CN116502708A - Performance evaluation and committee voting-based Bayesian attack resistant DFL method - Google Patents

Abstract

The invention discloses a DFL method for resisting Bayesian and busy-court attacks based on performance evaluation and committee voting, wherein a main node CM is randomly selected based on a consensus algorithm of credibility, and the main node CM coordinates other participants to participate in model training; the privacy of parameters in the model training process is protected based on DP and secret random number disturbance; detecting a Bayesian node in a training node TN based on a performance evaluation mode; analyzing the secret random disturbance aggregate result to detect a bayer pattern node in the candidate node CN; and verifying the model of the aggregation of the master nodes CM based on a committee voting mechanism, and detecting whether the master nodes CM are Bayesian nodes. The invention can solve the problems of Bayesian attack and privacy protection under heterogeneous data distribution and the problem of model training failure caused by single point failure under a central federal learning system architecture. The invention improves the performance of the federal learning model and accelerates the convergence rate of federal learning.

Description

Byzantine Attack Resistant DFL Method Based on Performance Evaluation and Committee Voting

technical field

The invention belongs to the field of physics technology, and further relates to a non-centralized distributed federated learning DFL (Decentralized Federated Learning) method based on performance evaluation and committee voting in the field of electric digital data technology to resist Byzantine attacks. The invention can implement anti-Byzantine attack and model training for participants' privacy protection in DFL.

Background technique

Federated learning has shown excellent performance in traffic and medical scenarios, but in some federated learning scenarios, it is difficult for data owners to find a reliable third-party server as a central server for model aggregation, and due to the traditional centralized federated learning system There will be a single point of failure in the architecture, resulting in failure of model training. In decentralized federated learning, each node faces a more serious Byzantine attack problem because it is difficult for each node to verify the data sent by other nodes. For example, when the traditional central federated learning system architecture is used in autonomous driving scenarios, the problem of model training failure caused by Byzantine attacks is particularly prominent. In federated learning, even a small number of malicious participants can destroy the global training, resulting in serious traffic accidents. Accidents threaten the driver's safety. In engineering practice, the distribution characteristics of data collected by different intelligent vehicles present Non-Independent and Identical Distributed (Non-Independent and Identical Distributed), which leads to large differences in the knowledge shared by different training nodes and increases the difficulty of Byzantine node identification. In addition, even if the participants do not share the original data in the federated model training, the attacker can still deduce the user's private information through the shared model parameters or gradient updates, resulting in privacy leakage.

The University of Electronic Science and Technology of China proposed an anti-Byzantine attack based on cosine similarity in its patent document "A Federated Learning Method Against Byzantine Attacks for Protecting User Data Privacy" (Application No.: 202111589802.7, Application Publication No.: CN 114239862 A) federated learning method. In this method, the server is divided into two servers, each of which calculates the cosine similarity between the server model gradient and the local model gradient, calculates the credibility score according to the cosine similarity, and uses the obtained credibility score and the local model to aggregate the global model. The two servers cannot obtain the client's local data through their own data, protecting the user's data privacy. However, the disadvantage of this method is that the traditional central federated learning system architecture will have a single point of failure, which will easily lead to model training failure.

Che C et al. proposed the CMFL scheme in their paper "A decentralized federated learning framework via committee mechanism with convergence guarantee" (IEEE Transactions on Parallel and Distributed Systems, 2022, 33(12):4783-4800), which is based on the Considering the accuracy and robustness of the model, two selection strategies are designed. At the same time, the committee mechanism is designed to aggregate the local gradients uploaded by the training nodes by using the appropriate selection strategy, and update the committee members through the election strategy. However, the shortcomings of this method are: the method cannot resist the Byzantine attack under the non-IID data set, and the selection strategy based on the Euclidean distance score is not robust enough to face the Byzantine attack; secondly, the CMFL algorithm The training node uploads the plaintext information of the local gradient, and the committee node has the problem of privacy leakage when Byzantine detection and aggregation gradient.

Contents of the invention

The purpose of the present invention is to address the above-mentioned deficiencies in the prior art, and propose a DFL method based on performance evaluation and committee voting to resist Byzantine attacks, which is used to solve the model caused by single-point failure under the traditional central federated learning system architecture Training failure problem, while solving the Byzantine attack and privacy protection problems under heterogeneous data distribution.

