Federated learning backdoor defense method, device, system and readable storage medium

Abstract

This application relates to a federated learning backdoor defense method, apparatus, system, and readable storage medium. The method includes: assigning global category labels in a global model to obtain a label set corresponding to each client; distributing the label set to each client so that each client can reverse-engineer triggers for each category label in the label set to obtain metadata, evaluation metrics, and backdoor sample embeddings for each candidate trigger; performing cluster analysis based on the metadata, evaluation metrics, and backdoor sample embeddings for each candidate trigger to obtain a set of potential triggers; and distributing the set of potential triggers to each client so that each client can construct enhancement samples based on each potential trigger in the set and use the enhancement samples to enhance and fine-tune its own local model to obtain an enhanced local model. This can improve backdoor defense capabilities while ensuring that client information is not leaked.

Description

Technical Field

[0001] This application relates to the field of federated learning technology, specifically to a method, apparatus, system, and readable storage medium for defending against backdoors in federated learning. Background Technology

[0002] Federated learning is a distributed machine learning paradigm. Its basic idea is to allow each client to train a model on its local data without directly sharing the original data. The client then uploads the model parameters, gradients, or model updates to an aggregation server, which aggregates these updates to obtain a global model. This mechanism can alleviate, to some extent, the privacy leaks, data compliance issues, and transmission costs associated with centralized storage of raw data in traditional centralized machine learning. Therefore, it has been applied in scenarios involving sensitive data, such as finance, healthcare, mobile devices, and the Internet of Things. However, because the local training process on each client is invisible to the server in federated learning, malicious clients can implant backdoors into the global model during local training through methods such as data poisoning, model replacement, or gradient manipulation. When the trained global model receives normal input, its predictive performance usually remains normal; however, when the input samples contain triggers preset by the attacker, the model will output the target category specified by the attacker, posing a serious threat to the reliability and security of the federated learning system. Therefore, backdoor defense for federated learning systems is particularly important.

[0003] In related technologies, backdoor defense of federated learning systems usually relies solely on the aggregation server to detect, sort, and cluster model updates from each client. However, this approach is prone to the risk of client information leakage. Furthermore, when attackers employ covert or adaptive attack strategies to make malicious updates appear statistically similar to normal updates, robust aggregation methods are prone to misjudgment. Therefore, improving backdoor defense capabilities while ensuring that client information is not leaked has become an urgent technical problem to be solved. Summary of the Invention

[0004] This application provides a method, apparatus, system, and readable storage medium for backdoor defense in federated learning systems, in order to solve the problems that existing backdoor defense methods in federated learning systems are prone to client information leakage risks and have poor backdoor defense capabilities.

[0005] Firstly, this application provides a method for defending against federated learning backdoors, applied to an aggregation server, the method comprising: After completing federated training with each client to obtain a global model, the global category labels in the global model are assigned to obtain the label set corresponding to each client; The tag set corresponding to each client is sent to each client respectively, so that each client can reverse the trigger for each category of tag in the tag set to obtain the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger, and upload the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger to the aggregation server. Based on the metadata, evaluation metrics and backdoor sample embeddings of each candidate trigger, cluster analysis is performed on the candidate triggers under different category labels from each client to obtain a set of potential triggers. The set of potential triggers is distributed to each client so that each client can construct enhancement samples based on each potential trigger in the set and use the enhancement samples to enhance and fine-tune its own local model to obtain an enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the unenhanced local model.

[0006] Optionally, the step of performing cluster analysis on candidate triggers from different categories of clients based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger to obtain a set of potential triggers includes: Candidate triggers from each client under the target category label are clustered to obtain multiple clusters corresponding to the target category label, wherein the target category label is any one of the global category labels; Based on the meta-information, evaluation metrics, and backdoor sample embeddings of the candidate triggers within each of the multiple clusters, the average L1 norm, the average attack success rate, and the average embedding similarity of each cluster are determined. Based on the average value of the L1 norm, the average value of the attack success rate, and the average value of the embedding similarity, calculate the comprehensive score corresponding to each cluster. Clusters whose overall scores are higher than a preset threshold are identified as the potential trigger set.

[0007] Optionally, determining the average L1 norm, average attack success rate, and average embedding similarity of each cluster based on the meta-information, evaluation metrics, and backdoor sample embeddings corresponding to the candidate triggers within each of the plurality of clusters includes: Based on the meta-information corresponding to the candidate triggers within each cluster, the average value of the L1 norm corresponding to each cluster is determined; Based on the evaluation metrics corresponding to the candidate triggers within each cluster, determine the average attack success rate for each cluster. The average embedding similarity of each cluster is determined based on the backdoor sample embeddings corresponding to the candidate triggers within each cluster.

[0008] Optionally, the formula for calculating the comprehensive score is as follows: ; Among them, the This represents the overall score corresponding to cluster O. This represents the average embedding similarity corresponding to cluster O. This represents the average attack success rate corresponding to cluster O. This represents the average L1 norm corresponding to cluster O. , and These represent the preset weights.

[0009] Optionally, the process of assigning global category labels in the global model to obtain a label set corresponding to each client includes: The global category labels in the global model are evenly distributed to obtain the label set corresponding to each client, wherein the category labels in the label sets corresponding to different clients do not overlap; or, The global category labels in the global model are overlapped to obtain the label set corresponding to each client. Among them, the category labels in the label sets corresponding to different clients have some overlap.

[0010] Secondly, this application also provides a federated learning backdoor defense method applied to a client, the method comprising: Receive a set of tags sent by the aggregation server, wherein the set of tags is obtained by the aggregation server after completing federated training with each client to obtain a global model and then allocating global category tags in the global model; The triggers in the tag set are reversed to obtain the meta-information, evaluation index and backdoor sample embedding of each candidate trigger. The metadata, evaluation metrics, and backdoor samples corresponding to each candidate trigger are embedded and uploaded to the aggregation server. The aggregation server then performs cluster analysis on the candidate triggers under different category labels from each client based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, obtains a set of potential triggers, and sends the set of potential triggers to the client. Enhanced samples are constructed based on each potential trigger in the set of potential triggers, and the enhanced samples are used to enhance and fine-tune the local model to obtain an enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the local model before enhancement.

[0011] Optionally, the step of performing trigger inversion on each category label in the label set to obtain the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger includes: Based on the preset constraint optimization function, the trigger is reversed to obtain a set of candidate triggers corresponding to the target category label, wherein the target category label is any one of the global category labels, and the set of candidate triggers includes at least one candidate trigger; Obtain the mask and pattern corresponding to each candidate trigger, and determine the target category label and the mask and pattern corresponding to each candidate trigger as the metadata corresponding to each candidate trigger; Construct trigger samples corresponding to each candidate trigger, and use the trigger samples corresponding to each candidate trigger as verification samples to evaluate the attack success rate corresponding to each candidate trigger. The attack success rate corresponding to each candidate trigger is determined as the evaluation index corresponding to each candidate trigger. Construct trigger samples corresponding to each candidate trigger, and perform feature mapping on the trigger samples corresponding to each candidate trigger to obtain the backdoor sample embedding corresponding to each candidate trigger.

[0012] Optionally, the step of using the enhanced samples to enhance and fine-tune the local model to obtain the enhanced local model includes: Based on the local clean samples, determine the clean sample loss value, and based on the augmented samples, determine the augmented sample loss value; Based on the clean sample loss value, the enhanced sample loss value, and the preset fine-tuning optimization function, the local model is enhanced and fine-tuned to obtain the enhanced local model.

[0013] Optionally, the fine-tuning optimization function is expressed by the following formula: ; in, This indicates that the local model parameters are The corresponding clean sample loss value under the condition, This indicates that the local model parameters are The corresponding augmented sample loss value in the case of, Indicates the local model parameters Optimize to make minimize, This indicates the preset coefficient.

[0014] Thirdly, this application also provides a federated learning backdoor defense device applied to an aggregation server, the device comprising: The allocation module is used to allocate global category labels in the global model after completing federated training with each client to obtain a global model, thereby obtaining a label set corresponding to each client. The first distribution module is used to distribute the tag set corresponding to each client to each client respectively, so that each client can reverse the trigger for each category tag in the tag set to obtain the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger, and upload the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger to the aggregation server. The clustering analysis module is used to perform clustering analysis on candidate triggers under different category labels from each client based on the metadata, evaluation metrics and backdoor sample embeddings of each candidate trigger, to obtain a set of potential triggers; The second distribution module is used to distribute the set of potential triggers to each client, so that each client can construct enhancement samples based on each potential trigger in the set of potential triggers, and use the enhancement samples to enhance and fine-tune its own local model to obtain an enhanced local model, wherein the backdoor defense capability of the enhanced local model is higher than that of the unenhanced local model.

