Federated learning backdoor defense-based intelligent perception model construction method for internet of vehicles

Abstract

The application discloses a kind of based on federal learning backdoor defense Internet of Vehicles intelligent perception model construction method, including constructing Internet of Vehicles federal learning network system;Initialization Internet of Vehicles intelligent perception model;Client local training and generating model update;Constitute the group reference center of client update;Calculate collaborative optimization deviation risk evidence, hierarchical disturbance risk evidence, group distance deviation risk evidence and historical consistency risk evidence and sensitive layer enhancement risk evidence;Risk evidence bounded calibration and risk mapping are carried out;Update risk response type asymmetric time sequence memory;Calculate client level risk self-adapting aggregation weight;Perform hierarchical continuous risk control;Aggregation stratified update and update global model;Iterative training and deploy final model;Solve the problems that existing technology data distribution heterogeneity leads to abnormal client identification difficulty, single statistical detection method is easy to misjudge, backdoor attack locality and strong concealment, latent attack is difficult to continue tracking and the like.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network target recognition technology, and in particular relates to a method for constructing a vehicle network intelligent perception model based on federated learning backdoor defense. Background Technology

[0002] Against the backdrop of rapid development in intelligent transportation and the Internet of Vehicles (IoV), vehicle-road cooperative perception, autonomous driving assistance, and intelligent traffic incident recognition have become important directions for intelligent transportation systems. Vehicles, roadside units, and traffic edge servers can collect road environment data through devices such as cameras, millimeter-wave radar, lidar, GPS, and inertial sensors to train intelligent models for traffic sign recognition, pedestrian detection, vehicle detection, road obstacle recognition, abnormal parking detection, and traffic accident perception. To improve the recognition accuracy and generalization ability of these models in complex road environments, it is urgent to conduct collaborative training using data from different vehicles, roadside units, and traffic nodes in different areas. However, IoV data has significant privacy and sensitivity issues. Data such as vehicle trajectories, driving behavior, road videos, license plate information, traffic flow, and regional road operation status may involve personal privacy, vehicle operation safety, and urban traffic management information, and cannot usually be directly uploaded to a central server for centralized processing. Furthermore, the sheer number and wide distribution of IoV nodes, along with the dynamically changing communication environment, mean that long-term transmission of large-scale raw perception data using centralized training methods would lead to high communication overhead and security risks.

[0003] Federated learning, as a distributed machine learning paradigm, allows multiple vehicle terminals, roadside units, or edge nodes to collaboratively train a global model while maintaining data locality. In the connected vehicle scenario, each client only needs to train the model based on local road perception data and upload model parameters or model updates to the server for aggregation, thus achieving "usable but invisible" road data. This approach can improve model performance by utilizing data from different road environments and traffic scenarios, while avoiding the direct exposure of raw road videos, vehicle trajectories, and driving behavior data, making it suitable for the collaborative training needs of connected vehicle intelligent perception models. However, in the actual deployment of connected vehicle federated learning systems, the client sources are complex, including private cars, commercial vehicles, roadside perception devices, and traffic edge servers. Some vehicle terminals or roadside units may be controlled by attackers due to device vulnerabilities, communication hijacking, or malicious access. Malicious nodes can tamper with local training data or modify training objectives, implanting backdoor information in uploaded model updates, allowing the global model to maintain a high recognition accuracy in normal road scenarios, but outputting erroneous results preset by the attacker when encountering specific triggering conditions. For example, in traffic sign recognition tasks, attackers can add specific stickers, light spots, or edge textures to local samples, causing the model to misidentify stop signs, speed limit signs, or construction warning signs as other categories on real roads, thereby affecting the reliability of vehicle-road cooperative early warning and intelligent driving decisions.

[0004] Further complicating matters is the highly heterogeneous nature of vehicle-to-everything (V2X) data. Different vehicles exhibit significant differences in their driving areas, sensor models, installation angles, weather conditions, lighting environments, and road types, leading to strong inconsistencies in model updates uploaded by legitimate clients. Traditional federated learning security methods often rely on model update norms, directional similarity, or distance outliers to identify anomalous clients and directly eliminate suspicious clients. This can easily misclassify normal vehicles or roadside units with unique scenarios as malicious nodes. Furthermore, backdoor attacks are often localized and covert, with their impact potentially concentrated in the feature extraction layer, target classification layer, or high-level semantic layer. Judging from the overall update perspective alone is insufficient to detect localized backdoor perturbations. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense, so as to solve the problems of heterogeneous data distribution, covert malicious updates, and difficulty in accurately identifying abnormal clients in the federated training of existing V2X road target recognition and traffic event perception.

[0006] Technical solution of the present invention:

[0007] A method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense includes:

[0008] Step 1: Construct a federated learning network system for the Internet of Vehicles;

[0009] Step 2: Initialize the vehicle-to-everything (V2X) intelligent perception model;

[0010] Step 3: Train the model locally on the client side and generate model updates;

[0011] Step 4: Construct a group reference center for client updates;

[0012] Step 5: Calculate evidence of deviation risk from collaborative optimization;

[0013] Step 6: Calculate the evidence of hierarchical disturbance risk;

[0014] Step 7: Calculate evidence of group distance deviation risk;

[0015] Step 8: Calculate historical consistency risk evidence and sensitive layer enhancement risk evidence;

[0016] Step 9: Perform bounded calibration of risk evidence and risk mapping;

[0017] Step 10: Update the risk-response asymmetric temporal memory;

[0018] Step 11: Calculate the client-level risk adaptive aggregation weight;

[0019] Step 12: Implement hierarchical continuous risk control;

[0020] Step 13: Aggregate hierarchical updates and update the global model;

[0021] Step 14: Iterate through training and deploy the final model.