The idea of realizing the purpose of the present invention is: Ouroboros, a consensus protocol based on credibility, randomly selects a master node CM (Current Master) in each round of iteration, and the master node CM coordinates other participants to participate in model training. Protect the privacy of parameters during model training based on DP and secret random number perturbation. After local training, each training node TN generates a secret random number perturbation with the same shape as the model parameters, and adds it to the local model to obtain the secret random number perturbation local model. The training node TN (Training Node) shares the generated secret random number perturbation to the candidate node CN (Candidate Node), thereby helping the master node CM recover the global model from the secret random number perturbation local model. Byzantine nodes in the training node TN are detected based on performance evaluation. The secret random perturbation aggregation results are analyzed to detect Byzantine nodes among candidate nodes CN. Finally, based on the committee voting mechanism, verify the correctness of the master node CM aggregation model, detect whether the master node CM is a Byzantine node, and ensure that all participants in the decentralized federated learning reach a consensus on the model update and Byzantine node detection results.

To achieve the above object, the concrete implementation steps of the present invention include as follows:

Step 1, generate a discriminative sample set for each participant:

Each participant in the model training randomly sends L small data samples, and each participant in the model training aggregates the received small data samples sent by other participants with its own small data samples to form the participant's discriminant sample set , where L≤3;

Step 2, randomly select the master node CM from the candidate master nodes CN, and the master node CM broadcasts the global model;

Step 3, the training nodes TN respectively use their own local data sets to train the global model to obtain their respective local models;

Step 4, the training node TN uses DP to generate a differentially private local model;

Step 5, the training node TN adds a secret random number perturbation item to each of its local models to obtain the secret random number perturbation local model of the training node TN;

Step 6, the master node CM detects Byzantine nodes based on the performance evaluation method:

The master node CM calculates the loss value of the differentially private local model of each training node TN on the discriminant sample set in the current round of iteration; the master node CM calculates the average loss of the differentially private local model of each training node TN in the current round of iteration value; the master node CM forms the benign node index set with the benign training nodes TN whose model loss value is less than the average loss value avglv and put benign index collections /> Send to candidate master node CN;

Step 7, the candidate master node CN aggregates the secret random disturbance item, and the master node CM updates the global model parameters:

Step 7.1, master node CM aggregates benign node index collection The secret random number in perturbs the local model to obtain the encrypted global model;

Step 7.2, the candidate master node CN receives the benign node index set sent by the master node CM Candidate master node CN will benign node index collection /> The secret random disturbance items sent by the corresponding training node TN are aggregated to obtain the secret random disturbance aggregation value R _k , and the candidate master node CN sends the secret random disturbance aggregation value R _k to the master node CM;

Step 7.3, after the master node CM receives the secret random disturbance aggregate value R _k , select the same and majority R _k as the secret random disturbance aggregate value R of the group of nodes, R=mode(R _k ), select the aggregate value The corresponding candidate master node CN node is a benign node, and the candidate master node CN that sends other aggregated values is regarded as a Byzantine node, where R represents the aggregate value of secret random disturbance, and mode( ) represents the mode operation;

In step 7.4, the master node CM subtracts the aggregated value R of the secret random disturbance from the encrypted global model to obtain the updated global model;

In step 7.5, the master node CM combines the loss value loss _i of the differential privacy local model of each training node TN and the secret random perturbation aggregation result R _k returned by the candidate master node CN node, and divides the training node TN into the following three trust states: When loss _i ∈ (0, avglv), the training node TN is a benign node, when loss _i ≥ avgle and R _k ≠ R, the training node TN is a Byzantine node, otherwise, the training node TN is a normal node;

Step 7.6, the master node CM updates the credibility and reputation of each training node TN;

Step 7.7, the master node CM broadcasts the global model to the system network;

Step 8, the candidate master node CN votes on the updated global model:

Step 8.1, each candidate master node CN calculates the loss value of the updated global model on the discriminant sample set;

