients, while the cloud server further verifies the reported edge servers by constructing detection training paths. This approach can accurately locate malicious edge servers while reducing the computational burden on the client.
[0034] 3. This invention introduces a reputation value management, malicious server removal, and disguised malicious server identification mechanism. The cloud server lowers the reputation value of malicious edge servers based on the detection results, and removes them from the subsequent training process when their reputation value reaches the removal criteria. At the same time, it can identify disguised malicious edge servers that perform normally during the detection phase but perform malicious updates during the actual training phase, thereby improving the security and stability of the split federated learning system in multiple rounds of training. Attached Figure Description
[0035] Figure 1 This is a schematic diagram of the training process and model aggregation structure of multi-sub-intermediate model split federated learning in a specific embodiment of the present invention. Figure 2 This is a schematic diagram of a collaborative defense mechanism for malicious edge servers that combines client-side reporting with cloud-based detection, as described in a specific embodiment of the present invention. Figure 3 This is a schematic diagram comparing the cost of model theft attacks under different intermediate model partitioning granularities in a specific embodiment of the present invention.
[0036] Table 1 shows the comparison results of client data reconstruction quality under different intermediate model partitioning granularities in the embodiments of the present invention. Table 1
[0037] Table 2 shows the comparison results of model accuracy, communication overhead, and time overhead before and after using the method of the present invention under different attack scenarios in the embodiments of the present invention. Table 2 Detailed Implementation
[0038] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.
[0039] like Figure 1 As shown, this embodiment provides a collaborative detection and defense method for malicious edge servers in a split federated learning system. This method is applied to a multi-sub-intermediate model split federated learning system, which includes a client, multiple edge server groups, and a cloud server. The client is responsible for storing local training data and training the head and tail models of the model locally. Multiple edge server groups each hold and train different sub-intermediate models. The cloud server is responsible for global model initialization, model parameter aggregation, malicious report reception, detection path construction, malicious edge server identification, reputation value management, and global model distribution.
[0040] In this embodiment, the client set is assumed to be... The edge server group is set as follows ,in This indicates the number of sub-intermediate models obtained by dividing the intermediate model. And. Each edge server group Train a corresponding sub-intermediate model. Client Holding local datasets Dataset It contains several training samples and their corresponding labels. The goal of split federated learning is to obtain a global model that meets preset training requirements through collaborative training between the client, edge server group, and cloud server, without the client directly uploading the original training data.
[0041] The cloud server first initializes the global model to be trained and divides it into head, intermediate, and tail models. The head and tail models are deployed on the client side, while the intermediate model is further divided into multiple sub-intermediate models, which are then deployed to different edge server groups. Let the global model parameters be... Then it can be expressed as:
[0042] (1)
[0043] in, Indicates the parameters of the head model. Indicates intermediate model parameters. This represents the tail model parameters. Further, the intermediate model parameters... Divided into:
[0044] (2)
[0045] in, Indicates the first Each sub-intermediate model has its own set of parameters. Each sub-intermediate model corresponds to an edge server group, and different edge server groups are responsible for training different sub-intermediate models. Through this division method, a single edge server can only access a portion of the intermediate model structure, some intermediate features, and some gradient information, making it difficult to obtain complete intermediate model information, thereby reducing the risk of malicious reconstruction of client data.
[0046] In the In the first round of training, Client From local dataset Select the current round of training data. for A subset of. Subsequently, the client selects one edge server from each edge server group to form the training path for the current round:
[0047] (3)
[0048] in, Indicates the first The client in the first In the first round of training Edge server group The edge server selected in the current round of training. Passing through in sequence Each edge server is responsible for the forward and backward propagation calculations of a sub-intermediate model.
[0049] During the forward propagation process, the client first sends the training data... The head model is input, and intermediate features output by the head model are obtained. Subsequently, the client sends these intermediate features to the training path. The first edge server in the training path continues forward propagation using its first sub-intermediate model and sends its output to the next edge server in the training path. Each edge server sequentially completes the computation of its assigned sub-intermediate model according to the order of the training path. The last edge server returns its output to the client, which then inputs this output into the tail model to obtain the final model output.
[0050] During backpropagation, the client calculates the training loss based on the final model output and corresponding data labels, and first updates the tail model parameters. Subsequently, the client sends the gradients obtained from the backpropagation of the tail model to the last edge server in the training path. Each edge server calculates the gradients in reverse order of the training path, updates the parameters of the intermediate sub-models it is responsible for, and then passes the gradients to the previous edge server. Finally, the first edge server returns the edge-side gradient used to update the head model to the client, and the client updates the head model parameters based on this edge-side gradient. .