[0022] The connected vehicle federated learning network system includes A distributed federated learning network architecture and a central server for participating nodes in the vehicle-to-everything (V2X) network; participating nodes include vehicle terminals, roadside units, and traffic edge servers; each participating node acts as an independent client. Configure a local computing unit and a local storage unit to store the road perception dataset collected by the node. The central server, acting as a coordination node, is responsible for global model initialization, training task distribution, client update reception, backdoor risk modeling, risk-driven aggregation, and global model updates.

[0023] Vehicle-to-everything (V2X) intelligent perception models are divided into: Each network layer, and the client In the The model update in round-robin upload is represented as , of which Layer update is represented as The central server will initialize the global model. Distributed to the set of clients participating in the current round of training The overall client update is represented as in, Indicates the client number. Indicates the model hierarchy number. Indicates the client In the Round Layer model update, This represents the set of clients currently participating in training; the central server pre-sets the set of sensitive layers based on the model structure. .

[0024] Methods for training and generating model updates locally on the client side include: in the... During a training round, the central server sends data to the set of clients participating in the current round. Deploy global model Client Based on local road perception dataset Perform local training to obtain the model parameters after local training. And generate local model updates according to the following formula:

[0025] ;

[0026] Indicates the client The model parameters after the t-th round of local training, Indicates the first Global model parameters issued by the wheel center server. This represents the local model update uploaded by client i in round t;

[0027] The method for constructing a group reference center includes: the central server receiving the set of clients participating in the current round. After the uploaded model is updated, the median coordinates are used to construct the overall group reference center for round t. :

[0028] ;

[0029] Correspondingly, the first Layered Group Reference Center Defined as:

[0030] ;

[0031] Where CMed represents the median operator, Let t represent the overall group reference center in round t. Indicates the t-th round. Layered Group Reference Center.

[0032] Methods for calculating evidence of deviation risk in collaborative optimization include:

[0033] The central server computes the model update of client i. With the overall group reference center Directional similarity between them:

[0034] ;

[0035] Evidence of client-level directional deviation risk is obtained based on directional similarity:

[0036] ;

[0037] in, This represents the client-level directional similarity of client i in round t. Let ε represent the risk evidence of client i deviating from the client-level direction in round t, and let ε represent the numerical stability constant to prevent the denominator from being zero.

[0038] At the hierarchical granularity, the first digit of client i is calculated. Layer update With the Layered Group Reference Center Directional similarity between them:

[0039] ;

[0040] The corresponding number Evidence for risk of layer direction deviation is as follows:

[0041] ;

[0042] The methods for calculating hierarchical disturbance risk evidence include:

[0043] The central server first calculates the value of client i in the first... Layer update magnitude:

[0044] ;

[0045] Record No. The median of the update magnitudes of all participating clients in the layer is:

[0046] ;

[0047] No. The absolute deviation of the median is:

[0048] ;

[0049] Then client i in the th The evidence for layer disturbance risk is defined as follows:

[0050] ;

[0051] The perturbation risk evidence at each layer is weighted and summed to obtain the client-level perturbation risk evidence:

[0052] ;

[0053] Indicates the first The importance coefficient of the layer This indicates that client i is in round t, at position t. Evidence of layer disturbance risk This indicates evidence of client-level hierarchical disturbance risks.

[0054] Methods for calculating evidence of group distance deviation risk include:

[0055] The central server computes the overall model update of client i. With the overall group reference center Distance between:

[0056]

[0057] Based on the overall distance distribution of all clients in the current round, evidence of client-level group distance deviation risk is obtained:

[0058] ;

[0059] Correspondingly, client i at the th The group distance of a layer is defined as:

[0060] ;

[0061] No. Evidence for risk of deviation from group distance is defined as follows:

[0062] ;

[0063] This represents the overall group distance of client i. Indicates client i Group distance of the layer This indicates evidence of risk of deviation from the client-level group distance. This indicates evidence of risk of deviation from hierarchical group distance;

[0064] The calculation methods for historical consistency risk evidence and sensitivity layer enhanced risk evidence include:

[0065] The central server maintains a length of [length missing] for client i. The historical update cache records the model updates uploaded in the most recent X rounds; let client i be the past... Wheel history updated to The client-level historical reference direction is defined as follows:

[0066] ;

[0067] The client-level historical consistency risk evidence is defined as follows:

[0068] ;

[0069] Correspondingly, the first The layer history reference direction is defined as:

[0070] ;

[0071] No. The evidence for layered historical consistency risk is defined as follows:

[0072] ;

[0073] in, This indicates the client-level historical reference direction for client i. Indicates client i Historical reference direction of the layer;

[0074] The calculation methods for enhancing risk evidence at the sensitive layer include: assuming... Let i represent the set of sensitive layers. Then, client i in round t... The definition of sensitive layer enhancement risk evidence is:

[0075] ;

[0076] Indicates the first Sensitive layer enhancement coefficient of the layer, Let be the indicator function; when the first... The layer belongs to the sensitive layer set. hour, ,otherwise ; The combined function consisting of existing risk evidence at the current layer is defined as:

[0077] ;

[0078] in, , , The weights are non-negative and satisfy the following conditions: .

