A multi-stage cascading defense method and system for federated learning backdoor attacks

Abstract

This invention belongs to the fields of artificial intelligence security and data security technology. Specifically, it discloses a multi-stage cascaded defense method and system for backdoor attacks in federated learning. The method includes four stages: Stage 1 identifies progressive poisoning through historical trajectory tracking and dual-signal fusion and triggers emergency rollback; Stage 2 introduces the centering kernel alignment of the radial basis function kernel function to replace the traditional cosine similarity, combined with dynamic adjustment of the group dispersion, and cross-weights high-similarity collusion groups; Stage 3 integrates multi-dimensional evidence to trigger hard clustering isolation to retain the most likely benign clusters; Stage 4 periodically uses clean datasets to fine-tune the global model with a low learning rate, continuously clearing backdoor parameter residues. Through four-stage cascaded collaboration, this invention systematically fills the gaps in existing defense capabilities in terms of temporal awareness, collaborative identification, and parameter purification, significantly improving the robustness of federated learning systems against various types of backdoor attacks.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and data security technology, and relates to a backdoor defense method in federated learning. More specifically, it relates to a multi-stage cascaded defense method and system for backdoor attacks in federated learning, which is used to systematically resist the composite threats of backdoor attacks in the three dimensions of time, space and parameters. Background Technology

[0002] Federated learning, as a decentralized distributed machine learning paradigm, allows multiple clients to collaboratively train a global model without sharing local data, and has been widely used in privacy-sensitive fields such as medical image analysis, intelligent transportation, and financial risk control. However, because servers cannot audit the local training process and private data of clients, malicious actors can inject covert backdoor behavior into the global model by implanting backdoor triggers in local data and uploading tampered model updates. This allows the model to consistently output the attacker's specified target label for samples carrying the trigger. Such backdoor attacks are highly covert and harmful, seriously threatening the reliable deployment of federated learning systems.

[0003] To defend against backdoor attacks, researchers have proposed several defense mechanisms. The first category is based on robust statistical aggregation methods, such as Bulyan, RobustLR, and FedMV. These methods mitigate the impact of outlier updates through median, truncated mean, or majority voting. However, these methods rely on the statistical distribution assumptions of a single update round and are ill-equipped to counter attackers' gradual strategies of smoothly adjusting the poisoning intensity across rounds. The second category is based on differential privacy or model smoothing methods, such as CRFL. These methods obscure backdoor traces by adding noise to model parameters or gradients. However, while enhancing robustness, these methods cause significant damage to the accuracy of the main task, and their protective effect diminishes sharply when malicious clients collude. The third category is based on cluster analysis or activation pattern detection methods, such as FLAME and DeepSight. These methods can detect anomalous structures or backdoor neuron traces within a group. However, the former lacks tracking of individual historical behavioral trajectories, and the latter is a reactive detection rather than an active blocking mechanism. The fourth category is knowledge distillation-based methods, including FedDF and FedRAD. These methods exhibit strong aggregation effects under heterogeneous data distributions, but they assume the server has sufficient high-quality public datasets and also lack proactive mechanisms for identifying malicious clients. Overall, existing methods either focus on a single attack pattern or simply stack different defense measures, lacking a systematic consideration of the triple threat of backdoor attacks: "temporal concealment, spatial coordination, and parameter persistence."

[0004] Specifically, existing defense methods face three fundamental challenges. First, there is a lack of temporal awareness—attackers can implement progressive poisoning, moving only a tiny step towards the target in each round, making the update magnitude indistinguishable from the natural fluctuations caused by data heterogeneity in benign clients. In a single round of statistical detection, the malicious update appears "normal enough" in each round, but after multiple rounds, the model has been significantly shifted. Second, there is the difficulty of group identification—multiple malicious clients can collude to generate highly similar gradient updates, aggregating into a dense cluster in the parameter space, masquerading as "mainstream consensus." In this case, detection based on group outlier will identify this cluster as the center of a normal distribution rather than an anomaly. Third, there is the stubbornness of parameter remnants—even if the aggregation stage successfully filters out all malicious updates in the current round, backdoor parameters implanted in the model in previous rounds, especially residual traces located in batch normalization layers or deep convolutional kernels, will not automatically disappear due to this round's filtering. These "dormant backdoors" can be awakened by specific triggers in subsequent inference stages.