Step 8.2, each candidate master node CN votes for the global model through the fluctuation threshold, if the absolute difference between the loss value of the updated global model calculated by the candidate master node CN on the discriminant sample set and the loss value of the previous iteration If the value does not exceed the fluctuation threshold, it indicates that the global model parameters are in the correct direction of convergence, and the candidate master node CN votes for the updated global model and broadcasts it to the system network; otherwise, the candidate master node CN broadcasts opposition in the system network information;

Step 8.3, if more than half of the candidate master nodes CN in the system network voted for the updated global model parameters, then judge the master node CM as a benign node, and execute step 8.4; otherwise, judge the master node CM as a Byzantine node, and reselect A master node CM, the master node CM broadcasts the global model, and performs step 3;

Step 8.4, the master node CM broadcasts the global model, the credibility and credibility of the training node TN to all nodes in the network, and the model training participants reach a consensus on the updated parameters;

Step 9, update the credibility and reputation of the master node CM, and select the new master node CM and candidate master node CN:

The master node CM selects x model training participants with high reputation as the candidate master node CN; in the candidate master node CN, a new master node CM is selected according to the consensus agreement of reputation; the new master node CM updates the master node of the previous round The credibility and reputation of CM, and broadcast it to the system network; the new master node CM broadcasts the global model;

Step 10, judge whether the global model is convergent, if so, go to step 11; otherwise, go to step 3;

Step 11, end the collaborative training and obtain the global model.

Compared with the prior art, the present invention has the following advantages:

First, the present invention is based on the performance evaluation on the discriminant sample set, the analysis of secret random disturbance aggregation results, and the committee voting mechanism to resist Byzantine attacks, which overcomes the shortcomings of Byzantine attacks under heterogeneous data distribution; enables the present invention to resist Non-IID data The Byzantine attack under the set ensures the availability of the centrally federated learning model.

Second, the present invention generates a differentially private local model and a secret random number perturbation local model based on DP and secret random perturbation, which overcomes the party’s privacy leakage caused by the original local model parameters obtained by the Byzantine node during the model training process in the prior art The problem makes the present invention protect the privacy of the intermediate parameters in the process of local model aggregation and Byzantine node identification. During the model training process, it can not only accurately identify the Byzantine nodes but also protect the private information of the participants, so as to realize the safe aggregation of model parameters and Accurate training of the model.

Description of drawings

Fig. 1 is a flowchart of the present invention.

Detailed ways

The implementation steps of the present invention will be further described below in conjunction with the accompanying drawing 1 and the embodiments.

There are 11 participants in model training of A, B, C, D, E, F, G, H, I, J, K in the embodiment of the present invention.

Step 1, generate a discriminative sample set for each participant.

Each participant in the model training randomly sends L small data samples, and each participant in the model training aggregates the received small data samples sent by other participants with its own small data samples to form the participant's discriminant sample set , where L≤3. In the embodiment of the present invention, participant A sends 10 data samples to 10 participants B, C, D, E, F, G, H, I, J, and K respectively, and A receives the A aggregates 10 data samples received from 10 participants and 10 data samples sent by A to form A’s discriminant sample set. The discriminant sample set contains a total of 110 The data sample and approximately conform to the IID distribution characteristics.

Step 2, randomly select the master node CM from the candidate master nodes CN, and the master node CM broadcasts the global model.

Step 2.1, randomly select one of all model training participants, and use the selected participant as the master node CM. The master node CM broadcasts the initialization parameters of the global model. Embodiments of the present invention select participant A as master node CM. Participant A builds a convolutional neural network. The structure of the network layers in series is: input layer, first convolutional layer, first pooling layer, second convolutional layer, second pooling layer, fully connected layer. Set the hyperparameters of the network structure and the size of the model parameters: set the number of neurons in the input layer to 28×28, set the window size of the first and second pooling layers to 2×2, and set the sliding step to 2, The convolution kernel sizes of the first and second convolutional layers are both set to 5×5, and the activation function is implemented using ReLu. The number of neurons in the output layer is set to 10, and the activation function is implemented using SoftMax. CM randomly initializes the weight matrix (the size of the model parameters) of each network layer. Participant A broadcasts the initialized global model to all training nodes TN. In all training nodes TN, the size of the model parameters is the same, and the size of the model parameters is different.