[0015] Fourthly, this application also provides a federated learning backdoor defense device for use on a client side, the device comprising: The receiving module is used to receive a tag set sent by the aggregation server, wherein the tag set is obtained by the aggregation server after completing federated training with each client to obtain a global model and then allocating global category tags in the global model; The execution module is used to reverse the execution of triggers for each category of tags in the tag set to obtain the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger; The upload module is used to upload the metadata, evaluation metrics and backdoor samples corresponding to each candidate trigger to the aggregation server, so that the aggregation server can perform cluster analysis on the candidate triggers under different category tags from each client based on the metadata, evaluation metrics and backdoor sample embeddings corresponding to each candidate trigger, obtain a set of potential triggers, and send the set of potential triggers to the client. The enhancement and fine-tuning module is used to construct enhancement samples based on each potential trigger in the potential trigger set, and to enhance and fine-tune its own local model using the enhancement samples to obtain an enhanced local model, wherein the backdoor defense capability of the enhanced local model is higher than that of the local model before enhancement.

[0016] Fifthly, this application also provides a federated learning backdoor defense system, the system comprising: an aggregation server and multiple clients communicatively connected to the aggregation server; The aggregation server is used to execute the federated learning backdoor defense method described in the first aspect; The client is used to execute the federated learning backdoor defense method described in the second aspect.

[0017] Sixthly, this application also provides a computer-readable storage medium storing computer-executable instructions, which are used to execute the federated learning backdoor defense method described in the first aspect, or to execute the federated learning backdoor defense method described in the second aspect.

[0018] The beneficial effects of this application are: (1) This application performs trigger reverse engineering through the client, which can use the client’s local sample data and local model information to determine candidate triggers without the need for the aggregation server to participate, thus effectively preventing the leakage of the client’s original data; and by using the aggregation server to perform cluster analysis on candidate triggers under different category labels from each client, potential triggers that appear continuously, have strong attack effects and similar semantic embeddings can be identified, thereby improving the backdoor defense capability.

[0019] (2) The client of this application uses enhanced samples to enhance and fine-tune its own local model, which enables the local model to gradually forget the malicious mapping relationship between potential triggers and attack tags, thereby reducing the success rate of backdoor attacks and achieving the purpose of improving backdoor defense capabilities. Attached Figure Description

[0020] Figure 1 A flowchart illustrating a federated learning backdoor defense method provided in an embodiment of this application; Figure 2 A flowchart illustrating yet another federated learning backdoor defense method provided in this application embodiment; Figure 3 A comparison chart showing the clean sample accuracy of different defense methods provided in the embodiments of this application under various backdoor attacks; Figure 4 A comparison chart of the attack success rates of different defense methods provided in the embodiments of this application under various backdoor attacks; Figure 5 A comparison graph showing the change in accuracy of different defense methods relative to the undefended federated averaging method provided in the embodiments of this application; Figure 6 A comparison chart showing the reduction in attack success rate of different defense methods provided in the embodiments of this application relative to the undefended federated average method; Figure 7 A schematic diagram of a federated learning backdoor defense device provided in an embodiment of this application; Figure 8 A schematic diagram of another federated learning backdoor defense device provided for an embodiment of this application; Figure 9 This is a schematic diagram of a federated learning backdoor defense system provided in an embodiment of this application. Detailed Implementation

[0021] The embodiments of this application will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be understood that the preferred embodiments are only for illustrating this application and are not intended to limit the scope of protection of this application.

[0022] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0023] For ease of description, spatial relative terms may be used in the text to describe the relative position or movement of one element or feature relative to another element or feature, as shown in the figure. These relative terms include, for example, "inside," "outside," "middle," "outer," "below," "below," "above," "front," "back," etc. Such spatial relative terms are intended to include different orientations of the device in use or operation, other than those depicted in the figure. For example, if the device in the figure undergoes a positional flip, orientation change, or change of motion, these directional indications will change accordingly. For instance, an element described as "below other elements or features" or "below other elements or features" will subsequently be oriented "above other elements or features" or "above other elements or features." Therefore, the example term "below" can include both upper and lower orientations. The device may be otherwise oriented (rotated 90 degrees or in other directions), and the spatial relative descriptors used in the text will be interpreted accordingly.

[0024] To address the issues of existing backdoor defense methods in federated learning systems being prone to client information leakage and having poor backdoor defense capabilities, this application provides a federated learning backdoor defense method, apparatus, system, and readable storage medium that can improve backdoor defense capabilities while ensuring that client information is not leaked.

[0025] See Figure 1 , Figure 1 This is a flowchart illustrating a federated learning backdoor defense method provided in an embodiment of this application. Figure 1 As shown, this federated learning backdoor defense method is applied to an aggregation server, and the federated learning backdoor defense method may include the following steps: Step S102: After completing federated training with each client to obtain a global model, the global category labels in the global model are assigned to obtain the label set corresponding to each client.

[0026] Specifically, the aforementioned global category labels refer to the label set for the horizontal federated learning classification task, which can be adopted as follows: To express.

[0027] When allocating global category labels in the global model, the aggregation server can distribute all category labels to different clients according to a preset allocation strategy based on the label set of the lateral federated learning classification task. This ensures that each client receives one or more category labels responsible for trigger inversion. The allocation strategy can include uniform partitioning and overlapping allocation strategies. This facilitates the subsequent distribution of the computational load for trigger inversion across clients, avoiding the large computational overhead required for the aggregation server to centrally perform trigger inversion. Furthermore, the overlapping allocation strategy ensures that different clients are assigned the same category label, providing sufficient sample diversity for subsequent cross-client clustering analysis.

[0028] It should be noted that this step needs to be performed after the aggregation server and each client have completed federated training to obtain a global model. That is, this application performs backdoor defense after the overall federated training is completed, rather than during the federated training.

[0029] Step S104: Distribute the tag set corresponding to each client to each client so that each client can reverse the trigger for each category of tag in the tag set to obtain the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger, and upload the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger to the aggregation server.

[0030] Specifically, after obtaining the label sets corresponding to each client, the aggregation server can distribute these sets to each client. Each client can then perform trigger inversion on each category of label in its set, obtaining the metadata, evaluation metrics, and backdoor sample embeddings for each candidate trigger. These metadata, evaluation metrics, and backdoor sample embeddings are then uploaded to the aggregation server. Trigger inversion here refers to the process by which, under fixed local model parameters, the client searches for a relatively small set of candidate triggers in its local data space by solving a constraint optimization function. The metadata refers to data describing the attributes of the candidate triggers, including at least their mask parameters. Pattern parameters and category labels This metadata is used to reconstruct the structural features of candidate triggers on the aggregation server and perform cross-client similarity comparisons. The evaluation metric here refers to a numerical measure used to quantify the attack effectiveness of candidate triggers, with the core metric being the Attack Success Rate (ASR). The ASR is defined as the proportion of times a candidate trigger, applied to each validation sample on a local, independent validation dataset, is predicted as an attack label by the local model. The backdoor sample embedding refers to the high-dimensional feature vector extracted by inputting the triggered sample into the intermediate layer (feature extraction layer) of the local model after applying the candidate trigger to the local sample. This backdoor sample embedding reflects the distribution of the triggered sample in the model's feature space and is the core basis for measuring whether different candidate triggers induce similar semantic shifts within the model.

[0031] Step S106: Based on the metadata, evaluation metrics and backdoor sample embeddings of each candidate trigger, perform cluster analysis on the candidate triggers under different category labels from each client to obtain a set of potential triggers.

[0032] Specifically, after receiving the metadata, evaluation metrics, and backdoor sample embeddings for each candidate trigger uploaded by each client, the aggregation server can perform cluster analysis on the candidate triggers under different category labels from each client, based on the metadata, evaluation metrics, and backdoor sample embeddings, to obtain a set of potential triggers. Here, cluster analysis refers to the aggregation server performing unsupervised clustering on all candidate triggers under the same category label based on the metadata, evaluation metrics, and backdoor sample embeddings reported by each client, grouping candidate triggers with similar spatial behavior and similar attack effects into the same cluster.

[0033] Step S108: Distribute the set of potential triggers to each client so that each client can construct enhancement samples based on each potential trigger in the set and use the enhancement samples to enhance and fine-tune its own local model to obtain the enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the unenhanced local model.

