CN118316699B - Malicious client detection method, device, electronic device and storage medium for encrypted federated learning - Google Patents

Abstract

The present invention belongs to the technical field of artificial intelligence, and specifically relates to a malicious client detection method and device for encrypted federated learning. The method includes: calculating the clipping threshold of the current iteration round based on the client gradient of the historical iteration round, and adaptively clipping the gradients of all clients according to the clipping threshold to obtain the intermediate gradient; adding Gaussian noise to the intermediate gradient to obtain the target gradient and upload it to the server; adding an index to each dimensional element of the target gradient, and using a linear regression algorithm to calculate the residual of each dimensional element of the target gradient to calculate the confidence of each dimensional element of the target gradient, so as to screen out the benign gradients in all target gradients according to the confidence; aggregating the benign gradients, and broadcasting the obtained global gradients to all clients for gradient update. The present invention solves the technical problem that when the federated learning system is performing local training, potential malicious clients generate malicious behaviors that affect model training.

Description

Malicious client detection method, device, electronic device and storage medium for encrypted federated learning

Technical Field

The present invention belongs to the technical field of artificial intelligence, and more specifically, relates to a malicious client detection method, device, electronic device and storage medium for encrypted federated learning.

Background Art

With the advent of the information age, machine learning has gradually changed people's way of life and production, and has made great progress in speech, image and text recognition, language translation and other aspects. At the same time, with the rapid development of artificial intelligence technology, data privacy and security have become major issues worldwide. Faced with the "data island" phenomenon that restricts the development of artificial intelligence and data privacy and security issues, federated learning, as a new type of distributed machine learning technology, has emerged. It does not require large-scale data transmission and sharing. Each data holder can achieve collaborative modeling locally to improve the effect of artificial intelligence models. It is an effective way to solve the above problems and has important research value and practical application significance.

However, in practical applications, federated learning also has some security risks. During the training process, some clients may behave maliciously and dishonestly. They may tamper with local model parameter updates and try to influence the global model update direction, resulting in a decrease in federated learning performance. In the face of these malicious behaviors of clients, some measures need to be taken to ensure the security and robustness of the model to ensure the stability and reliability of the federated learning system.

For example, Chinese patent document CN117113413A discloses a robust federated learning privacy protection system based on blockchain. By adding an additional small communication overhead, the gradient on the blockchain is privacy protected in plain text. The impact on model performance is theoretically lower than differential privacy, and it can expand the existing robust aggregation algorithm to defend against attacks from malicious clients. The three aggregation algorithms Krum, Sim and TD are modified, and a new aggregation algorithm SD is proposed to apply these four aggregation methods to the system. The scheme proposed in the present invention has dynamically adjustable privacy protection capabilities, is robust against malicious attacks, and when considering privacy protection, the modified three Byzantine aggregation methods have higher performance than the original ones.

Chinese patent document CN117077806A discloses a differential privacy federated learning method based on random election verification blockchain. The design method is as follows: First, the decentralization of blockchain is utilized to build a federated learning system based on identity authentication blockchain. Secondly, a random selection mechanism is used to determine the verification leader node to ensure the fairness of the verification node block generation, and the verification node anomaly detection mechanism is used to defend against malicious node attacks to ensure the accuracy of the global model. Finally, differential privacy is used to protect the security of the local model, and an incentive mechanism is designed according to the degree of contribution of the node to the model to encourage the node to train a high-quality model, thereby improving the accuracy of the global model.

The above method achieves data privacy protection by defending against attacks from malicious clients, but malicious clients still exist. Therefore, when the federated learning system is locally trained, detecting and eliminating potential malicious clients to deal with the impact of malicious behavior has become one of the urgent issues to be solved.

In addition, federated learning introduces a large number of gradient interactions, which are not only threatened by model users like centralized training, but may also be attacked by untrusted clients. Attackers use gradients to infer specific features or certain statistical characteristics in the client's local data set, thereby restoring the original data and leaking data privacy. Therefore, in the context of federated learning, effectively protecting the client's local training gradients to deal with privacy leaks caused by malicious attacks has become one of the issues that people are widely concerned about.