[0051] After completing the current round of training, the client uploads the head model parameters and tail model parameters to the cloud server. Each edge server in the training path uploads the parameters of its assigned sub-intermediate models to the cloud server. The cloud server aggregates the head model parameters, tail model parameters, and sub-intermediate model parameters uploaded by the client to obtain the final training result. Round global model In one implementation, the aggregation method employs a weighted average approach, where the aggregation weights can be determined based on the amount of client data, the reputation value of the edge server, the number of training rounds, or a system-preset strategy.
[0052] like Figure 2 As shown, this embodiment also includes a collaborative defense process for malicious edge servers that combines client-side reporting with cloud-based detection. Figure 2 Taking the intermediate model being divided into two sub-intermediate models as an example, i.e. Accordingly, the system includes a first edge server group and a second edge server group. Each edge server group contains multiple candidate edge servers, and a corresponding reputation value is maintained for each edge server. It should be noted that... Figure 2 This explanation only considers the case of two sub-intermediate models. When the intermediate model is divided into three or more sub-intermediate models, the cloud server can perform individual detection on each edge server in the training path in the same way.
[0053] During the client-side reporting phase, after the current training round ends, the client retrieves the training data from the current round. A portion of the data is selected as local verification data, denoted as . The local validation data is a subset of the current round of training data, and its size is smaller than that of the current round of training data. In a preferred embodiment, the size of the local validation data is set to approximately 5% of the current round of training data, thereby reducing the computational overhead on the client side while ensuring detection performance.
[0054] The client will verify the data locally. Input the previous round global model And during backpropagation, the local reference gradient corresponding to the edge gradient position is obtained. Let the edge gradient returned by the edge server during training be... The local reference gradient calculated by the client based on the previous round of global model is: The gradient similarity between the two can be calculated using cosine similarity:
[0055] (4)
[0056] Where ||·|| represents the Euclidean norm. The client determines whether a suspected malicious edge server exists in the current training path based on the gradient similarity or gradient deviation between the edge-side gradient and the local reference gradient. When the gradient similarity or gradient deviation between the two meets preset client reporting conditions, the client considers a possible malicious edge server to exist in the current training path and sends a malicious report to the cloud server. The malicious report includes information about the current training path. Local verification data information Training round information and client identification information.
[0057] After receiving a malicious report, the cloud server first calculates the cloud reference gradient based on the locally verified data. Specifically, the cloud server uses the locally verified data... Input the previous round global model And during backpropagation, the reference gradient of the corresponding layer or module of the intermediate model is extracted, denoted as... Subsequently, the cloud server constructs a detection training path based on the training path in the malicious report in order to further locate the malicious edge server in the training path.
[0058] When constructing the detection training path, the cloud server checks each edge server in the reported training path one by one. For each edge server to be detected, the cloud server retains that edge server and replaces the other edge servers in the training path with edge servers from the corresponding edge server group that have higher reputation values or fewer reports. In this way, the interference of other potentially malicious edge servers on the detection results can be reduced, enabling the cloud server to more accurately determine whether the edge server to be detected has malicious behavior.
[0059] by Figure 2 Taking two edge server groups as an example, if the currently reported training path is The cloud server is monitoring the edge servers in the first edge server group. During testing, retain The servers in the second edge server group are replaced with servers with higher reputation scores or fewer reported instances, thus forming the first detection training path. The cloud server is based on the first detection training path. Perform validation training and obtain the detection gradient generated by the first edge server to be detected. .
[0060] Accordingly, the cloud server monitors the edge servers to be detected in the second edge server group. During testing, retain The servers in the first edge server group are replaced with servers with higher reputation values or fewer reported instances, thus forming the second detection training path. The cloud server is based on the second detection training path. Perform validation training and obtain the detection gradients generated by the second edge server to be detected. .
[0061] The cloud server calculates the similarity between the detection gradient and the cloud reference gradient. For the first... There are several edge servers to be detected, and their detection gradient is: The cloud reference gradient is Then the gradient similarity between the two can be expressed as:
[0062] (5)
[0063] When the gradient similarity or gradient deviation between the detected gradient and the cloud reference gradient meets the preset cloud detection conditions, the cloud server determines that the edge server to be detected is a malicious edge server; otherwise, it determines that the edge server does not currently exhibit malicious behavior. For sub-intermediate models containing multiple network layers or multiple structural modules, the cloud server can calculate the similarity between the gradients of each layer separately, and determine the final detection result based on the maximum value, minimum value, average value, or weighted average value.
