Adaptive federated learning defense method considering privacy protection and byzantine robustness

Abstract

The application discloses a kind of self-adapting federal learning defense methods giving consideration to privacy protection and byzantine robustness, it is related to federal learning technical field, wherein method includes: server initializes global model and builds history state queue;Client adds noise protection local update data according to model convergence state and local deviation degree, adaptively.Combining multiple rounds of local and global parameters constructs direction vector, and according to global evolution trend, the direction of noise data is corrected.Dual screening is carried out by geometric distance and direction similarity after server receives data, and abnormal update content is removed.Three-dimensional reputation evaluation is carried out from consistency, quality and contribution, and the global model is iterated by dynamically adjusting aggregation weight and weightedly fusing update data.The application can correct the model drift caused by differential privacy, improve the stability of training convergence;Relies on dual screening and multi-dimensional reputation evaluation, strengthens the defense capability of byzantine attack, and gives consideration to privacy security and model application performance of federal learning.

Description

Technical Field

[0001] This invention relates to the field of federated learning technology, and in particular to an adaptive federated learning defense method that balances privacy protection and Byzantine robustness. Background Technology

[0002] Federated learning, as a core paradigm of distributed artificial intelligence, is widely used in sensitive data areas such as financial risk control and smart healthcare. With the surge in IoT devices, related technologies, through the collaborative operation of local differential privacy, robust aggregation algorithms, and dynamic noise mechanisms, have constructed a secure defense system from data acquisition to model aggregation. Specifically, this system covers key aspects such as gradient noise addition, outlier removal, and reputation assessment, aiming to balance privacy compliance and model utility.

[0003] However, existing technical solutions directly employ static privacy budgeting and single geometric distance filtering, without establishing a direction correction mechanism based on historical trajectories or a multi-dimensional reputation dynamic perception system. Due to the lack of real-time response to the global convergence state, continuous random noise injection easily triggers severe model drift, leading to training oscillations or even non-convergence. Furthermore, traditional methods neglect consistency verification of update directions, making it difficult to identify hidden Byzantine attacks concealed behind statistical biases. This results in significantly insufficient robustness of the system in complex adversarial environments, severely restricting the reliability of large-scale deployments. Summary of the Invention

[0004] The main objective of this invention is to provide an adaptive federated learning defense method that balances privacy protection and Byzantine robustness.

[0005] Another objective of this invention is to propose an adaptive federated learning defense device that balances privacy protection and Byzantine robustness.

[0006] The third objective of this invention is to provide an electronic device.

[0007] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0008] To achieve the above objectives, a first aspect of the present invention proposes an adaptive federated learning defense method that balances privacy protection and Byzantine robustness, comprising:

[0009] S1, the server initializes the global model and establishes a historical state queue. The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the update data generated by local training. S2, the client extracts the local model parameters and global model parameters of the current and historical multiple rounds, constructs the local update direction vector and the global evolution trend vector, and uses the global evolution trend vector to perform direction correction processing on the updated data after injecting noise; S3, the server receives the updated data after orientation correction, performs dual filtering based on geometric distance and orientation similarity, and removes updated data with abnormal values ​​and orientation deviations. S4: The server performs a three-dimensional reputation assessment of the filtered updated data based on consistency, quality, and contribution. It dynamically adjusts the aggregation weights based on the real-time attack intensity and integrates the weighted updated data into the global model.

[0010] Optionally, the client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the locally trained update data, including: The client calculates the stability of the global model, which is the L2 norm of the difference between the global model parameters in the current round and the global model parameters in the previous round. The client calculates the deviation of the local model from the global consensus, and its value is the L2 norm of the difference between the local model parameters in the previous round and the global model parameters in the current round. The client calculates the convergence perception factor based on the stability of the global model and the deviation of the local model from the global consensus, and updates the noise scaling factor using the exponential smoothing formula. The exponential smoothing formula is that the noise scaling factor of the next round is equal to the momentum decay factor multiplied by the noise scaling factor of the current round plus the adjustment factor multiplied by the cutoff value of the convergence perception factor. The cutoff value is the result of comparing the convergence perception factor with the preset upper and lower limits. The client performs adaptive Gaussian noise adjustment on the locally trained update data based on the updated noise scaling factor to obtain the locally updated data with injected noise.

