Secure federated learning method, device, medium, and product

Abstract

The present application relates to the technical field of artificial intelligence. Disclosed are a secure federated learning method, a device, a medium, and a product. In the present application, after receiving a model update gradient sent by each participant, a central server calculates a credibility score for each participant on the basis of a plurality of calculation indexes, i.e., the similarities between a model feature parameter set of each participant and model feature parameter sets of other participants, and the similarity between a last-layer neural network before global model training and the last-layer neural network after global model training; and the central server uses each credibility score as a basis for determining a weighting coefficient during the process of performing weighted aggregation update on the basis of the model update gradient of each participant, wherein a higher credibility score corresponds to a higher weighting coefficient. In addition, a weighting coefficient during weighted aggregation is determined by means of a credibility score, such that a participant with a low credibility score has no or little impact on the update of a global model, thereby defending against the attack of a poisoning model and improving the robustness of federated learning.

Description

Secure federated learning methods, equipment, media and products

[0001] Cross-references to related applications

[0002] This application is based on and claims priority to Chinese Patent Application No. 202411564315.9, filed on November 4, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of artificial intelligence technology, and in particular to a secure federated learning method, device, medium, and product. Background Technology

[0004] Currently, in practical applications, the hardware and software defense capabilities of local participants in federated learning vary widely. The aggregation algorithm of the central server is simple, and for information security reasons, the central server cannot obtain the local data of each participant for verification. This makes federated learning vulnerable to various attacks, including poisoning attacks. Poisoning attacks involve attackers maliciously modifying and adding data during training, disrupting the distribution of the local dataset, and sharing the poisoned gradient updates globally, thus reducing the performance of the global model. Poisoning attacks can be carried out through various methods such as adding incorrect training data, deleting existing training data, flipping the labels of existing data, and adding noise to the existing data. Poisoning attacks can be further divided into two categories: one targets local data, disrupting the distribution of the dataset and causing the original model to converge or fail to converge in the wrong direction (data poisoning); the other forges incorrect gradients during model gradient transmission (model poisoning). Current federated learning methods have poor robustness and are unable to effectively cope with model poisoning attacks, thus failing to guarantee that the final federated learning model has good performance.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide a secure federated learning method, device, medium, and product, addressing the technical problem of poor robustness in current federated learning methods.

[0007] To achieve the above objectives, this application proposes a secure federated learning method, which includes the following operations:

[0008] Receive the model update gradients sent by each participant in the federated learning process regarding the training of the global model;

[0009] The credibility score of each participant is determined, wherein the credibility score is calculated based on the similarity of the model feature parameter set with other participants, and the similarity of the final neural network before and after global model training.

[0010] The global model is weighted and aggregated based on the credibility scores of each participant and the model update gradients of each participant to obtain a new global model. In the weighted aggregation update process, the model update gradient of the participant with a higher credibility score has a higher weighting coefficient.

[0011] In addition, to achieve the above objectives, this application also proposes an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the operation of the secure federated learning method as described above.

[0012] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the operation of the secure federated learning method as described above.

[0013] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the operation of the secure federated learning method as described above. Attached Figure Description

[0014] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 is a flowchart of the first embodiment of the secure federated learning method of this application;

[0017] Figure 2 is a schematic diagram of the framework of federated learning in the secure federated learning method of this application;

[0018] Figure 3 is a flowchart of the second embodiment of the secure federated learning method in this application;

[0019] Figure 4 is a schematic diagram of the inverse hyperbolic tangent function in the secure federated learning method of this application;

[0020] Figure 5 is a schematic diagram of the device structure of the hardware operating environment involved in the secure federated learning method in this application embodiment.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] Currently, in practical applications, the hardware and software defense capabilities of local participants in federated learning vary widely. The aggregation algorithm of the central server is simple, and for information security reasons, the central server cannot obtain the local data of each participant for verification. This makes federated learning vulnerable to various attacks, including poisoning attacks. Poisoning attacks involve attackers maliciously modifying and adding data during training, disrupting the distribution of the local dataset, and sharing the poisoned gradient updates globally, thus reducing the performance of the global model. Poisoning attacks can be carried out through various methods such as adding incorrect training data, deleting existing training data, flipping the labels of existing data, and adding noise to the existing data. Poisoning attacks can be further divided into two categories: one targets local data, disrupting the distribution of the dataset and causing the original model to converge or fail to converge in the wrong direction (data poisoning); the other forges incorrect gradients during model gradient transmission (model poisoning). Current federated learning methods have poor robustness and are unable to effectively cope with model poisoning attacks, thus failing to guarantee that the final federated learning model has good performance.

[0025] The main solution of this application embodiment is: receiving model update gradients for training the global model sent by each participant in the federated learning process; determining the credibility score of each participant, wherein the calculation index of the credibility score includes the similarity of the model feature parameter set with other participants, and the similarity of the final neural network before and after training the global model; performing weighted aggregation update on the global model based on the credibility scores of each participant and the model update gradients to obtain a new global model, wherein the model update gradient of the participant with a high credibility score has a high weighting coefficient during the weighted aggregation update process.