[0064] In this embodiment, the cloud server maintains a reputation value for each edge server. Let the edge server... Reputation value When the edge server When a cloud server identifies a server as a malicious edge server, the cloud server lowers its reputation score.
[0065] (6)
[0066] in, This indicates the extent to which the preset reputation value has decreased. When the edge server... When a reputation value is lower than or equal to a preset removal threshold, the cloud server removes the edge server from the candidate set of subsequent training paths, preventing it from participating in subsequent model training. For edge servers that are reported multiple times but not confirmed to be malicious, the cloud server can record the number of reports and reduce their priority in subsequent training path selection or detection path construction.
[0067] After completing the detection of malicious edge servers, reputation value updates, and exclusion of abnormal parameters, the cloud server aggregates the client model parameters and edge server sub-intermediate model parameters that were not identified as malicious to obtain a new global model. The global model and the corresponding sub-intermediate model parameters are then distributed to the client and each edge server group for the next round of training.
[0068] Furthermore, to prevent malicious edge servers from behaving normally during the cloud detection phase but performing malicious updates during the actual training phase, this embodiment also includes a fake malicious edge server detection step. A fake malicious edge server refers to an edge server that performs normal training during the cloud detection phase but uploads abnormal gradients or abnormal model parameters during the actual training process. The cloud server requires the reported edge server to upload the gradients of the sub-intermediate model it is responsible for training during subsequent training, and compares the similarity of these sub-intermediate model gradients with the detection gradients obtained based on local validation data. When the gradient similarity or gradient deviation between the two meets preset depth recognition conditions, the cloud server determines that the edge server is a fake malicious edge server and lowers its reputation value or removes it from the system.
[0069] In one specific implementation, the gradient similarity can be calculated using cosine similarity, Euclidean distance similarity, Jaccard similarity, or a combination thereof. The client reporting conditions, cloud detection conditions, and deep recognition conditions can be preset based on the model structure, dataset type, number of edge servers, estimated proportion of malicious servers, or system security requirements. The reputation value reduction magnitude, initial reputation value, and removal threshold can also be set according to the system security level.
[0070] To verify the defensive effect of multi-sub-intermediate model partitioning against model theft attacks in this embodiment, a specific experiment was conducted. MobileNet-V2, ResNet18, and ResNet50 were used as model structures, respectively. The proportion or number of malicious edge servers required for an attacker to achieve the same accuracy of the alternative model was compared when no sub-intermediate model was partitioned, when the model was partitioned into two sub-intermediate models, and when the model was partitioned into four sub-intermediate models.
[0071] like Figure 3As shown, under the same model accuracy target, the proportion and number of malicious edge servers that an attacker needs to control increase significantly with the increase in the granularity of intermediate model partitioning. Specifically, when the intermediate model is not further partitioned, an attacker only needs to control a relatively small number of edge servers to obtain relatively complete intermediate model information; when the intermediate model is divided into two or four sub-intermediate models, the attacker must simultaneously control a sufficient number of edge servers in multiple edge server groups to obtain complete or near-complete intermediate model structure, parameters, and gradient information. Therefore, multi-sub-intermediate model partitioning can significantly increase the cost of model theft attacks and reduce the risk of client data being reconstructed and alternative models being constructed.
[0072] Furthermore, as shown in Table 1, under different intermediate model partitioning granularities, the less model structure knowledge a malicious edge server obtains, the worse the quality of its reconstruction of client data. Specifically, when the intermediate model is divided into multiple sub-intermediate models, the malicious edge server can only obtain a portion of the intermediate model information, leading to a decrease in the peak signal-to-noise ratio and structural similarity of the reconstructed data, and an increase in the perceived difference index. This result indicates that the multi-sub-intermediate model partitioning method described in this embodiment can reduce the amount of information that a single edge server can obtain, thereby reducing the risk of client data leakage.
[0073] Furthermore, to verify the effectiveness of the client-reported and cloud-detected collaborative defense mechanism against model poisoning attacks in this embodiment, a specific experiment was conducted to compare the model accuracy, communication overhead, and time overhead before and after applying the method of this invention under backdoor attack, gradient inversion attack, and stochastic gradient attack scenarios. As shown in Table 2, in the presence of malicious edge servers, after applying the method of this invention, the cloud server can further construct a detection training path based on the client report, detect the edge servers in the reported training path one by one, and exclude abnormal parameters or gradient updates uploaded by malicious edge servers through reputation value reduction and elimination mechanisms. Therefore, the model accuracy after applying the method of this invention is significantly higher than that without applying the method of this invention, while only introducing a small amount of communication overhead and time overhead.