[0011] Optionally, the client extracts local and global model parameters from the current and historical multiple rounds, constructs a local update direction vector and a global evolution trend vector, and uses the global evolution trend vector to perform direction correction processing on the updated data after injecting noise, including: The client retrieves four historical state data from local storage: local model parameters of the current round, local model parameters of the previous round, global model parameters of the previous round, and global model parameters of the two rounds before that. The client calculates the local update direction vector based on the local model parameters of the current round and the local model parameters of the previous round, and calculates the global evolution trend vector based on the global model parameters of the previous round and the global model parameters of the two previous rounds. The client calculates the cosine similarity between the local update direction vector and the global evolution trend vector in the parameter space of each network layer, and constructs a parameter-level angle matrix. The client uses the global evolution trend vector as the orientation calibration benchmark, and combines it with the parameter-level angle matrix to perform a four-fold historical state correction algorithm on the noise-injected update data to generate orientation-calibrated local update data.

[0012] Optionally, the server receives the orientation-corrected update data and performs a dual filtering based on geometric distance and orientation similarity to remove update data with abnormal values ​​and orientation deviations, including: The server calculates the Euclidean distance between the updated data of each client and the reference center. Updates with Euclidean distances exceeding a preset distance threshold are marked as outliers with abnormal values ​​and removed, thus completing the first screening based on geometric distance. The server calculates the directional similarity between each client update vector and the reference center vector in the remaining update data, and marks the update data with a directional similarity lower than a preset angle threshold as a covert attack aimed at offsetting the global learning results and removes it, thus completing the second screening based on directional similarity. The server outputs an updated set of data that has passed both the first and second rounds of filtering, which serves as input data for subsequent three-dimensional reputation assessment.

[0013] Optionally, the server performs a three-dimensional reputation assessment of the filtered updated data based on consistency, quality, and contribution, dynamically adjusts the aggregation weights according to the real-time attack intensity, and integrates the weighted updated data into the global model, including: For each client update data that passes the screening, the server calculates its consistency score relative to the historical update trajectory, its quality score relative to the local dataset quality, and its contribution score relative to the global model improvement. The server weights and fuses the consistency score, quality score, and contribution score to generate an initial reputation score for each client, and calculates adaptive temperature adjustment parameters based on the real-time perceived attack intensity. The server uses the adaptive temperature adjustment parameters to construct a Softmax policy function, inputs the initial reputation score of each client into the Softmax policy function, and calculates the dynamic aggregation weight of each client in the current round of aggregation. The server performs a weighted summation operation on the filtered updated data based on the calculated dynamic aggregation weights, and then merges the weighted updated data into the global model to achieve dynamic aggregation that smoothly distributes weights during strong attacks and focuses on the weights of advantageous clients during weak attacks.

[0014] To achieve the above objectives, a second aspect of the present invention provides an adaptive federated learning defense device that balances privacy protection and Byzantine robustness, comprising: The initialization module is used by the server to initialize the global model and establish a historical state queue. The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the update data generated by local training. The bias correction module is used by the client to extract local and global model parameters from the current and historical multiple rounds, construct local update direction vectors and global evolution trend vectors, and use the global evolution trend vectors to perform orientation correction processing on the updated data after injecting noise. The update module is used by the server to receive the updated data after orientation correction, and to perform dual filtering based on geometric distance and orientation similarity to remove updated data with abnormal values ​​and orientation deviations. The fusion module is used by the server to perform a three-dimensional reputation assessment of the consistency, quality, and contribution of the filtered updated data, dynamically adjust the aggregation weights based on the real-time attack intensity, and fuse the weighted updated data into the global model.

[0015] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0016] To achieve the above objectives, a third aspect of this application provides an electronic device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory, in order to implement the adaptive federated learning defense method that balances privacy protection and Byzantine robustness as described in the first aspect embodiment.

[0017] To achieve the above objectives, a fourth aspect of this application proposes a non-transitory computer-readable storage medium storing a computer program that, when executed by a processor, implements the adaptive federated learning defense method that balances privacy protection and Byzantine robustness as described in the first aspect embodiment.

