A federated learning backdoor defense method based on frequency domain hybrid differential privacy

Abstract

The present application relates to a kind of federal learning backdoor defence method based on frequency domain hybrid differential privacy, belong to data security technical field, the present application is oriented to smart grid collaborative scheduling and state evaluation scene, aggregation server is actualized as cloud power grid dispatching center, client is actualized as the edge power terminal participating in collaborative training.Meanwhile, independent parameter shuffler is actualized as the security gateway deployed in the core side of power communication network.The present application relies on three big mechanisms to operate cooperatively: end side frequency domain hybrid differential privacy noise adding mechanism, shuffler end forced check and deassociation mechanism, aggregation server end hierarchical energy perception and dynamic monitoring mechanism.Under the premise of meeting strict local differential privacy constraint, not only the precise interception of multiple types of complex backdoor attack is realized, but also the false injury to benign trunk feature is more thoroughly avoided, finally ensure that global model converges efficiently and stably under high privacy requirement.

Description

Technical Field

[0001] This invention relates to a federated learning backdoor defense method based on frequency domain hybrid differential privacy, belonging to the field of data security technology. Background Technology

[0002] Federated learning is a promising distributed machine learning training method that enables multiple clients to collaboratively train a global model while keeping the data locally, ensuring privacy and security. However, although the raw data does not leave the client, the model gradients or parameters transmitted during communication still face serious privacy risks and are extremely vulnerable to backdoor attacks launched by malicious nodes. Backdoor attackers inject malicious samples with specific triggers into some clients, making the global model perform normally on normal tasks, but once data containing triggers is input, the model will output incorrect results preset by the attacker, posing a serious threat to the system's security. Taking the smart grid field as an example, distributed load forecasting and equipment anomaly diagnosis are crucial to ensuring the safe and stable operation of the power grid. Since the power grid operation sequence data collected by various edge power terminals (such as smart substations, photovoltaic inverters, etc.) involves enterprise capacity and extremely valuable privacy information, centralized sharing faces serious privacy leakage and data compliance risks. Federated learning achieves collaborative modeling of power data "without leaving the domain." However, during cross-site communication, the transmitted model gradients still face extremely serious privacy risks and are extremely vulnerable to backdoor attacks launched by malicious nodes, posing a catastrophic threat to the safe scheduling of the power grid system. To provide strict privacy guarantees in untrusted aggregation environments, Local Differential Privacy (LDP) has been widely adopted in federated learning. Before uploading parameters, the client independently performs gradient truncation and noise addition locally, thereby achieving parameter-level privacy protection.

[0003] However, in federated learning systems incorporating LDP, a significant challenge arises in balancing privacy protection and security defense. Current mainstream research typically attempts to eliminate malicious models by calculating the statistical similarity between client-updated parameters, or utilizes a globally static truncation threshold to limit the expansion of malicious gradients. However, these existing techniques reveal the following significant drawbacks in practical applications:

[0004] First, high-intensity privacy noise masks anomalous signals, rendering traditional detection mechanisms ineffective. Under strict LDP constraints, to meet theoretical privacy guarantees, client-injected high-intensity privacy noise severely masks anomalous spikes in signals generated by backdoor attacks, significantly reducing the effectiveness of traditional anomaly detection mechanisms based on gradient distance or statistical similarity. Furthermore, numerical truncation performed to strictly control privacy sensitivity further disrupts the direction of the true gradient. This makes existing methods ineffective against malicious attacks in complex attack scenarios.

[0005] Secondly, isomorphic noise addition mechanisms in the spatial domain have inherent limitations. Existing LDP mechanisms typically apply isomorphic uniform noise to all gradient features in the spatial domain. However, the core knowledge of neural networks is often concentrated in low-frequency regions, while subtle, hidden backdoor trigger features may be lurking in high-frequency regions. Indiscriminately applying isomorphic noise in the spatial domain not only leads to a sharp reduction in model usability due to excessive destruction of low-frequency core features, but also fails to effectively suppress high-frequency backdoor features.

[0006] Finally, globally static coarse-grained thresholds can easily affect model convergence. Existing federated defense methods generally adopt a coarse-grained approach by applying a single static pruning threshold to the global model, completely ignoring the significant differences in weight energy distribution between different network layers. When facing backdoor attacks launched by malicious nodes, this rigid mechanism struggles to accurately capture malicious perturbations hidden in specific network layers. Furthermore, in the later stages of model training, as gradient values ​​naturally decrease, this single and inflexible static pruning method can easily lead to the incorrect interception of crucial benign gradient information or its complete burying by privacy noise, affecting model convergence. Summary of the Invention

[0007] To address the challenge of balancing privacy protection and backdoor defense in existing federated learning techniques under strict Local Differential Privacy (LDP) constraints, traditional spatial domain isomorphic noise addition and globally fixed static thresholds not only fail to accurately intercept sophisticated backdoor attacks but also easily inadvertently damage benign backbone features, thus affecting model convergence, this invention proposes a federated learning backdoor defense method based on frequency domain hybrid differential privacy. Targeting smart grid collaborative scheduling and state assessment scenarios, the aggregation server is materialized as a cloud-based power grid dispatch center, and the client is materialized as an edge power terminal (such as a smart substation controller or photovoltaic inverter) participating in collaborative training. The local data processed is a power grid runtime sequence dataset with privacy protection restrictions. Simultaneously, the independent parameter shuffler is materialized as a security gateway deployed on the core side of the power communication network.

[0008] The present invention adopts the following technical solution:

[0009] A federated learning backdoor defense method based on frequency domain hybrid differential privacy includes the following steps:

[0010] S1, the cloud-based power grid dispatch center initializes the global model and parameters, and broadcasts the global model and parameters to the edge power terminal (i.e., the client).

[0011] S2, after receiving the global model, the edge power terminal uses local data to train the model in multiple rounds and calculates the update amount of the local gradient.