[0079] Methods for bounded calibration of risk evidence include:

[0080] remember This represents the client-level original risk evidence of client i in round t, of type m. For the client-level risk evidence of type m, a robust metric is constructed based on the risk evidence distribution of all participating clients in the current round:

[0081] ;

[0082] The bounded calibration result of client-level risk evidence is defined as:

[0083] ;

[0084] For evidence of hierarchical risk, remember This indicates that client i is in round t, at position t. The m-th type of original risk evidence in the layer, then the... The robustness criterion for evidence of the m-th type of risk is defined as follows:

[0085] ;

[0086] The corresponding level of risk evidence bounded calibration results are as follows:

[0087] ;

[0088] After bounded calibration is completed, the client-level instantaneous risk representation is defined as:

[0089] ;

[0090] in, This represents the instantaneous client-level risk of client i in round t. The client-level risk mapping weights are all non-negative and satisfy the following conditions:

[0091] ;

[0092] Correspondingly, client i in round t, The instantaneous risk component of a layer is defined as follows:

[0093] ;

[0094] in, This indicates that client i is in round t, at position t. The instantaneous risk component of the layer, , , , and The corresponding risk mapping weights are all non-negative and satisfy the following conditions:

[0095] .

[0096] The beneficial effects of this invention are:

[0097] This invention achieves a balance between security and model availability during the federated training of vehicle-to-everything (V2X) road target recognition and traffic event perception models through a multi-perspective backdoor risk modeling mechanism. This mechanism characterizes the risks of client-uploaded model updates from multiple angles, including collaborative optimization deviation, local backdoor propagation, and behavioral evolution instability. It avoids the misjudgment problems caused by traditional methods that rely solely on single statistical features such as update norm, directional similarity, or distance outlier determination for anomaly detection, thus improving the accuracy and stability of malicious client identification.

[0098] In the context of highly heterogeneous vehicle-to-everything (V2X) data, this invention can better distinguish between normal scenario differences and malicious backdoor updates. Different vehicle terminals, roadside units, and traffic edge nodes naturally exhibit differences in local data distribution and model updates due to variations in road type, sensor configuration, acquisition angle, weather conditions, and traffic density. This invention does not simply categorize client updates as normal or malicious; instead, it uses a continuous representation of update risk through a client-level total risk score and a hierarchical backdoor risk vector, thereby reducing the possibility of incorrectly removing vehicles or roadside units that are normal but have specific scenario requirements.

[0099] Regarding backdoor attack defense capabilities, this invention can effectively suppress covert backdoor attacks in traffic sign recognition, road target detection, and traffic event perception tasks. For backdoor behaviors implanted through triggering patterns such as specific stickers, light spots, road textures, vehicle body patterns, or sensor perturbations, this invention not only conducts risk assessment from the perspective of overall client updates but also further analyzes local backdoor propagation characteristics from different network layers. It can discover local abnormal perturbations concentrated in the feature extraction layer, target classification layer, or high-level semantic layer, thus overcoming the shortcomings of traditional overall detection methods in identifying local backdoor risks.

[0100] In terms of persistent attack identification, this invention improves the defense against latent, intermittent, and progressive backdoor attacks through a risk-response asymmetric temporal memory mechanism. When the client's risk status increases significantly, this mechanism can quickly accumulate historical risks; when the client's short-term behavior returns to normal, historical risks are not immediately cleared, thus preventing malicious clients from quickly masking existing abnormal behavior through a few normal rounds. Therefore, this invention can more stably track changes in client behavior across rounds, enhancing the ability to identify long-term, covert backdoor injection processes.

[0101] In terms of aggregation defense, this invention employs a risk-driven differentiated aggregation strategy, mapping the total risk score at the client level to the overall aggregation weight, and mapping the hierarchical backdoor risk vector to the local processing intensity of different network layers. For low-risk clients, this invention retains more of their effective training contributions; for high-risk clients or high-risk network layers, this invention reduces their pollution impact on the global model by decreasing the aggregation weight and enhancing the local suppression strength. Compared with the traditional method of directly eliminating suspicious clients, this approach can reduce the loss of training information in rare road scenes, helping to maintain the model's ability to recognize complex traffic environments.

[0102] This invention is applicable to tasks such as road target recognition, traffic sign recognition, pedestrian and vehicle detection, road obstacle recognition, abnormal parking detection, and traffic accident perception in the Internet of Vehicles (IoV). It supports secure collaborative training among multiple vehicle terminals, roadside units, and traffic edge nodes without uploading raw road perception data. This method retains the advantage of federated learning—"data is available but not visible"—while enhancing the robustness of IoV intelligent perception models against malicious clients and backdoor attacks, providing technical support for building a secure, reliable, and trustworthy vehicle-road cooperative intelligent perception system.

[0103] This invention solves the technical problems existing in the connected vehicle federated learning system, such as the difficulty in identifying abnormal clients due to heterogeneous data distribution, the susceptibility of misjudgment by a single statistical detection method, the strong locality and concealment of backdoor attacks, the difficulty in continuously tracking latent attacks, the easy loss of effective training information by hard removal strategies, and the susceptibility of the global model to malicious updates. Attached Figure Description

[0104] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation

[0105] A method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense includes:

[0106] Step 1: Construct a federated learning network system for the Internet of Vehicles;

[0107] Establish containing This is a distributed federated learning network architecture for vehicle-to-everything (V2X) networks, where participating nodes include vehicle terminals, roadside units, and traffic edge servers. Each participating node acts as an independent client. Configure a local computing unit and a local storage unit to store the road perception dataset collected by the node. The road perception data includes traffic sign images, road video frames, vehicle target images, pedestrian target images, road obstacle images, abnormal parking scene images, construction area images, and traffic accident scene images. A central server is set up as a coordination node, responsible for global model initialization, training task distribution, client update reception, backdoor risk modeling, risk-driven aggregation, and global model updates. The central server does not access any raw road perception data; each client only uses its local dataset. The trained model is uploaded and local model updates are uploaded to participate in the aggregation, thereby realizing the "usable but invisible" nature of vehicle-to-everything (V2X) road perception data.