Summary of the invention

The present invention aims to overcome at least one defect of the above-mentioned prior art and provide a malicious client detection method for encrypted federated learning, with the purpose of detecting and eliminating clients with malicious behavior in the federated learning process and ensuring the security of the gradient interaction process.

The present invention also provides a device for implementing the malicious client detection method for encrypted federated learning.

The detailed technical scheme of the present invention is as follows:

A malicious client detection method for encrypted federated learning, the method comprising:

S1. Calculate the clipping threshold of the current iteration round based on the client gradient of the historical iteration round, and adaptively clip the gradients of all clients participating in federated learning according to the clipping threshold of the current iteration round to obtain the clipped intermediate gradient;

S2. Introduce a differential privacy mechanism, add Gaussian noise to the clipped intermediate gradient, obtain the target gradient injected with noise, and upload the target gradient to the server participating in federated learning;

S3, adding an index to each dimension element of the target gradient of all clients to form a two-dimensional point set, and using the Repeated Median linear regression algorithm to calculate the residual of each dimension element of the target gradient, and calculating the confidence of each dimension element of the target gradient according to the residual, and calculating the gradient score of each dimension element according to the confidence, and screening out the benign gradients in all target gradients according to the sum of the scores of all elements of the target gradient of each client;

S4. Aggregate the selected benign gradients to obtain a global gradient, and broadcast the global gradient to all clients for gradient update.

Preferably, in step S1, the _L2 norm of each client gradient in t rounds of iteration is calculated, and the p percentile of the historical gradient _L2 norm is selected as the clipping threshold in the current iteration round, that is:

In formula (1), _Ct represents the clipping threshold in the tth iteration, represents the _L2 norm of the i-th historical client gradient calculated in the t-th iteration, p is the percentage of the clipping threshold selection, and 0≤p≤1.

Preferably, according to the present invention, in step S1, the gradients of all clients are clipped according to the clipping threshold in the current iteration round, and the clipped intermediate gradient is:

In formula (2), Represents the intermediate gradient after clipping of the i-th client in the t-th iteration.

Preferably, according to the present invention, in step S2, Gaussian noise is added to the clipped intermediate gradient to obtain a target gradient of injected noise:

In formula (3), represents the target gradient of the noise injected by the i-th client in the t-th iteration, represents Gaussian noise with a mean of zero and a variance of σ ² C _t ² , where represents Gaussian distribution, σ ² represents variance, and I is the identity matrix.

Preferably, in step S3, the residual of each dimensional element of the target gradient is calculated using a Repeated Median linear regression algorithm, which specifically includes:

Generate a linear regression equation y=κ+ξx based on a two-dimensional point set;

The Repeated Median linear regression algorithm is used to estimate the slope ξ and intercept κ of the linear regression equation, namely:

In formula (4) and (5), denote the n-th dimension element of the target gradient of the j-th client and the i-th client respectively, denotes the index of the n-th dimension element of the target gradient of the j-th client and the i-th client, respectively, where i,j∈{1,2,…,m}, m is the number of clients;

Calculate the residual of each dimension element of all client target gradients. For the n-th dimension element, the residual is:

r _n ←y _n -κ-ξx _n (6);

In formula (6), r _n represents the residual of the n-th dimension element of the client objective gradient.

Preferably, in step S3, the confidence of each dimensional element of the target gradient is calculated according to the residual, and the gradient score of each dimensional element is calculated according to the confidence, and the benign gradients in all target gradients are screened out according to the sum of the scores of all elements of the target gradient of each client, which specifically includes:

Normalize the residuals of each dimension element of all client target gradients, take the absolute value of the residuals of each dimension element of the client target gradient and calculate the median gradient, for the n-th dimension element, expressed as

In formula (7), The median gradient of the absolute value of the residual of the n-th dimension element of the client objective gradient;

The median gradient is scaled by a constant γ with the number of clients m The scaling result is expressed as:

In formula (8), a is the adjustment constant, and a=5;

Normalize the residual r _n and divide the residual r _n by the scaling result τ _n , that is:

In formula (9), _en represents the residual normalization result of the n-th dimension element of the client target gradient;

According to the residual normalization result of each dimension element of the client target gradient, the confidence of each dimension element is calculated:

In formula (10), w _n represents the confidence of the n-th dimension element of the client target gradient, H _n represents the projection matrix of the index x _n of the n-th dimension element of the client target gradient, diag(H _n ) represents the vector composed of the diagonal elements of the projection matrix H _n , Ψ represents the confidence interval, and Ψ(x)=max(-Z,min(Z,x)), λ is a hyperparameter;

According to the confidence of each dimension element of the client target gradient, the score of each dimension element is calculated:

In formula (11), represents the score of the n-th dimension element of the client target gradient, σ( _wn ) represents the standard deviation of the confidence of the n-th dimension element of the client target gradient;

Based on the score of each dimension element of the client's target gradient, the sum of the scores of all elements of each client's target gradient is calculated:

In formula (12), W ^(k) represents the sum of the scores of all elements of the target gradient of the kth client, and N represents the number of all elements of the target gradient of the kth client;

According to the sum of the scores of all elements of each client's target gradient, the benign gradients among all target gradients are screened out.

Preferably, according to the present invention, in step S4, the selected benign gradients are aggregated to obtain a global gradient as follows:

In formula (13), represents the global gradient obtained in the tth iteration, m is the number of clients, and f is the number of malicious clients;

The global gradient is broadcast to all clients for gradient update, that is:

In formula (14), g ^t+1 represents the client gradient of the t+1th round, and η is the learning rate.

In another aspect of the present invention, a device for implementing a malicious client detection method for encrypted federated learning is provided, the device comprising:

The clipping module is used to calculate the clipping threshold of the current iteration round based on the client gradient of the historical iteration round, and adaptively clip the gradients of all clients participating in the federated learning according to the clipping threshold of the current iteration round to obtain the clipped intermediate gradient;

A noise injection module is used to add Gaussian noise to the clipped intermediate client gradient to obtain a target client gradient injected with noise, and upload the target client gradient to a server participating in federated learning;

A calculation module, used to add an index to each dimensional element of all target client gradients to form a two-dimensional point set, and use the Repeated Median linear regression algorithm to calculate the residual of each dimensional element of the target client gradient, calculate the confidence of each dimensional element of the target client gradient based on the residual, and calculate the gradient score of each dimensional element based on the confidence, and screen out the benign gradients in all target gradients based on the sum of the scores of all elements of each client target gradient;

The aggregation module is used to aggregate the selected benign client gradients to obtain a global gradient, and broadcast the global gradient to all clients for gradient update.

In another aspect of the present invention, there is also provided an electronic device, comprising:

at least one processor; and

A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the malicious client detection method for encrypted federated learning as described above.

In another aspect of the present invention, a machine-readable storage medium is provided, which stores executable instructions, and when the instructions are executed, the machine executes the malicious client detection method for encrypted federated learning as described above.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention provides a malicious client detection method for encrypted federated learning. By adding Gaussian noise that satisfies the differential privacy mechanism to the client gradient, malicious attackers cannot infer relevant information of the original data, thereby protecting data privacy. At the same time, in order to detect malicious behavior of the client during training and improve the reliability of the federated learning system, the present invention adopts a Repeated Median linear regression algorithm to calculate the residual and confidence of the corresponding gradient, and then scores each client gradient according to the calculation result, and judges the gradients with lower scoring values as malicious gradients and eliminates them. The remaining benign gradients participate in the aggregation calculation to ensure the security of the gradient interaction process.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a malicious client detection method for encrypted federated learning according to the present invention.

Figure 2 is a topological diagram of the federated learning system.

FIG3 is a schematic diagram showing how the test accuracy of the method of the present invention varies with the number of training rounds.

FIG. 4 is a schematic diagram showing how the test accuracy of the method of the present invention varies with the number of malicious clients.

DETAILED DESCRIPTION

The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and/or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and/or combinations thereof.