[0034] Specifically, after obtaining the set of potential triggers, the aggregation server can distribute it to each client. Each client can then construct augmented samples based on the potential triggers in the set and use these samples to fine-tune their local model, resulting in an enhanced local model. Here, augmented samples refer to perturbed samples constructed by the client by overlaying the server-distributed potential triggers onto clean samples in their original local training set. These samples are labeled with the true labels of the original samples (not the attack labels specified by the attacker). The construction method of these augmented samples is the same as that of the samples with triggers in trigger reversal, but the labeling rules are completely different: attack labels are used in trigger reversal (encouraging incorrect model predictions), while true labels are used in augmentation fine-tuning (encouraging correct model predictions). Augmentation fine-tuning refers to the client using the augmented dataset composed of the aforementioned augmented samples to perform small-scale, small-step parameter update training on their local model. This allows the model to gradually learn to output the correct labels on the inputs with triggers, thereby weakening or eliminating the malicious association between the triggers and the attack labels.

[0035] In this way, trigger reverse engineering can be performed on the client side, utilizing local sample data and local model information to identify candidate triggers without the need for an aggregation server, thus effectively preventing the leakage of raw client data. Furthermore, by using an aggregation server to cluster candidate triggers under different category labels from various clients, persistent, highly effective, and semantically similar potential triggers can be identified, thereby improving backdoor defense capabilities. Additionally, the client can use augmented samples to fine-tune its local model, gradually causing the local model to forget the malicious mapping relationship between potential triggers and attack labels, thereby reducing the success rate of backdoor attacks and ultimately enhancing backdoor defense capabilities.

[0036] In an optional embodiment, step S106 above, which involves performing cluster analysis on candidate triggers from different categories of clients based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, to obtain a set of potential triggers, includes: Cluster the candidate triggers under the target category label from each client to obtain multiple clusters corresponding to the target category label, where the target category label is any one of the global category labels; Based on the meta-information, evaluation metrics, and backdoor sample embeddings of candidate triggers within each cluster, the average L1 norm, average attack success rate, and average embedding similarity of each cluster are determined. The comprehensive score for each cluster is calculated based on the average L1 norm, the average attack success rate, and the average embedding similarity. Clusters with a comprehensive score higher than a preset threshold are identified as potential trigger sets.

[0037] Specifically, the aforementioned target category label refers to any one of the category labels in the global category label, represented by the symbol... The clustering analysis is based on the target category label, that is, only candidate triggers from different clients but targeting the same target category label are clustered. The above cluster refers to a set of candidate triggers that are grouped together after being processed by the clustering algorithm under the same target category label. All candidate triggers in a cluster have high consistency in the following dimensions: (1) the attack target is the same (all are the same target category label); (2) the backdoor samples are embedded in the model feature space in similar positions (i.e., triggering similar intermediate layer feature responses); (3) the attack success rate is in a similar high-level range.

[0038] The average L1 norm mentioned above refers to the average L1 norm of all candidate triggers within a cluster. This average is used to quantify the spatial sparsity and visual saliency level of the triggers in that cluster. The smaller the average L1 norm of candidate triggers in a cluster, the more likely the triggers in that cluster are to be "small and hidden," which is highly consistent with the behavior pattern of real backdoor attacks.

[0039] The average attack success rate mentioned above refers to the average local attack success rate of all candidate triggers within a cluster. This average is used to quantify the average attack strength and effectiveness of candidate triggers in that cluster. If the average attack success rate of candidate triggers in a cluster is high, it indicates that the candidate triggers in that cluster generally have a strong attack effect, which increases the likelihood that they belong to a real backdoor attack.

[0040] The average embedding similarity mentioned above refers to the average cosine similarity between the embedding center vectors of the backdoor samples of all candidate triggers within a cluster. This average is used to quantify the behavioral consistency and semantic alignment of candidate triggers within the cluster in the model's feature space. The higher the average embedding similarity, the more consistent the semantic shifts induced by each candidate trigger within the cluster within the model, and the more likely they are to originate from the same backdoor mechanism.

[0041] The comprehensive score mentioned above refers to a scalar value calculated by the aggregation server for each cluster, used to comprehensively evaluate the likelihood that the cluster represents a real backdoor attack. The higher the comprehensive score, the more the candidate triggers within the cluster conform to the characteristic patterns of a real backdoor attack in terms of attack effectiveness, behavioral consistency, and stealth, and the higher the confidence level of being judged as a potential backdoor.

[0042] The aforementioned preset threshold is a pre-defined numerical limit used to determine whether a cluster poses a backdoor threat. When the overall score of a cluster is higher than the preset threshold, the cluster is identified as a potential trigger set; when the overall score is lower than or equal to the preset threshold, the cluster is considered a harmless cluster or a pseudo-trigger cluster and is not included in subsequent defense processing.

[0043] In this step, the aggregation server can cluster candidate triggers under a specific category label from various clients, obtaining multiple clusters corresponding to that category label. Then, based on the metadata, evaluation metrics, and backdoor sample embeddings of the candidate triggers within each cluster, it determines the average L1 norm, average attack success rate, and average embedding similarity for each cluster. Next, based on these average L1 norm, average attack success rate, and average embedding similarity, it calculates a comprehensive score for each cluster. Finally, clusters with comprehensive scores higher than a preset threshold are identified as the potential trigger set. In this way, the aggregation server can perform the same operation for other category labels in the global category label to obtain the potential trigger set for each category label.

[0044] This approach avoids relying solely on a single client or metric to determine backdoor triggers, thereby reducing the risk of misjudgments caused by accidental reverse engineering, data heterogeneity, and local model bias. Compared to defense methods based solely on weight distance or gradient direction, the method in this application directly analyzes the trigger patterns and feature space consistency of backdoor attacks, thus providing greater targeting against persistent and covert backdoor attacks.

[0045] In an optional embodiment, the above steps, which determine the average L1 norm, average attack success rate, and average embedding similarity of each cluster based on the meta-information, evaluation metrics, and backdoor sample embeddings corresponding to candidate triggers within each cluster, respectively, include: Based on the meta-information corresponding to the candidate triggers within each cluster, determine the average value of the L1 norm for each cluster; Based on the evaluation metrics corresponding to the candidate triggers within each cluster, determine the average attack success rate for each cluster. The average embedding similarity of each cluster is determined based on the backdoor sample embeddings corresponding to the candidate triggers within each cluster.

[0046] Specifically, when determining the average L1 norm of each cluster based on the metadata corresponding to the candidate triggers within each cluster, the sparsity / amplitude measure of the mask and pattern can be calculated for each candidate trigger within a given cluster to reflect its saliency and complexity. For example, the L1 norm can be calculated using the following formula: ; in, Indicates client Candidate triggers Target tags L1 norm under, Indicates candidate trigger The mask, Indicates candidate trigger The pattern The element-wise multiplication operator, also known as the Hadamard product, is used to multiply the elements of two vectors, matrices, or tensors of the same dimension at corresponding positions. This represents the L1 norm. Smaller L1 norms often correspond to sparser or more hidden triggers, while larger L1 norms correspond to more salient triggers.

[0047] After calculating the L1 norm of each candidate trigger within the cluster using the above formula, the average of the L1 norms of all candidate triggers within the cluster can be calculated to obtain the average L1 norm of the cluster. Using the same process, the average L1 norm of each cluster can be obtained.

[0048] When determining the average attack success rate (ASR) for each cluster based on the evaluation metrics corresponding to the candidate triggers within each cluster, the following formula can be used to calculate the corresponding ASR for each candidate trigger within a given cluster: ; in, Indicates client Candidate triggers Target tags The success rate of local attacks is as follows. Indicates client The local verification subset Represents the first in the local verification subset One original clean validation sample For indicator functions, Indicates client Local model functions, This indicates that the candidate trigger is applied to the original clean sample. The sample with triggers was constructed later. Indicates client Local model parameters, Represents the local model In parameters Below are samples with triggers The output vector, This represents the class label with the highest probability in the model's output vector (i.e., the model's final predicted class). Indicates the target category label.

[0049] After calculating the local attack success rate for each candidate trigger within the cluster using the above formula, the average local attack success rates for all candidate triggers within the cluster can be calculated, as shown by the following formula: ; in, This represents the average attack success rate corresponding to this cluster. Indicates client Candidate triggers Target category tags The success rate of local attacks is as follows. This indicates that there are upload candidate triggers. The client set. Using the above formula, the average attack success rate corresponding to each cluster can be obtained.