[0108] Step 2: Initialize the road target recognition and traffic event perception model;

[0109] The central server constructs a deep neural network model (vehicle-to-everything intelligent perception model) for road target recognition and traffic event perception in the Internet of Vehicles (IoV), and initializes the global model. The model is used to identify road targets or traffic events such as traffic signs, pedestrians, vehicles, road obstacles, abnormal parking, construction areas, and traffic accidents. To characterize the differentiated performance of different network layers under backdoor attacks, the model is divided into... There are network layers, among which This indicates the total number of model levels, and the client... In the The model update in round-robin upload is represented as , of which Layer update is represented as The central server will initialize the global model. Distributed to the set of clients participating in the current round of training A complete client update can be represented as... in, Indicates the client number. Indicates the model hierarchy number. Indicates the client In the Round Layer model update, This represents the set of clients currently participating in the training.

[0110] The central server pre-sets a set of sensitive layers based on the model structure. The set of sensitive layers includes a classification head layer, a normalization layer, and a high-level semantic feature layer. For vehicle-to-everything (V2X) road target recognition and traffic event perception tasks, the high-level semantic feature layer is used to extract decision-related features such as traffic sign categories, pedestrian outlines, vehicle targets, and obstacle morphologies.

[0111] Step 3: Train the model locally on the client side and generate model updates;

[0112] In the During the training round, the client Global model of receiving central server broadcast And based on the local road perception dataset Perform several rounds of local training to obtain the locally trained model parameters. The client then generates a local model update based on the differences in model parameters before and after local training. The client only uploads local model updates to the central server. It also provides necessary training information, without uploading original road images, road videos, or vehicle trajectory data, thereby ensuring that the vehicle-to-everything (V2X) road perception data is retained locally.

[0113] The method for local training and generating model updates on the client includes: in the... During a training round, the central server sends data to the set of clients participating in the current round. Deploy global model Client Based on local road perception dataset Perform local training to obtain the model parameters after local training. And generate local model updates according to the following formula:

[0114]

[0115] in, Indicates the client The model parameters after the t-th round of local training, Indicates the first Global model parameters issued by the wheel center server. This represents the local model update uploaded by client i in round t.

[0116] Step 4: Construct a group reference center for client updates;

[0117] The central server receives the set of clients participating in the current round. After the uploaded model is updated, the overall group reference center for this round is first constructed. This is used to characterize the dominant optimization direction of the current wheel-vehicle network federated training. To mitigate the impact of anomalous updates on the reference center, the overall group reference center can be constructed using the coordinate median method. Correspondingly, for the model's... The network layer, the central server constructs the first... Layered Group Reference Center Overall Group Reference Center Used for subsequent calculations of client-level backdoor risk evidence, the first Layered Group Reference Center Used to calculate backdoor risk evidence at different levels.

[0118] The method for constructing a group reference center includes: a central server receiving the set of clients participating in the current round. After the uploaded model is updated, the median coordinates are used to construct the overall group reference center for round t. :

[0119]

[0120] Correspondingly, the first Layered Group Reference Center Defined as:

[0121]

[0122] Where CMed represents the median operator, Let t represent the overall group reference center in round t. Indicates the t-th round. Layered Group Reference Center.

[0123] The median operator CMed refers to: calculating the median for each parameter coordinate of all model updates uploaded by participating clients in the current round, and forming a reference vector consistent with the model update dimension by the medians of each parameter coordinate.

[0124] Step 5: Calculate evidence of deviation risk from collaborative optimization;

[0125] The central server is based on the overall group reference center in round t. Computing client Model update The consistency of direction with the current round of group-dominated optimization direction, thereby obtaining evidence of client-level directional deviation risk. The more inconsistent the client's update direction is with the group reference center, the greater the degree to which the client's update deviates from the main task optimization trend of the global vehicle network model. Furthermore, the central server is based on the... Layered Group Reference Center Calculate the first Evidence of risk of layer direction deviation Used to characterize the client In the Does the layer exhibit local directional anomalies?

[0126] The method for calculating the collaborative optimization deviation risk evidence includes: the central server calculating the model update of client i. With the overall group reference center Directional similarity between them:

[0127]

[0128] Evidence of client-level directional deviation risk is obtained based on directional similarity:

[0129]

[0130] in, This represents the client-level directional similarity of client i in round t. Let ε represent the risk evidence of client i deviating from the client-level direction in round t, and let ε represent the numerical stability constant to prevent the denominator from being zero.

[0131] At the hierarchical granularity, the first digit of client i is calculated. Layer update With the Layered Group Reference Center Directional similarity between them:

[0132]

[0133] The corresponding number Evidence for risk of layer direction deviation is as follows:

[0134]

[0135] Step 6: Calculate evidence of hierarchical disturbance risk;

[0136] Central server needle client In the Round Layer model update Calculate its update magnitude and perform robust statistical calibration by combining it with the update distribution of all clients at the same level in the current round, to obtain the first... Evidence of layer disturbance risk For network layers closely related to road target classification and traffic event judgment, such as the classification head layer, normalization layer, or high-level semantic feature layer, if their update amplitude is significantly abnormal compared to other clients in the same layer, it indicates that this layer may be carrying backdoor perturbations. Furthermore, the central server weights and summarizes the perturbation risk evidence from each layer to obtain client-level layer perturbation risk evidence. .

[0137] The calculation method for the hierarchical disturbance risk evidence includes: the central server first calculates the risk level of client i at the 1st... Layer update magnitude:

[0138]

[0139] Record No. The median of the update magnitudes of all participating clients in the layer is:

[0140]

[0141] No. The absolute deviation of the median is:

[0142]

[0143] Then client i in the th The evidence for layer disturbance risk is defined as follows:

[0144]

[0145] Furthermore, the perturbation risk evidence at each layer is weighted and summed to obtain the client-level perturbation risk evidence:

[0146]

[0147] in, Indicates the first The importance coefficient of the layer This indicates that client i is in round t, at position t. Evidence of layer disturbance risk This indicates evidence of client-level hierarchical disturbance risks.