In the absence of conflict, the embodiments in the present disclosure and the features in the embodiments may be combined with each other.

In view of the problems existing in the prior art, the present invention provides a malicious client detection method for encrypted federated learning, which aims to detect and eliminate clients with malicious behaviors in the federated learning process and ensure the security of the gradient interaction process.

Malicious clients can seriously affect data security and model performance. To reduce the risk of data privacy leakage, the present invention adds Gaussian noise that satisfies the differential privacy mechanism to the client gradient, so that malicious attackers cannot infer relevant information of the original data, thereby protecting data privacy. To detect malicious behavior of the client during training and improve the reliability of the federated learning system, the present invention adopts a Repeated Median linear regression algorithm to calculate the residual and confidence of the corresponding gradient, and then scores the gradients of each client according to the calculation results. The gradients with lower scoring values are judged as malicious gradients and eliminated, and the remaining benign gradients participate in the aggregation calculation.

The malicious client detection method and device for encrypted federated learning of the present invention are described in detail below in conjunction with specific embodiments.

Embodiment 1,

Referring to Figure 1, this embodiment provides a malicious client detection method for encrypted federated learning, which is applied to a federated learning system. Referring to Figure 2, the federated learning system includes two types of entities, a client and a server, and multiple clients communicate with a single server.

The method comprises:

S1. Calculate the clipping threshold of the current iteration round based on the client gradient of the historical iteration round, and adaptively clip the gradients of all clients participating in federated learning according to the clipping threshold of the current iteration round to obtain the clipped intermediate gradient.

This embodiment designs an adaptive gradient clipping method to adaptively clip the gradient sizes of all clients within a reasonable threshold, thereby preventing any single local update from excessively affecting the global model update and causing a gradient explosion problem.

Specifically, assume that the federated learning system has m clients (P ₁ ,P ₂ ,…,P _m ), corresponding to m local training datasets D _i (i＝1,2,…,m). Assume that there are f malicious clients, which attempt to upload meaningless or malicious client gradients to prevent the correct convergence of the global model.

First, the client _Pi receives the global gradient from the server in the previous round Use its local dataset _Di to train its local model and obtain its client gradient for round t Each client gradient contains n elements (ie, a vector).

In the differential privacy mechanism, gradient clipping is crucial. If the gradient clipping threshold is set too large, it will introduce too much unnecessary noise, thus affecting the model performance; if the gradient clipping threshold is set too small, there is a risk of exposing too much gradient information.

Based on this, the method of this embodiment adopts an adaptive method to clip the gradient. The specific process is as follows.

First, calculate the _L2 norm of each client gradient in t rounds of iterations, and select the p percentile of the historical gradient _L2 norm as the clipping threshold of the current iteration, that is:

In formula (1), _Ct represents the clipping threshold in the tth iteration, represents the _L2 norm of the i-th historical client gradient calculated in the t-th iteration, p is the percentage of the clipping threshold selection, and 0≤p≤1.

Then, the gradients of all clients are clipped according to the obtained clipping threshold _Ct , and the intermediate gradient after client clipping is obtained as:

In formula (2), Represents the intermediate gradient after clipping of the i-th client in the t-th iteration.

The above adaptive clipping method can predict the change of the gradient in the current iteration according to the change trend of the client's historical gradient, and determine the appropriate gradient clipping threshold accordingly, which can effectively prevent the impact of excessive gradients on model updates. In addition, this method only needs to specify the clipping percentage and will not expose the original gradient information, thereby better protecting privacy.

S2. Introduce a differential privacy mechanism, add Gaussian noise to the clipped intermediate gradient, obtain the target gradient injected with noise, and upload the target gradient to the server participating in federated learning.

In order to prevent the leakage of local privacy data, security measures need to be taken to effectively protect the gradients before the client uploads the gradients obtained from its local training to the server.

The method in this embodiment introduces a differential privacy mechanism to the intermediate gradient after the client is clipped Adding Gaussian noise, the target gradient of injected noise is:

In formula (3), represents the target gradient of the noise injected by the i-th client in the t-th iteration, represents Gaussian noise with a mean of zero and a variance of σ ² C _t ² , where represents Gaussian distribution, σ ² represents variance, and I is the identity matrix.