[0026] In other words, after receiving the model update gradients sent by each participant, the central service provider in this embodiment calculates the credibility score of each participant based on multiple metrics, including the similarity of the model feature parameter sets with other participants and the similarity of the final neural network before and after global model training. These credibility scores are used as the basis for determining the weighting coefficients during the weighted aggregation update process based on the model update gradients of each participant; a higher credibility score corresponds to a higher weighting coefficient. It is understood that the composition of the model feature parameter sets is often very similar among normal participants, while there are significant differences between the composition of the model feature parameter sets of poisoned participants and normal participants. Furthermore, the changes in the updates of normal participants are not significant in each round of training; conversely, when a participant changes from normal to poisoned, the amount of change in its model update often changes significantly. Therefore, the similarity of the model feature parameter sets and the similarity of the final neural network before and after global model training are selected as credibility scoring metrics to measure the trustworthiness of participants from different perspectives, providing an accurate reference for avoiding attacks by poisoned models. Furthermore, by determining the weighting coefficients in the weighted aggregation through credibility scores, participants with high credibility scores receive high weighting coefficients, while participants with low credibility scores receive low weighting coefficients. This ensures that participants with low credibility scores (i.e., poisoning models) cannot influence or have minimal influence on the update of the global model, thereby resisting poisoning model attacks, improving the robustness of federated learning, and guaranteeing the performance of the model obtained from the final federated learning.

[0027] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a cloud platform, computer, mobile phone, etc., or an electronic device capable of realizing the above functions.

[0028] Based on this, this application provides a secure federated learning method. Referring to FIG1, it is a flowchart of the first embodiment of the secure federated learning method of this application.

[0029] In this embodiment, the secure federated learning method includes operations S10 to S30:

[0030] Operation S10 receives the model update gradients for training the global model from each participant in the federated learning process.

[0031] It should be noted that the implementing entity of the aforementioned secure federated learning method can be the central service provider in federated learning. Within the framework of federated learning, each participant receives model and parameter data from the central service provider without transmitting local data. They then update their models using their local data, and each participant sends the updated gradients to the central service provider for aggregation. The central service provider uses an aggregation algorithm to obtain an updated new model. In the next training round, the central service provider sends the new model or its parameters to each participant for a new round of iterative updates until the model converges. In this embodiment, the aforementioned secure federated learning method primarily targets and defends against attacks or poisoning that may occur during the federated learning process. Furthermore, the detection and defense implemented in this embodiment mainly focus on the stage where the central service provider aggregates the model update gradients sent by each participant for updating.

[0032] For example, during federated learning, the central service provider receives model update gradients from each participant regarding the training of the global model. Different participants can be different terminal devices or servers, and each participant stores different training samples locally. These training samples can be labeled image samples or text samples, etc., depending on the functionality of the global model, and will not be elaborated here. Taking one participant as an example, this participant can update the model parameters in the global model sent by the central service provider based on its locally stored training samples, obtaining the model update gradient corresponding to that participant. To ensure data security, when sending the model update gradient, the participant can first encrypt the gradient to obtain an encrypted result, and then send the encrypted result to the central service provider. After receiving the encrypted result, the central service provider decrypts it to obtain the model update gradient. Through this method, the central service provider can receive model update gradients from each participant regarding the training of the global model.

[0033] Operation S20: Determine the credibility score of each participant, wherein the credibility score calculation index includes the similarity of the model feature parameter set with other participants, and the similarity of the final layer neural network before and after global model training.

[0034] For example, after receiving the model update parameters sent by each participant, the central service provider can determine the credibility score of each participant. It should be noted that the credibility score of a participant is mainly used to identify whether a participant is abnormal, or whether the model update gradient sent by the participant is poisoned. Furthermore, the calculation indicators for a participant's credibility score can include the similarity of the model feature parameter sets of other participants, and the similarity of the final neural network layers of that participant with those of other participants. The higher the similarity of the model feature parameter sets, the higher the credibility score of the participant; similarly, the higher the similarity of the final neural network layers, the higher the credibility score of the participant. It is worth noting that in practical applications, the model feature parameter sets of models trained by normal participants are often similar, consisting of the model parameters that contribute the most and least to the model. Conversely, the composition of the model feature parameter sets corresponding to poisoned models is often different from that of normal participants. Therefore, in this embodiment, the similarity of the model feature parameter sets is selected as one of the indicators for calculating the credibility score. Furthermore, under normal circumstances, the changes in updates from normal participants during each training round are not significant (i.e., the gradient is not large). However, once a participant changes from normal to poisoning, the amount of change in its model updates will change considerably. This is because the purpose of poisoning is to cause the model to update in the wrong direction, so once poisoning occurs, the amount of model updates will change drastically. Moreover, in practical applications, the model parameter weight updates of the last layer of the neural network are more sensitive than those of other layers. Therefore, in this embodiment, the similarity of the last layer of the neural network before and after global model training is selected as one of the indicators for calculating the credibility score. These two indicator dimensions can measure the trustworthiness of participants from different perspectives, essentially providing an accurate reference for screening poisoned model participants or avoiding attacks from poisoned models. Additionally, in practical applications, the central service provider can use multi-threaded parallel processing to calculate the credibility score of each participant, thereby ensuring the aggregation and update speed of the global model.

[0035] Operation S30: Based on the credibility scores of each participant and the model update gradients of each participant, the global model is weighted and aggregated to obtain a new global model. In the weighted aggregation update process, the model update gradients of participants with higher credibility scores have higher weighting coefficients.

[0036] For example, after determining the credibility scores of each participant, the central service provider performs a weighted aggregation update of the global model based on the credibility of each participant and their model update gradients, resulting in a new global model. The weighted aggregation primarily involves adding weighting coefficients to the model update gradients of each participant during the aggregation process; the specific aggregation process can be found in existing solutions and will not be elaborated here. Furthermore, during the weighted aggregation update process, participants with higher credibility scores have higher weighting coefficients for their model update gradients, and vice versa. It is understandable that by using weighted aggregation, participants with low credibility scores (i.e., the "poisoning" model) can have little or no impact on the update of the global model, thus ensuring the robustness of federated learning.