[0050] Based on the backdoor sample embeddings corresponding to the candidate triggers within each cluster, the average embedding similarity of each cluster is determined. This can be done by first analyzing each candidate trigger within a given cluster. In the client Embedded collection The mean vector is obtained using the following formula: ; in, Indicates client Candidate triggers Target category tags The embedded center vector below, This indicates the number of trigger-enabled samples used to extract the embeddings. Indicates the first A sample with a trigger, This represents the feature extraction mapping function of the local model.

[0051] Then, the cosine similarity between any two sets of center vectors within the cluster is calculated, specifically using the following formula: ; in, Represents the embedding center vector and Cosine similarity between them Indicates client Candidate triggers Target category tags The embedded center vector below, Indicates client Candidate triggers Target category tags The embedding center vector below. Let L2 norm be denoted. This cosine similarity indicates that backdoor samples from different clients are highly consistent in the feature space, suggesting that these triggers may originate from the same or similar backdoor mechanisms.

[0052] Next, the cosine similarity between any two sets of center vectors within the cluster is averaged to obtain the average embedding similarity for that cluster. Using the same method, the average embedding similarity for each cluster can be obtained.

[0053] In this way, the aggregation server can accurately determine the average L1 norm, average attack success rate, and average embedding similarity of each cluster based on the metadata, evaluation metrics, and backdoor sample embeddings of the candidate triggers in each cluster. This facilitates the subsequent calculation of the comprehensive score of each cluster based on the average L1 norm, average attack success rate, and average embedding similarity, thereby determining the set of potential triggers.

[0054] In one optional embodiment, the formula for calculating the overall score is as follows: ; in, This represents the overall score corresponding to cluster O. This represents the average embedding similarity corresponding to cluster O. This represents the average attack success rate corresponding to cluster O. This represents the average L1 norm of cluster O. , and These represent the preset weights.

[0055] Specifically, the aggregation server aggregates tags for the same target category. The candidate triggers are clustered, and a comprehensive potential trigger score is calculated for each cluster O using the formula described above. Next, the aggregation server can classify clusters with comprehensive scores higher than a preset threshold as a set of potential triggers. Finally, this set of potential triggers can be output. This set will be used for further local enhancement and fine-tuning. Furthermore, to reduce privacy risks, the aggregation server can require clients to upload dimensionality-reduced / quantized / normalized embeddings or add differential privacy noise to the embeddings. The aforementioned weights... , and With preset threshold Adaptive adjustment can be validated using a small sample size.

[0056] In this way, the aggregation server can calculate the comprehensive score corresponding to each cluster based on the average L1 norm, the average attack success rate, and the average embedding similarity. This avoids relying solely on a single client or a single metric to determine backdoor triggers, thereby reducing the risk of misjudgment caused by accidental reverse engineering results, data heterogeneity, and local model bias. Compared to defense methods based solely on weighted distance or gradient direction, this application directly analyzes the trigger patterns and feature space consistency of backdoor attacks, thus providing stronger targeting for persistent and covert backdoor attacks.

[0057] In an optional implementation, step S102 above, which involves assigning global category labels to the global model to obtain a label set corresponding to each client, includes: The global category labels in the global model are evenly distributed to obtain the label set corresponding to each client, where the category labels in the label sets corresponding to different clients do not overlap; or, The global category labels in the global model are overlapped to obtain the label set corresponding to each client. Among them, the category labels in the label sets corresponding to different clients have some overlap.

[0058] Specifically, the aggregation server can employ a uniform partitioning strategy to distribute global category labels across the global model. In other words, the aggregation server can distribute global category labels... Based on the total number of clients Perform uniform segmentation so that each client is assigned approximately the same number of tags, i.e., client The obtained tag set satisfy Furthermore, the union of all client-side tag sets is the universal set. .

[0059] As another implementation, the aggregation server can employ an overlapping allocation strategy to assign global category labels in the global model. Specifically, the aggregation server can assign the same target category label to multiple clients simultaneously, meaning there exists... and , making and Overlapping assignments enable the reverse results of triggers for the same target label to be independently verified by multiple different clients, improving the robustness and reliability of subsequent trigger analysis.

[0060] For example, consider a federated learning system with 10 category labels (labels 0 to 9) and 5 clients. Using a uniform partitioning strategy, the server assigns labels 0 and 1 to client 1, labels 2 and 3 to client 2, and so on, with each client responsible for reversing the triggers for two category labels. Using an overlapping partitioning strategy, the server can assign label 0 to clients 1, 2, and 3 simultaneously, allowing the reversal of triggers for the same label to be executed in parallel by multiple clients.

[0061] In this way, the computational load of trigger reversal can be distributed to each client, avoiding the large computational overhead required for centralized execution of trigger reversal on the aggregation server. Furthermore, through the overlapping allocation strategy, candidate triggers for the same target label come from multiple clients with different data distributions, providing sufficient sample diversity for subsequent cross-client clustering analysis. In addition, the entire allocation process only involves the transfer of label numbers and does not involve the exchange of any client's original data or model weights, which meets the basic requirements for privacy protection in federated learning.

[0062] See Figure 2 , Figure 2 This is a flowchart illustrating another federated learning backdoor defense method provided in an embodiment of this application. Figure 2 As shown, this federated learning backdoor defense method is applied to the client side, and the federated learning backdoor defense method may include the following steps: Step S202: Receive the tag set sent by the aggregation server. The tag set is obtained by the aggregation server after completing federated training with each client to obtain a global model and then allocating global category tags in the global model.

[0063] Specifically, after completing federated training with each client to obtain a global model, the aggregation server can allocate global category labels in the global model to obtain a label set corresponding to each client. Then, it distributes the label sets corresponding to each client to their respective clients, allowing each client to receive the label sets sent by the aggregation server. The allocation of global category labels in the global model by the aggregation server has been described in detail in the preceding embodiments and will not be repeated here.

[0064] Step S204: Perform trigger inversion on each category label in the label set to obtain the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger.

[0065] Specifically, after receiving the tag set from the aggregation server, each client can perform trigger inversion on each category of tags in the tag set to obtain the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger. Trigger inversion here refers to the process by which the client searches for a relatively small set of candidate triggers in the local data space by solving a constraint optimization function under fixed local model parameters. Meta-information refers to data describing the attributes of the candidate triggers themselves, including at least the mask parameters of the candidate triggers. Pattern parameters and category labels This metadata is used to reconstruct the structural features of candidate triggers on the aggregation server and perform cross-client similarity comparisons. The evaluation metric here refers to a numerical measure used to quantify the attack effectiveness of candidate triggers, with the core metric being the attack success rate (ASR). The attack success rate is defined as the proportion of times a candidate trigger is predicted as an attack label by the local model after being applied to each validation sample on a locally independent validation dataset. The backdoor sample embedding refers to the high-dimensional feature vector extracted by inputting the triggered sample into the intermediate layer (i.e., the feature extraction layer) of the local model after applying the candidate trigger to the local sample. This backdoor sample embedding reflects the distribution of the triggered sample in the model's feature space and is the core basis for measuring whether different candidate triggers induce similar semantic shifts within the model.

[0066] Step S206: Upload the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger to the aggregation server. The aggregation server will then perform cluster analysis on the candidate triggers under different category labels from each client based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, obtain a set of potential triggers, and send the set of potential triggers to the client.

[0067] Specifically, after obtaining the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, each client can upload these metadata, evaluation metrics, and backdoor sample embeddings to the aggregation server. The aggregation server can then perform cluster analysis on the candidate triggers from each client under different category labels based on these metadata, evaluation metrics, and backdoor sample embeddings, obtaining a set of potential triggers, and then distributing the set of potential triggers to the clients. The process of the aggregation server performing cluster analysis on the candidate triggers from each client under different category labels has been described in detail in the preceding embodiments and will not be repeated here.

[0068] Step S208: Construct enhanced samples based on each potential trigger in the potential trigger set, and use the enhanced samples to enhance and fine-tune the local model to obtain the enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the local model before enhancement.

[0069] Specifically, after receiving the set of potential triggers from the aggregation server, each client can construct augmented samples based on the potential triggers in the set and use these samples to fine-tune its local model, resulting in an enhanced local model. Here, augmented samples refer to perturbed samples constructed by the client by overlaying the server-sent potential triggers onto clean samples in its original local training set. These samples are labeled with the true labels of the original samples (not the attack labels specified by the attacker). The construction method of these augmented samples is the same as that of the samples with triggers in trigger reversal, but the labeling rules are completely different: attack labels are used in trigger reversal (encouraging incorrect model predictions), while true labels are used in augmentation fine-tuning (encouraging correct model predictions). Augmentation fine-tuning refers to the client using the augmented dataset composed of the aforementioned augmented samples to perform small-scale, small-step parameter update training on its local model, enabling the model to gradually learn to output the correct labels on the inputs with triggers, thereby weakening or eliminating the malicious association between the triggers and the attack labels.