[0012] S3, the edge power terminal performs discrete cosine transform (DCT) on the update quantity layer by layer, transforming it from the spatial domain to the frequency domain, and obtains the frequency domain coefficient vector;

[0013] S4, the edge power terminal divides the frequency domain coefficient vector into low-frequency and high-frequency components according to the retention coefficients of each layer issued by the server;

[0014] S5, edge power terminals perform local defense: local clipping is performed on low-frequency and high-frequency components according to the clipping radius of each layer, and noise is added using Gaussian noise mechanism and Duchi mechanism respectively to achieve layered local differential privacy protection;

[0015] S6, after receiving the noisy coefficients, the power security gateway performs cloud-based defense: based on the legal security confidence boundary of this round, it performs mandatory legality verification and secondary physical truncation on the frequency domain coefficients; then, it constructs a parameter pool according to the network layer name and parameter index, uses a random function to thoroughly shuffle the element-level random permutation, cuts off the physical association, and returns it to the cloud-based power grid dispatch center;

[0016] S7, the cloud-based power grid dispatch center receives the parameter pool processed by the power security gateway, performs unbiased aggregation of the mean, and obtains a noisy global frequency domain average vector.

[0017] S8, the cloud-based power grid dispatch center uses the Noise Decoupling Energy Estimation (NDEE) algorithm to extract the true gradient average energy of each layer, that is, subtract the theoretical aggregated noise variance from the observed energy of that layer, and combine it with the minimum energy lower limit to prevent numerical overflow.

[0018] S9, the cloud-based power grid dispatch center calculates the abnormal deviation ratio between the average energy of the current gradient and the historical baseline energy of each layer, and independently adjusts the clipping radius boundary of each layer for the next round using the hierarchical sensitivity awareness (EA-ACB) dynamic defense mechanism. After the adjustment is completed, the global frequency domain average vector is restored to the spatial domain gradient using the inverse discrete cosine transform (IDCT) and the state of the power grid dispatch model is updated. Finally, the privacy budget audit is completed and the next iteration is entered.

[0019] Furthermore, in step S1, it is assumed that there are in the system. The first edge power terminal participating in federated learning, currently the [number]th. In this round of communication iterations, the number of edge power terminals selected to participate in aggregation is: The global model contains Each network parameter layer, cloud-based power grid dispatch center (aggregation server) initialization ( The parameters of the wheel include:

[0020] Global model initialization weights Total privacy budget cap Low-frequency privacy budget High-frequency privacy budget slack variables , No. Layer network parameter layer retention coefficient Low-frequency cutting radius High-frequency cutting radius Minimum energy lower limit Minimal floating-point error tolerance Abnormal shrinkage coefficient Target expansion multiplier Single-round elastic expansion rate Threshold for determining severe anomalies and historical baseline smoothing coefficient ,in .

[0021] Furthermore, in step S2, the edge power terminal After receiving the global model weights, multiple rounds of iterative training are performed using the local private power grid dataset to obtain updated local model parameters. The parameter update difference of the local model in this round is then calculated, which is the update amount of the local gradient. ,in, This represents the number of edge power terminals selected to participate in aggregation in this round. , For the client In the Wheel and First The local model parameters after the round of updates.

[0022] Furthermore, in step S3, the edge power terminal right Perform a one-dimensional discrete cosine transform (1D-DCT) with orthogonal normalization on each network layer to obtain the th One-dimensional frequency domain coefficient vector of the layer For a total length of The transformation formula for the network layer parameter vector is:

[0023]

[0024] in, Represents a one-dimensional frequency domain coefficient vector The first in Each frequency coefficient value; The normalized compensation coefficient is defined as follows: , Frequency index representing frequency domain coefficients, ; This represents the total length of the parameter vector (i.e., the total number of parameters in this layer). Indicates the index subscript of the local model parameter in the spatial domain. ; express In the The first layer Each parameter value; Indicates the first The total length of the layer parameter vector.

[0025] This transformation utilizes the energy concentration characteristics of the frequency domain, allowing the core knowledge of the model to be concentrated in the low-frequency part, while the high-frequency part contains minute details and possible backdoor trigger features.

[0026] Furthermore, in step S4, the edge power terminal According to the server's sent number Layer network parameter layer retention coefficient The one-dimensional frequency domain coefficient vector of this layer Cutting and separating, front Each coefficient is divided into low-frequency components. , The coefficients less than the total number of parameters in this layer are classified as high-frequency components. .

[0027] Furthermore, in step S5, the low-frequency components... Each element in the string is strictly truncated to Within the range, Indicates the first Wheel of Life The low-frequency clipping radius of the layer is adjusted, and noise following a Gaussian distribution is added. The standard deviation of Gaussian noise is calibrated as follows:

[0028]

[0029] High frequency components Each element in the array is truncated to Within range (global sensitivity) ), Indicates the first Wheel of Life The high-frequency clipping radius of the layer is determined, and a strongly perturbative Duchi mechanism is applied to the truncated input value. Its output is mapped to physical extrema. One of them is the absolute extreme value. for:

[0030]

[0031] The output is The probability satisfies: The output is The probability is ;

[0032] After processing, the mixed and noisy frequency domain coefficients are uploaded to the cloud-based power grid dispatch center. Because the noise standard deviation is strictly bound to the dynamic clipping radius, when the system encounters an attack that triggers boundary contraction, the absolute amount of locally injected noise will also adaptively decrease proportionally.

[0033] The client of this invention performs Discrete Cosine Transform (DCT) on the gradient updates obtained from local training layer by layer, mapping the gradients from the spatial domain to the frequency domain. Utilizing the energy concentration characteristics of the frequency domain, the frequency coefficients are divided into low-frequency components carrying core knowledge and high-frequency components containing detailed features and potential backdoor triggers, based on the retention coefficients issued by the server. A controlled Gaussian noise mechanism is applied to the low-frequency components to retain key usable information, while a strongly perturbed Duchi mechanism noise is applied to the high-frequency components for discretization and inversion. This maximizes the blocking of direct uploading of backdoor features while satisfying the strict LDP theoretical safety lower bound.

[0034] Furthermore, this invention introduces an independent parameter shuffler as a secure intermediate layer (power security gateway), serving a dual purpose. First, it performs mandatory legality verification and secondary physical truncation on the received noisy parameters. Based on the security confidence boundary set for this round of parameters, it smooths out abnormal values ​​exceeding extremes, completely stripping away and intercepting excessively malicious disturbance signals. Second, for each parameter index in each layer, it performs element-level random permutation and shuffling of all client data, severing the physical association between parameters across rounds, thereby significantly reducing overall privacy budget consumption and enhancing client anonymity.