[0037] In this embodiment, the central service provider receives model update gradients from each participant in the federated learning process regarding the training of the global model; determines the credibility score of each participant, wherein the credibility score is calculated based on the similarity of the model feature parameter sets with other participants, and the similarity of the final neural network before and after global model training; and performs weighted aggregation update on the global model based on the credibility scores of each participant and the model update gradients to obtain a new global model, wherein the model update gradient of a participant with a higher credibility score corresponds to a higher weighting coefficient during the weighted aggregation update process. That is, after receiving the model update gradients from each participant, the central service provider in this embodiment calculates the credibility score of each participant based on multiple metrics, including the similarity of the model feature parameter sets with other participants and the similarity of the final neural network before and after global model training. The credibility score is used as the basis for determining the weighting coefficient during the weighted aggregation update process based on the model update gradients of each participant, and a higher credibility score corresponds to a higher weighting coefficient. Understandably, since the composition of model feature parameter sets is often very similar among normal participants, while the composition of model feature parameter sets differs significantly between poisoned and normal participants, and the changes in model updates for normal participants are not substantial during each training round, conversely, the amount of change in model updates often changes significantly when a participant changes from normal to poisoned. Therefore, the similarity of model feature parameter sets and the similarity of the final neural network layers before and after global model training are selected as credibility scoring indicators to measure the trustworthiness of participants from different perspectives, providing an accurate reference for avoiding poisoned model attacks. Moreover, the weighting coefficients in the weighted aggregation are determined by the credibility score, so that participants with high credibility scores have high weighting coefficients, and participants with low credibility scores have low weighting coefficients. This ensures that participants with low credibility scores (i.e., poisoned models) cannot affect or have minimal impact on the updates of the global model, thereby resisting poisoned model attacks, improving the robustness of federated learning, and ensuring the performance of the final federated model.

[0038] Referring to Figure 2, which is a schematic diagram of the federated learning framework in this application, each participant updates the global model based on its local training sample set to obtain its local model. Each participant also sends the model update gradient used in generating the local model to the central service provider. The central service provider then calculates the scores of each participant based on different metrics to determine the weighting coefficients of the model update gradients of each participant. The central service provider performs weighted aggregation updates on the global model using the weighting coefficients and the model update gradients to obtain a new global model. Finally, the central service provider broadcasts the new global model to each participant.

[0039] In one feasible implementation, the credibility score calculation metric further includes model update gradient similarity, and the operation of determining the credibility score of each participant includes operations S21 to S24:

[0040] In operation S21, for any participant to be scored among the participants, the similarity of the model feature parameter set between the participant to be scored and the other participants is calculated to obtain the first similarity.

[0041] In step S22, calculate the similarity of the final neural network layer of the global model before and after training the global model of the participant to be scored, and obtain the second similarity.

[0042] In step S23, calculate the model update gradient similarity between the participant to be scored and other participants to obtain the third similarity.

[0043] Operation S24: Based on the first similarity, the second similarity, and the third similarity, generate a credibility score for the participant to be scored.

[0044] It should be noted that, in this embodiment, the credibility score calculation metrics include not only the similarity of model feature parameter sets with other participants and the similarity of the final neural network before and after global model training, but also the model update gradient similarity, which is used to detect Sybil attacks. Furthermore, in practical applications, the scoring process for each participant by the central service provider is basically the same. Therefore, in this embodiment, the scoring process of one participant to be scored will be used as an example, where the participant to be scored refers to the participant for which no credibility score has been generated.

[0045] For example, for any participant to be scored, the similarity of the model feature parameter sets between that participant and the other participants is calculated to obtain the first similarity. Here, the model feature parameter set of a participant consists of model parameters with different contributions (the contribution of a model parameter characterizes its influence on the model's output) obtained by training the global model locally on that participant. The model feature parameter set typically consists of model parameters with high contributions (e.g., those with contributions greater than a preset threshold or ranking among the top) and model parameters with low contributions (e.g., those with contributions less than a preset threshold or ranking among the bottom). After determining the model feature parameter set of each participant, the similarity between the model feature parameter set of the participant to be scored and the model feature parameter sets of the other participants is calculated. The average of these similarities is then calculated to obtain the first similarity.

[0046] Simultaneously, the central service provider can also calculate the similarity between the final neural networks of the global model before and after training the global model for the participant to be scored, thus obtaining a second similarity. For example, after training the global model, the participant to be scored can obtain the corresponding target model update gradient and send it to the central service provider. If the previous round of the global model (i.e., the aforementioned global model) is updated based on this target model update gradient, a local model can be obtained. Then, the model parameters of the final neural networks in the global model and the model parameters of the final neural networks in the local model are extracted for similarity calculation to obtain the aforementioned second similarity.

[0047] Similarly, the central service provider can directly calculate the similarity between the received model update gradients to obtain a third similarity. Furthermore, since different participants typically use different training samples, their model update gradients are usually not excessively similar. Therefore, in this embodiment, the central service provider can use the model similarity of the participant whose model update gradient is most similar to that of the participant to be evaluated as the aforementioned third similarity. It is worth noting that the obtained third similarity can be used to directly label whether the participant to be evaluated is a Sybil attack participant. For example, if the third similarity is greater than a preset similarity threshold, the participant to be evaluated can be labeled as a Sybil attack participant.