Step 2.2, from all participants except the master node CM, randomly select x nodes to form the candidate master node CN, x=n×α, where n represents the total number of model training participants, and a represents the candidate master node CN. The ratio of node CN to all model training participants, and 0<α<1. In the embodiment of the present invention, from participants B, C, D, E, F, G, H, I, J, and K other than participant A, four nodes B, C, D, and E are randomly selected to form Candidate master node CN.

In step 3, the training nodes TN use their own local data sets to train the global model to obtain their own local models.

Step 3.1, participants other than the master node CM form a training node TN. In the embodiment of the present invention, participants B, C, D, E, F, G, H, I, J, and K other than A form the training node TN.

Step 3.2, each training node TN updates its own local model with the received global model.

In step 3.3, each training node TN inputs its own local data set into its own local model, and uses the SGD gradient descent algorithm to perform τ rounds of iterations to obtain the optimal local model.

Step 4, the training node TN uses DP to generate a differentially private local model.

Step 4.1, each training node TN selects a privacy budget ε _i and a relaxation constant δ _i according to local privacy requirements, and the sensitivity of model parameters The standard deviation of the Gaussian noise is set to /> Among them, C is the clipping threshold of the local model parameters, and DS _i is the local data set of the i-th training node TN. In the embodiment of the present invention, the privacy budget ε _i is set to 0.01 by default, and the slack constant δ _i is set to 0.5 by default. The training node TN can set local appropriate privacy parameters according to the local privacy requirements. The smaller the privacy budget ε _{i is} , the generated Gaussian noise /> The larger the value, the higher the security, but the larger the noise is not conducive to the detection of Byzantine nodes. Therefore, the training node TN should set appropriate parameters according to the local privacy needs to prevent the added noise from being misjudged as a Byzantine node. At the same time, as long as the privacy requirements are met, the noise of the local model added by TN each time during training is independent.

Step 4.2, each training node TN generates Gaussian noise obey the distribution />

In step 4.3, the training nodes TN add the generated Gaussian noise to the local model to obtain a differentially private local model, which is used to detect whether each training node TN is a Byzantine node.

Step 4.4, the training node TN sends the differential privacy local model parameters to the master node CM.

Step 5, the training node TN adds a secret random number perturbation item to each of its local models to obtain the secret random number perturbation local model of the training node TN.

Step 5.1, each training node TN generates a secret random perturbation item R _i with any non-zero element, and adds the secret random perturbation item R _i to the local model to generate a secret random number to perturb the local model. The secret random perturbation term R _i has the same shape as the model parameters.

Step 5.2, the training node TN sends the secret random perturbation item to all candidate master nodes CN, and transmits the secret random number perturbation local model parameters to the master node CM.

Step 6, the master node CM detects Byzantine nodes based on performance evaluation.

According to the following formula, the master node CM calculates the loss value of the differentially private local model of each training node TN on the discriminant sample set in the current iteration.

Among them, loss _i represents the model loss value of the i-th training node TN on the discriminant sample set dds, |·| represents the modulo operation, L _i (·) represents the loss function of the i-th training node TN, Indicates the parameters of the differentially private local model of the i-th training node TN, and dds _j indicates the j-th sample in dds.

The master node CM calculates the average loss value of the differentially private local model of each training node TN in the current iteration according to the following formula.

Among them, avglv represents the average loss value of the differentially private local model of the ith training node TN on the discriminant sample set, and S represents the set of training nodes TN.

The master node CM forms the benign node index set with the benign training nodes TN whose model loss value is less than avglv and put benign index collections /> Sent to the candidate master node CN. In the embodiment of the present invention, the model loss value is less than avglv has {C, D, E, H, I, K}, as a set /> Send to candidate master nodes CN: B, C, D, E.

Step 7, the candidate master node CN aggregates the secret random disturbance item, and the master node CM updates the global model parameters.

Step 7.1, the master node CM aggregates the benign node index set according to the following formula The secret in randomly perturbs the local model to obtain an encrypted global model.

in, Indicates a parameter in the encrypted global model, /> Represents a parameter in the secret random number perturbation local model.