[0035] In step S6, for the first Layer, power security gateway (independent parameter shuffler) sets low-frequency theoretical security confidence boundaries based on current round parameters. Set high-frequency theoretical security confidence boundaries The power safety gateway performs element-by-element verification on the received values. If a low-frequency coefficient is found to exceed the corresponding safety boundary, [-] [Or the high-frequency coefficients exceed the corresponding safety boundary] If a threshold physical cutoff is enforced, the frequency band will be flattened to the safety boundary. If the frequency exceeds the corresponding safety boundary, the cutoff will be enforced. Abnormal values ​​( Refers to the safety boundary of the frequency band to which the current coefficient belongs, i.e., low frequency. High frequency is If the value is greater than 10, a threshold physical truncation operation will be forcibly executed. The specific truncation logic is as follows: if the value is greater than 10, the threshold physical truncation operation will be forcibly executed. Then reset it to If the value is less than - Then reset to - .

[0036] Furthermore, in step S7, since the data link attribution is removed by shuffling and the LDP noise has a zero-mean distribution, mean fusion can statistically effectively cancel out positive and negative privacy noise, achieving unbiased aggregation under the law of large numbers, and obtaining a noisy global frequency domain average vector. The formula for mean-unbiased aggregation is:

[0037]

[0038] in, This represents the noisy global frequency domain average vector. This represents the noisy frequency domain coefficients output by the power safety gateway. This represents the total number of edge power terminals participating in this round of aggregation.

[0039] Furthermore, the implementation process of step S8 is as follows:

[0040] Calculate the mean energy of the low-frequency dimensions after aggregation: ,in Indicates the first The low-frequency component of the layer in the aggregated global frequency domain average vector is the first... A noisy frequency domain coefficient, which will be included in this round of aggregation. The mean value of the noisy low-frequency coefficients at the corresponding locations uploaded by each edge power terminal is obtained by unbiased averaging, and the specific calculation formula is as follows: in, This indicates that after processing by the power security gateway, the first... The edge power terminal in the first The first layer of low-frequency components A noisy frequency domain coefficient.

[0041] Calculate the mean energy of observations in the high-frequency dimensions after aggregation: ,in Indicates the first The total length of the layer parameter vector; Indicates the first The high-frequency components of the layer in the aggregated global frequency domain average vector The calculation method for the noisy frequency domain coefficients can be referenced from the calculation of the low-frequency component in the aggregated global frequency domain average vector. The noisy frequency domain coefficients will not be elaborated here;

[0042] Based on the central limit theorem, the residual variance of the theoretical aggregation noise is calculated as follows:

[0043] For the low-frequency Gaussian noise mechanism, the theoretical residual variance of the aggregated noise is: For the high-frequency Duchi mechanism, the theoretical residual aggregation noise variance is: ;

[0044] Calculate the current round after deducting noise interference. Layer true gradient average energy:

[0045] To prevent negative values ​​from appearing after variance stripping, use Function truncation, average energy of low-frequency true gradient: ;

[0046] High-frequency true gradient average energy: ;

[0047] Combined with minimum energy lower limit The decoupled low-frequency true gradient average energy and high-frequency true gradient average energy are combined to obtain the first energy of this round. The true gradient average energy of the layer:

[0048] .

[0049] Furthermore, in step S9, the abnormal deviation ratio is first calculated. , Indicates the first Historical baseline energy of the layer;

[0050] If the abnormal deviation ratio Severe anomaly determination threshold If the system is deemed safe, a low-frequency target upper limit is set. Then the radius of the low-frequency cropping in the next round: At the same time, set an upper limit for high-frequency targets. Then the high-frequency clipping radius for the next round is: ;

[0051] If the abnormal deviation ratio Severe anomaly determination threshold If this condition is not met, it is considered an abnormal state, triggering the boundary shrinkage mechanism: the low-frequency pruning radius for the next round is updated to... The next round of high-frequency cropping radius update is as follows: ;

[0052] The historical baseline energy of this layer is updated using the exponential moving average (EMA): In the initialization phase, in the first round of federated learning (… In this case, since no historical baseline has been established, the system directly initializes the baseline energy of this layer to the average energy of the true gradient calculated in this round, i.e. In the dynamic update phase, the system uses the exponential moving average (EMA) method to update the values ​​in each subsequent iteration. This is done to smooth out misjudgments caused by single-round gradient fluctuations, ensuring the baseline accurately tracks the long-term energy trend of that layer. Each time a new true energy for the current round is calculated, the old value is overwritten and updated using this formula. This will serve as the benchmark for judging the abnormal deviation ratio in the next round.

[0053] Furthermore, in step S9, after completing the dynamic defense adjustment, the cloud-based power grid dispatch center uses the inverse discrete cosine transform (IDCT) formula to average the global frequency domain vector. The global gradient update is restored to the spatial domain and combined with the learning rate to complete the update of the global power grid dispatch model state in this round. The formula for updating the power grid dispatch model is:

[0054]

[0055] in The global learning rate of the system;

[0056] A strict hybrid RDP actuary (RDPA accountant) is invoked to perform a global privacy audit based on the combinatorial theorem. The privacy budget audit process is as follows:

[0057] (1) Single-round divergence calculation:

[0058] Given Rèry The order of divergence The hybrid RDP actuaries separately tracked and calculated the Rènyi divergence generated by the low-frequency Gaussian mechanism in this round. Rèryi divergence generated by the high-frequency Duchi mechanism ;

[0059] (2) Combinatorial theorem summation:

[0060] Based on the serial combination theorem of hybrid RDP actuaries, the previous The divergence consumed in each round of training is linearly accumulated to obtain the cumulative Rènyi divergence. :

[0061]

[0062] (3) According to RDP to the standard - The transformation theorem for differential privacy, calculating given slack variables Total cumulative privacy consumption

[0063]

[0064] (4) Calculate the total amount of privacy consumption. Compared with the total system privacy budget limit initialized in step S1 Perform a comparison, if This proves that the privacy budget is sufficient, and the system enters the next iteration, i.e. ;like If the privacy budget is exhausted, the system terminates federated training and outputs the current final model to ensure that the system meets the strict theoretical privacy lower bound requirements.