[0005] Therefore, there is an urgent need for a unified defense method that can simultaneously address the challenges of time-series awareness, group identification, and parameter purification. Summary of the Invention

[0006] (a) Technical problems to be solved

[0007] Based on the aforementioned deficiencies in the background technology, this invention provides a multi-stage cascaded defense method and system for federated learning backdoor attacks, to solve the problems of lack of time sequence awareness, difficulty in group identification, and persistent parameter residue in the existing federated learning backdoor defenses. Moreover, the detection → weight reduction → isolation → purification in the defense method of this invention can form a cascaded closed loop in sequence, with information being transmitted step by step, and it has the function of front-end and back-end collaborative defense.

[0008] (II) Technical Solution

[0009] To achieve the above objectives, this invention discloses a multi-stage cascaded defense method against federated learning backdoor attacks, comprising the following steps:

[0010] Step S1: Timing Dual Signal Detection: Maintain a historical update queue for each participating client, calculate the Manhattan amplitude deviation and cosine direction deviation of the current update relative to the historical mean, and achieve cross-client adaptive normalization and dynamic threshold determination through the median absolute deviation. For clients that deviate from the threshold for multiple consecutive rounds, trigger emergency rollback and permanent isolation.

[0011] Step S2: Kernel Similarity Collaborative Weight Reduction: Based on the radial basis kernel function, the center kernel alignment is used to calculate the high-order statistical similarity between clients, replacing the traditional cosine similarity. The penalty intensity is dynamically adjusted according to the gradient dispersion of the group, and cross-weighting is applied to highly similar client pairs to compress the aggregate weight of the collaborative attack group.

[0012] Step S3: Hard isolation driven by comprehensive suspicion: Integrate directional deviation, synergy density and time-series anomaly score to construct a comprehensive suspicion index. When the historical adaptive threshold is exceeded, principal component analysis and K-Means hard clustering screening are triggered. The most likely benign clusters are retained by three-dimensional scoring of size proportion, intra-cluster cohesion and cluster core separation, and all other clusters are isolated.

[0013] Step S4: Periodic backdoor residue cleaning: Using the clean public dataset held by the server, perform lightweight fine-tuning of the global model at fixed intervals with low learning rate and few iterations to clean up the residual backdoor parameters.

[0014] Furthermore, for details regarding steps S1 to S4, please refer to the specific implementation method described below, which will not be repeated here.

[0015] In addition, the present invention also claims a multi-stage cascaded defense system against federated learning backdoor attacks, comprising: at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor can execute the multi-stage cascaded defense method against federated learning backdoor attacks as described above by calling the program instructions.

[0016] (III) Beneficial Effects

[0017] Compared with existing technologies, the present invention has at least the following beneficial effects:

[0018] 1. The multi-stage cascaded unified backdoor defense method in federated learning provided by this invention achieves full-link defense from immediate blocking to long-term purification through four stages of cascaded collaboration: Stage 1 accurately identifies progressive poisoning behavior and triggers emergency rollback through time-series dual signal detection; Stage 2 effectively dismantles the aggregate influence of the collusive group through kernel similarity collaborative weight reduction; Stage 3 accurately retains the most likely benign clusters under extreme attack scenarios through hard isolation driven by comprehensive suspiciousness; and Stage 4 continuously cleans up the residing backdoor parameters through periodic backdoor residue cleaning, systematically filling the gaps in the existing defense capabilities in terms of time-series perception, collaborative identification, and parameter purification.

[0019] The core of this defense method is unidirectional information inheritance and dynamic triggering. The time-series anomaly score output by step S1 and the similarity threshold and remaining client set output by step S2 can be directly fed into step S3, achieving standardization and result reuse, avoiding redundant calculations. In terms of the dynamic adjustment dimension of defense depth, in normal rounds, only step S2 slightly reduces the weight; in cases of high-intensity collusion, the strong penalty in step S2 can also trigger a surge in the collaborative density in step S3, triggering hard clustering isolation; persistent threats are immediately rolled back by S1 and terminate the subsequent stages of this round. In terms of time dimension, steps S1 to S3 focus on the immediate blocking of the aggregation in this round, while step S4 independently performs periodic fine-tuning, continuously weakening the amplitude of the already-resident backdoor parameters even if the first three stages miss detection. In this architecture, information is transmitted unidirectionally, defense is layered and progressive, and there is always a backup in the next stage if any stage fails, completely realizing the cascaded closed loop of "detection → suppression → isolation → purification".