Then inject the noise into the target gradient Upload to the server for secure aggregation.

By adding Gaussian noise to the clipped client gradient, the client gradient is protected from inference attacks during the communication iteration process, effectively protecting the client gradient and local data and reducing the risk of privacy leakage.

S3. Add an index to each dimensional element of the target gradient of all clients to form a two-dimensional point set, and use the Repeated Median linear regression algorithm to calculate the residual of each dimensional element of the target gradient, calculate the confidence of each dimensional element of the target gradient based on the residual, and calculate the gradient score of each dimensional element based on the confidence, and screen out the benign gradients in all target gradients based on the sum of the scores of all elements of the target gradient of each client.

In this embodiment, in order to identify malicious behaviors during training, detect and remove malicious clients, a malicious client detection and removal method based on Repeated Median linear regression is designed under the protection of differential privacy mechanism. The specific process is as follows.

First, the server sorts each dimension element of the target gradient of all received clients in ascending order, descending order, or sequential order, etc. Here, ascending order is preferred. The nth dimension element of the target gradient of the i-th client is represented as

Then add an index to each dimension element of the target gradient of all sorted clients Finally, a two-dimensional point set (x ⁿ , y ⁿ ) is formed. In this embodiment, the index can be set to a positive integer from 1 to N.

Exemplarily, assume that there are 3 clients, and the target gradient of each client contains 2 elements, namely: client 1, element n1 = [2.5, 3.1]; client 2, element n2 = [1.7, 4.2]; client 3, element n3 = [0.9, 2.8].

The elements of each dimension of the target gradients of all clients are sorted in ascending order, and the elements of the first dimension after sorting are [0.9, 1.7, 2.5], and the elements of the second dimension are [2.8, 3.1, 4.2].

Add an index to each dimension element of the target gradient of all sorted clients, and set the index of each dimension element to: [1, 2, 3]. The resulting two-dimensional point set is {(1, 0.9), (2, 1.7), (3, 2.5), (1, 2.8), (2, 3.1), (3, 4.2)}.

Based on the two-dimensional point set ( ^xn , ^yn ) obtained above, a linear regression equation y=κ+ξx is generated. Then the server uses the Repeated Median linear regression algorithm to estimate the slope ξ and intercept κ of the linear regression equation, namely:

In formula (4) and (5), denote the n-th dimension element of the target gradient of the j-th client and the i-th client respectively, denotes the index of the n-th dimension element of the target gradient of the j-th client and the i-th client, respectively, where i,j∈{1,2,…,m}, m is the number of clients.

After that, the residual of each dimension element of all client target gradients is calculated. For the n-th dimension element, the residual is:

r _n ←y _n -κ-ξx _n (6);

In formula (6), r _n represents the residual of the n-th dimension element of the client objective gradient.

In this embodiment, the confidence of each dimensional element of the target gradient is calculated according to the residual, and the gradient score of each dimensional element is calculated according to the confidence. According to the sum of the scores of all elements of the target gradient of each client, the benign gradients in all target gradients are screened out, specifically including:

First, the residual of each dimension of the client target gradient is normalized.

Since the residuals of different elements are not easy to compare, the residuals need to be normalized. Take the absolute value of the residual of each dimension element of the client target gradient and calculate its median gradient. For the n-th dimension element, it is expressed as

In formula (7), Represents the median gradient of the absolute value of the residual of the n-th dimension element of the client objective gradient.

The median gradient is scaled by a constant γ with the number of clients m The scaling result is expressed as:

In formula (8), a is an adjustment constant, and a=5, and the adjustment constant can be set.

Normalize the residual r _n and divide the residual r _n by the scaling result τ _n , that is:

In formula (9), _en represents the residual normalization result of the n-th dimension element of the client target gradient.

The above process obtains the residual normalization results of each dimensional element of all client target gradients, ensuring that the residuals are adjusted according to their typical amplitudes and scale factors, making them more comparable between different elements.