[0065] This invention introduces noise decoupling energy estimation and hierarchical sensitivity awareness defense techniques during the aggregation phase. The server first subtracts the theoretical aggregation noise variance residue from the observed mean energy of the aggregated frequency domain gradient, and calculates the true average gradient energy of each layer based on the minimum energy lower limit. Then, it calculates the anomalous deviation ratio between the true average gradient energy and the historical baseline energy, independently determining the state of each layer: an anomalous state or a normal state. When an anomalous state is identified, a corresponding proportional contraction is triggered on the next round's clipping radius to cut off backdoor injection; in the normal state, the clipping boundary is allowed to expand slowly according to a set target expansion multiplier. The contraction in the anomalous state blocks external damage from malicious attacks, while the elastic recovery in the normal state avoids starvation of benign gradients, thus improving the model's generalization accuracy. The coordination between these two mechanisms enables the model to converge safely and efficiently.

[0066] This invention abandons the traditional single-dimensional defense approach and constructs a three-layer closed-loop collaborative adaptive defense architecture encompassing "end-side frequency domain heterogeneous noise addition - cloud-based forced verification and decorrelation - server-side energy sensing and dynamic monitoring." While meeting strict local differential privacy constraints, this architecture not only achieves accurate interception of various complex backdoor attacks but also completely avoids collateral damage to benign backbone features, ultimately ensuring the efficient and stable convergence of the global model under extremely high privacy requirements.

[0067] For any details not covered in this invention, please refer to the prior art.

[0068] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0069] 1. An innovative layered frequency-domain hybrid noise reduction mechanism breaks through the usability bottleneck of spatial domain isomorphic noise reduction. This invention abandons the traditional direct spatial domain noise reduction scheme and innovatively maps the model gradient to the frequency domain through Discrete Cosine Transform (DCT). For each layer, Gaussian noise reduction is applied to the low-frequency components containing core features, while a more suitable Duchi noise reduction is applied to the high-frequency components that may contain hidden backdoors. This approach utilizes the energy concentration characteristics of the frequency domain to finely segment and target the sensitivity of different network layer updates and different frequency bands. This design, while meeting the strict lower bound of LDP theory, avoids the indiscriminate destruction of global core knowledge by traditional spatial domain isomorphic noise reduction, greatly preserving the effective information of the gradient, and laying the foundation for maintaining extremely high model usability under extreme noise conditions.

[0070] 2. Noise Decoupling Energy Estimation Early Warning and Dynamic Shuffling of the Shuffler Enable Precise Interception of Multiple Types of Backdoor Attacks. This invention uses a Noise Decoupling Energy Estimation (NDEE) algorithm on the server side to dynamically calculate the deviation between the true energy of each network layer and the adaptive energy benchmark; and constructs a dynamic confidence boundary guided by the noise mechanism on the independent parameter shuffler. When the system is not under attack, the shuffler maintains a broad confidence boundary to ensure zero loss of benign gradients; once the noise decoupling energy estimation mechanism detects an abnormal energy surge caused by backdoor injection, the shuffler instantly tightens the confidence boundary rapidly. This method not only provides absolute defense against powerful attacks such as BadNets, but also highly isolates various variant attacks such as DBA (Distributed Fragmentation), covert fusion, and Neurotoxin (Sparse Persistence).

[0071] 3. A minimum energy lower bound and a resilient anti-lock mechanism are introduced to ensure high-precision and stable convergence of the model under stringent privacy constraints. During the adaptive adjustment phase of defense parameters, this invention specifically introduces an absolute "minimum energy lower bound" as the physical lower bound of the system, along with a boundary elastic recovery mechanism under normal conditions. This mechanism, at its underlying mathematical logic, prevents statistical variance bias caused by finite sample sampling in LDP, ensuring that the adaptive energy benchmark will not fall below the safe lower bound under any extreme defense contraction. This resolves the model crash trap caused by excessive shrinkage of the clipping radius or zero variance calculation in the later stages of traditional adaptive defense during training. Even when resisting the most intense persistent attacks, it still ensures the healthy knowledge aggregation of honest nodes, ensuring that the global model achieves high-precision and stable convergence under stringent privacy constraints. Attached Figure Description

[0072] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application.

[0073] Figure 1 The results of experiments conducted in response to BadNests backdoor attacks;

[0074] Figure 2 The results of experiments conducted in response to DBA backdoor attacks;

[0075] Figure 3 The results of experiments against Neurotoxin backdoor attacks;

[0076] Figure 4 The results of experiments against Blended covert fusion backdoor attacks;

[0077] Figure 5 This is a schematic diagram of the federated learning backdoor defense method based on frequency domain hybrid differential privacy of the present invention. Detailed Implementation

[0078] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0079] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments of the invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0080] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0081] All data acquisition in this embodiment is carried out in accordance with laws and regulations and with user consent, and the data is used legally.

[0082] Terminology Explanation:

[0083] 1. Federated Learning: Federated learning is a distributed machine learning technique. Its core principle is that data does not leave the local machine, and the model is built collaboratively by multiple parties. It achieves joint modeling through parameter exchange, ensuring that training can be completed without the data leaving the local device or institution. It features data locality, model parameter circulation, and continuous iterative optimization during training. The classic federated learning architecture consists of multiple clients and a central aggregation server.

[0084] 2. Discrete Cosine Transform (DCT): The Discrete Cosine Transform (DCT) is a mathematical transformation related to the Discrete Fourier Transform (DCT). Essentially, it's a mathematical tool for converting signals from the spatial domain (or time domain) to the frequency domain, using only real numbers (cosine functions). It can decompose an image or audio signal into a combination of cosine waves of different frequencies, revealing which parts of the signal change gradually and which change dramatically. This scheme leverages the energy concentration characteristic of the DCT, concentrating the core information for model updates on low-frequency coefficients and distributing detailed information across high-frequency coefficients, providing a foundation for subsequent frequency-domain layered privacy protection and anomalous energy detection.

[0085] 3. Gaussian Noise Mechanism: The Gaussian noise mechanism serves as the low-frequency privacy protection mechanism in this invention. It is a standard mechanism for perturbing continuous data in differential privacy. For a query function with sensitivity Δ, the Gaussian mechanism achieves (ε, δ)-differential privacy by adding noise following an N(0, σ²) distribution to the query result. This invention uses the Gaussian mechanism to add noise to the low-frequency components in the frequency domain. While meeting the requirements of differential privacy, it leverages the controllable noise amplitude to preserve the usable information of the low-frequency backbone features to the greatest extent possible.