[0020] 2. The cascaded unified backdoor defense method in federated learning provided by this invention adopts adaptive normalization driven by median absolute deviation and dynamic threshold determination, which avoids the high false alarm risk of fixed thresholds in the early stage of training or in highly heterogeneous scenarios; by continuously counting suspects and using an emergency rollback mechanism, the attack window is compressed to within a single round, effectively blocking the vertical propagation of progressive poisoning.

[0021] 3. The cascaded unified backdoor defense method in federated learning provided by this invention introduces a centering kernel alignment based on radial basis function kernel function to replace the traditional cosine similarity. By performing block kernel mapping and centering processing on the update vector, it captures the high-order statistical dependencies in the gradient space, effectively resisting bypass attacks implemented by attackers through uniform scaling of gradient direction; at the same time, it dynamically adjusts the penalty intensity according to the gradient dispersion of the group, applies cross-weighting to highly similar client pairs, and significantly compresses the effective aggregation weight of the collaborative attack group.

[0022] 4. The cascaded unified backdoor defense method in federated learning provided by this invention integrates multi-dimensional evidence such as directional deviation, collaborative density, and time-series anomaly score to construct a comprehensive suspiciousness index. It also designs a historical adaptive threshold and hard clustering screening mechanism. Through a three-dimensional comprehensive score of scale proportion, intra-cluster cohesion, and cluster core separation, it accurately locates and retains the most likely benign clusters, ensuring a low false alarm rate in normal heterogeneous scenarios and strong isolation capabilities in high-intensity attack scenarios. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this invention or the prior art, the accompanying drawings used in the embodiments will be briefly described below:

[0024] Figure 1 A flowchart illustrating a multi-stage cascaded defense method against federated learning backdoor attacks provided in an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] The core of this invention is to provide a multi-stage cascaded defense method for federated learning backdoor attacks, in order to solve the problems of lack of time awareness, difficulty in group identification, and persistent parameter residue in existing federated learning backdoor defenses.

[0027] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0028] Figure 1 A flowchart illustrating a multi-stage cascaded defense method against federated learning backdoor attacks, as provided in this embodiment of the invention, is shown below. Figure 1 As shown, it includes the following steps:

[0029] Step S1: Timing Dual Signal Detection: Maintain a historical update queue for each participating client, calculate the Manhattan amplitude deviation and cosine direction deviation of the current update relative to the historical mean, and achieve cross-client adaptive normalization and dynamic threshold determination through the median absolute deviation. For clients that deviate from the threshold for multiple consecutive rounds, trigger emergency rollback and permanent isolation.

[0030] Given that single-round statistics are easily circumvented by gradual poisoning or gradient scaling, this stage maintains a fixed-length historical update queue for each participating client and calculates the Manhattan magnitude deviation and cosine direction deviation of the current update relative to the historical mean. Subsequently, adaptive normalization and dynamic threshold determination are achieved across clients using the median absolute deviation. This dual-signal design ensures that both magnitude and direction anomalies are not missed, while MAD normalization eliminates the high false positive risk of fixed thresholds in the early stages of training or in highly heterogeneous scenarios.

[0031] In one embodiment, step S1 further includes, letting the first The global model parameters are Client The locally updated local model is Then its parameter update amount is Maintain a sliding history window for each client. H represents the historical window length, and the historical mean is calculated. To comprehensively capture abnormal patterns, a dual-signal detection path is constructed: amplitude signal... The Manhattan distance is used to measure the overall deviation of the update magnitude, defined as follows:

[0032] It is sensitive to sparse large-amplitude perturbations and computationally efficient; directional signal The deviation from the updated orientation is measured using cosine distance, defined as follows:

[0033] It is independent of the amplitude norm and can effectively capture targeted attacks. This is the inner product of two vectors. Since the dimensions and distributions of the two types of signals differ significantly, direct weighting or fixed-threshold fusion will introduce unnecessary prior bias.

[0034] This invention employs robust normalization using the median absolute deviation: as the original deviation signal of any single dimension to be normalized. For any set of signals ,definition in, The median. Let N represent the absolute deviation of the median, N represent the number of clients participating in this round, and median represent the mathematical function for taking the median. Then the normalized value is... ; Compared to Z-score, MAD is inherently robust to outliers and will not distort the overall distribution due to extreme malicious updates. The temporal anomaly score is obtained by weighted fusion of the two signals.

[0035] Among them, the weighting coefficient Dynamic adjustments are made based on the current round's abnormal distribution.