[0018] The embodiments of the present invention have the following beneficial effects: It effectively solves the model drift problem caused by local differential privacy, significantly improving training convergence stability and efficiency. Combining dual geometric screening and a three-dimensional reputation evaluation mechanism, it achieves precise defense against covert Byzantine attacks, enhancing the robustness of the global model while ensuring adaptive privacy protection. Attached Figure Description

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating an adaptive federated learning defense method that balances privacy protection and Byzantine robustness, provided as an embodiment of the present invention; Figure 2 A flowchart of another adaptive federated learning defense method that balances privacy protection and Byzantine robustness provided in an embodiment of the present invention; Figure 3 This is a structural diagram of an adaptive federated learning defense device that balances privacy protection and Byzantine robustness, provided as an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0022] The adaptive federated learning defense method and apparatus that balances privacy protection and Byzantine robustness, according to embodiments of the present invention, are described below with reference to the accompanying drawings.

[0023] Example 1 This invention provides an adaptive federated learning defense method that balances privacy protection and Byzantine robustness, such as... Figure 1 As shown, the method includes the following steps: S1, the server initializes the global model and establishes a historical state queue. The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the update data generated by local training.

[0024] To balance privacy and model training efficiency during federated learning, this application achieves precise privacy protection by initializing the server to establish a benchmark and using two indicators on the client to perceive the convergence status, and adaptively adjusting the noise intensity.

[0025] In this embodiment, the server first undertakes the initialization work at the start of the process, completing the unified configuration of global related parameters and the establishment of the baseline, specifically including initializing the initial global model parameters. Meanwhile, a differential privacy budget is pre-configured and set. Momentum decay factor and directional correction strength Core control parameters, through standardized parameter preset methods, lay a solid foundation for the smooth and orderly implementation of subsequent rounds of federal training and the entire closed-loop defense process.

[0026] In this embodiment, while the server completes parameter initialization, it simultaneously builds and maintains a global historical state queue. This queue is specifically used to continuously record the complete update trajectory and parameter evolution process of the global model during multiple iterations. In this embodiment, the historical trajectory data stored in the queue can serve as an important reference benchmark for evaluating the consistency and rationality of each client's model update in subsequent rounds, effectively constraining the evolution trend of the client's local update, ensuring that the model update of each client always closely follows the global optimal learning direction, and avoiding disordered update behavior that deviates from the global consensus.

[0027] In this embodiment, after each client node receives the global model parameters for the current round from the server, it carries out an independent model training task based on its own local private dataset. Through local iterative training, it generates exclusive local model update data, providing a basic data source for subsequent upload and aggregation.

[0028] In this embodiment, before the client prepares to upload local update data to the server and perform privacy noise injection, this application introduces and enables a convergence-aware dynamic noise scaling mechanism as an LDP privacy protection layer, which is also one of the core adaptive control mechanisms of this application. It can achieve dynamic collaborative optimization and balance between privacy and security protection and federated learning training efficiency.

[0029] In this embodiment, the client sequentially calculates two key quantitative evaluation indicators. The first is the global model stability indicator, which is calculated by solving the global model parameters in the current round. Compared with the global model parameters in the previous round The L2 norm of the difference between them is obtained, and the expression is: It is used to quantitatively characterize the overall convergence degree and steady-state change trend of the global model.

[0030] In this embodiment, the second item is a deviation index of the local model from the global consensus, which is obtained by solving the local model parameters of the previous round. With the global model parameters of the current round The L2 norm of the difference between them is obtained, and the expression is: It is used to accurately quantify the deviation between the client's local model update trajectory and the global unified learning consensus.

[0031] In this embodiment, the client combines the calculated global model stability index and local model deviation index to dynamically solve for the convergence sensing factor. This factor can simultaneously characterize the convergence speed of the global model and the degree of deviation from local updates of a single client, providing a core criterion for subsequent adaptive adjustment of the noise coefficient. In this embodiment, the client updates the noise scaling coefficient using an exponential smoothing iterative method. The iterative calculation formula used is:

[0032] in, This is a preset adjustment coefficient used to control the weight of the convergence perception factor on the noise figure. and Nested functions are used to evaluate convergence-perceived factors. Upper and lower limit truncation constraints are applied to limit it to a reasonable range of 0.1 to 2.0 to prevent the convergence perception factor from having extreme values, thereby avoiding the adverse effects of abnormal fluctuations in the noise scaling factor on privacy protection and model training accuracy.

[0033] In this embodiment, the designed dynamic noise scaling mechanism has good adaptive and adaptive control characteristics. When the global model is detected to be gradually approaching the convergence steady state, the system will automatically increase the noise scaling coefficient to enhance the privacy protection strength and perform stronger privacy masking on sensitive data at the model boundary, effectively preventing the risk of leakage of user privacy information. In this embodiment, when a large deviation is detected between the local model update of the client and the global consensus, the system will appropriately reduce the noise injection intensity to reduce the interference of noise on the effective model parameters, prioritize the learning convergence efficiency of the federation as a whole, and avoid problems such as model training lag and convergence stagnation caused by excessive noise.