[0048] For example, after obtaining the first, second, and third similarities, the credibility score of the participant to be scored can be determined based on each similarity. Since the third similarity can directly determine whether it is a Sybil attack, if the third similarity is too high, i.e., greater than a preset similarity threshold, a credibility score can be directly assigned (e.g., assigning a preset low credibility score, indicating it is an attacker). Alternatively, if the third similarity is less than or equal to the preset similarity threshold, the credibility score can be determined based on the first and second similarities. For example, the first and second similarities can be directly added together, or a weighted average can be applied. Technical personnel can set the calculation method according to actual needs; no restrictions are placed here.

[0049] In one feasible implementation, the operation of calculating the similarity of the model feature parameter set between the participant to be scored and other participants to obtain the first similarity includes operations S211 to S212:

[0050] In operation S211, the contribution of each model parameter in the local model obtained by the participant to be scored through training the global model is determined, and a set of model feature parameters of the participant to be scored is generated based on the contribution. For any model parameter, the contribution of the model parameter is calculated by the weight of the model parameter in the model loss function and the update amount of the model parameter in the model update gradient used to update the local model. The types of model feature parameters in the set of model feature parameters include important model parameters and marginal model parameters. The higher the contribution of the model parameter, the higher the probability that it is regarded as an important model parameter, and the lower the contribution of the model parameter, the higher the probability that it is regarded as a marginal model parameter.

[0051] Operation S212: Calculate the model feature parameter set of the participant to be scored, and the similarity between the model feature parameter set of the participant and the model feature parameter set of the other participants, and generate the first similarity based on the similarity of each model feature parameter set.

[0052] For example, in calculating the first similarity, the central service provider can first calculate the contribution of each model parameter in the local model obtained by the participant to be scored from the global model. It should be noted that the neural network used in the global model of federated learning often has tens of thousands of parameters, each with different weights. In each iteration of the model, the gradient update size for each parameter is also different. The magnitude of the gradient update for a parameter represents its positive contribution to model convergence, and this contribution is related to the model weights and the gradient updated in each iteration. In a normal federated learning training system, the importance of parameters with the same parameters should be similar among normal participant models, because the output results of normal participant models for the same input are not significantly different. However, the importance of parameters with the same parameters differs greatly between poisoned participant models and normal participants, because the goal of a poisoning attack is to interfere with the normal convergence of the model. Whether it's data poisoning causing the poisoned participant model to converge in the wrong direction, or model poisoning modifying or falsifying the parameters of the poisoned participant model, a poisoning attack needs to make the parameter weights and gradients of the poisoned model different from those of the normal participant models. This is because the essence of a poisoning attack is to interfere with the normal convergence of the model by changing parameter weights and gradient updates. Therefore, this application selects model feature parameters from the perspective of model contribution to form a set, which is then used to calculate the first similarity.

[0053] To generate the set of model feature parameters for the participants to be scored based on their contribution, it is first necessary to determine the contribution of the model parameters to the model accuracy. The weights of the model parameters trained by the i-th participant in the t-th iteration in its loss function are represented by... This represents the global model parameters from the previous iteration, and defines the local model parameters to be updated in each iteration. For the nth model parameter, its contribution to the model can be defined as:

[0054] In the formula, [n] represents the nth model parameter. This indicates the amount of update to the model parameter n when forming the local model in the current iteration. This represents the weight of the model parameter n in the loss function used to train the local model. The larger the value of p[n], the more important the parameter is considered to be, i.e., the greater its contribution.

[0055] In addition, the model feature parameter set includes important model parameters and marginal model parameters. Important model parameters are model parameters with high contribution, that is, the higher the contribution of a model parameter, the higher the probability of it being regarded as an important model parameter. Marginal model parameters are model parameters with low contribution, that is, the lower the contribution of a model parameter, the higher the probability of it being regarded as a marginal model parameter.

[0056] For example, the relevant model parameters of the participants to be evaluated can be sorted based on their contribution, resulting in a contribution sequence of model parameters. The most important (important model parameters) and the least important (marginal model parameters) K parameters are then selected. The Top-K and Bottom-K model parameters from the contribution sequence are then combined to form a set of model feature parameters. (In practice, Top-K is typically the top 3% of the contribution sequence, and Bottom-K is the bottom 5%). It is worth noting that the set of model feature parameters for each participant is obtained using the same method described above, so it will not be repeated here.

[0057] Next, the model feature parameter set of the participant to be scored is calculated, and the similarity of the model feature parameter set between it and the model feature parameter sets of other participants is calculated. A first similarity score is then generated based on the similarity scores of each model feature parameter set. In this embodiment, the similarity between different model feature parameter sets can be quantitatively calculated using Jaccard similarity and Spearman similarity.

[0058] For example, the similarity of the model feature parameter sets between participant i and participant j is calculated using the following formula:

[0059] In the formula, The Jaccard similarity represents the key model parameters between participant i and participant j. The Jaccard similarity of the marginal model parameters between participant i and participant j is represented. The Spearman similarity of the marginal model parameters between participant i and participant j is represented. This represents the Spearman similarity of key model parameters between participant i and participant j.

[0060] It should be noted that the formula for calculating Jaccard similarity is... It means that the number of elements in the intersection of sets A and B divided by the number of elements in the union of sets A and B represents the similarity relationship between the two sets.