[0070] In this way, trigger reverse engineering can be performed on the client side, utilizing local sample data and local model information to identify candidate triggers without the need for an aggregation server, thus effectively preventing the leakage of raw client data. Furthermore, by using an aggregation server to cluster candidate triggers under different category labels from various clients, persistent, highly effective, and semantically similar potential triggers can be identified, thereby improving backdoor defense capabilities. Additionally, the client can use augmented samples to fine-tune its local model, gradually causing the local model to forget the malicious mapping relationship between potential triggers and attack labels, thereby reducing the success rate of backdoor attacks and ultimately enhancing backdoor defense capabilities.

[0071] In an optional embodiment, step S204 above, performing trigger reversal on each category label in the label set to obtain the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, includes: Based on the preset constraint optimization function, the trigger is reversed to obtain the candidate trigger set corresponding to the target category label. The target category label is any one of the global category labels, and the candidate trigger set includes at least one candidate trigger. Obtain the mask and pattern corresponding to each candidate trigger, and determine the target category label and the mask and pattern corresponding to each candidate trigger as the metadata corresponding to each candidate trigger; Construct trigger samples corresponding to each candidate trigger, and use the trigger samples corresponding to each candidate trigger as verification samples to evaluate the attack success rate corresponding to each candidate trigger. The attack success rate corresponding to each candidate trigger is determined as the evaluation index corresponding to each candidate trigger. Construct trigger samples corresponding to each candidate trigger, and perform feature mapping on the trigger samples corresponding to each candidate trigger to obtain the backdoor sample embedding corresponding to each candidate trigger.

[0072] Specifically, the mathematical expression for the above-mentioned constrained optimization function is as follows: ; in, The optimization objective is to find a set of , making Minimize the value of . The mask representing the trigger. The pattern representing the trigger. Indicates client Local model functions, Indicates a sample with a trigger. Indicates client Local model parameters, Indicates the target category label. and This indicates the preset weighting coefficient. The L1 norm of the mask is represented. This represents the sparsity regularization term of the mask. The regularization function representing the pattern. For pattern regularization, Represents the classification loss function. This indicates the loss of the target.

[0073] It can be seen that the constrained optimization function consists of three terms, which correspond to the three objectives of the trigger inversely: attack effectiveness (corresponding to attack target loss), spatial concealment (corresponding to mask sparsity regularization), and visual concealment (corresponding to pattern regularization).

[0074] The client can use any of the following numerical optimization methods to solve the above constrained optimization function: (1) Gradient descent method: Using the standard backpropagation and gradient descent algorithm, the mask is... and patterns Perform iterative updates until the constraint optimization function converges or the preset number of iterations is reached.

[0075] (2) Projected gradient descent: After each update step, the mask is... Project to Within the range, the pattern Projected to the effective pixel value range (e.g.) This ensures that the generated trigger is physically feasible.

[0076] (3) Multiple random initializations: In order to avoid the optimization getting stuck in local optima, the client can use multiple different random initial values ​​to perform optimization, and select the set of results with the smallest objective function value (i.e. the best and most covert attack effect) as the final candidate trigger.

[0077] Therefore, we can obtain the set of candidate triggers corresponding to the target category label. ,in, Indicates candidate trigger The mask, Indicates candidate trigger The pattern This indicates the total number of candidate triggers in the set.

[0078] It is particularly important to emphasize that, throughout the entire optimization process of trigger inversion, the local model parameters... It remains fixed (i.e., frozen). The optimization algorithm only adjusts the mask. and patterns The value of the trigger does not update any weights or biases of the model. This design ensures that the trigger inverse is to search for perturbations in the input space from a fixed model “view”, rather than to adapt the model to the perturbations.

[0079] After obtaining the set of candidate triggers corresponding to the target category label, the client can obtain the mask corresponding to each candidate trigger. and patterns and target category label and the masks corresponding to each candidate trigger. and patterns , which are determined as the metadata corresponding to each candidate trigger; A sample of triggers corresponding to each candidate trigger is constructed, and this sample is used as a validation sample to evaluate the attack success rate of each candidate trigger. Specifically, for each candidate trigger... The client uses a separate subset of validation locally. Evaluate its attack success rate (ASR). Define the success rate for each verification sample. The sample with trigger is The local ASR can then be calculated using the following formula: ; in, Indicates client Candidate triggers Target tags The success rate of local attacks is as follows. Indicates client The local verification subset Represents the first in the local verification subset One original clean validation sample For indicator functions, Indicates client Local model functions, This indicates that the candidate trigger is applied to the original clean sample. The sample with triggers was constructed later. Indicates client Local model parameters, Represents the local model In parameters Below are samples with triggers The output vector, This represents the class label with the highest probability in the model's output vector (i.e., the model's final predicted class). This represents the target category label. This ASR can be used to evaluate the attack effectiveness of reverse-engineered triggers. The stronger the attack effectiveness, the more likely it is to closely approximate the real trigger. Then, the attack success rate corresponding to each candidate trigger is determined as the evaluation metric for each candidate trigger.

[0080] In addition, to facilitate cross-client backdoor sample similarity analysis and clustering by the aggregation server, the client needs to generate and upload each candidate trigger from local data. Intermediate feature embeddings of samples with triggers. Let the feature extraction mapping be... Then for the selected Sample The corresponding backdoor sample embedding set is: ; These embeddings can be first processed by dimensionality reduction, quantization, or normalization to reduce communication overhead and privacy risks. The client can choose to upload either a unit vectorized representation of each embedding or a low-dimensional representation after Principal Component Analysis (PCA) / random projection. This allows the acquisition of the backdoor sample embeddings corresponding to each candidate trigger.

[0081] In this way, each client can reverse-engineer the triggers for each category of the tag set to obtain the metadata, evaluation metrics and backdoor sample embeddings for each candidate trigger. This makes it easier to upload them to the aggregation server, so that the aggregation server can perform cluster analysis on the candidate triggers under different category tags from each client to obtain a set of potential triggers.

[0082] In an optional embodiment, step S208, which involves enhancing and fine-tuning the local model using enhanced samples to obtain an enhanced local model, includes: Based on local clean samples, determine the clean sample loss value, and based on augmented samples, determine the augmented sample loss value; Based on the clean sample loss value, the augmented sample loss value, and the preset fine-tuning optimization function, the local model is enhanced and fine-tuned to obtain the enhanced local model.

[0083] Specifically, the aggregation server distributes the identified set of potential triggers to each client. Upon receiving the set, each client uses it locally to construct augmented samples and fine-tune its local model. Specifically, each potential trigger cluster generated during the trigger analysis phase... After being distributed to the client, the client uses these triggers locally to perform small-scale enhancements and fine-tuning of the model, in order to sever the association between the triggers and the attack labels. Let the client's original training set be denoted as . The potential trigger set is For each trigger and several selected clean samples Construct an enhanced sample with triggers: And label it as a real label. That is, the correct labels that are the same as the original samples. Let the augmented dataset be... .

[0084] The core purpose of local model fine-tuning is to weaken the abnormal association between triggers and attack labels established by backdoor attacks while maintaining the model's performance on normal tasks. Specifically, clean sample loss constrains the model to maintain its ability to correctly classify original samples, preventing the defense process from significantly impacting normal task performance; augmented sample loss requires the model to still predict the original true label when given an augmented sample containing triggers, rather than the target label specified by the attacker. Since the essence of a backdoor attack is to make the model establish the erroneous association of "predicting the attack label as soon as the trigger appears," minimizing this objective is equivalent to readjusting the model using supervision information opposite to that of a backdoor attack, gradually weakening its erroneous response to triggers and restoring its judgment of the true semantics of samples, thereby reducing the success rate of backdoor attacks while maintaining normal classification ability. After fine-tuning, the client can locally evaluate the ASR and accuracy (ACC) of the augmented model. This local augmentation fine-tuning is completed locally on the client and aims to significantly reduce the success rate of backdoor attacks while maintaining the model's accuracy on clean samples by strengthening the model's learning of the correct labels on triggers and thus forgetting the association between triggers and attack labels.

[0085] In this way, through local enhancement and fine-tuning, the model can output the true label on the input with the trigger, thereby disrupting the malicious mapping relationship between the trigger and the attack label. Since this process is entirely local to the client, the aggregation server does not need to obtain the client's raw data, nor does it need to directly hold a complete and clean validation set. This mechanism can significantly reduce the success rate of backdoor attacks while maintaining or restoring the model's accuracy on normal samples.