Then, the server calculates the confidence of each dimension of each client's target gradient based on the residual normalization result of each dimension of the element:

In formula (10), w _n represents the confidence of the n-th dimension element of the client target gradient, H _n represents the projection matrix of the index x _n of the n-th dimension element of the client target gradient, diag(H _n ) represents the vector composed of the diagonal elements of the projection matrix H _n , Ψ represents the confidence interval, and Ψ(x)=max(-Z,min(Z,x)), λ is a hyperparameter.

Then, according to the confidence of each dimension element of the client target gradient, the score of each dimension element is calculated:

In formula (11), represents the score of the n-th element of the client objective gradient, and σ(·) represents the standard deviation of the confidence of the n-th element of the client objective gradient.

Based on the score of each dimension element of the client's target gradient, the sum of the scores of all elements of each client's target gradient is calculated:

In formula (12), W ^(k) represents the sum of the scores of all elements of the target gradient of the kth client, and N represents the number of all elements of the target gradient of the kth client.

Finally, all clients are sorted in ascending order according to the sum of the scores of all elements of the target gradients of all m clients. The first f clients with lower scores are regarded as malicious clients and eliminated. The remaining m-f clients are retained as benign clients, and the target gradients of the benign clients will be used as benign gradients in the aggregation calculation.

S4. Aggregate the selected benign gradients to obtain a global gradient, and broadcast the global gradient to all clients for gradient update.

That is, the target gradients of m-f benign clients with higher scores are finally aggregated as benign gradients to obtain the global gradient:

In formula (13), Represents the global gradient obtained in the tth iteration.

Finally, the global gradient Broadcast to all clients to update local model gradients:

In formula (14), g ^t+1 represents the client gradient of the t+1th round, and η is the learning rate.

In this embodiment, the MNIST dataset is used, and the convolutional neural network model CNN is adopted to test the test accuracy under the label flipping attack. The results are shown in Figures 3 and 4.

FIG3 is a schematic diagram showing how the test accuracy of the method of this embodiment varies with the number of training rounds. It can be seen that the method still has a high test accuracy under attack, indicating that the method has detected and removed malicious clients, verifying the effectiveness of the method.

FIG4 is a schematic diagram showing how the test accuracy of the method of this embodiment varies with the number of malicious clients. It can be seen that as the number of attackers increases, the test accuracy remains at a relatively high standard, indicating that the method has better performance when the number of malicious clients increases.

Embodiment 2,

This embodiment provides a device for implementing a malicious client detection method for encrypted federated learning, the device comprising:

The clipping module is used to calculate the clipping threshold of the current iteration round based on the client gradient of the historical iteration round, and adaptively clip the gradients of all clients participating in the federated learning according to the clipping threshold of the current iteration round to obtain the clipped intermediate gradient;

A noise injection module is used to add Gaussian noise to the clipped intermediate client gradient to obtain a target client gradient injected with noise, and upload the target client gradient to a server participating in federated learning;

A calculation module, used to add an index to each dimensional element of all target client gradients to form a two-dimensional point set, and use the Repeated Median linear regression algorithm to calculate the residual of each dimensional element of the target client gradient, calculate the confidence of each dimensional element of the target client gradient based on the residual, and calculate the gradient score of each dimensional element based on the confidence, and screen out the benign gradients in all target gradients based on the sum of the scores of all elements of each client target gradient;

The aggregation module is used to aggregate the selected benign client gradients to obtain a global gradient, and broadcast the global gradient to all clients for gradient update.

Embodiment 3,

This embodiment also provides an electronic device, including:

at least one processor; and

A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the malicious client detection method for encrypted federated learning as described above.

In this embodiment, the electronic device may include, but is not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, and the like.

Embodiment 4,

This embodiment also provides a machine-readable storage medium storing executable instructions, which, when executed, enable the machine to execute the malicious client detection method for encrypted federated learning as described above.

Specifically, a system or device equipped with a readable storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer or processor of the system or device can read and execute instructions stored in the readable storage medium.

In this case, the program code itself read from the machine-readable medium can realize the function of any one of the above embodiments, and thus the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification.

Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer or a cloud via a communication network.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present invention is described with reference to the flowchart and/or block diagram of the method, device (system), and computer program product according to the embodiment of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims (8)

1. A malicious client detection method for encryption federal learning, the method comprising:

S1, calculating a clipping threshold value of a current iteration round based on client gradients of historical iteration rounds, and adaptively clipping gradients of all clients participating in federal learning according to the clipping threshold value of the current iteration round to obtain clipped intermediate gradients;

the client gradient calculation method based on the historical iteration round comprises the following steps of:

Calculating the L ₂ norm of each client gradient in the t-round iteration, and selecting the p percentile of the L ₂ norm of the historical gradient as a clipping threshold in the current iteration round, namely:

In equation (1), C _t represents the clipping threshold in the t-th round of iteration, The L ₂ norm of the gradient of the history client of the ith round calculated in the iteration of the t round is represented, p is the clipping threshold selection percentage, and p is more than or equal to 0 and less than or equal to 1;

cutting the gradients of all the clients according to the cutting threshold value in the current iteration round, and obtaining the intermediate gradient after cutting as follows:

in the formula (2), the amino acid sequence of the compound, Representing the intermediate gradient of the ith client after clipping in the t-th iteration;

s2, introducing a differential privacy mechanism, adding Gaussian noise to the cut intermediate gradient to obtain a target gradient of injected noise, and uploading the target gradient to a server participating in federal learning;

S3, adding indexes to each dimension element of the target gradient of all clients to form a two-dimensional point set, calculating residual errors of each dimension element of the target gradient by using REPEATED MEDIAN linear regression algorithm, calculating confidence coefficient of each dimension element of the target gradient according to the residual errors, calculating gradient scores of each dimension element according to the confidence coefficient, and screening benign gradients in all target gradients according to the total scores of all elements of the target gradient of each client;

S4, aggregating the screened benign gradients to obtain global gradients, and broadcasting the global gradients to all clients for gradient updating.

2. The malicious client detection method for encrypted federal learning according to claim 1, wherein in the step S2, gaussian noise is added to the intermediate gradient after clipping, and a target gradient of injected noise is obtained as follows:

In the formula (3), the amino acid sequence of the compound, Representing the target gradient of noise injected by the ith client in the t-th iteration,Representing gaussian noise subject to zero mean, σ ²C_t ² variance, where,Representing gaussian distribution, σ ² representing variance, I being the identity matrix.

3. The method for detecting malicious clients facing encrypted federal learning according to claim 1, wherein in the step S3, a REPEATED MEDIAN linear regression algorithm is used to calculate a residual error of each dimension element of the target gradient, and the method specifically comprises:

generating a linear regression equation y=k+ζx based on the two-dimensional point set;

The slope ζ and intercept K of the linear regression equation are estimated using REPEATED MEDIAN linear regression algorithm, namely:

In the formulas (4) and (5), An nth dimension element representing a target gradient of the jth client and the ith client respectively, Index of the n-th dimension element representing the target gradient of the j-th client and the i-th client, respectively, where i, j e {1, 2..m }, m being the number of clients;

calculating the residual error of each dimension element of all client target gradients, wherein for the nth dimension element, the residual error is as follows:

r_n←yⁿ-κ-ξxⁿ (6)；

In equation (6), r _n represents the residual of the n-th dimension element of the client target gradient.

4. The method for detecting malicious clients facing encrypted federal learning according to claim 1, wherein in the step S3, a confidence level of each dimension element of the target gradient is calculated according to the residual error, a gradient score of each dimension element is calculated according to the confidence level, and benign gradients in all target gradients are screened out according to a total score of all elements of each client target gradient, specifically comprising:

Normalizing the residual error of each dimension element of all client-side target gradients, taking the absolute value of the residual error of each dimension element of the client-side target gradients and calculating the median gradient, and for the nth dimension element, representing as

In the formula (7), the amino acid sequence of the compound,A median gradient representing the residual absolute value of the n-th dimension element of the client target gradient;

scaling a median gradient with a constant gamma and the number of clients m The scaling result is expressed as:

in formula (8), a is an adjustment constant, and a=5;