[0061] Spearman similarity utilizes the correlation between the ranks of element variables. Since our two sets are already sorted according to parameter importance, we need to find the intersection of the two participant parameter sets. We calculate the Spearman similarity by comparing the rank of these two intersection elements within their respective sets. The specific formula is as follows:

[0062] In the formula, di represents the difference between the ranks of the corresponding values ​​in variables xi and yi, where xi and yi are the values ​​of the i-th observation in variables X and Y, respectively. and are the average values ​​of variables X and Y, respectively; di is the rank difference, which is the difference between the ranks of the i-th observation in variables X and Y; and is the number of observations, i.e., the number of samples in the dataset.

[0063] For example, if sets A and B have a total of 3 elements, with one element being the same, and the element is ranked 2 in set A and 3 in set B, with a ranking difference of 1, then their Spearman similarity is:

[0064] After calculating the similarity of the model feature parameter sets between the participant to be scored and other participants using the above method, the first similarity can be obtained by averaging the similarity of each model feature parameter set. The formula for calculating the first similarity is as follows:

[0065] In the formula, The similarity of the set of model feature parameters between the local models of participant i and participant j is represented by Client, which represents the total number of participants in the training process. It is directly used as the first similarity score mentioned above.

[0066] In addition, to prevent collusion attacks with high similarity, we need to consider the similarity score between the new model and the previous global model, as shown in the following formula:

[0067] In the formula, Characterizes the similarity of the set of model feature parameters between participant i's local model and the previous round's global model. This is the overall score.

[0068] The global score and the similarity score of the model feature parameter sets among participants are combined (i.e., the combination of the two equations above) as follows:

[0069] At this point, the first similarity score of the participants to be rated can be obtained.

[0070] In one feasible implementation, the operation of calculating the similarity of the final layer neural network of the global model before and after training the global model of the participant to be scored, and obtaining the second similarity, includes operations S221 to S223:

[0071] Operation S221: Determine the first network parameters of the final layer neural network in the local model obtained by the participant to be scored from the global model, and determine the second network parameters of the final layer neural network in the global model.

[0072] Operation S222: By using the difference between the first network parameters and the second network parameters, the local update gradient of the final neural network of the participant to be scored during the training of the global model is obtained.

[0073] In operation S223, the similarity between the local update gradient and the second network parameters is calculated to obtain the second similarity.

[0074] It should be noted that when participants update the gradients of the global model during local training, the weight updates of the last layer of the neural network are more sensitive than those of other layers. The gradient updates of the last layer of the neural network obtained by normal participants and malicious participants in a poisoning attack often differ significantly; that is, the gradient update magnitude of the last layer of the neural network obtained by malicious participants is often larger. A second similarity can be obtained by comparing the parameters of the last layer of the participant's neural network with the weights of the last layer of the global model in the previous round and calculating cosine similarity.

[0075] For example, in the ResNet-18 neural network architecture, the last layer is a fully connected layer (FCL) that classifies the previous feature maps into the final output. The parameter weights of the fully connected layer affect the model's final classification of the input data and are important factors in the model's performance accuracy. We use cosine similarity to calculate the differences in gradient updates between the final neural network layers of different models.

[0076] First, cosine similarity is defined as: the dot product of two vectors (i.e., x and y in the following formula) divided by the product of the norms of the two vectors.

[0077] Based on the above cosine similarity calculation, the formula for calculating the second similarity is as follows:

[0078] In the formula, For the second network parameters of the final layer neural network in round t-1 or the previous round global model (i.e., the global model mentioned above; in addition, the new global model obtained by aggregation in subsequent operations is the global model of round t or the current round), Let be the first network parameter of the final layer neural network in the local model of the i-th participant in the t-th iteration.

[0079] in addition, Then, the i-th iteration in the t-th round represents the local update gradient of the final neural network participating in the training of the global model.

[0080] In one feasible implementation, the operation of calculating the model update gradient similarity between the participant to be scored and other participants to obtain the third similarity includes operations S231 to S232:

[0081] Operation S231: Calculate the model update gradient of the participant to be scored, and compare it with the model update gradient of the local model used by other participants to update the gradient.

[0082] Operation S232: The model with the highest similarity among the updated gradient similarities is taken as the third similarity.

[0083] It should be noted that the third similarity is mainly used for Sybil attack detection. A Sybil attack is an attack method that uses fake identities to forge model parameter gradients and disrupt the federated learning system. It achieves this by forging several fake model parameter gradient updates during model aggregation, uploading them along with the gradient updates of other normal participants to the global model aggregation, thereby affecting the normal convergence of the model. The model gradients of the Sybil attack-targeting models exhibit unusual similarity, and this embodiment uses this similarity to prevent Sybil attacks.

[0084] For example, model update mentions from all participants can be collected to construct the gradient matrix, as follows:

[0085] In the formula, The model update for the nth participant in round t of training is mentioned.

[0086] In this embodiment, cosine similarity can also be used to represent the similarity between the gradient updates of different models. The calculation method is to multiply the gradient matrix by its transpose, as follows: MatrixSim = MatrixGrads × MatrixGrads T

[0087] In the MatrixSim matrix, the (m,n)th element represents the cosine similarity between the gradient of the m-th participant model and the gradient of the n-th participant model. The maximum value in each column represents the cosine similarity between the gradient update of a participant model and the gradient updates of other participant models connected to it (excluding the similarity with itself): SybilSim = Max(MatrixSim, axis = 1).

[0088] In the formula, the value of SybilSim represents the highest similarity among the model update gradient similarities between a participant and other participants (i.e., the third similarity of that participant). It also represents the probability that the participant may be a Sybil attacker. When the similarity of the model update gradients of two participants exceeds a certain threshold, we consider that the degree of similarity between the two exceeds the maximum similarity probability of normal model update gradients, and judge it as a suspicious Sybil attack. Accordingly, its weight is assigned to 0 in the subsequent poisoning model defense stage.