Step 7.2, the candidate master node CN receives the benign node index set sent by the master node CM Candidate master node CN will benign node index collection /> The secret random disturbance items sent by the corresponding training node TN are aggregated to obtain the secret random disturbance aggregation value R _k , and the candidate master node CN sends the secret random disturbance aggregation value R _k to the master node CM. There may be Byzantine nodes in the candidate master node CN, which may return wrong secret random perturbation aggregation value. Normally, the secret random perturbation aggregate value returned by normal nodes should be consistent, while Byzantine nodes may return randomly generated wrong secret random perturbation aggregate values. Participant B sends any wrong value to participant A, and participants C, D, and E send correct values to participant A.

Step 7.3, after the master node CM receives the secret random disturbance aggregate value R _k , select the same and majority R _k as the secret random disturbance aggregate value R of the group of nodes, R=mode(R _k ), select the aggregate value The corresponding candidate master node CN node is a benign node, and the candidate master node CN that sends other aggregation values is a Byzantine node, where R represents the aggregate value of secret random disturbance, and mode( ) represents the mode operation. In the embodiment of the present invention, participant A receives any wrong value sent by participant B and the correct value sent by participants C, D, and E, and the correct value sent by participants C, D, and E is in the majority. At this time, it can be determined Participant B is a Byzantine node.

In step 7.4, the master node CM subtracts the aggregated value R of the secret random disturbance from the encrypted global model to obtain the updated global model.

In step 7.5, the master node CM combines the loss value loss _i of each training node TN node model and the secret random disturbance aggregation result R _k returned by the candidate master node CN node, and divides the training node TN into the following three trust states: when loss When _i ∈ (0, avglv), it is benign, when loss _i ≥ avglv and R _k ≠ R, it is Byzantine, otherwise it is normal. B in the embodiment of the present invention satisfies the condition of loss _i ≥ avglv and R _k ≠ R, so B is considered a Byzantine node, and nodes C, D, E, H, I, and K satisfy the condition of loss _i ∈ (0, avglv) , so C, D, E, H, I, K are considered benign nodes, and the remaining nodes F, G, J are normal nodes.

In step 7.6, the master node CM updates the credibility and reputation of each training node TN according to the following formula.

in, Indicates the credibility of the i-th training node TN in the t-th iteration, /> Indicates the reputation of the i-th training node TN in the t-th iteration, a, b, and c are the standard parameters of the Gompertz function, and Gompertz represents a function describing the relationship between gradient credibility and reputation. In the embodiment of the present invention, all participants initialize the credibility/> Update B credibility Update C, D, E, H, I, K confidence levels /> Update F, G, J credibility

Step 7.7, the master node CM broadcasts the global model to the system network.

Step 8, the candidate master node CN votes on the updated global model.

Step 8.1, each candidate master node CN calculates the loss value of the updated global model on the discriminant sample set.

In step 8.2, each candidate master node CN votes on the global model through the fluctuation threshold according to the following formula. If the absolute value of the difference between the loss value and the previous iteration loss value does not exceed the fluctuation threshold, it indicates that the global model parameters are correct. In the direction of convergence, the candidate master node CN votes for the updated global model and broadcasts it to the system network; otherwise, the candidate master node CN broadcasts retraining information in the system network.

in, Indicates the loss value of the i-th training node TN at round t, and μ indicates the fluctuation threshold of the global model loss value.

Step 8.3, if more than half of the candidate master nodes CN in the system network voted for the updated global model parameters, then judge the master node CM as a benign node, and execute step 8.4; otherwise, judge the master node CM as a Byzantine node, and reselect A master node CM, the master node CM broadcasts the global model, and performs step 3. In the embodiment of the present invention, participants C, D, and E vote for the updated global model parameters, but participant B does not support the updated global model parameters. More than half of the candidate master nodes CN vote for the updated global model parameters, and perform step 8.4.

Step 8.4, the master node CM broadcasts the global model, the credibility and reputation of the training node TN to all nodes in the network, and the model training participants reach a consensus on the updated parameters.

Step 9, updating the credibility and reputation of the master node CM, and selecting a new master node CM and a candidate master node CN.

The master node CM selects x model training participants with high reputation as the candidate master node CN; in the candidate master node CN, a new master node CM is selected according to the consensus agreement of reputation; the new master node CM updates the master node of the previous round CM's credibility and reputation, and broadcast it to the system network; the new master node CM broadcasts the global model.