[0034] In this embodiment, the client finally applies adaptive Gaussian noise superposition and privacy injection processing to the locally trained model update data based on the noise scaling factor after the iterative update is completed, so as to obtain noisy local update data after privacy protection, which lays the foundation for the subsequent construction of local update direction vector and global evolution trend vector.

[0035] S2: The client extracts local and global model parameters from the current and historical multiple rounds, constructs local update direction vectors and global evolution trend vectors, and uses the global evolution trend vectors to perform direction correction processing on the updated data after injecting noise.

[0036] To eliminate model drift caused by privacy noise, this application constructs a dual vector based on four historical states and combines cosine similarity for parameter-level correction, ensuring that the local update direction aligns with the globally optimal training path.

[0037] In this embodiment, since noise injection may cause "model drift" in local updates, that is, the local update direction deviates from the global optimal path, affecting the overall training effect, this application specifically sets up a four-fold historical state direction correction algorithm (as the core algorithm) before uploading update data to the client. The core purpose is to eliminate the adverse effects of noise, ensure that the local update direction is consistent with the global learning direction, and ensure the uniformity and effectiveness of model training.

[0038] In this embodiment, the client first extracts four key historical state data from local storage, which are the local model parameters of the current round. Parameters of the local model in the previous round Previous round global model parameters and the global model parameters of the first two rounds These four key parameters can comprehensively reflect the update trajectory of the local model and the evolution trend of the global model, providing solid data support for subsequent orientation calibration, ensuring that the correction operation is systematic and based on evidence, and avoiding deviations caused by blind calibration.

[0039] In this embodiment, the client constructs two core vectors based on four extracted key historical state data, laying the foundation for direction correction. Specifically, the direction vector is locally updated. It is calculated from the difference between the local model parameters of the current round and the local model parameters of the previous round, that is:

[0040] This vector directly reflects the update direction of the client's local model; global evolution trend vector. It is calculated from the difference between the global model parameters of the previous round and the global model parameters of the previous two rounds, that is:

[0041] This vector serves as a "compass" for the global learning direction, clarifying the overall direction of model training.

[0042] In this embodiment, the client further calculates the local update direction vector. With global evolution trend vector The cosine similarity in the parameter space of each network layer is used to intuitively determine the directional consistency between the two updates—higher similarity indicates a better alignment between the local update direction and the global evolution trend; lower similarity indicates greater influence of noise on the local update and a more significant directional deviation. Subsequently, a parameter-level angle matrix is ​​constructed based on the calculated cosine similarity.

[0043] in, Let be the angle between the two vectors. To ensure the correction intensity is consistent with the previous correction intensity, the standard for correction must be uniform and consistent.

[0044] In this embodiment of the application, the client uses a global evolution trend vector. As a calibration benchmark, a quadruple historical state correction algorithm is executed, combined with a parameter-level angle matrix, to accurately calibrate the direction of the locally updated data after noise injection. This correction operation effectively corrects local update direction deviations caused by noise, ensuring that local updates always align with the globally optimal path and preventing "direction deviation" issues due to noise interference. After calibration, the client uploads the calibrated local update data to the server, completing all defense operations.

[0045] In this embodiment, a dual vector is constructed by extracting parameters from multiple rounds of historical models. Cosine similarity and parameter-level angle matrices are used to implement quadruple state correction, correcting model drift caused by noise and making local updates match the global evolution direction, thus laying the foundation for subsequent dual screening based on geometric distance and directional similarity.

[0046] S3, the server receives the updated data after orientation correction, performs dual filtering based on geometric distance and orientation similarity, and removes updated data with abnormal values ​​and orientation deviations.

[0047] To defend against outlier attacks and sign-flipping covert attacks in federated learning, this application uses dual geometric filtering based on distance and direction to eliminate anomalous updates, ensuring the authenticity and reliability of subsequent model aggregation data.

[0048] In this embodiment, after the server receives the model update data uploaded by each client and processed by orientation correction, in order to effectively resist various malicious behaviors such as outlier attacks and sign-flipping stealth attacks, this application actively enables a dual geometric screening and dynamic pruning mechanism to perform secondary screening and filtering on the collected client update data. This ensures from the source that the update data entering the subsequent aggregation calculation stage is valid and reliable, and avoids malicious abnormal data from interfering with the aggregation accuracy and training stability of the global model.