[0089] In one feasible implementation, the operation of generating a credibility score for the participant to be scored based on the first similarity, the second similarity, and the third similarity includes operations S241 to S242:

[0090] In operation S241, if the third similarity is less than or equal to a preset threshold, the credibility score of the participant to be scored is calculated based on the first similarity and the second similarity.

[0091] In operation S242, if the third similarity is greater than a preset threshold, the preset low score representing the attacker is used as the credibility score of the participant to be scored.

[0092] For example, after calculating the scores given by the participants to be rated on the above three indicators, three scores w will be obtained. Cpa w CosSim w Sybilsim These are the first similarity, second similarity, and third similarity, respectively. In the score synthesis stage, the three scores can be synthesized first, for example, when w... Sybilsim If the score is below the maintenance threshold (i.e., the aforementioned preset threshold), the attacker is considered not a Sybil attacker, and the overall score is w. Agg That is, the above credibility score can be normalized using Min-Max normalization on w. Cpa and w CosSim Formed after processing and To get the result by adding them together, or you can directly use w. Cpa and w CosSim Add them together. Conversely, if its w Sybilsim The score is unusually high, suggesting a Sybil attacker. Overall score w Agg Assigning 0 means setting the score to the default low score, which also indicates that the participant being scored is an attacker.

[0093] Referring to Figure 3, a flowchart illustrating the second embodiment of the secure federated learning method proposed in this application, based on the first embodiment of the secure federated learning method of this application, is provided. Content in this embodiment that is the same as or similar to the above embodiments can be referred to the above description and will not be repeated hereafter. The operation of weighted aggregation and updating the global model based on the credibility scores of each participant and the model update gradients to obtain a new global model includes operations S31 to S34:

[0094] Operation S31: Perform a differentiation operation on the credibility scores of each participant to amplify the score differences between each participant and obtain the differentiated scores of each participant.

[0095] In operation S32, the weighting coefficients of each model update gradient are determined based on the differentiation scores of each participant and the preset score observation interval. The weighting coefficients of the model update gradients of participants whose differentiation scores are less than the lower bound of the preset score interval are the first weighting values, and the weighting coefficients of the model update gradients of participants whose differentiation scores are greater than the upper bound of the preset score interval are the second weighting values. The weighting coefficients of the model update gradients of participants whose differentiation scores are within the preset score interval are between the first weighting value and the second weighting value. The weighting coefficients of the model update gradients of participants whose differentiation scores are within the preset score interval are proportional to the differentiation scores, and the first weighting value is less than the second weighting value.

[0096] Operation S33: Based on the weighting coefficients of the update gradients of each model, perform overweighted calculation on the update gradients of each model to obtain the global model update gradient of the global model;

[0097] Operation S34 updates the global model based on the global model update gradient to obtain the new global model.

[0098] It should be noted that in this embodiment, a weighting coefficient will be set for each participant based on each credibility score. Furthermore, before setting the weighting coefficient, a differentiation operation will be performed on each credibility score to amplify the score differences between participants, thereby obtaining a differentiated score for each participant.

[0099] For example, in practical applications, the weighting coefficients can also be the learning rate λ. iThis represents the aggregation weight of the gradient updates of each model during aggregation by the central service provider. Participants with high scores have a higher global model learning rate towards them, while participants with low scores have a lower global model learning rate. In the early stages of training, normal participants may be mistakenly identified as poisoners. In the middle stages, due to the non-independent and identically distributed nature of the data, models of normal participants may have higher learning rates than other participants. To address this, this embodiment adds a differentiation function to further differentiate the score differences between normal participants and poisoners, while also maintaining an observation interval for a pruning function (i.e., the aforementioned preset score interval, including the lower bound and the upper bound). To penalize poisoners, the learning rate of models with scores below the lower bound is assigned 0, i.e., the aforementioned first weighting value is applied. Simultaneously, to reward the positive contributions of normal participants and accelerate model convergence, the learning rate of normal participants with scores above the upper bound is assigned 1, i.e., the aforementioned second weighting value is applied. For participants whose scores fall between the two, we call them participants within the observation interval. The aggregation learning rate (i.e., weighting coefficient) is directly replaced by the final differentiation score, which is between (0,1). The observation interval is set up to reduce the impact of misjudging normal participants as malicious participants who are poisoning others.

[0100] In a practical application example, Min-Max normalization is performed on each similarity score:

[0101] Normalization of the first similarity:

[0102] Normalization of the second similarity:

[0103] The sum of the first and second similarities is then normalized again using Min-Max.

[0104] The sum of the first and second similarities:

[0105] The summation result is then normalized:

[0106] SybilSim score detection: if the third similarity score is higher than the threshold, it is considered a Sybil attack and assigned a weight of 0.

[0107] Threshold determination: If SybilSim[i]>0.99995

[0108] Weight assigned to 0:

[0109] Furthermore, the differentiation function used for the differentiation operation described above can be the inverse hyperbolic tangent arctanh function, yielding a differentiation score. The inverse hyperbolic tangent function further differentiates the score gaps between participants, causing already high scores to rise even higher, thus reducing the penalty for benign participants and facilitating the convergence of the global model towards a benign model. The formula for the inverse hyperbolic tangent function is as follows:

[0110] In the formula, Let i be the credibility score for the i-th participant in round t. The differentiation score is given to the i-th participant in the t-th round.