[0086] 4. Duchi Mechanism: As the high-frequency privacy protection mechanism of this scheme, the Duchi mechanism is a perturbation mechanism for bounded numerical data in Local Differential Privacy (LDP). Its basic principle is to map the truncated input value to one of the physical extrema of the domain with a specific probability, thereby achieving strict local differential privacy guarantees in a single query. This invention uses the Duchi mechanism to discretize and invert noise on high-frequency components in the frequency domain, utilizing its strong perturbation characteristics on individual values ​​to maximally block the direct uploading of potentially hidden backdoor trigger features in the high-frequency region.

[0087] 5. Shuffler: As the privacy-enhancing middleware layer in this solution, the shuffler is a classic architectural component in privacy enhancement technologies, situated between the data provider and the data receiver. Its core function is to randomly shuffle data uploaded by multiple parties at the element level, severing the physical connection between the data and the sender, thereby enhancing anonymity without increasing the privacy budget. This solution introduces an independent parameter shuffler as a secure middleware layer between the client and the aggregation server, adding mandatory legality verification and secondary physical truncation functions on top of random permutation.

[0088] 6. Exponential Moving Average (EMA): The Exponential Moving Average (EMA) is used as the energy baseline maintenance method in this invention. It is a commonly used time series smoothing method, whose core idea is to assign higher weights to recent data while retaining the trend information of historical data. This invention utilizes EMA to maintain the historical energy baseline of each network layer, enabling the system to smoothly track the long-term trend of gradient energy changes and avoid misjudgments caused by single-round fluctuations.

[0089] 7. Global Model: In the federated learning architecture, the global model refers to the core machine learning model initialized, maintained, and uniformly managed by the central aggregation server. The global model does not directly access any client's local raw data. Instead, it continuously absorbs and aggregates the model parameter updates uploaded by each client through multiple rounds of communication iterations to perform overall optimization. It carries the global knowledge learned collaboratively by all participants and is the final convergence product of the entire federated learning system. It is also the ultimate target for malicious backdoor attacks attempting to poison and tamper with the data. In the architecture of this invention, the global model can still securely and efficiently complete knowledge aggregation under stringent privacy constraints and defensive reshuffling.

[0090] Example 1

[0091] A federated learning backdoor defense method based on frequency domain hybrid differential privacy, such as... Figure 5 As shown, it includes the following steps:

[0092] S1, the cloud-based power grid dispatch center initializes the global model and parameters, and broadcasts the global model and parameters to the edge power terminal (i.e., the client).

[0093] In the system, it is assumed that there are The first edge power terminal participating in federated learning, currently the [number]th. In this round of communication iterations, the number of edge power terminals selected to participate in aggregation is: The global model contains Each network parameter layer, cloud-based power grid dispatch center (aggregation server) initialization ( The parameters of the wheel include:

[0094] Global model initialization weights Total privacy budget cap Low-frequency privacy budget High-frequency privacy budget slack variables , No. Layer network parameter layer retention coefficient Low-frequency cutting radius High-frequency cutting radius Minimum energy lower limit Minimal floating-point error tolerance Abnormal shrinkage coefficient Target expansion multiplier Single-round elastic expansion rate Threshold for determining severe anomalies and historical baseline smoothing coefficient ,in .

[0095] In this embodiment, low-frequency privacy budget High-frequency privacy budget slack variables retention factor The value is 25%, meaning the top 25% of the low-frequency coefficients are retained, and the low-frequency clipping radius is [not specified]. High-frequency cutting radius =0.05, minimum energy lower limit Minimal floating-point error tolerance Preferred value Abnormal shrinkage coefficient The preferred value is 0.1, and the target expansion multiplier is... The preferred value is 2.0, and the single-wheel elastic expansion rate is... The preferred value is 1.01, which is the threshold for determining severe anomalies. =1.5, meaning the actual energy exceeds the baseline by 1.5 times; historical baseline smoothing coefficient. .

[0096] S2, after receiving the global model, the edge power terminal uses local data to train the model in multiple rounds and calculates the update amount of the local gradient.

[0097] Edge power terminal After receiving the global model weights, multiple rounds of iterative training are performed using the local private power grid dataset to obtain updated local model parameters. The parameter update difference of the local model in this round is then calculated, which is the update amount of the local gradient. ,in, This represents the number of edge power terminals selected to participate in aggregation in this round. , For the client In the Wheel and First The local model parameters after the round of updates.

[0098] S3, the edge power terminal performs discrete cosine transform (DCT) on the update quantity layer by layer, transforming it from the spatial domain to the frequency domain, and obtains the frequency domain coefficient vector;

[0099] Edge power terminal right Perform a one-dimensional discrete cosine transform (1D-DCT) with orthogonal normalization on each network layer to obtain the th One-dimensional frequency domain coefficient vector of the layer For a total length of The transformation formula for the network layer parameter vector is:

[0100]

[0101] in, Represents a one-dimensional frequency domain coefficient vector The first in Each frequency coefficient value; The normalized compensation coefficient is defined as follows: , Frequency index representing frequency domain coefficients, ; This represents the total length of the parameter vector (i.e., the total number of parameters in this layer). Indicates the index subscript of the local model parameter in the spatial domain. ; express In the The first layer Each parameter value.

[0102] This transformation utilizes the energy concentration characteristics of the frequency domain, allowing the core knowledge of the model to be concentrated in the low-frequency part, while the high-frequency part contains minute details and possible backdoor trigger features.

[0103] S4, the edge power terminal divides the frequency domain coefficient vector into low-frequency and high-frequency components according to the retention coefficients of each layer issued by the server;

[0104] Edge power terminal According to the server's sent number Layer network parameter layer retention coefficient The one-dimensional frequency domain coefficient vector of this layer Cutting and separating, front Each coefficient is divided into low-frequency components. , The coefficients less than the total number of parameters in this layer are classified as high-frequency components. .