[0074] In summary, this embodiment reduces the likelihood of a single edge server obtaining the complete intermediate model structure, complete intermediate features, and complete gradient information by partitioning into multiple sub-intermediate models. Furthermore, it detects, locates, and processes malicious edge servers in the training path through client reporting, cloud detection, detection path reconstruction, reputation value management, malicious edge server removal, and identification mechanisms for disguised malicious edge servers. This reduces the risk of model theft while improving the security and stability of the split federated learning system under model poisoning attacks.
[0075] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, or improvements made to the above embodiments within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for collaborative detection and defense of malicious edge servers oriented towards split federated learning, characterized in that, include: S1. The cloud server divides the global model to be trained into a head model, an intermediate model, and a tail model. The head model and tail model are deployed on the client. The intermediate model is divided into multiple sub-intermediate models, and the multiple sub-intermediate models are deployed on different edge server groups. S2. At the beginning of each training round, the client selects training data from the local dataset and selects edge servers from different edge server groups to form the current round training path. S3. The client inputs the training data into the head model to obtain intermediate features, and transmits the intermediate features to each edge server in sequence according to the current round training path. Each edge server performs forward propagation based on its corresponding sub-intermediate model. Finally, the client obtains the model output through the tail model. S4. The client calculates the loss based on the model output and the corresponding data label, and performs backpropagation in the order of tail model, multiple sub-intermediate models, and head model to obtain the edge-side gradient returned by the edge servers in the training path. S5. The client calculates the local reference gradient based on the previous round global model and local validation data, and judges whether there are suspected malicious edge servers in the current round training path based on the gradient similarity between the edge-side gradient and the local reference gradient. S6, If the client determines that there is a suspected malicious edge server in the current training path, it sends a malicious report to the cloud server. The malicious report includes the current training path information and local verification data. S7, After receiving the malicious report, the cloud server constructs a detection training path based on the local verification data and calculates the gradient similarity between the detection gradient generated by the edge server to be detected and the cloud reference gradient to identify the malicious edge server. S8, The cloud server reduces the reputation value of the malicious edge server or removes it from the training system according to the identification result, and excludes the model parameters uploaded by the malicious edge server when aggregating the global model to obtain the next round of global model.
2. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, The intermediate model mentioned in step S1 is divided into at least two sub-intermediate models, each sub-intermediate model corresponds to an edge server group, and different edge server groups are responsible for training different sub-intermediate models.
3. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, The current training path described in step S2 consists of an edge server selected by the client from each edge server group, so that a training process passes through multiple edge servers that are responsible for different sub-intermediate models in sequence.
4. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, The local validation data mentioned in step S5 is a subset selected by the client from the current round of training data. The amount of local validation data is less than the amount of current round of training data. The client inputs the local validation data into the previous round of global model and obtains the local reference gradient corresponding to the edge gradient position during backpropagation.
5. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, The gradient similarity in step S5 is calculated using cosine similarity. When the gradient similarity between the edge gradient and the local reference gradient meets the preset client reporting conditions, the client sends a malicious report to the cloud server.
6. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, The cloud reference gradient mentioned in step S7 is obtained by the cloud server inputting the local verification data into the previous round of global model and extracting the gradients corresponding to one or more layers in the intermediate model during the backpropagation process.
7. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, The detection training path described in step S7 is obtained by retaining the edge server to be detected and replacing other edge servers in the current round of training path. The replaced edge server is the edge server with a higher reputation value or fewer reports in the corresponding edge server group.
8. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, In step S8, the cloud server maintains a reputation value for each edge server. When an edge server is identified as a malicious edge server, its reputation value is reduced. When the reputation value of an edge server is lower than or equal to a preset removal threshold, the edge server is removed from the candidate set of subsequent training paths.
9. The method for collaborative detection and defense of malicious edge servers based on split federated learning according to claim 1, characterized in that, After step S7, a fake malicious edge server detection step is also included. The cloud server requires the reported edge server to upload the gradient of the sub-intermediate model it is responsible for training during the subsequent training process, and compares the similarity between the sub-intermediate model gradient and the detection gradient obtained based on local verification data. When the gradient similarity between the two meets the preset depth recognition conditions, the edge server is determined to be a fake malicious edge server.