[0036] The decision threshold also employs an adaptive mechanism based on MAD, setting the decision threshold... ,in An adjustable coefficient is used to control detection sensitivity. This threshold is dynamically adjusted as training progresses, avoiding a large number of false alarms caused by a fixed threshold during the early oscillation phase of training. At that time, the client Marked as "suspect". To distinguish between occasional fluctuations and persistent malicious behavior, a continuous suspect count is introduced. If this round is marked, then ,otherwise Only when a client is marked as abnormal for multiple consecutive rounds, i.e., when... Only when a preset threshold of consecutive rounds is reached will an application be added to the permanent blacklist, with an initial buffer period set to avoid overreacting to momentary fluctuations. Once a client is added to the blacklist... All subsequent updates will be permanently excluded from the aggregation.

[0037] In addition, to further prevent the vertical propagation of accumulated backdoor effects, an emergency rollback mechanism is introduced in this phase: if a confirmed persistent threat exists in the current blacklist, the system will immediately restore the global model to the previous backup snapshot. The current round of aggregation is terminated, and a cooling window is set to prevent frequent rollbacks from causing training stagnation. This conservative strategy of "rollback first, isolation later" compresses the attack window to within a single round, ensuring that even if there is a single-round delay in detection, the backdoor cannot establish a stable presence within the model. Through the synergistic effect of the aforementioned temporal modeling and dynamic threshold determination, Phase 1 not only achieves early warning of progressive poisoning behavior but also provides reliable anomalous prior information for subsequent phases of weighted aggregation and hard isolation.

[0038] Step S2: Kernel Similarity Collaborative Weight Reduction: Based on the radial basis kernel function, the high-order statistical similarity between clients is calculated by centering the kernel alignment, replacing the traditional cosine similarity. The penalty intensity is dynamically adjusted according to the gradient dispersion of the group, and cross-weighting is applied to highly similar client pairs to compress the aggregate weight of the collaborative attack group.

[0039] To address the design of group-based collusion attacks, this phase introduces Centered Kernel Alignment (CKA) based on the RBF kernel as a benchmark for measuring similarity among clients. By performing block kernel mapping and centering on the update vector, it captures high-order statistical dependencies in the gradient space, thus maintaining more stable discriminative power than traditional cosine similarity under Non-IID data distribution. Traditional cosine similarity only captures first-order linear correlations and is easily bypassed by attackers by uniformly scaling the gradient direction.

[0040] In one embodiment, step S2 further includes, to avoid the curse of dimensionality and numerical instability caused by direct calculation of extremely high-dimensional parameters, firstly updating the parameter amount for each client. After flattening, cut into Equal-length blocks , Right now In this round of processing, column standardization is performed independently on each block.

[0041] In this embodiment, let For the client The block representation matrix, For the intra-block dimension. Calculate the RBF kernel matrix. Its elements are

[0042]

[0043] kernel width parameter The median heuristic is adaptively determined, with indices p and q representing blocks. In the sequence, the values ​​of p and q within the same client i range from 1 to M. Let... It is an M×M identity matrix. If the vector is an M×1 column vector of all 1s, then the centralized matrix is ​​defined. Then the client and RBF Kernel CKA Similarity for

[0044]

[0045] in It is the Frobenius norm. CKA essentially measures the normalized form of HSIC (Hilbert-Schmidt Independence Criterion), which can capture nonlinear high-order statistical dependencies, is naturally immune to gradient scaling attacks, and degenerates much less than cosine similarity under non-IID data distributions.

[0046] In obtaining the similarity matrix After setting the diagonal elements to zero, the basic weighting factor... Defined as

[0047]

[0048] Where max is the function for finding the maximum value, and the subscripts i and j are different client numbers. Each element C ij This refers to the similarity calculated in step S2. The basic weighting factor in the state-aware stage This is the aggregate weight used to drive the subsequent state correction phase. The derived metrics are calculated based on the updated data.

[0049] To further strengthen the suppression of coordinated attacks, the concept of gradient dispersion is introduced to measure the consistency of group updates. A set of client update directions is defined. Global center direction , where mean is the average function used to accurately capture the center of group collusion, then the dispersion is...