[0111] Referring to Figure 4, the formula for the inverse hyperbolic tangent function in this application is shown. In Figure 4, the vertical axis represents the differentiation score, and the horizontal axis represents the credibility score. The differentiation score ranges from (0, +∞). Malicious participants with low differentiation scores need to be clipped, which can be done using a Clip function. The Clip function maintains a preset score observation interval (Lower Bound, Upper Bound). Let Upper Bound be 0.5 and Lower Bound be 0.25. For independent variables with a value greater than or equal to 0.5, the output weight coefficient is 1; for those less than or equal to 0.25, the output weight coefficient is 0. The threshold interval is set to (0.25, 0.5).

[0112] In the formula, For the i-th participant in the t-th round, the i-th differentiation score is... Let be the weight coefficient of the i-th participant in the t-th round.

[0113] The final global model aggregation is as follows:

[0114] In the formula Let be the weight coefficient of the i-th participant in the t-th round. Update the gradient for the model of the i-th participant in round t. For the global model in round t-1, This is the global model for round t (i.e., the new global model mentioned above).

[0115] It is understandable that, since the credibility score of each participant is calculated from three indicators in the embodiments of this application, and a weighted coefficient for each participant is set according to the credibility score and participates in the aggregation, the limitation that the proportion of attacker models cannot be too high when using the Krum algorithm alone, and the proportion of attacker models cannot be too low when using the FoolsGold algorithm alone can be broken, thus increasing the robustness of defense against attacks in the federated learning process.

[0116] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the secure federated learning method in Embodiment 1 above.

[0117] Referring to Figure 5 below, a schematic diagram of a suitable electronic device for implementing embodiments of this application is shown. The electronic device in the embodiments of this application may include, but is not limited to, mobile terminals such as computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as computers. The electronic device shown in Figure 5 is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0118] As shown in Figure 5, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although electronic devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0119] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0120] The electronic device provided in this application employs the secure federated learning method described in the above embodiments, thus addressing the technical problem of poor robustness in current federated learning methods. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the secure federated learning method provided in the above embodiments, and other technical features of this electronic device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0121] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0122] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0123] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the secure federated learning method described in the above embodiments.

[0124] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0125] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0126] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by an electronic device, cause the electronic device to:

[0127] The system receives model update gradients from each participant in the federated learning process regarding the training of the global model; determines the credibility score of each participant, wherein the credibility score is calculated based on the similarity of the model feature parameter sets with other participants, and the similarity of the final neural network layers before and after global model training; and performs a weighted aggregation update on the global model based on the credibility scores of each participant and the model update gradients to obtain a new global model, wherein the model update gradient of a participant with a higher credibility score has a higher weighting coefficient during the weighted aggregation update process.

[0128] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0130] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0131] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described secure federated learning method, thus addressing the technical problem of poor robustness in current federated learning methods. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the secure federated learning method provided in the above embodiments, and will not be repeated here.

[0132] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the operation of the secure federated learning method described above.

[0133] The computer program product provided in this application can solve the technical problems of secure federated learning. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as the beneficial effects of the secure federated learning method provided in the above embodiments, and will not be repeated here.

[0134] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A secure federated learning method, the secure federated learning method comprising the following steps: Receive the model update gradients sent by each participant in the federated learning process regarding the training of the global model; The credibility score of each participant is determined, wherein the credibility score is calculated based on the similarity of the model feature parameter set with other participants, and the similarity of the final neural network before and after global model training. The global model is weighted and aggregated based on the credibility scores of each participant and the model update gradients of each participant to obtain a new global model. In the weighted aggregation update process, the model update gradient of the participant with a higher credibility score has a higher weighting coefficient.

2. The secure federated learning method as described in claim 1, wherein, The credibility score calculation metric also includes model update gradient similarity, and the operation of determining the credibility score of each participant includes: For any one of the participants to be scored, calculate the similarity of the model feature parameter set between the participant to be scored and the other participants to obtain the first similarity. Calculate the similarity of the final neural network layer of the global model before and after training the global model for the participants to be scored, and obtain the second similarity. Calculate the model update gradient similarity between the participant to be scored and other participants to obtain the third similarity. Based on the first similarity, the second similarity, and the third similarity, a credibility score is generated for the participant to be scored.

3. The secure federated learning method as described in claim 2, wherein, The operation of calculating the similarity of the model feature parameter set between the participant to be scored and other participants to obtain the first similarity includes: The contribution of each model parameter in the local model obtained by the participant to be scored through training the global model is determined, and a set of model feature parameters of the participant to be scored is generated based on the contribution. For any model parameter, the contribution of the model parameter is calculated by the weight of the model parameter in the model loss function and the update amount of the model parameter in the model update gradient used to update the local model. The types of model feature parameters in the set of model feature parameters include important model parameters and marginal model parameters. The higher the contribution of the model parameter, the higher the probability that it is regarded as an important model parameter, and the lower the contribution of the model parameter, the higher the probability that it is regarded as a marginal model parameter. Calculate the model feature parameter set of the participant to be scored, and the similarity between the model feature parameter set of the participant and the model feature parameter set of the other participants, and generate the first similarity based on the similarity of each model feature parameter set.

4. The secure federated learning method as described in claim 2, wherein, The operation of calculating the similarity of the final neural network layer of the global model before and after training the global model for the participant to be scored, and obtaining the second similarity, includes: Determine the first network parameters of the final layer neural network in the local model obtained by the participant to be scored training the global model, and determine the second network parameters of the final layer neural network in the global model; By using the difference between the first network parameters and the second network parameters, the local update gradient of the final neural network of the participant to be scored during the training of the global model is obtained; The similarity between the local update gradient and the second network parameters is calculated to obtain the second similarity.