[0049] In this embodiment, the dual-screening mechanism designed in this application is executed sequentially in two dimensions. First, distance dimension filtering is performed, which is the first level of screening. In this embodiment, the server selects the geometric median as the reference center of the overall update distribution. The geometric median has good anti-outlier characteristics, can truly fit the overall evolution trend of the global model update, and is not easily swayed by individual abnormal node data.

[0050] In this embodiment, the server calculates the Euclidean distance between each client's uploaded updated data vector and the geometric median reference circle. Client updates with Euclidean distance values ​​exceeding a preset threshold are identified as outlier updates. In this embodiment, such outlier updates are mostly caused by malicious node attacks or client-side training anomalies. Directly participating in global aggregation would severely degrade model training performance. Therefore, the server directly removes these anomalous updates, completing the first layer of security filtering in the distance dimension.

[0051] In this embodiment, after distance-dimensional filtering and removing obviously anomalous outlier updates, directional-dimensional filtering, i.e., the second layer of screening, is performed. In this embodiment, the server uses the vector corresponding to the geometric median as the reference center vector, and calculates the directional similarity between the remaining legitimate client update vectors and the reference center vector one by one. Based on the magnitude of the directional similarity, it identifies whether the client has engaged in covert attacks such as sign flipping.

[0052] In this embodiment, such covert attacks deliberately tamper with the evolution direction of local model updates, making it completely contrary to the normal global evolution trend. The aim is to negate existing global learning results and disrupt the overall convergence process of federated learning. In this embodiment, the server uniformly classifies client update data with directional similarity below a preset angle threshold as covert attack updates and removes them, thus intercepting malicious interference data at the directional level.

[0053] In this embodiment, after a step-by-step dual screening along both the distance and direction dimensions, the server aggregates and retains client update data that simultaneously passes both screening criteria to form a valid dataset. In this embodiment, the update data in this dataset not only has a normal numerical distribution, but its update direction also highly aligns with the global evolution trend, possessing reliable qualifications to participate in aggregation. It can be directly used as standard input data for the subsequent three-dimensional reputation scoring assessment, thus completing the entire screening and defense execution process corresponding to step S3.

[0054] In this embodiment, distance filtering and directional similarity verification based on the geometric median are used for dual screening to remove outlier and covert attack update data, providing reliable input for subsequent reputation assessment.

[0055] S4: The server performs a three-dimensional reputation assessment of the filtered updated data based on consistency, quality, and contribution. It dynamically adjusts the aggregation weights based on the real-time attack intensity and integrates the weighted updated data into the global model.

[0056] To accurately assess the quality of client updates and adapt to different attack scenarios for model aggregation, this application adopts a three-dimensional reputation scoring combined with an attack intensity adaptive weighting strategy to construct a closed-loop defense link that balances privacy and security with model training performance.

[0057] In this embodiment, the server conducts in-depth quality identification and comprehensive evaluation of the client model update data retained after double screening. This application innovatively adopts a three-dimensional reputation scoring mechanism consisting of consistency, quality, and contribution, which comprehensively measures the credibility, compliance, and practical application value of each client update data from multiple levels, providing an objective and reliable quantitative judgment basis for the subsequent dynamic model aggregation process.

[0058] In this embodiment, the three-dimensional reputation scoring mechanism has a clear sub-item evaluation logic. The consistency score is mainly used to judge the degree of fit between the client's current round of update data and its own historical multi-round update trajectory. If the current update trend is consistent with the historical evolution trend, the consistency score is higher, and vice versa, thereby identifying whether the client's update behavior has an abnormal change.

[0059] In this embodiment of the application, the quality score focuses on the completeness and purity of the client's local training dataset, while also evaluating the reliability of the model update data itself trained on the dataset. The better the quality of the local dataset and the more the generated update data matches the global model training requirements, the higher the corresponding quality score will be.

[0060] In this embodiment, the contribution score focuses on the positive gain brought by the update data of a single client to the improvement of global model accuracy and generalization ability. Update data that can effectively promote the iterative optimization of global model performance will have a higher contribution score. In this embodiment, the server performs reasonable weighted fusion processing on the consistency score, quality score, and contribution score to calculate and generate an initial reputation score for each client. The higher the reputation score, the stronger the credibility of the update data of the corresponding client and the greater its actual value to global training.