The residual r _n is normalized, and the residual r _n is divided by the scaling result τ _n, namely:

In the formula (9), e _n represents the residual normalization result of the n-th dimension element of the client target gradient;

Calculating the confidence coefficient of each dimension element of the client target gradient according to the residual error normalization result of each dimension element:

In formula (10), w _n represents the confidence level of the n-th dimensional element of the client target gradient, H _n represents the projection matrix of index x ⁿ of the n-th dimensional element of the client target gradient, diag (H _n) represents the vector composed of diagonal elements of projection matrix H _n, ψ represents the confidence interval, and Lambda is a super parameter;

According to the confidence degree of each dimension element of the client target gradient, calculating the score of each dimension element:

In the formula (11), the amino acid sequence of the compound, A score representing the n-th dimension element of the client target gradient, σ (w _n) representing the standard deviation of the confidence of the n-th dimension element of the client target gradient;

Calculating a scoring sum of all elements of the target gradient of each client based on the scoring of each dimension element of the target gradient of the client:

in the formula (12), W ^(k) represents the sum of scores of all elements of the target gradient of the kth client, and N represents the number of all elements of the target gradient of the kth client;

and screening out benign gradients in all target gradients according to the scoring sum of all elements of the target gradients of each client.

5. The method for detecting malicious clients facing encrypted federal learning according to claim 1, wherein in the step S4, the screened benign gradients are aggregated to obtain a global gradient as follows:

In the formula (13), the amino acid sequence of the compound, Representing global gradient obtained in the t-th iteration, wherein m is the number of clients, and f is the number of malicious clients;

Broadcasting the global gradient to all clients for gradient update, namely:

In the formula (14), g ^t+1 represents the client gradient of the t+1st round, and η is the learning rate.

6. An apparatus for implementing an encryption federal learning oriented malicious client detection method, the apparatus comprising:

The clipping module is used for calculating clipping thresholds of the current iteration rounds based on client gradients of the historical iteration rounds, and adaptively clipping gradients of all clients participating in federal learning according to the clipping thresholds of the current iteration rounds to obtain clipped intermediate gradients;

the client gradient calculation method based on the historical iteration round comprises the following steps of:

Calculating the L ₂ norm of each client gradient in the t-round iteration, and selecting the p percentile of the L ₂ norm of the historical gradient as a clipping threshold in the current iteration round, namely:

In equation (1), C _t represents the clipping threshold in the t-th round of iteration, The L ₂ norm of the gradient of the history client of the ith round calculated in the iteration of the t round is represented, p is the clipping threshold selection percentage, and p is more than or equal to 0 and less than or equal to 1;

cutting the gradients of all the clients according to the cutting threshold value in the current iteration round, and obtaining the intermediate gradient after cutting as follows:

in the formula (2), the amino acid sequence of the compound, Representing the intermediate gradient of the ith client after clipping in the t-th iteration;

The noise injection module is used for adding Gaussian noise to the cut intermediate gradient to obtain a target gradient of injected noise, and uploading the target gradient to a server participating in federal learning;

The computing module is used for adding indexes to each one-dimensional element of the target gradient of all clients to form a two-dimensional point set, calculating residual errors of each one-dimensional element of the target gradient by using REPEATED MEDIAN linear regression algorithm, calculating the confidence coefficient of each one-dimensional element of the target gradient according to the residual errors, calculating the gradient score of each one-dimensional element according to the confidence coefficient, and screening out benign gradients in all target gradients according to the total score of all elements of the target gradient of each client;

And the aggregation module is used for aggregating the screened benign gradients to obtain global gradients, and broadcasting the global gradients to all clients for gradient updating.

7. An electronic device, comprising:

at least one processor; and

A memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the encryption federal learning oriented malicious client detection method of any one of claims 1 to 5.

8. A machine-readable storage medium storing executable instructions that, when executed, cause the machine to perform the encryption federal learning oriented malicious client detection method of any one of claims 1 to 5.