[0148] satisfy The importance coefficients can be preset according to the functions of the network layers; for the classification head layer, normalization layer, and high-level semantic feature layer, larger importance coefficients should be set; when there are no prior settings, take... .

[0149] Step 7: Calculate evidence of group distance deviation risk;

[0150] The central server further calculates the client's... Overall model update With the overall group reference center The degree of distance deviation between them provides evidence of client-level group distance deviation risk. This risk evidence is used to identify hidden backdoor updates that may be directionally close to the dominant population direction but still deviate from the normal update distribution in parameter space location. Correspondingly, the central server communicates with the client. The Layer model update With the Layered Group Reference Center The distances between them are calculated to obtain evidence of risk of hierarchical group distance deviation. .

[0151] The method for calculating the evidence of group distance deviation risk includes: the central server calculating the overall model update of client i. With the overall group reference center Distance between:

[0152]

[0153] Based on the overall distance distribution of all clients in the current round, evidence of client-level group distance deviation risk is obtained:

[0154]

[0155] Correspondingly, client i at the th The group distance of a layer is defined as:

[0156]

[0157] No. Evidence for risk of deviation from group distance is defined as follows:

[0158]

[0159] in, This represents the overall group distance of client i. Indicates client i Group distance of the layer This indicates evidence of risk of deviation from the client-level group distance. This indicates evidence of risk of deviation from the hierarchical group distance.

[0160] Step 8: Calculate historical consistency risk evidence and sensitive layer enhanced risk evidence;

[0161] The central server maintains a historical update cache for each client, recording the model updates uploaded by that client in the most recent rounds. For each client... The model update uploaded in the current round The central server compares it with the client's historical reference update to obtain evidence of client-level historical consistency risk. At the same time, for the first Layer update Evidence of historical consistency risk at the computational level For sensitive layer sets The central server further calculates enhanced risk evidence for the sensitive layer. This improves the ability to identify local backdoor perturbations in the classification head layer, normalization layer, and high-level semantic layer.

[0162] The calculation method for the historical consistency risk evidence includes: the central server maintains a length of [missing information - likely a unit of length]. The historical update cache records the model updates uploaded in the most recent X rounds. Let client i be the past... Wheel history updated to Its client-level historical reference direction is defined as:

[0163]

[0164] The client-level historical consistency risk evidence is defined as follows:

[0165]

[0166] Correspondingly, the first The layer history reference direction is defined as:

[0167]

[0168] No. The evidence for layered historical consistency risk is defined as follows:

[0169]

[0170] in, This indicates the client-level historical reference direction for client i. Indicates client i Historical reference direction for the layer.

[0171] The calculation method for the enhanced risk evidence of the sensitive layer includes: assuming Let i represent the set of sensitive layers. Then, client i in round t is... The definition of sensitive layer enhancement risk evidence is:

[0172]

[0173] Indicates the first Sensitive layer enhancement coefficient of the layer, Let be the indicator function; when the first... The layer belongs to the sensitive layer set. hour, ,otherwise . The combined function consisting of existing risk evidence at the current layer is defined as:

[0174]

[0175] in, , , The weights are non-negative and satisfy the following conditions: .

[0176] Step 9: Perform bounded calibration of risk evidence and risk mapping;

[0177] After obtaining backdoor risk evidence such as directional deviation, hierarchical perturbation, group distance deviation, historical consistency, and sensitive layer enhancement, the central server first performs bounded calibration on different types of risk evidence to uniformly map them to... The range is defined to avoid the impact of different original value scales on subsequent fusion of different risk evidence. After calibration, the central server combines client-level risk evidence according to preset risk mapping weights to obtain client-level instantaneous risk representation. At the same time, for the first By combining layer-by-layer risk evidence, the instantaneous first-order risk level is obtained. Layer risk components .

[0178] The method for bounded calibration of risk evidence includes: recording... Let m represent the client-level original risk evidence of client i in round t, where m corresponds to directional deviation, hierarchical perturbation, group distance deviation, and historical consistency. For the m-th type of client-level risk evidence, a robust metric is constructed based on the risk evidence distribution of all participating clients in the current round:

[0179]

[0180] The bounded calibration result of client-level risk evidence is defined as:

[0181]

[0182] For evidence of hierarchical risk, remember This indicates that client i is in round t, at position t. The m-th type of original risk evidence in the layer, then the... The robustness criterion for evidence of the m-th type of risk is defined as follows:

[0183]

[0184] The corresponding level of risk evidence bounded calibration results are as follows:

[0185]

[0186] After bounded calibration is completed, the client-level instantaneous risk representation is defined as:

[0187]

[0188] in, This represents the instantaneous client-level risk of client i in round t. The client-level risk mapping weights are all non-negative and satisfy the following conditions:

[0189]

[0190] Correspondingly, client i in round t, The instantaneous risk component of a layer is defined as follows:

[0191]

[0192] in, This indicates that client i is in round t, at position t. The instantaneous risk component of the layer, , , , and The corresponding risk mapping weights are all non-negative and satisfy the following conditions:

[0193]

[0194] Step 10: Update the risk-response asymmetric temporal memory;

[0195] To enhance the continuous identification capability of stealthy, intermittent, and progressive backdoor attacks, the central server is based on the client. Current round instantaneous risk Based on historical risk memories from the previous round, the client-level risk increase is calculated, and a risk response memory coefficient is determined accordingly. If client-side risk increases significantly, historical risk memories accumulate rapidly; if current risk decreases, historical risk is released slowly. The client-level risk response memory coefficient is determined based on the risk increase. After the central server updates the client-level historical risk memory, it obtains the client-level total risk score. Correspondingly, the central server... Layer instantaneous risk component Perform the same temporal memory update to obtain the first... Layer risk components And constitute a hierarchical backdoor risk vector. .