[0086] In an optional embodiment, the fine-tuning optimization function is expressed by the following formula: ; in, This indicates that the local model parameters are The corresponding clean sample loss value under the condition, This indicates that the local model parameters are The corresponding augmented sample loss value under the given circumstances, Indicates the local model parameters Optimize to make minimize, This indicates the preset coefficient.

[0087] Specifically, preset coefficients The importance of enhancing sample loss during fine-tuning. In practice, clients typically use small step sizes (small learning rates) and a small number of fine-tuning rounds to avoid excessive perturbation to the original model's performance, and can add regularization terms or early stopping strategies to maintain generalization ability.

[0088] The formulas for calculating the clean sample loss and the augmented sample loss are as follows: ; ; in, This indicates that the local model parameters are The corresponding clean sample loss value under the condition, This indicates that the local model parameters are The corresponding augmented sample loss value under the given circumstances, Indicates client A clean set of samples Show client Enhanced sample set, Indicates client Clean sample, Indicates a clean sample Corresponding category tags, Indicates client Enhanced samples, Indicates client Local model functions, Indicates client The loss function.

[0089] The aforementioned fine-tuning optimization function is the objective function used by the client when performing local augmentation fine-tuning. Its core function is to weaken the malicious association between the triggers established by the backdoor attack and the attack label while maintaining the model's normal classification performance. This function minimizes the weighted sum of the clean sample loss and the augmented sample loss simultaneously, enabling the model to balance the goals of retaining old knowledge and learning new rules during parameter updates. The two losses form a synergistic rather than antagonistic relationship during optimization: the model needs to simultaneously satisfy two constraints: correctly judging clean samples and correctly judging samples with triggers (i.e., not being misled). The latter is the core objective of the defense, while the former is a necessary constraint to ensure the usability of the defense.

[0090] This approach maintains the normal task performance of the client's local model while weakening the abnormal association between the triggers established by the backdoor attack and the attack tag.

[0091] To verify the technical effectiveness of this application, an experiment was conducted based on a horizontal federated learning training framework in one embodiment. The experiment used a non-independent, identically distributed data partitioning method to simulate a real federated learning scenario, with the proportion of malicious clients set to 10%. Attack methods included BadNets, Neurotoxin, and Chameleon methods. Defense methods included undefended federated averaging (FedAvg), robust aggregation method Multi-Krum (derived from the Krum algorithm, Krum being the author's name), federated learning adaptive model elimination defense framework (FLAME), robust learning rate (RLR), and the method of this application. The experimental results are shown in Table 1 below:

[0092] Table 1 Experimental results show that, under the undefended FedAvg setting, all three attacks can introduce backdoors into the federated model. The attack success rates for BadNets, Neurotoxin, and Chameleon are 0.4743, 0.3693, and 0.1080, respectively, while the clean sample accuracy remains high, indicating that the backdoor attacks are highly covert. After adopting the method of this application, the attack success rate under BadNets attack decreased to 0.0112, and the clean sample accuracy reached 0.8914; the attack success rate under Neurotoxin attack was 0.0576, and the clean sample accuracy reached 0.8940; the attack success rate under Chameleon attack decreased to 0.0080, and the clean sample accuracy reached 0.9022. Under the three attacks, the average clean sample accuracy of the method of this application is approximately 0.8959, and the average attack success rate is approximately 0.0256. Compared with the undefended FedAvg, this application significantly reduces the attack success rate while maintaining a high normal classification accuracy. The experimental results above demonstrate that this application, through a combination of trigger reverse engineering, trigger analysis, and local enhancement fine-tuning, can effectively weaken the malicious association between backdoor triggers and target tags, achieving a good balance between security and model usability in persistent and covert attack scenarios. Figure 3 This chart compares the accuracy of clean samples under various backdoor attacks using different defense methods. Figure 4 This chart compares the success rates of different defense methods against various backdoor attacks. Figure 5 This is a graph comparing the accuracy changes of different defense methods relative to the undefended federated average method. Figure 6 A chart comparing the reduction in attack success rate of different defense methods relative to the average undefended federated method.

[0093] Unlike existing schemes that primarily rely on server-side weight detection or robust aggregation, this application does not simply depend on the parameter distance between client-side model updates, nor does it require the server to directly access the client's original training data. This application places the trigger inversion process locally on the client, enabling the trigger search process to utilize local data and model information while preventing the leakage of original data. Through cross-client statistical analysis of candidate triggers on the server side, persistent trigger patterns with strong attack effects and similar semantic embeddings can be identified. Through local client-side enhancement and fine-tuning, the model gradually forgets the malicious mapping relationship between triggers and target labels, thereby reducing the success rate of backdoor attacks.

[0094] This application has at least the following beneficial effects: First, this application can complete trigger identification and backdoor mitigation without uploading the original client data, meeting the privacy protection requirements of localized federated learning data. Compared with defense methods that require centralized collection of clean samples or verification data on servers, this application places the trigger reverse engineering and enhancement fine-tuning process primarily on the client side, reducing compliance risks associated with original data transmission and centralized storage, and lowering the additional costs required for data leakage, data anonymization, and centralized security management. In scenarios involving sensitive data, such as finance, healthcare, and intelligent connected vehicles, this mechanism can reduce the costs of privacy auditing, data compliance, and security operations and maintenance arising from centralized data processing.

[0095] Second, this application does not solely rely on the distance between model weights or gradients to identify malicious clients, thus mitigating the problem of robust aggregation methods misjudging normal updates or missing malicious updates in scenarios involving non-independent, identically distributed data, covert attacks, or persistent attacks. By combining trigger inversion, trigger analysis, and local enhancement fine-tuning, this application can significantly reduce the success rate of backdoor attacks while maintaining the model's normal classification performance. In one embodiment, this application can reduce the attack success rate under various typical backdoor attacks from approximately 10% to 47% to approximately 1% to 6%, and the overall attack risk can be reduced by approximately 80% to 95%. Therefore, by adopting this application, federated learning systems can reduce the number of times model rollback, retraining, manual investigation, and security hardening are required when subjected to continuous poisoning by malicious clients or covert backdoor injection, thereby reducing system maintenance costs.

[0096] Third, this application combines trigger reverse engineering with trigger analysis, focusing not only on whether client updates are abnormal but also directly on the core carrier of backdoor attacks—the trigger pattern and its consistency in the model feature space. This allows for more targeted identification of potential backdoors. Compared to solutions that only filter model updates on the server side, this application can discover potential trigger patterns repeatedly used by attackers across multiple clients or training rounds, thereby improving resistance to persistent, stealthy, and adaptive backdoor attacks. For perception models, driving behavior recognition models, or road environment recognition models deployed in vehicle-cloud collaborative learning systems, this mechanism can reduce the risk of abnormal model predictions due to backdoor triggers, and decrease the workload of remote diagnostics, model patch distribution, and cloud security review caused by model anomalies.

[0097] Fourth, this application uses local enhancement and fine-tuning to label trigger-enabled samples as true labels, enabling the model to learn the discrimination rule that "triggers should not change the original semantics," thereby disrupting the malicious association between triggers and target labels. This reduces the success rate of attacks while maintaining the accuracy of clean samples as much as possible. Since local enhancement and fine-tuning only requires a small number of enhanced samples and a few rounds of fine-tuning on the client side, it does not require large-scale retraining of the global model, thus reducing computational resource consumption and model repair costs. Taking vehicle-cloud model applications as an example, if each vehicle or each edge node requires regular model security maintenance, adopting this application can reduce the number of times the whole vehicle model needs to be retrained, manually labeled and verified, and remotely upgraded due to backdoor risks. Based on an estimated cost of several to tens of yuan per vehicle for model security maintenance, diagnosis, and upgrade, when the system is deployed in hundreds of thousands to millions of intelligent vehicles, it can cumulatively reduce operation and security maintenance costs by millions to tens of millions of yuan.

[0098] Fifth, the defense module of this application can be deployed as an additional module after the standard federated learning training process, or it can be executed periodically after several communication rounds. It has good compatibility and scalability, and can be applied to horizontal federated learning tasks with different model structures, different numbers of clients, and different label space sizes. Since this application does not require large-scale modification of the original federated learning framework, it can be used in conjunction with existing mechanisms such as FedAvg, robust aggregation, and secure aggregation, thus resulting in low deployment costs. In practical vehicle-cloud collaboration, mobile terminal collaborative learning, and industrial IoT scenarios, this application can be embedded in the existing training platform as a model security detection and repair module, reducing system reconstruction costs and reducing the pressure of subsequent model security inspections and manual handling through periodic defense mechanisms.