5. The secure federated learning method as described in claim 3, wherein, The operation of calculating the model update gradient similarity between the participant to be scored and other participants to obtain the third similarity includes: Calculate the model update gradient of the participant to be scored, and compare it with the model update gradient of the local model used by other participants to update the gradient. The highest similarity among the gradient similarities of each model update is taken as the third similarity.

6. The secure federated learning method as described in claim 2, wherein, The operation of generating a credibility score for the participant to be scored based on the first similarity, the second similarity, and the third similarity includes: If the third similarity is less than or equal to a preset threshold, then the credibility score of the participant to be scored is calculated based on the first similarity and the second similarity. If the third similarity is greater than a preset threshold, the preset low score representing the attacker will be used as the credibility score of the participant to be scored.

7. The secure federated learning method as described in claim 1, wherein, The operation of weighted aggregation and updating the global model based on the credibility scores of each participant and the model update gradients to obtain a new global model includes: The credibility scores of each participant are differentiated to amplify the score differences between them, resulting in differentiated scores for each participant. The weighting coefficients of each model update gradient are determined based on the differentiation scores of each participant and a preset score observation interval. The weighting coefficients of the model update gradients of participants whose differentiation scores are less than the lower bound of the preset score interval are the first weighting values, and the weighting coefficients of the model update gradients of participants whose differentiation scores are greater than the upper bound of the preset score interval are the second weighting values. The weighting coefficients of the model update gradients of participants whose differentiation scores are within the preset score interval are between the first weighting value and the second weighting value. The weighting coefficients of the model update gradients of participants whose differentiation scores are within the preset score interval are proportional to the differentiation scores, and the first weighting value is less than the second weighting value. The global model update gradient is obtained by over-weighting the update gradients of each model based on the weighting coefficients of each model update gradient. The global model is updated based on the global model update gradient to obtain the new global model.

8. The secure federated learning method as described in claim 3, wherein, The calculation of the similarity of the model feature parameter set includes: The similarity between different sets of model feature parameters is quantified using Jaccard similarity and Spearman similarity, wherein the Jaccard similarity is used to calculate the set similarity between the important model parameters and the marginal model parameters, and the Spearman similarity is used to calculate the rank similarity of the intersection elements within their respective sets.

9. The secure federated learning method as described in claim 2, wherein, The calculation of the similarity of the final layer neural network includes: The similarity between the final neural network parameters of the participant to be scored and the final neural network parameters of the global model is calculated using cosine similarity.

10. The secure federated learning method as described in claim 2, wherein, The calculation of the gradient similarity for model updates includes: Construct a gradient matrix, and calculate the product of the gradient matrix and its transpose using cosine similarity to obtain a similarity matrix. The maximum value of each column in the similarity matrix is ​​used as the third similarity of the participants to be scored.

11. The secure federated learning method as described in claim 6, wherein, The operation of generating a credibility score for the participant to be scored based on the first similarity, the second similarity, and the third similarity includes: The first similarity and the second similarity are subjected to Min-Max normalization, and the normalized results are summed to obtain a comprehensive score; and / or If the third similarity is greater than a preset threshold, the preset low score representing the attacker will be assigned as the credibility score of the participant to be scored, and the score will be 0.

12. The secure federated learning method as described in claim 7, wherein, The weighted aggregation update also includes: The credibility score is differentiated using the inverse hyperbolic tangent function to amplify the score differences.

13. The secure federated learning method as described in claim 12, wherein, The determination of the weighting coefficients also includes: The differentiation score is clipped using the Clip function. A preset score observation interval is defined. The weight coefficient of the participant whose differentiation score is greater than the upper limit of the score observation interval is 1, and the weight coefficient of the participant whose differentiation score is less than the lower limit of the score observation interval is 0.

14. The secure federated learning method as described in claim 1, further comprising: When calculating the similarity of the model feature parameter set, the similarity score between the participant to be scored and the previous round of global model is taken into account.

15. The secure federated learning method as described in claim 14, further comprising: The first similarity score of the participant to be scored is obtained by combining the similarity score between the participant to be scored and the global model in the previous round with the similarity score of the model feature parameter set of each participant.

16. The secure federated learning method as described in claim 1, wherein, The secure federated learning method is executed by the central service provider in the federated learning process. Within the framework of federated learning, each participant receives model and parameter data from the central service provider without transmitting local data. They then use the local data to update the model. Each participant then transmits the updated gradient to the central service provider for aggregation. The central service provider uses an aggregation algorithm to obtain an updated new model. In the next training round, the central service provider sends the new model or its parameters to each participant for a new round of iterative updates until the model converges.

17. The secure federated learning method as described in claim 16, wherein, The weighting coefficient can also be a learning rate, used to characterize the aggregation weight of the gradient update of each model when the central service provider aggregates. The global model of the participant with the higher credibility score has a higher learning rate, and the global model of the participant with the lower credibility score has a lower learning rate.

18. An electronic device comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to perform the operation of secure federated learning as claimed in any one of claims 1 to 17.

19. A storage medium, being a computer-readable storage medium, wherein a computer program is stored on the storage medium, and the computer program, when executed by a processor, performs the operation of secure federated learning as described in any one of claims 1 to 17.

20. A computer program product comprising a computer program that, when executed by a processor, implements the operation of secure federated learning as claimed in any one of claims 1 to 17.

Images