[0196] The risk-response-based asymmetric temporal memory update method includes: recording... This represents the client-level historical risk memory of client i after the end of the previous participation round. First, the risk increase of client i in round t is defined as:

[0197]

[0198] in, Let represent the increase in client-level risk for client i in round t. Based on the increase in risk, define the client-level risk response memory coefficient as:

[0199]

[0200] in, and Let these represent the lower and upper bounds of the memory coefficient, respectively, satisfying... ; represents the sensitivity coefficient of historical memory to the magnitude of risk increase; exp represents an exponential function with the natural constant e as the base.

[0201] Client-level historical risk memory updated to:

[0202]

[0203] Ultimately, the client-level total risk score is defined as:

[0204]

[0205] At the hierarchical granularity, the first The increase in layer risk is defined as:

[0206] The corresponding hierarchical risk response memory coefficient is defined as follows:

[0207] No. The historical risk memory of the layer has been updated to:

[0208] The final stage used for aggregation Layer risk components are defined as follows:

[0209]

[0210] in, This indicates that client i is in the i-th round after the previous round of participation. Layer of historical risk memory, This indicates that client i is in round t, at position t. The risk increase of the layer, Indicates the first Layered risk response memory coefficient.

[0211] Step 11: Calculate the client-level risk adaptive aggregation weight;

[0212] The central server is based on the client. Local sample size Calculate the original federated average aggregate weight Based on this, a client-level total risk score is introduced. The client-level risk adaptive aggregation weight is obtained. .when When smaller, the client The updates are basically based on the original sample size weights when participating in aggregation; when When it is large, the client The overall aggregation contribution is continuously reduced. This step explicitly transforms client-level backdoor risks into overall participation intensity, avoiding the loss of training information in normal road scenarios caused by directly deleting suspicious clients in traditional hard removal methods.

[0213] The calculation method for the client-level risk adaptive aggregation weight includes: the central server calculates the weight based on the local sample size of client i. Calculate the original federated average aggregate weights:

[0214] in, This represents the weight of the original sample size for client i. This represents the number of local samples for client i. A client-level total risk score is further introduced. This yields client-level risk adaptive aggregation weights:

[0215]

[0216] in, This represents the risk adaptive aggregation weight of client i in round t. This represents the risk suppression strength coefficient. The larger, The smaller the value, the lower the overall aggregation contribution of client i.

[0217] Step 12: Implement hierarchical continuous risk control;

[0218] The central server, according to the first Layer risk components For the client The Layer model update Implement hierarchical continuous risk control. First, calculate the... Layer base clipping threshold and combined Obtain the risk-adaptive pruning threshold Subsequently, the risk adaptive compression coefficient was calculated. and risk adaptive noise scale The central server sequentially... Perform trimming, compression, and noise perturbation to obtain a hierarchical update after continuous control. The higher the risk, the stronger the clipping, compression, and noise disturbances experienced by the corresponding layer.

[0219] The hierarchical continuous risk control method includes: the central server first determines the current round... All clients in the layer update the amplitude, and calculate the first... Layer base clipping threshold:

[0220]

[0221] in, Indicates the first Layer-based pruning threshold This represents the scaling factor. Further, combined with the... Layer risk components Construct a risk-adaptive pruning threshold:

[0222]

[0223] in, This indicates that client i is in round t, at position t. The risk adaptive pruning threshold for the layer, where ρ represents the risk sensitivity coefficient.

[0224] The corresponding clipping function is defined as follows:

[0225]

[0226] The risk adaptive compression coefficient is defined as:

[0227]

[0228] in, This indicates that client i is in round t, at position t. The risk-adaptive compression factor of the layer, and Let these represent the lower and upper bounds of the compressibility coefficient, respectively, satisfying... .

[0229] The compression function is defined as:

[0230]

[0231] The risk adaptive noise scale is defined as:

[0232]

[0233] in, This indicates a risk-adaptive noise scale. Indicates the baseline noise level. This represents the noise adjustment coefficient.

[0234] The noise disturbance function is defined as:

[0235]

[0236] By combining trimming, compression, and noise perturbation, the hierarchical update after continuous control is obtained:

[0237]

[0238] in, This indicates that client i is in round t, at position t. The model is updated after continuous risk control.

[0239] Step 13: Aggregate hierarchical updates and update the global model;

[0240] After completing client-level weighted and hierarchical continuous risk control, the central server uses risk adaptive aggregation weights. The processed first client Layer update Perform weighted aggregation to obtain the first... Layer global update After aggregating all L network layers, the complete global update is obtained. The central server, according to Update the current global model To obtain the next round of global model This process transforms the backdoor risk representation obtained before aggregation into the actual aggregation suppression strength, achieving a continuous defense loop from risk characterization to risk suppression.

[0241] The method for aggregation hierarchical updates includes: the central server utilizing risk-adaptive aggregation weights. After continuous risk control of each client, the first Layer update Perform weighted aggregation to obtain the first... Layer-wide update:

[0242]

[0243] After aggregating all L network layers, the complete global update is obtained:

[0244]

[0245] The central server updates the current global model based on the entire round of global update Δ̃ᵗ:

[0246]

[0247] in, Indicates the t-th round. Layer-wide aggregate update, This indicates the global aggregate update in round t. This indicates the server-side update step size. This represents the global model parameters in round t+1.