[0099] Sixth, from an economic perspective, this application can bring continuous security and operational benefits to federated learning systems by reducing the success rate of backdoor attacks, decreasing model anomaly predictions, and reducing the frequency of retraining and redeployment. For the cloud, this application can reduce the computing resources required for large-scale centralized retraining and secure rollback, lowering GPU / server computing overhead and model distribution costs. For individual vehicles, mobile devices, or edge devices, this application can reduce the number of remote diagnostics, version rollbacks, and patch upgrades caused by model anomalies, lowering terminal maintenance costs. If deployed in a vehicle-cloud collaborative system with millions of terminals, even if the annual security maintenance cost reduction for a single terminal is only a few to tens of yuan, it can result in comprehensive cost savings of millions to tens of millions of yuan, while simultaneously improving the continuity, reliability, and security of model services.

[0100] See Figure 7 , Figure 7 This is a schematic diagram of a federated learning backdoor defense device provided as an embodiment of this application. Figure 7 As shown, this federated learning backdoor defense device is applied to an aggregation server, and the federated learning backdoor defense device 700 may include: The allocation module 702 is used to allocate global category labels in the global model after completing federated training with each client to obtain a global model, thereby obtaining a label set corresponding to each client. The first distribution module 704 is used to distribute the tag set corresponding to each client to each client respectively, so that each client can perform trigger reverse engineering on each category tag in the tag set to obtain the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger, and upload the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger to the aggregation server. The clustering analysis module 706 is used to perform clustering analysis on candidate triggers under different category labels from each client based on the meta-information, evaluation index and backdoor sample embedding of each candidate trigger, to obtain a set of potential triggers; The second distribution module 708 is used to distribute the set of potential triggers to each client, so that each client can construct enhancement samples based on each potential trigger in the set of potential triggers, and use the enhancement samples to enhance and fine-tune its own local model to obtain an enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the unenhanced local model.

[0101] Furthermore, the clustering analysis module 706 includes: The clustering submodule is used to cluster candidate triggers under the target category label from each client to obtain multiple clusters corresponding to the target category label, where the target category label is any one of the global category labels; The first determination submodule is used to determine the average L1 norm, the average attack success rate, and the average embedding similarity of each cluster based on the meta-information, evaluation index, and backdoor sample embedding of each candidate trigger in each cluster. The calculation submodule is used to calculate the comprehensive score corresponding to each cluster based on the average value of L1 norm, the average value of attack success rate, and the average value of embedding similarity. The second determination submodule is used to determine clusters with comprehensive scores higher than a preset threshold as a set of potential triggers.

[0102] Furthermore, the first determining submodule includes: The first determining unit is used to determine the average value of the L1 norm corresponding to each cluster based on the meta-information corresponding to the candidate triggers within each cluster. The second determining unit is used to determine the average attack success rate corresponding to each cluster based on the evaluation index corresponding to the candidate triggers within each cluster. The third determining unit is used to determine the average value of the embedding similarity of each cluster based on the backdoor sample embedding corresponding to the candidate triggers within each cluster.

[0103] Furthermore, the formula for calculating the overall score is as follows: ; in, This represents the overall score corresponding to cluster O. This represents the average embedding similarity corresponding to cluster O. This represents the average attack success rate corresponding to cluster O. This represents the average L1 norm of cluster O. , and These represent the preset weights.

[0104] Furthermore, the allocation module 702 includes: The first allocation submodule is used to evenly distribute the global category labels in the global model to obtain the label set corresponding to each client, wherein the category labels in the label sets corresponding to different clients do not overlap; or... The second allocation submodule is used to perform overlapping allocation of global category labels in the global model to obtain the label set corresponding to each client. Among them, there is some overlap in the category labels in the label sets corresponding to different clients.

[0105] It should be noted that the Federal Learning Backdoor Defense Device 700 can achieve the aforementioned... Figure 1The federated learning backdoor defense method provided in the illustrated embodiment can achieve the same technical effect, and will not be described in detail here.

[0106] See Figure 8 , Figure 8 This is a schematic diagram of another federated learning backdoor defense device provided as an embodiment of this application. Figure 8 As shown, this federated learning backdoor defense device is applied to the client side, and the federated learning backdoor defense device 800 may include: The receiving module 802 is used to receive the tag set sent by the aggregation server. The tag set is obtained by the aggregation server after completing federated training with each client to obtain a global model and then allocating global category tags in the global model. The execution module 804 is used to reverse the triggers of each category of labels in the label set to obtain the meta-information, evaluation index and backdoor sample embedding of each candidate trigger. Upload module 806 is used to upload the metadata, evaluation metrics and backdoor sample embeddings corresponding to each candidate trigger to the aggregation server, so that the aggregation server can perform cluster analysis on the candidate triggers under different category labels from each client based on the metadata, evaluation metrics and backdoor sample embeddings corresponding to each candidate trigger, obtain the potential trigger set, and send the potential trigger set to the client. The enhancement and fine-tuning module 808 is used to construct enhancement samples based on each potential trigger in the potential trigger set, and to enhance and fine-tune its own local model using the enhancement samples to obtain an enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the unenhanced local model.

[0107] Furthermore, execution module 804 includes: The execution submodule is used to perform inverse operation of the trigger based on the preset constraint optimization function to obtain a set of candidate triggers corresponding to the target category label. The target category label is any one of the global category labels, and the set of candidate triggers includes at least one candidate trigger. The third determination submodule is used to obtain the mask and pattern corresponding to each candidate trigger, and to determine the target category label and the mask and pattern corresponding to each candidate trigger as the meta-information corresponding to each candidate trigger. The evaluation submodule is used to construct trigger samples corresponding to each candidate trigger, and use the trigger samples corresponding to each candidate trigger as verification samples to evaluate the attack success rate corresponding to each candidate trigger, and determine the attack success rate corresponding to each candidate trigger as the evaluation index corresponding to each candidate trigger. The feature mapping submodule is used to construct the trigger samples corresponding to each candidate trigger and perform feature mapping on the trigger samples corresponding to each candidate trigger to obtain the backdoor sample embedding corresponding to each candidate trigger.

[0108] Furthermore, the enhanced fine-tuning module 808 includes: The fourth determination submodule is used to determine the clean sample loss value based on the local clean samples and the augmented sample loss value based on the augmented samples. The enhancement and fine-tuning submodule is used to enhance and fine-tune the local model based on the clean sample loss value, the enhanced sample loss value, and the preset fine-tuning optimization function, so as to obtain the enhanced local model.

[0109] Furthermore, the fine-tuning optimization function is expressed by the following formula: ; in, This indicates that the local model parameters are The corresponding clean sample loss value under the condition, This indicates that the local model parameters are The corresponding augmented sample loss value under the given circumstances, Indicates the local model parameters Optimize to make minimize, This indicates the preset coefficient.

[0110] It should be noted that the Federal Learning Backdoor Defense Device 800 can achieve the aforementioned... Figure 2 The federated learning backdoor defense method provided in the illustrated embodiment can achieve the same technical effect, and will not be described in detail here.

[0111] See Figure 9 , Figure 9 This is a schematic diagram of a federated learning backdoor defense system provided as an embodiment of this application. Figure 9 As shown, the federated learning backdoor defense system includes: an aggregation server 902 and multiple clients 904 that communicate with the aggregation server 902; Among them, aggregation server 902 is used to perform the aforementioned Figure 1 The steps of the federated learning backdoor defense method provided in the illustrated embodiment can achieve the same technical effect, and will not be described in detail here; Client 904 is used to execute the aforementioned Figure 2 The steps of the federated learning backdoor defense method provided in the illustrated embodiment are the same as those in the example, and can achieve the same technical effect, so they will not be described in detail here.

[0112] In addition, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the federated learning backdoor defense method provided in any of the foregoing method embodiments.

[0113] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0115] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0116] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for defending against backdoors in federated learning, characterized in that, Applied to an aggregation server, the method includes: After completing federated training with each client to obtain a global model, the global category labels in the global model are assigned to obtain the label set corresponding to each client; The tag set corresponding to each client is sent to each client respectively, so that each client can reverse the trigger for each category of tag in the tag set to obtain the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger, and upload the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger to the aggregation server. Based on the metadata, evaluation metrics and backdoor sample embeddings of each candidate trigger, cluster analysis is performed on the candidate triggers under different category labels from each client to obtain a set of potential triggers. The set of potential triggers is distributed to each client so that each client can construct enhancement samples based on each potential trigger in the set and use the enhancement samples to enhance and fine-tune its own local model to obtain an enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the unenhanced local model. Specifically, based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, cluster analysis is performed on candidate triggers from different categories of clients to obtain a set of potential triggers, including: Candidate triggers from each client under the target category label are clustered to obtain multiple clusters corresponding to the target category label, wherein the target category label is any one of the global category labels; Based on the meta-information, evaluation metrics, and backdoor sample embeddings of the candidate triggers within each of the multiple clusters, the average L1 norm, the average attack success rate, and the average embedding similarity of each cluster are determined. Based on the average value of the L1 norm, the average value of the attack success rate, and the average value of the embedding similarity, calculate the comprehensive score corresponding to each cluster. Clusters whose overall scores are higher than a preset threshold are identified as the potential trigger set.