[0061] In this embodiment, to adapt to various malicious attacks of varying strengths in a federated learning scenario, an adaptive weighted aggregation strategy based on real-time attack intensity adjustment is introduced. In this embodiment, the server senses and quantifies the attack intensity currently facing the system in real time. The corresponding adaptive temperature adjustment parameter is calculated based on the attack intensity value. This temperature parameter can flexibly adjust the uniformity of the aggregate weight distribution among clients.

[0062] In this embodiment, the server constructs an adaptive Softmax policy function by combining adaptive temperature adjustment parameters. The initial reputation scores obtained by each client are input into the policy function one by one, and the dynamic aggregation weight corresponding to each client in the current iteration round is calculated. In this embodiment, the adaptive aggregation strategy has strong scene adaptability. When the system faces a high-intensity malicious attack, the aggregation weights of each client will exhibit a smooth distribution, effectively preventing a single attacked client from having an excessively high weight and interfering with the global model aggregation effect. In this embodiment, when the attack intensity in the system's environment is relatively weak, the aggregation weights will automatically tilt and focus towards advantageous clients with high reputation scores and excellent updated data quality, thereby improving the aggregation convergence efficiency and overall training performance of the global model.

[0063] In this embodiment, the server performs a weighted summation operation on the effective model update data that has passed the double screening, according to the dynamically aggregated weights of each client that have been solved, and integrates the weighted and fused update parameters into the global model of the current round. In this process, a new round of global model is generated iteratively. This completes a single round of comprehensive security defense and model parameter aggregation process.

[0064] In this embodiment, the server synchronously records and updates the updated global model parameters to the global historical state queue, thus preserving benchmark data for operations such as convergence perception, consistency assessment, and direction correction in the next iteration process. This forms a complete closed-loop defense link that sequentially connects initialization, noise adjustment, direction correction, dual screening, and reputation aggregation.

[0065] In this embodiment of the application, through the continuous iterative operation of the entire closed-loop defense mechanism, the synergistic optimization of privacy protection and security anti-attack in federated learning scenarios can be achieved simultaneously, steadily improving the overall malicious attack resistance capability and user privacy protection performance of the LDPBR defense system.

[0066] Example 2 This invention provides an adaptive federated learning defense device 10 that balances privacy protection and Byzantine robustness, such as... Figure 3 As shown, the device includes: The initialization module 100 is used for the server to initialize the global model and establish a historical state queue. The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the update data generated by local training. The correction module 200 is used by the client to extract local and global model parameters from the current and historical multiple rounds, construct local update direction vectors and global evolution trend vectors, and use the global evolution trend vectors to perform direction correction processing on the updated data after injecting noise. The update module 300 is used by the server to receive the updated data after orientation correction, and to perform dual filtering based on geometric distance and orientation similarity to remove updated data with abnormal values ​​and orientation deviations. The fusion module 400 is used by the server to perform a three-dimensional reputation assessment of consistency, quality and contribution of the filtered updated data, dynamically adjust the aggregation weight based on the real-time attack intensity, and fuse the weighted updated data into the global model.

[0067] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0068] Example 3 To implement the methods of the above embodiments, the present invention also provides an electronic device, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the various steps of the methods described above.

[0069] Example 4 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0070] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0071] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0072] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. An adaptive federated learning defense method that balances privacy protection and Byzantine robustness, characterized in that, include: S1, the server initializes the global model and establishes a historical state queue. The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the update data generated by local training. S2, the client extracts the local model parameters and global model parameters of the current and historical multiple rounds, constructs the local update direction vector and the global evolution trend vector, and uses the global evolution trend vector to perform direction correction processing on the updated data after injecting noise; S3, the server receives the updated data after orientation correction, performs dual filtering based on geometric distance and orientation similarity, and removes updated data with abnormal values ​​and orientation deviations. S4: The server performs a three-dimensional reputation assessment of the filtered updated data based on consistency, quality, and contribution. It dynamically adjusts the aggregation weights based on the real-time attack intensity and integrates the weighted updated data into the global model.