[0105] S5, edge power terminals perform local defense: local clipping is performed on low-frequency and high-frequency components according to the clipping radius of each layer, and noise is added using Gaussian noise mechanism and Duchi mechanism respectively to achieve layered local differential privacy protection;

[0106] Low frequency components Each element in the string is strictly truncated to Within the range, Indicates the first Wheel of Life The low-frequency clipping radius of the layer is adjusted, and noise following a Gaussian distribution is added. The standard deviation of Gaussian noise is calibrated as follows:

[0107]

[0108] High frequency components Each element in the array is truncated to Within range (global sensitivity) ), Indicates the first Wheel of Life The high-frequency clipping radius of the layer is determined, and a strongly perturbative Duchi mechanism is applied to the truncated input value. Its output is mapped to physical extrema. One of them is the absolute extreme value. for:

[0109]

[0110] The output is The probability satisfies: The output is The probability is ;

[0111] After processing, the mixed and noisy frequency domain coefficients are uploaded to the cloud-based power grid dispatch center. Because the noise standard deviation is strictly bound to the dynamic clipping radius, when the system encounters an attack that triggers boundary contraction, the absolute amount of locally injected noise will also adaptively decrease proportionally.

[0112] S6, after receiving the noisy coefficients, the power security gateway performs cloud-based defense: based on the legal security confidence boundary of this round, it performs mandatory legality verification and secondary physical truncation on the frequency domain coefficients; then, it constructs a parameter pool according to the network layer name and parameter index, performs a thorough element-level random permutation and shuffling, cuts off physical associations, and returns it to the cloud-based power grid dispatch center;

[0113] Regarding the first Layer, power security gateway (independent parameter shuffler) sets low-frequency theoretical security confidence boundaries based on current round parameters. Set high-frequency theoretical security confidence boundaries The power safety gateway performs element-by-element verification on the received values. If a low-frequency coefficient is found to exceed the corresponding safety boundary, [-] [Or the high-frequency coefficients exceed the corresponding safety boundary] If a threshold physical cutoff is enforced, the frequency band will be flattened to the safety boundary. If the frequency exceeds the corresponding safety boundary, the cutoff will be enforced. Abnormal values ​​( Refers to the safety boundary of the frequency band to which the current coefficient belongs, i.e., low frequency. High frequency is If the value is greater than 10, a threshold physical truncation operation will be forcibly executed. The specific truncation logic is as follows: if the value is greater than 10, the threshold physical truncation operation will be forcibly executed. Then reset it to If the value is less than - Then reset to - .

[0114] S7, the cloud-based power grid dispatch center receives the parameter pool processed by the power security gateway, performs unbiased aggregation of the mean, and obtains a noisy global frequency domain average vector.

[0115] The formula for mean unbiased aggregation is:

[0116]

[0117] in, This represents the noisy global frequency domain average vector. This represents the noisy frequency domain coefficients output by the power safety gateway. This represents the total number of edge power terminals participating in this round of aggregation.

[0118] S8, the cloud-based power grid dispatch center uses the Noise Decoupling Energy Estimation (NDEE) algorithm to extract the true gradient average energy of each layer, that is, subtract the theoretical aggregated noise variance from the observed energy of that layer, and combine it with the minimum energy lower limit to prevent numerical overflow.

[0119] Calculate the mean energy of the low-frequency dimensions after aggregation: ,in Indicates the first The low-frequency component of the layer in the aggregated global frequency domain average vector is the first... Each noisy frequency domain coefficient will be included in this round of aggregation. The mean value of the noisy low-frequency coefficients at the corresponding locations uploaded by each edge power terminal is obtained by unbiased averaging, and the specific calculation formula is as follows: in, This indicates that after processing by the power security gateway, the first... The edge power terminal in the first The first layer of low-frequency components A noisy frequency domain coefficient.

[0120] Calculate the mean energy of observations in the high-frequency dimensions after aggregation: ,in Indicates the first The total length of the layer parameter vector; Indicates the first The high-frequency components of the layer in the aggregated global frequency domain average vector The calculation method for the noisy frequency domain coefficients can be referenced from the calculation of the low-frequency component in the aggregated global frequency domain average vector. The noisy frequency domain coefficients will not be elaborated here;

[0121] Based on the central limit theorem, the residual variance of the theoretical aggregation noise is calculated as follows:

[0122] For the low-frequency Gaussian noise mechanism, the theoretical residual variance of the aggregated noise is: For the high-frequency Duchi mechanism, the theoretical residual aggregation noise variance is: ;

[0123] Calculate the current round after deducting noise interference. Layer true gradient average energy:

[0124] To prevent negative values ​​from appearing after variance stripping, use Function truncation, average energy of low-frequency true gradient: ;

[0125] High-frequency true gradient average energy: ;

[0126] Combined with minimum energy lower limit The decoupled low-frequency true gradient average energy and high-frequency true gradient average energy are combined to obtain the first energy of this round. The true gradient average energy of the layer:

[0127] .

[0128] S9, the cloud-based power grid dispatch center calculates the abnormal deviation ratio between the average energy of the current real gradient and the historical baseline energy of each layer, and independently adjusts the pruning radius boundary of each layer for the next round using the hierarchical sensitivity awareness (EA-ACB) dynamic defense mechanism; after the adjustment is completed, the global frequency domain average vector is restored to the spatial domain gradient using the inverse discrete cosine transform (IDCT) and the state of the power grid dispatch model is updated. Finally, the privacy budget audit is completed and the next iteration is entered.

[0129] First, calculate the abnormal deviation ratio. , Indicates the first Historical baseline energy of the layer;

[0130] If the abnormal deviation ratio Severe anomaly determination threshold If the system is deemed safe, a low-frequency target upper limit is set. Then the radius of the low-frequency cropping in the next round: At the same time, set an upper limit for high-frequency targets. Then the high-frequency clipping radius for the next round is: ;

[0131] If the abnormal deviation ratio Severe anomaly determination threshold If this condition is not met, it is considered an abnormal state, triggering the boundary shrinkage mechanism: the low-frequency pruning radius for the next round is updated to... The next round of high-frequency cropping radius will be updated to... ;

[0132] The historical baseline energy of this layer is updated using the exponential moving average (EMA): In the initialization phase, in the first round of federated learning (… In this case, since no historical baseline has been established, the system directly initializes the baseline energy of this layer to the average energy of the true gradient calculated in this round, i.e. In the dynamic update phase, the system uses the exponential moving average (EMA) method to update the values ​​in each subsequent iteration. This is done to smooth out misjudgments caused by single-round gradient fluctuations, ensuring the baseline accurately tracks the long-term energy trend of that layer. Each time a new true energy for the current round is calculated, the old value is overwritten and updated using this formula. This will serve as the benchmark for judging the abnormal deviation ratio in the next round.