[0050]

[0051] Among them, dispersion This reflects the dispersion of client update directions, with Var representing the variance function. When malicious clients collude highly, their update directions become highly convergent, leading to... This is significantly smaller than the expected value in naturally heterogeneous scenarios. Based on this, this embodiment designs a dynamic penalty intensity based on dispersion. :when The penalty intensity reaches its maximum when the value is extremely small; when When the variance is large, the penalty tends to be conservative to avoid accidentally harming legitimate clients. This invention utilizes the characteristic of malicious collusion leading to minimal variance to trigger penalties in reverse. Although the dispersion is calculated based on variance... While easily affected by extreme values, the algorithm here identifies coordinated attacks by observing whether the "group is too uniform," which is a "fight fire with fire" strategy.

[0052] Then, a cross-penalty is applied to the similarity matrix: a similarity threshold is set. For all that satisfy The client for Perform the following weight updates:

[0053]

[0054] in As a decay base, and are the aggregation weights of clients i and j in the global aggregation, respectively, and Percentile is the percentile statistical function. This is a preset hyperparameter, ranging from 0 to 100, used to control the strictness of filtering highly similar client pairs. This operation makes highly similar groups penalize each other, especially creating exponential weight suppression for malicious collusion groups. Finally, an adaptive percentile threshold based on weight distribution is used. After removing clients with extremely low privileges, the remaining client set is denoted as After Phase Two processing, the effective aggregate weights of the coordinated attack group are significantly compressed, while the diverse updates truly from benign heterogeneous clients are preserved; simultaneously, the weight information output in this phase is integrated with the remaining client set. The data is directly fed into stage three, providing a pre-purified input space for subsequent comprehensive suspicion calculation and hard clustering isolation.

[0055] Step S3: Hard isolation driven by comprehensive suspicion: Integrate directional deviation, synergy density and time-series anomaly score to construct a comprehensive suspicion index. When the historical adaptive threshold is exceeded, principal component analysis and K-Means hard clustering screening are triggered. The most likely benign clusters are retained by three-dimensional scoring of size proportion, intra-cluster cohesion and cluster core separation, and all other clusters are isolated.

[0056] Phase Three acts as the "last line of defense" in the defense system. When the demotion mechanism of Phase Two faces extremely large-scale collusion, it may still be insufficient to completely suppress the aggregated influence of the attack group. Therefore, this phase integrates multiple complementary anomalous signals—including the deviation of the update direction, the density of coordinated attacks, and the temporal anomaly score output from Phase One—to construct a comprehensive suspiciousness index to accurately identify high-intensity attack rounds. Once the comprehensive suspiciousness exceeds an adaptive threshold smoothed by an exponentially weighted moving average of historical data, a hard isolation process is triggered.

[0057] In one embodiment, step S3 further includes, in this embodiment, integrating three complementary anomaly signals in stage three to construct a comprehensive suspicion level. The directional anomaly signal measures the degree of deviation between the client update and the global center direction; the directional deviation... Defined as

[0058]

[0059] The cooperative density signal characterizes the degree of clustering of highly similar neighbors around a client. Defined as

[0060]

[0061] in The similarity threshold determined in Phase 2. It is an indicator function; a timing anomaly fractional signal. Provided directly by Phase One, it reflects the degree to which the client deviates from its historical trajectory. The overall suspiciousness is obtained by weighting and fusing the above three pieces of evidence.

[0062]

[0063] in, , , These are the directional deviations. Synergy density Time series anomaly score The weighting coefficients are dynamically allocated based on the discriminative power of each signal against the attack behavior. Orientation anomalies and cooperative density are given higher weights to dominate the identification of high-intensity attacks, while temporal anomalies are used as auxiliary correction terms.

[0064] The trigger threshold adopts a historical adaptive strategy: maintaining a sequence of the highest suspicion levels from previous rounds. ,in , This is the overall suspiciousness of client i in the r-th round of the historical rounds, where r ranges from 1 to t-1. The trigger threshold for the current round is...

[0065]

[0066] EWMA stands for Exponentially Weighted Moving Average. To control the adjustable coefficient of detection sensitivity, an exponentially weighted moving average is used to smooth out cross-cycle fluctuations in the threshold. When If a high-intensity coordinated attack is detected in the current round, a hard clustering isolation process is triggered. It should be noted that the overall suspicion level of the current round (round t) is... It is not used for current decision-making, but rather for the comprehensive suspiciousness of historical rounds (round r). This is used to build a historical database. In order to calculate dynamic thresholds .