[0248] Step 14: Iterate through training and deploy the final model;

[0249] The central server repeatedly executes the following processes: global model broadcasting, local client training, model update and upload, multi-view backdoor risk modeling, risk-responsive asymmetric temporal memory update, risk-driven differentiated aggregation, and global model update, until the preset maximum number of communication rounds is reached, the model performance meets the requirements of vehicle-to-everything (V2X) applications, or the global model converges. After training, the central server deploys the final model to vehicle terminals, roadside units, or traffic edge servers to perform tasks such as traffic sign recognition, pedestrian and vehicle detection, road obstacle recognition, abnormal parking detection, construction area recognition, and traffic accident perception.

[0250] The method for iteratively training and deploying the final model includes: the central server repeatedly executing steps 2 to 13 to perform multiple rounds of federated learning training. Training is considered complete when one of the following conditions is met: the preset maximum number of communication rounds is reached; the performance of the global model on the validation data meets the application requirements of vehicle-to-everything (V2X) road target recognition and traffic event perception tasks; or the update magnitude of the global model in multiple consecutive rounds is less than a preset convergence threshold. After training, the central server deploys the final model to vehicle terminals, roadside units, or traffic edge servers for traffic sign recognition, pedestrian and vehicle detection, road obstacle recognition, abnormal parking detection, construction area recognition, and traffic accident perception.

[0251] The model performance includes road target recognition accuracy, traffic event recognition accuracy, or validation loss. When the model's recognition accuracy on the validation dataset reaches a preset threshold, or the validation loss changes less than the preset threshold for multiple consecutive rounds, the model performance is considered to meet the application requirements.

Claims

1. A method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense, characterized in that: The method includes: Step 1: Construct a federated learning network system for the Internet of Vehicles; Step 2: Initialize the vehicle-to-everything (V2X) intelligent perception model; Step 3: Train the model locally on the client side and generate model updates; Step 4: Construct a group reference center for client updates; Step 5: Calculate evidence of deviation risk from collaborative optimization; Step 6: Calculate the evidence of hierarchical disturbance risk; Step 7: Calculate evidence of group distance deviation risk; Step 8: Calculate historical consistency risk evidence and sensitive layer enhancement risk evidence; Step 9: Perform bounded calibration of risk evidence and risk mapping; Step 10: Update the risk-response asymmetric temporal memory; Step 11: Calculate the client-level risk adaptive aggregation weight; Step 12: Implement hierarchical continuous risk control; Step 13: Aggregate hierarchical updates and update the global model; Step 14: Iterate through training and deploy the final model.

2. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense as described in claim 1, characterized in that: The connected vehicle federated learning network system includes A distributed federated learning network architecture and central server for each participating node in the vehicle-to-everything (V2X) network; Participating nodes include vehicle terminals, roadside units, and traffic edge servers; each participating node acts as an independent client. Configure a local computing unit and a local storage unit to store the road perception dataset collected by the node. The central server, acting as a coordination node, is responsible for global model initialization, training task distribution, client update reception, backdoor risk modeling, risk-driven aggregation, and global model updates.

3. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense as described in claim 2, characterized in that: Vehicle-to-everything (V2X) intelligent perception models are divided into: Each network layer, and the client In the The model update in round-robin upload is represented as , of which Layer update is represented as The central server will initialize the global model. Distributed to the set of clients participating in the current round of training ; The overall client update is represented as in, Indicates the client number. Indicates the model hierarchy number. Indicates the client In the Round Layer model update, This represents the set of clients currently participating in training; The central server pre-sets a set of sensitive layers based on the model structure. .

4. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense as described in claim 2, characterized in that: Methods for training and generating model updates locally on the client side include: in the... During a training round, the central server sends data to the set of clients participating in the current round. Deploy global model Client Based on local road perception dataset Perform local training to obtain the model parameters after local training. And generate local model updates according to the following formula: ； Indicates the client The model parameters after the t-th round of local training, Indicates the first Global model parameters issued by the wheel center server. This represents the local model update uploaded by client i in round t; The method for constructing a group reference center includes: the central server receiving the set of clients participating in the current round. After the uploaded model is updated, the median coordinates are used to construct the overall group reference center for round t. : ； Correspondingly, the first Layered Group Reference Center Defined as: ； Where CMed represents the median operator, Let t represent the overall group reference center in round t. Indicates the t-th round. Layered Group Reference Center.

5. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense according to claim 1, characterized in that: Methods for calculating evidence of deviation risk in collaborative optimization include: The central server computes the model update of client i. With the overall group reference center Directional similarity between them: ； Evidence of client-level directional deviation risk is obtained based on directional similarity: ； in, This represents the client-level directional similarity of client i in round t. Let ε represent the client-level directional deviation risk evidence of client i in round t, and let ε represent the numerical stability constant to prevent the denominator from being zero. At the hierarchical granularity, the first digit of client i is calculated. Layer update With the Layered Group Reference Center Directional similarity between them: ； The corresponding number Evidence for risk of layer direction deviation is as follows: ； The methods for calculating hierarchical disturbance risk evidence include: The central server first calculates the value of client i in the first... Layer update magnitude: ； Record No. The median of the update magnitudes of all participating clients in the layer is: ； No. The absolute deviation of the median is: ； Then client i in the th The evidence for layer disturbance risk is defined as follows: ； The perturbation risk evidence at each layer is weighted and summed to obtain the client-level perturbation risk evidence: ； Indicates the first The importance coefficient of the layer This indicates that client i is in round t, at position t. Evidence of layer disturbance risk This indicates evidence of client-level hierarchical disturbance risks.

6. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense according to claim 1, characterized in that: Methods for calculating evidence of group distance deviation risk include: The central server computes the overall model update of client i. With the overall group reference center Distance between: Based on the overall distance distribution of all clients in the current round, evidence of client-level group distance deviation risk is obtained: ； Correspondingly, client i at the th The group distance of a layer is defined as: ； No. Evidence for risk of deviation from group distance is defined as follows: ； This represents the overall group distance of client i. Indicates client i Group distance of the layer This indicates evidence of risk of deviation from the client-level group distance. This indicates evidence of risk of deviation from hierarchical group distance; The calculation methods for historical consistency risk evidence and sensitivity layer enhanced risk evidence include: The central server maintains a length of [length missing] for client i. The historical update cache records the model updates uploaded in the most recent X rounds; let client i be the past... Wheel history updated to The client-level historical reference direction is defined as follows: ； The client-level historical consistency risk evidence is defined as follows: ； Correspondingly, the first The layer history reference direction is defined as: ； No. The evidence for layered historical consistency risk is defined as follows: ； in, This indicates the client-level historical reference direction for client i. Indicates client i Historical reference direction of the layer; The calculation methods for enhancing risk evidence at the sensitive layer include: assuming... Let i represent the set of sensitive layers. Then, client i in round t is... The definition of sensitive layer enhancement risk evidence is: ； Indicates the first Sensitive layer enhancement coefficient of the layer, Let be the indicator function; when the first... The layer belongs to the sensitive layer set. hour, ,otherwise ; The combined function consisting of existing risk evidence at the current layer is defined as: ； in, , , The weights are non-negative and satisfy the following conditions: .

7. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense according to claim 1, characterized in that: Methods for bounded calibration of risk evidence include: remember This represents the client-level original risk evidence of client i in round t, of type m. For the client-level risk evidence of type m, a robust metric is constructed based on the risk evidence distribution of all participating clients in the current round: ； The bounded calibration result of client-level risk evidence is defined as: ； For evidence of hierarchical risk, remember This indicates that client i is in round t, at position t. The m-th type of original risk evidence in the layer, then the... The robustness criterion for evidence of the m-th type of risk is defined as follows: ； The corresponding level of risk evidence bounded calibration results are as follows: ； After bounded calibration is completed, the client-level instantaneous risk representation is defined as: ； in, This represents the instantaneous client-level risk of client i in round t. The client-level risk mapping weights are all non-negative and satisfy the following conditions: ； Correspondingly, client i in round t, The instantaneous risk component of a layer is defined as follows: ； in, This indicates that client i is in round t, at position t. The instantaneous risk component of the layer, , , , and The corresponding risk mapping weights are all non-negative and satisfy the following conditions: 。 8. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense according to claim 1, characterized in that: Risk-responsive asymmetric temporal memory update methods include: This represents the client-level historical risk memory of client i after the end of the previous participation round. The risk increase of client i in round t is defined as: ； in, This represents the increase in client-level risk for client i in round t; based on the increase in risk, the client-level risk response memory coefficient is defined as: ； in, and Let these represent the lower and upper bounds of the memory coefficient, respectively, satisfying... ; represents the sensitivity coefficient of historical memory to the magnitude of risk increase; exp represents an exponential function with the natural constant e as the base. Client-level historical risk memory updated to: ； Ultimately, the client-level total risk score is defined as: ； At the hierarchical granularity, the first The increase in layer risk is defined as: ; The corresponding hierarchical risk response memory coefficient is defined as follows: ; No. The historical risk memory of the layer has been updated to: ; The final stage used for aggregation Layer risk components are defined as follows: ； in, This indicates that client i is in the i-th round after the previous round of participation. Layer of historical risk memory, This indicates that client i is in round t, at position t. The risk increase of the layer, Indicates the first Layered risk response memory coefficient.

9. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense according to claim 1, characterized in that: The calculation method for client-level risk adaptive aggregation weights includes: the central server calculates the weights based on the local sample size of client i. Calculate the original federated average aggregate weights: ; in, This represents the weight of the original sample size for client i. This represents the number of local samples for client i; further, a client-level total risk score is introduced. This yields client-level risk adaptive aggregation weights: ； in, This represents the risk adaptive aggregation weight of client i in round t. Indicates the risk suppression intensity coefficient; The methods for hierarchical continuous risk control include: the central server first determines the risk level based on the current round number... All clients in the layer update the amplitude, and calculate the first... Layer base clipping threshold: ； in, Indicates the first Layer-based pruning threshold This represents the scaling factor; further combined with the first... Layer risk components Construct a risk-adaptive pruning threshold: ； in, This indicates that client i is in round t, at position t. The risk adaptive pruning threshold for the layer, where ρ represents the risk sensitivity coefficient; The corresponding clipping function is defined as follows: ； The risk adaptive compression coefficient is defined as: ； in, This indicates that client i is in round t, at position t. The risk-adaptive compression factor of the layer, and Let these represent the lower and upper bounds of the compressibility coefficient, respectively, satisfying... The compression function is defined as follows: ； The risk adaptive noise scale is defined as: ； in, This indicates a risk-adaptive noise scale. Indicates the baseline noise level. Indicates the noise adjustment factor; The noise disturbance function is defined as: ； By combining trimming, compression, and noise perturbation, the hierarchical update after continuous control is obtained: ； in, This indicates that client i is in round t, at position t. The model is updated after continuous risk control.

10. The method for constructing a vehicle-to-everything (V2X) intelligent perception model based on federated learning backdoor defense according to claim 1, characterized in that: The methods for aggregation-based hierarchical updates include: the central server utilizing risk-adaptive aggregation weights. After continuous risk control of each client, the first Layer update Perform weighted aggregation to obtain the first... Layer-wide update: ； After aggregating all L network layers, the complete global update is obtained: ； The central server updates the current global model based on the entire round of global update Δ̃ᵗ: ； Indicates the t-th round. Layer-wide aggregate update, This indicates the global aggregate update in round t. This indicates the server-side update step size. This represents the global model parameters in round t+1.

Images