2. The method according to claim 1, characterized in that, The step of determining the average L1 norm, average attack success rate, and average embedding similarity of each cluster based on the meta-information, evaluation metrics, and backdoor sample embeddings corresponding to candidate triggers within each of the multiple clusters includes: Based on the meta-information corresponding to the candidate triggers within each cluster, the average value of the L1 norm corresponding to each cluster is determined; Based on the evaluation metrics corresponding to the candidate triggers within each cluster, determine the average attack success rate for each cluster. The average embedding similarity of each cluster is determined based on the backdoor sample embeddings corresponding to the candidate triggers within each cluster.

3. The method according to claim 1, characterized in that, The formula for calculating the overall score is as follows: ； Among them, the This represents the overall score corresponding to cluster O. This represents the average embedding similarity corresponding to cluster O. This represents the average attack success rate corresponding to cluster O. This represents the average L1 norm corresponding to cluster O. , and These represent the preset weights.

4. The method according to claim 1, characterized in that, The process of assigning global category labels in the global model to obtain a label set corresponding to each client includes: The global category labels in the global model are evenly distributed to obtain the label set corresponding to each client, wherein the category labels in the label sets corresponding to different clients do not overlap; or, The global category labels in the global model are overlapped to obtain the label set corresponding to each client. Among them, the category labels in the label sets corresponding to different clients have some overlap.

5. A method for defending against backdoors in federated learning, characterized in that, Applied to a client, the method includes: Receive a set of tags sent by the aggregation server, wherein the set of tags is obtained by the aggregation server after completing federated training with each client to obtain a global model and then allocating global category tags in the global model; The triggers in the tag set are reversed to obtain the meta-information, evaluation index and backdoor sample embedding of each candidate trigger. Meta-information, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger are uploaded to the aggregation server. The aggregation server then performs cluster analysis on candidate triggers from different category labels from each client based on the meta-information, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, obtaining a set of potential triggers. The set of potential triggers is then sent to the client. The set of potential triggers consists of clusters with a comprehensive score higher than a preset threshold. The comprehensive score is calculated based on the average L1 norm, the average attack success rate, and the average embedding similarity. The average L1 norm, the average attack success rate, and the average embedding similarity are determined based on the meta-information, evaluation metrics, and backdoor sample embeddings corresponding to candidate triggers within each cluster of multiple clusters. The multiple clusters are obtained by clustering candidate triggers from each client under the target category label. Enhanced samples are constructed based on each potential trigger in the set of potential triggers, and the enhanced samples are used to enhance and fine-tune the local model to obtain an enhanced local model. The backdoor defense capability of the enhanced local model is higher than that of the local model before enhancement.

6. The method according to claim 5, characterized in that, The step of performing trigger reversal on each category of labels in the label set to obtain the meta-information, evaluation index, and backdoor sample embedding corresponding to each candidate trigger includes: Based on the preset constraint optimization function, the trigger is reversed to obtain a set of candidate triggers corresponding to the target category label, wherein the target category label is any one of the global category labels, and the set of candidate triggers includes at least one candidate trigger; Obtain the mask and pattern corresponding to each candidate trigger, and determine the target category label and the mask and pattern corresponding to each candidate trigger as the metadata corresponding to each candidate trigger; Construct trigger samples corresponding to each candidate trigger, and use the trigger samples corresponding to each candidate trigger as verification samples to evaluate the attack success rate corresponding to each candidate trigger. The attack success rate corresponding to each candidate trigger is determined as the evaluation index corresponding to each candidate trigger. Construct trigger samples corresponding to each candidate trigger, and perform feature mapping on the trigger samples corresponding to each candidate trigger to obtain the backdoor sample embedding corresponding to each candidate trigger.

7. The method according to claim 5, characterized in that, The process of using the enhanced samples to enhance and fine-tune the local model to obtain the enhanced local model includes: Based on the local clean samples, determine the clean sample loss value, and based on the augmented samples, determine the augmented sample loss value; Based on the clean sample loss value, the enhanced sample loss value, and the preset fine-tuning optimization function, the local model is enhanced and fine-tuned to obtain the enhanced local model.

8. The method according to claim 7, characterized in that, The fine-tuning optimization function is expressed by the following formula: ； in, This indicates that the local model parameters are The corresponding clean sample loss value under the condition, This indicates that the local model parameters are The corresponding augmented sample loss value in the case of, Indicates the local model parameters Optimize to make minimize, This indicates the preset coefficient.

9. A federated learning backdoor defense device, characterized in that, Applied to an aggregation server, the device includes: The allocation module is used to allocate global category labels in the global model after completing federated training with each client to obtain a global model, thereby obtaining a label set corresponding to each client. The first distribution module is used to distribute the tag set corresponding to each client to each client respectively, so that each client can reverse the trigger for each category tag in the tag set to obtain the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger, and upload the meta information, evaluation index and backdoor sample embedding corresponding to each candidate trigger to the aggregation server. The clustering analysis module is used to perform clustering analysis on candidate triggers under different category labels from each client based on the metadata, evaluation metrics and backdoor sample embeddings of each candidate trigger, to obtain a set of potential triggers; The second distribution module is used to distribute the set of potential triggers to each client, so that each client can construct enhancement samples based on each potential trigger in the set of potential triggers, and use the enhancement samples to enhance and fine-tune its own local model to obtain an enhanced local model, wherein the backdoor defense capability of the enhanced local model is higher than that of the local model before enhancement. The clustering analysis module includes: The clustering submodule is used to cluster candidate triggers under the target category label from each client to obtain multiple clusters corresponding to the target category label, wherein the target category label is any one of the global category labels; The first determining submodule is used to determine the average value of the L1 norm, the average value of the attack success rate, and the average value of the embedding similarity of each cluster based on the meta-information, evaluation index, and backdoor sample embedding of each candidate trigger in each of the multiple clusters. The calculation submodule is used to calculate the comprehensive score corresponding to each cluster based on the average value of the L1 norm, the average value of the attack success rate, and the average value of the embedding similarity. The second determining submodule is used to determine the clusters with comprehensive scores higher than a preset threshold as the potential trigger set.

10. A federated learning backdoor defense device, characterized in that, Applied to a client, the device includes: The receiving module is used to receive a tag set sent by the aggregation server, wherein the tag set is obtained by the aggregation server after completing federated training with each client to obtain a global model and then allocating global category tags in the global model; The execution module is used to reverse the execution of triggers for each category of tags in the tag set to obtain the meta-information, evaluation index and backdoor sample embedding corresponding to each candidate trigger; The upload module is used to upload the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger to the aggregation server. The aggregation server then performs cluster analysis on the candidate triggers under different category labels from each client based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to each candidate trigger, to obtain a set of potential triggers. The set of potential triggers is then sent to the client. The set of potential triggers consists of clusters with a comprehensive score higher than a preset threshold. The comprehensive score is calculated based on the average L1 norm, the average attack success rate, and the average embedding similarity. The average L1 norm, the average attack success rate, and the average embedding similarity are determined based on the metadata, evaluation metrics, and backdoor sample embeddings corresponding to the candidate triggers within each cluster of multiple clusters. The multiple clusters are obtained by clustering candidate triggers under target category labels from each client. The enhancement and fine-tuning module is used to construct enhancement samples based on each potential trigger in the potential trigger set, and to enhance and fine-tune its own local model using the enhancement samples to obtain an enhanced local model, wherein the backdoor defense capability of the enhanced local model is higher than that of the local model before enhancement.

11. A federated learning backdoor defense system, characterized in that, The system includes: an aggregation server and multiple clients that are communicatively connected to the aggregation server; The aggregation server is used to execute the federated learning backdoor defense method according to any one of claims 1-4; The client is used to execute the federated learning backdoor defense method according to any one of claims 5-8.

12. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions for performing the federated learning backdoor defense method according to any one of claims 1-4, or for performing the federated learning backdoor defense method according to any one of claims 5-8.

Images