[0067] The hard clustering process first performs L2 normalization on the update vectors of the participating client sets. Principal component analysis (PCA) was then performed to reduce the dimensionality to two dimensions. , Specifically refers to data The PCA function is applied to reduce the dimensionality to two dimensions (i.e., the first two principal components). The number of clusters is adaptively determined by the silhouette coefficient. The K-Means algorithm is used to cluster the dimensionality-reduced features, resulting in several candidate clusters. To identify benign groups from multiple candidate clusters, a three-dimensional comprehensive scoring mechanism is designed. For any cluster... Its rating for

[0068]

[0069] in For the cluster center, As the global center, , , The three weights correspond to cluster size, intra-cluster cohesion, and cluster core separation, respectively. The cluster with the highest score is selected. As a benign cluster, all clients from other clusters are hard-isolated and removed from this round of aggregation, with argmax being a function of the arguments of the maxima. The rationale behind this scoring design is that benign groups are typically the largest, have high internal directional consistency, and naturally gravitate towards the global center, while malicious collusion groups, although they may maintain high cohesion, will inevitably reveal anomalies in their size or deviation from the global center. Through this hard isolation mechanism, Phase Three proactively shrinks the aggregation range when high-intensity attack signals are detected, sacrificing a small amount of participation for robust defense in extreme scenarios.

[0070] Step S4: Periodic backdoor residue cleaning: Using the clean public dataset held by the server, perform lightweight fine-tuning of the global model at fixed intervals with low learning rate and few iterations to clean up the residual backdoor parameters.

[0071] In one embodiment, step S4 further includes a focus on the period after aggregation is complete. The first three stages all perform filtering during aggregation, but backdoor parameters successfully injected into the global model in previous rounds do not automatically disappear due to this round of filtering. Therefore, in this embodiment, the server holds a clean, public dataset. Its data distribution is consistent with the training task and contains no backdoor triggering patterns. During training, Anti-MOBA uses a clean, public dataset held by the server to perform short-cycle fine-tuning of the global model at fixed intervals. The fine-tuning objective is to minimize the cross-entropy loss on the clean data.

[0072]

[0073] in, To fine-tune the loss value, These are all the parameters of the current global model. For the expectation operator, To obtain from clean public datasets A pair of inputs sampled in the middle, where the sample is The actual label is y. This indicates sampling from it, where f(x;θ) is the model. In a given sample and parameters The classification probability output by the forward propagation. This is the cross-entropy loss function.

[0074] The parameter update rule is as follows

[0075]

[0076] Among them, fine-tuning the learning rate The learning rate is set to a small fraction of the main training rate to avoid significantly interfering with the accuracy of the main task, while the number of fine-tuning iterations is limited to a few steps. The descent direction was calculated using the old parameters, and the new parameters were obtained. The new parameters overwrite the old ones. The underlying mechanism of this operation is that backdoor neurons typically have low activation frequencies or anomalous weight magnitudes on clean data. These characteristics make backdoor-related parameters "fragile" under clean data distributions. During fine-tuning, the gradients of the clean data naturally push these anomalous parameters towards the normal distribution region, thus breaking down the backdoor mapping relationship. Because the number of fine-tuning iterations is extremely small and the learning rate is extremely low, the model's core representational ability to fit the main task on clean data is maintained, preventing catastrophic forgetting due to overfitting.

[0077] By periodically executing this purification step, Phase Four continuously eliminates backdoor remnants that slip through due to defense delays, forming a complete closed loop of "detection-suppression-isolation-purification" with the first three phases. Phase Four complements the first three phases in a temporal-dimensional defense: the first three phases act on the immediate decision space of each aggregation, blocking the injection channels of new backdoors; Phase Four acts on a longer timescale, continuously tracking and eliminating existing backdoor traces. Their synergistic operation ensures that even if an attacker manages to breach the immediate defenses of the first three phases in rare cases, they cannot establish a long-term, stable backdoor presence in the model—because the periodic purification step continuously "sweeps" away anomalous parameters, preventing the backdoor effect from accumulating effectively.

