Federated AI Model Poisoning Detection Via Distance Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communications systems face challenges in detecting model poisoning in artificial intelligence (AI) models, particularly in federated learning (FL) scenarios, where client-side data remains private and is susceptible to poisoning attacks, and current methods are computationally expensive or violate privacy regulations.
Innovation Solution
Implementing explainable AI (XAI) techniques to measure distance metrics between global and local models, apply thresholding, and generate poisoning scores to identify and mitigate model poisoning by reducing computational complexity and respecting data privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing model poisoning detection methods are used, then model poisoning can be detected, but computational complexity increases and data privacy is violated
Solution Approach 1:
The patent creates a simplified copy of the full model architecture (the skeleton model with placeholder nodes) that maintains the structural information needed for poisoning detection without requiring computation on the complete model. This copying approach reduces computational complexity while preserving detection capability.
Solution Approach 2:
The patent extracts only the essential structural information from the full model (node types, edge connections, architecture hierarchy) and uses this extracted information for poisoning detection. By taking out only the necessary structural elements and discarding redundant computational components, the system achieves low computational complexity while maintaining detection accuracy.
2Reliability
If existing model poisoning detection methods are used, then model poisoning can be detected, but data privacy is violated
Solution Approach 1:
The patent creates a structural copy of the model architecture that contains only topology information (nodes and edges) without any client-specific data. This copy allows poisoning detection to be performed on the architecture structure alone, completely preserving client data privacy while enabling accurate detection.
Solution Approach 2:
The patent extracts only the architectural structure from the model and uses this extracted structure for poisoning detection. By taking out solely the structural information and excluding all training data and client-specific parameters, the system achieves privacy preservation while maintaining detection capability.
3Measurement precision
If detailed model comparison is performed, then poisoning detection precision improves, but resource usage increases
Solution Approach 1:
The patent creates a lightweight copy of the model structure that can be compared between clients without requiring heavy computational resources. The skeleton model with placeholder nodes provides sufficient structural representation for precision detection while consuming minimal computational energy compared to full model comparison.
Solution Approach 2:
The patent changes the comparison parameters from full model parameter analysis to structural parameter comparison (node types, edge connections, architecture hierarchy). This parameter transformation enables high-precision detection focused on structural anomalies rather than exhaustive parameter analysis, significantly reducing computational resource usage.
Data Source
AI summary
Various aspects of the present disclosure relate to model poisoning detection for artificial intelligence models. An apparatus, such as a network equipment (NE), generates a first distance value based at least in part on a comparison of one or more first artificial intelligence models and one or more second artificial intelligence models. The NE compares the first distance value to a distance value threshold and generates a flag to initiate poisoning score detection based at least in part on whether the first distance value surpasses the distance value threshold. The NE generates one or more model poisoning scores based at least in part on comparison of the first artificial intelligence model and one or more third artificial intelligent models in training.