2. The method according to claim 1, characterized in that, The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the locally trained update data, including: The client calculates the stability of the global model, which is the L2 norm of the difference between the global model parameters in the current round and the global model parameters in the previous round. The client calculates the deviation of the local model from the global consensus, and its value is the L2 norm of the difference between the local model parameters in the previous round and the global model parameters in the current round. The client calculates the convergence perception factor based on the stability of the global model and the deviation of the local model from the global consensus, and updates the noise scaling factor using the exponential smoothing formula. The exponential smoothing formula is that the noise scaling factor of the next round is equal to the momentum decay factor multiplied by the noise scaling factor of the current round plus the adjustment factor multiplied by the cutoff value of the convergence perception factor. The cutoff value is the result of comparing the convergence perception factor with the preset upper and lower limits. The client performs adaptive Gaussian noise adjustment on the locally trained update data based on the updated noise scaling factor to obtain the locally updated data with injected noise.

3. The method according to claim 1, characterized in that, The client extracts local and global model parameters from the current and historical multiple rounds, constructs a local update direction vector and a global evolution trend vector, and uses the global evolution trend vector to perform direction correction processing on the updated data after injecting noise, including: The client retrieves four historical state data from local storage: local model parameters of the current round, local model parameters of the previous round, global model parameters of the previous round, and global model parameters of the two rounds before that. The client calculates the local update direction vector based on the local model parameters of the current round and the local model parameters of the previous round, and calculates the global evolution trend vector based on the global model parameters of the previous round and the global model parameters of the two previous rounds. The client calculates the cosine similarity between the local update direction vector and the global evolution trend vector in the parameter space of each network layer, and constructs a parameter-level angle matrix. The client uses the global evolution trend vector as the orientation calibration benchmark, and combines it with the parameter-level angle matrix to perform a four-fold historical state correction algorithm on the noise-injected update data to generate orientation-calibrated local update data.

4. The method according to claim 1, characterized in that, The server receives the updated data after orientation correction and performs a dual screening based on geometric distance and orientation similarity to remove updated data with abnormal values ​​and orientation deviations, including: The server calculates the Euclidean distance between the updated data of each client and the reference center. Updates with Euclidean distances exceeding a preset distance threshold are marked as outliers with abnormal values ​​and removed, thus completing the first screening based on geometric distance. The server calculates the directional similarity between each client update vector and the reference center vector in the remaining update data, and marks the update data with a directional similarity lower than a preset angle threshold as a covert attack aimed at offsetting the global learning results and removes it, thus completing the second screening based on directional similarity. The server outputs an updated set of data that has passed both the first and second rounds of filtering, which serves as input data for subsequent three-dimensional reputation assessment.

5. The method according to claim 1, characterized in that, The server performs a three-dimensional reputation assessment of the filtered updated data based on consistency, quality, and contribution. It dynamically adjusts the aggregation weights according to the real-time attack intensity and integrates the weighted updated data into the global model, including: For each client update data that passes the screening, the server calculates its consistency score relative to the historical update trajectory, its quality score relative to the local dataset quality, and its contribution score relative to the global model improvement. The server weights and fuses the consistency score, quality score, and contribution score to generate an initial reputation score for each client, and calculates adaptive temperature adjustment parameters based on the real-time perceived attack intensity. The server uses the adaptive temperature adjustment parameters to construct a Softmax policy function, inputs the initial reputation score of each client into the Softmax policy function, and calculates the dynamic aggregation weight of each client in the current round of aggregation. The server performs a weighted summation operation on the filtered updated data based on the calculated dynamic aggregation weights, and then merges the weighted updated data into the global model to achieve dynamic aggregation that smoothly distributes weights during strong attacks and focuses on the weights of advantageous clients during weak attacks.

6. An adaptive federated learning defense device that balances privacy protection and Byzantine robustness, characterized in that, include: The initialization module is used by the server to initialize the global model and establish a historical state queue. The client dynamically calculates the noise scaling factor based on the convergence state of the global model and the local update deviation, and performs adaptive noise injection processing on the update data generated by local training. The bias correction module is used by the client to extract local and global model parameters from the current and historical multiple rounds, construct local update direction vectors and global evolution trend vectors, and use the global evolution trend vectors to perform orientation correction processing on the updated data after injecting noise. The update module is used by the server to receive the updated data after orientation correction, and to perform dual filtering based on geometric distance and orientation similarity to remove updated data with abnormal values ​​and orientation deviations. The fusion module is used by the server to perform a three-dimensional reputation assessment of the consistency, quality, and contribution of the filtered updated data, dynamically adjust the aggregation weights based on the real-time attack intensity, and fuse the weighted updated data into the global model.

7. An electronic device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-5.

Images