[0078] To verify the effectiveness of the defense method described in this invention, experimental comparisons were also conducted. This embodiment uses the ResNet-18 model on the CIFAR-10 dataset, in a non-independent, identically distributed (i.e., Based on the data segmentation, Anti-MOBA is compared with ten existing mainstream defense methods, including FedAvg, CRFL, DeepSight, FedDF, FedRAD, FLAME, FedMV Pruning, RobustLR, fine-tuning, and Bulyan. A comprehensive evaluation is conducted on six representative advanced backdoor attacks: F3BA, 3DFed, LPTack, DBA, Neurotoxin, and Baseline. Experimental results show that most baseline methods suffer severe accuracy collapse or defense failure when facing advanced attacks such as F3BA, 3DFed, and LPTack. FLAME and FedMV Pruning have ASRs as high as 97.77% and 99.77% respectively under F3BA, almost completely failing. FedAvg, FedDF, FLAME, and RobustLR all have ASRs exceeding 97% under LPTack, completely unable to defend against inter-layer poisoning attacks. Bulyan's ACC drops sharply to 40.53% and its ASR is as high as 85.42% under 3DFed attacks, indicating severe instability. In comparison, Anti-MOBA achieved ASRs of 9.50%, 8.78%, and 8.23% under F3BA, 3DFed, and LPTack attacks, respectively, while maintaining ACCs of 76.99%, 68.18%, and 66.84%, achieving the best defensive robustness among all methods. Under DBA, Neurotoxin, and Baseline attacks, Anti-MOBA also maintained excellent defensive performance, with ASRs of 9.97%, 7.66%, and 11.41%, respectively, and ACCs consistently at 76.98%, 76.31%, and 67.35%. Considering the overall performance across all six attack types, Anti-MOBA maintained an ASR below 11.5% and an ACC consistently between 67% and 77% across all scenarios, making it the only method to maintain stable defensive performance across all attack types. The above results show that existing defense methods are difficult to maintain consistent defense effectiveness under diverse attack scenarios, while Anti-MOBA, through its four-stage cascaded design, maintains low ASR and stable ACC under different attack types and intensities, fully verifying its superiority and robustness under diverse threat scenarios.

[0079] The cascaded unified backdoor defense method in federated learning provided by this invention has been described in detail above. The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Content not described in detail in this invention belongs to the prior art known to those skilled in the art.

[0080] Furthermore, in the embodiments provided by this invention, the defense method of this invention can be implemented in the form of a computer software program. When the software functional units corresponding to each of the above steps are stored in a storage medium, they include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-stage cascaded defense method against federated learning backdoor attacks, characterized in that, Includes the following steps: Step S1: Timing Dual Signal Detection: Maintain a historical update queue for each participating client, calculate the Manhattan amplitude deviation and cosine direction deviation of the current update relative to the historical mean, and achieve cross-client adaptive normalization and dynamic threshold determination through the median absolute deviation. For clients that deviate from the threshold for multiple consecutive rounds, trigger emergency rollback and permanent isolation. Step S2: Kernel Similarity Collaborative Weight Reduction: Based on the radial basis kernel function, the center kernel alignment is used to calculate the high-order statistical similarity between clients, replacing the traditional cosine similarity. The penalty intensity is dynamically adjusted according to the gradient dispersion of the group, and cross-weighting is applied to highly similar client pairs to compress the aggregate weight of the collaborative attack group. Step S3: Hard isolation driven by comprehensive suspicion: Integrate directional deviation, synergy density and time-series anomaly score to construct a comprehensive suspicion index. When the historical adaptive threshold is exceeded, principal component analysis and K-Means hard clustering screening are triggered. The most likely benign clusters are retained by three-dimensional scoring of size proportion, intra-cluster cohesion and cluster core separation, and all other clusters are isolated. Step S4: Periodic backdoor residue cleaning: Using the clean public dataset held by the server, perform lightweight fine-tuning of the global model at fixed intervals with low learning rate and few iterations to clean up the residual backdoor parameters.

2. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 1, characterized in that, In step S1, the timing dual-signal detection specifically includes: letting the first... The global model parameters are Client The locally updated local model is Client The local update volume is Maintain a sliding history window for each client. H represents the window length, and the historical mean is ; Amplitude signal Using Manhattan distance: Direction signal Using cosine distance: function The inner product of two vectors serves as the signal of the original one-dimensional bias value to be normalized. For any set of signals ,definition in, The median. The median absolute deviation is given by N, which represents the number of clients participating in this round, and median represents the mathematical function for taking the median. Normalized value ; The timing anomaly score is obtained by weighted fusion of the two signals. : Determination threshold for: in To control the adjustable coefficient of detection sensitivity, when The client was flagged as a suspect.

3. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 2, characterized in that, In step S1, triggering an emergency rollback and permanent isolation for clients that deviate from the threshold for multiple consecutive rounds specifically involves: introducing a continuous suspicion count. If this round is marked as a suspect, then ,otherwise ,when When the preset threshold for consecutive rounds is reached, the client will be added to the blacklist. Permanent isolation; if a confirmed persistent threat is found in this round of blacklisting, the system will immediately restore the global model to the previous backup snapshot. The current aggregation round is terminated, and a cooling window is set to prevent frequent rollbacks from causing training to stall.

4. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 3, characterized in that, In step S2, the calculation of higher-order statistical similarity between clients based on radial basis function kernel alignment specifically involves updating the parameter amount for each client. After flattening, cut into Equal-length blocks , Right now The abbreviation used in this round of processing, To represent the matrix in blocks, For the intra-block dimension, the RBF kernel matrix The elements are: Among them, the kernel width parameter The median heuristic is adaptively determined, with indices p and q representing blocks. In the sequence, the values ​​of p and q within the same client i are both in the range of 1 to M. Let... It is an M×M identity matrix. Let M×1 column vectors be all 1s, and define a centered matrix. Client and Centered kernel alignment similarity for: in It is the Frobenius norm.

5. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 4, characterized in that, In step S2, a similarity matrix with diagonal elements set to zero is obtained. After that, the basic weighting factor Defined as Where max is the function to find the maximum value, and the subscripts i and j are different client numbers. Each element C ij This refers to the center alignment similarity calculated in step S2. .

6. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 5, characterized in that, In step S2, the step of dynamically adjusting the penalty intensity based on the population gradient dispersion and applying cross-weighting to highly similar client pairs specifically involves defining the client update direction. Global center direction The mean is a function to calculate the average value, and the dispersion is... for: Based on dispersion Dynamically determine the intensity of punishment Var represents the variance function, and the similarity threshold is set to 1. For all that satisfy The client performs cross-weighting reduction: in As a decay base, and , are the aggregation weights of clients i and j in the global aggregation, respectively; Percentile is the percentile statistical function, and... It is a preset hyperparameter that ultimately eliminates clients with extremely low weights based on an adaptive percentile threshold of the weight distribution.

7. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 6, characterized in that, In step S3, the comprehensive suspiciousness index is composed of the following three pieces of evidence weighted and fused together: Directional deviation : Synergy density : For similarity threshold, It is an indicator function, a time series anomaly score. Provided by step S1; Overall Suspicion for: , , These are the directional deviations. Synergy density Time series anomaly score Weighting coefficients; Trigger threshold for: Maintain the maximum suspicion sequence of historical rounds ,in , It represents the overall suspiciousness of client i in the r-th round of the historical rounds, where r ranges from 1 to t-1, and EWMA represents the exponentially weighted moving average function. To control the adjustable coefficient of detection sensitivity, when The hard clustering isolation process is triggered at certain times.

8. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 7, characterized in that, In step S3, the principal component analysis and K-Means hard clustering screening, and the retention of the most likely benign clusters through three-dimensional comprehensive scoring, specifically involves L2 normalization of the update vectors of the participating clients. Perform PCA to reduce dimensionality to two dimensions , To transfer data The PCA function is applied to reduce the dimensionality to two dimensions. The number of clusters is adaptively determined by the silhouette coefficient. The K-Means algorithm is used to cluster the dimensionality-reduced features to obtain several candidate clusters. For any cluster The three-dimensional comprehensive score is: in For the cluster center, As the global center, , , The three weights correspond to cluster size, intra-cluster cohesion, and cluster core separation, respectively. The cluster with the highest score is selected. As a benign cluster, all other clusters are hard isolated and removed, and argmax is a function of the argument variable that takes the maximum value.

9. The multi-stage cascaded defense method against federated learning backdoor attacks according to claim 8, characterized in that, In step S4, the periodic backdoor remnant cleaning specifically involves: assuming the server holds a clean public dataset. At fixed intervals, the current global model parameters are adjusted. Fine-tuning is performed, with the goal of minimizing the cross-entropy loss on clean data: in, To fine-tune the loss value, These are all the parameters of the current global model. For the expectation operator, To obtain from clean public datasets A pair of inputs sampled in the middle, where the sample is The actual label is y. This indicates sampling from it, where f(x;θ) is the model. In a given sample and parameters The classification probability output by the forward propagation. The cross-entropy loss function; The parameter update rules are as follows: Among them, fine-tuning the learning rate Set it to a small fraction of the main training learning rate, and limit the number of fine-tuning iterations to a few steps.

10. A multi-stage cascaded defense system against federated learning backdoor attacks, characterized in that, include: At least one processor; And at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor invokes the program instructions to execute the multi-stage cascaded defense method against federated learning backdoor attacks as described in any one of claims 1-9.

Images