[0133] Furthermore, in step S9, after completing the dynamic defense adjustment, the cloud-based power grid dispatch center uses the inverse discrete cosine transform (IDCT) formula to average the global frequency domain vector. The global gradient update is restored to the spatial domain and combined with the learning rate to complete the update of the global power grid dispatch model state in this round. The formula for updating the power grid dispatch model is:

[0134]

[0135] in The global learning rate of the system;

[0136] A strict hybrid RDP actuary (RDPA accountant) is invoked to perform a global privacy audit based on the combinatorial theorem. The privacy budget audit process is as follows:

[0137] (1) Single-round divergence calculation:

[0138] Given Rèry The order of divergence The hybrid RDP actuaries separately tracked and calculated the Rènyi divergence generated by the low-frequency Gaussian mechanism in this round. Rèryi divergence generated by the high-frequency Duchi mechanism ;

[0139] (2) Combinatorial theorem summation:

[0140] Based on the serial combination theorem of hybrid RDP actuaries, the previous The divergence consumed in each round of training is linearly accumulated to obtain the cumulative Rènyi divergence. :

[0141]

[0142] (3) According to RDP to the standard - The transformation theorem for differential privacy, calculating given slack variables Total cumulative privacy consumption

[0143]

[0144] (4) Calculate the total amount of privacy consumption. Compared with the total system privacy budget limit initialized in step S1 Perform a comparison, if This proves that the privacy budget is sufficient, and the system enters the next iteration, i.e. ;like If the privacy budget is exhausted, the system terminates federated training and outputs the current final model to ensure that the system meets the strict theoretical privacy lower bound requirements.

[0145] Experimental Example 1

[0146] Based on the existing MNIST dataset, the defensive robustness of the defense system constructed by the method of this invention is comprehensively evaluated in a federated learning environment. The experiment involves 40 clients participating in training, 12 of which are malicious clients. In each round, 30 clients are randomly selected for aggregation.

[0147] The experiment introduced four representative backdoor attack methods:

[0148] BadNets (centralized model replacement attack) injects high-intensity local static triggers into malicious nodes and uses extreme gradient amplification to brute-force poisoning;

[0149] DBA (Distributed Fragment Attack) refers to a malicious node employing a "break down" strategy to inject small, localized trigger fragments in an attempt to evade single-point detection.

[0150] Blended (covert fusion attack) uses an invisible watermark across the entire image to merge with the original image at extremely low transparency, and performs a covert attack by changing weak global statistical features.

[0151] Neurotoxin (sparse persistent attack) involves attackers avoiding frequently updated "hot parameters" and instead injecting toxic energy into "cold parameters" that are rarely updated, in an attempt to achieve long-term latency.

[0152] Experimental results are as follows Figures 1 to 4 As shown, the system of this invention can effectively identify and intercept malicious updates in the face of the four types of attacks mentioned above. In the frequency domain hierarchical noise addition stage, the heterogeneous perturbation strategy of Gaussian and Duchi mechanisms can retain the core features of the model to the greatest extent while satisfying strict LDP guarantees. In the shuffler verification stage, the dynamic confidence boundary mechanism can accurately intercept extreme abnormal perturbations that bypass local defenses. In the adaptive defense stage, noise decoupling energy estimation can keenly capture abnormal energy surges caused by backdoor injection and drive the adaptive shrinkage of the pruning radius to block the attack. As the number of communication rounds increases, the global model can achieve effective convergence in all attack scenarios, and the final accuracy gradually narrows the gap with the non-attack scenario, demonstrating the robustness and stability of the system of this invention under different attack types.

[0153] The above description is merely a preferred embodiment of this practice and is not intended to limit the scope of this practice. Various modifications and variations can be made to this practice by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this practice should be included within the protection scope of this practice.

Claims

1. A federated learning backdoor defense method based on frequency domain hybrid differential privacy, characterized in that, Includes the following steps: S1, the cloud-based power grid dispatch center initializes the global model and parameters, and broadcasts the global model and parameters to the edge power terminals; S2, after receiving the global model, the edge power terminal uses local data to train the model in multiple rounds and calculates the update amount of the local gradient. S3, the edge power terminal performs discrete cosine transform on the update quantity layer by layer, transforming it from the spatial domain to the frequency domain, and obtains the frequency domain coefficient vector; S4, the edge power terminal divides the frequency domain coefficient vector into low-frequency and high-frequency components according to the retention coefficients of each layer issued by the server; S5, edge power terminals perform local defense: local clipping is performed on low-frequency and high-frequency components according to the clipping radius of each layer, and noise is added using Gaussian noise mechanism and Duchi mechanism respectively to achieve layered local differential privacy protection; S6: After receiving the noisy coefficients, the power safety gateway performs mandatory legality verification and secondary physical truncation on the frequency domain coefficients based on the legal security confidence boundary of this round. Then, it constructs a parameter pool according to the network layer name and parameter index, performs element-level random permutation and shuffling, cuts off physical associations, and returns it to the cloud power grid dispatch center. S7, the cloud-based power grid dispatch center receives the parameter pool processed by the power security gateway, performs unbiased aggregation of the mean, and obtains a noisy global frequency domain average vector. S8, the cloud-based power grid dispatch center uses a noise decoupling energy estimation algorithm to extract the true gradient average energy of each layer; S9, the cloud-based power grid dispatch center calculates the abnormal deviation ratio between the average energy of the current gradient and the historical baseline energy of each layer, and independently adjusts the clipping radius boundary of each layer for the next round using a hierarchical sensitivity perception dynamic defense mechanism; after the adjustment is completed, the global frequency domain average vector is restored to the spatial domain gradient using inverse discrete cosine transform and the state of the power grid dispatch model is updated, and finally the privacy budget audit is completed and the next iteration is entered.

2. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 1, characterized in that, In step S1, the global model includes The network parameter layer, the parameters initialized by the cloud-based power grid dispatch center include: Global model initialization weights Total privacy budget cap Low-frequency privacy budget High-frequency privacy budget slack variables , No. Layer network parameter layer retention coefficient Low-frequency cutting radius High-frequency cutting radius Minimum energy lower limit Minimal floating-point error tolerance Abnormal shrinkage coefficient Target expansion multiplier Single-round elastic expansion rate Threshold for determining severe anomalies and historical baseline smoothing coefficient ,in .

3. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 2, characterized in that, In step S2, the edge power terminal After receiving the global model weights, multiple rounds of iterative training are performed using the local private power grid dataset to obtain updated local model parameters. The parameter update difference of the local model in this round is then calculated, which is the update amount of the local gradient. ,in, This represents the number of edge power terminals selected to participate in aggregation in this round. , For the client In the Wheel and First The local model parameters after the round of updates; In step S3, the edge power terminal right Performing a one-dimensional discrete cosine transform with orthogonal normalization on each network layer yields the... One-dimensional frequency domain coefficient vector of the layer For a total length of The transformation formula for the network layer parameter vector is: in, Represents a one-dimensional frequency domain coefficient vector The first in Each frequency coefficient value; The normalized compensation coefficient is defined as follows: , Frequency index representing frequency domain coefficients; Indicates the index subscript of the local model parameter in the spatial domain; express In the The first layer Each parameter value; Indicates the first The total length of the layer parameter vector.

4. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 3, characterized in that, In step S4, the edge power terminal According to the server's sent number Layer network parameter layer retention coefficient The one-dimensional frequency domain coefficient vector of this layer Cutting and separating, front Each coefficient is divided into low-frequency components. The remaining coefficients are divided into high-frequency components. .

5. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 4, characterized in that, In step S5, the low-frequency components are... Each element in the array is truncated to Within the range, Indicates the first Wheel of Life The low-frequency clipping radius of the layer is adjusted, and noise following a Gaussian distribution is added. The standard deviation of Gaussian noise is calibrated as follows: High frequency components Each element in the array is truncated to Within the range, Indicates the first Wheel of Life The high-frequency clipping radius of the layer is determined, and the Duchi mechanism is applied to the truncated input values. Its output is mapped to physical extrema. One of them is the absolute extreme value. for: The output is The probability satisfies: The output is The probability is ; After processing, the mixed and noisy frequency domain coefficients are uploaded to the cloud-based power grid dispatch center.

6. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 5, characterized in that, In step S6, for the first The power security gateway sets low-frequency theoretical security confidence boundaries based on the parameters of this round. Set high-frequency theoretical security confidence boundaries ; The power safety gateway performs element-by-element verification on the received values. If a low-frequency coefficient is found to exceed the corresponding safety boundary, [-] [Or the high-frequency coefficients exceed the corresponding safety boundary] If the threshold is truncated, a physical cutoff will be enforced, flattening the material to the safe boundary.

7. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 6, characterized in that, In step S7, the formula for unbiased aggregation of the mean is: in, This represents the noisy global frequency domain average vector. This represents the noisy frequency domain coefficients output by the power safety gateway. This represents the total number of edge power terminals participating in this round of aggregation.

8. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 7, characterized in that, The implementation process of step S8 is as follows: Calculate the mean energy of the low-frequency dimensions after aggregation: ,in Indicates the first The low-frequency component of the layer in the aggregated global frequency domain average vector is the first... Each noisy frequency domain coefficient will be included in this round of aggregation. The mean value of the noisy low-frequency coefficients at the corresponding locations uploaded by each edge power terminal is obtained by unbiased averaging. Calculate the mean energy of observations in the high-frequency dimensions after aggregation: ,in Indicates the first The total length of the layer parameter vector; Indicates the first The high-frequency components of the layer in the aggregated global frequency domain average vector One noisy frequency domain coefficient; Based on the central limit theorem, the residual variance of the theoretical aggregation noise is calculated as follows: For the low-frequency Gaussian noise mechanism, the theoretical residual variance of the aggregated noise is: For the high-frequency Duchi mechanism, the theoretical residual aggregation noise variance is: ; Calculate the current round after deducting noise interference. Layer true gradient average energy: Low-frequency true gradient average energy: ; High-frequency true gradient average energy: ; Combined with minimum energy lower limit The decoupled low-frequency true gradient average energy and high-frequency true gradient average energy are combined to obtain the first energy of this round. The true gradient average energy of the layer: 。 9. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 8, characterized in that, In step S9, the abnormal deviation ratio is first calculated. , Indicates the first Historical baseline energy of the layer; If the abnormal deviation ratio Severe anomaly determination threshold If the system is deemed safe, a low-frequency target upper limit is set. Then the radius of the low-frequency cropping in the next round: At the same time, set an upper limit for high-frequency targets. Then the high-frequency clipping radius for the next round is: ; If the abnormal deviation ratio Severe anomaly determination threshold If this condition is not met, it is considered an abnormal state, triggering the boundary shrinkage mechanism: the low-frequency pruning radius for the next round is updated to... The next round of high-frequency cropping radius will be updated to... ; And update the historical baseline energy of this layer using an exponential moving average: .

10. The federated learning backdoor defense method based on frequency domain hybrid differential privacy according to claim 8, characterized in that, In step S9, the formula for updating the power grid dispatch model is: in The global learning rate of the system; The privacy budget audit process is as follows: (1) Single-round divergence calculation: Given Rèry The order of divergence The hybrid RDP actuaries separately tracked and calculated the Rènyi divergence generated by the low-frequency Gaussian mechanism in this round. Rèryi divergence generated by the high-frequency Duchi mechanism ; (2) Combinatorial theorem summation: Based on the serial combination theorem of hybrid RDP actuaries, the previous The divergence consumed in each round of training is linearly accumulated to obtain the cumulative Rènyi divergence. : (3) Calculate the given slack variables according to the transformation theorem. Total cumulative privacy consumption (4) Calculate the total amount of privacy consumption. Compared with the total system privacy budget limit initialized in step S1 Perform a comparison, if If the privacy budget is sufficient, the system can proceed to the next iteration; if If the privacy budget has been exhausted, the system terminates federated training and outputs the current final model.

Images