Step 10, judge whether the global model is converged, if so, go to step 11; otherwise, go to step 3.

Step 11, end the collaborative training and obtain the global model.

Claims (10)

1. An anti-Byzantine attack DFL method based on performance evaluation and committee voting, characterized in that the master node CM detects Byzantine nodes based on the performance evaluation method, and the candidate master node CN votes on the updated global model; the anti-Byzantine attack The specific steps of the DFL method include the following: Step 1, generate a discriminative sample set for each participant: Each participant in the model training randomly sends L small data samples, and each participant in the model training aggregates the received small data samples sent by other participants with its own small data samples to form the participant's discriminant sample set , where L≤3; Step 2, randomly select the master node CM from the candidate master nodes CN, and the master node CM broadcasts the global model; Step 3, the training nodes TN respectively use their own local data sets to train the global model to obtain their respective local models; Step 4, the training node TN uses DP to generate a differentially private local model; Step 5, the training node TN adds a secret random number perturbation item to each of its local models to obtain the secret random number perturbation local model of the training node TN; Step 6, the master node CM detects Byzantine nodes based on the performance evaluation method: The master node CM calculates the loss value of the differentially private local model of each training node TN on the discriminant sample set in the current round of iteration; the master node CM calculates the average loss of the differentially private local model of each training node TN in the current round of iteration value; the master node CM forms the benign node index set with the benign training nodes TN whose model loss value is less than the average loss value avglv and put benign index collections /> Send to candidate master node CN; Step 7, the candidate master node CN aggregates the secret random disturbance item, and the master node CM updates the global model parameters: Step 7.1, master node CM aggregates benign node index collection The secret random number in perturbs the local model to obtain the encrypted global model; Step 7.2, the candidate master node CN receives the benign node index set sent by the master node CM Candidate master node CN will benign node index collection /> The secret random disturbance items sent by the corresponding training node TN are aggregated to obtain the secret random disturbance aggregation value R _k , and the candidate master node CN sends the secret random disturbance aggregation value R _k to the master node CM; Step 7.3, after the master node CM receives the secret random disturbance aggregate value R _k , select the same and majority R _k as the secret random disturbance aggregate value R of the group of nodes, R=mode(R _k ), select the aggregate value The corresponding candidate master node CN node is a benign node, and the candidate master node CN that sends other aggregated values is regarded as a Byzantine node, where R represents the aggregate value of secret random disturbance, and mode( ) represents the mode operation; In step 7.4, the master node CM subtracts the aggregated value R of the secret random disturbance from the encrypted global model to obtain the updated global model; In step 7.5, the master node CM combines the loss value loss _i of the differential privacy local model of each training node TN and the secret random perturbation aggregation result R _k returned by the candidate master node CN node, and divides the training node TN into the following three trust states: When loss _i ∈ (0, avglv), the training node TN is a benign node, when loss _i ≥ avglv and R _k ≠ R, the training node TN is a Byzantine node, otherwise, the training node TN is a normal node; Step 7.6, the master node CM updates the credibility and reputation of each training node TN; Step 7.7, the master node CM broadcasts the global model to the system network; Step 8, the candidate master node CN votes on the updated global model: Step 8.1, each candidate master node CN calculates the loss value of the updated global model on the discriminant sample set; Step 8.2, each candidate master node CN votes for the global model through the fluctuation threshold, if the absolute difference between the loss value of the updated global model calculated by the candidate master node CN on the discriminant sample set and the loss value of the previous iteration If the value does not exceed the fluctuation threshold, it indicates that the global model parameters are in the correct direction of convergence, and the candidate master node CN votes for the updated global model and broadcasts it to the system network; otherwise, the candidate master node CN broadcasts opposition in the system network information; Step 8.3, if more than half of the candidate master nodes CN in the system network voted for the updated global model parameters, then judge the master node CM as a benign node, and execute step 8.4; otherwise, judge the master node CM as a Byzantine node, and reselect A master node CM, the master node CM broadcasts the global model, and performs step 3; Step 8.4, the master node CM broadcasts the global model, the credibility and credibility of the training node TN to all nodes in the network, and the model training participants reach a consensus on the updated parameters; Step 9, update the credibility and reputation of the master node CM, and select the new master node CM and candidate master node CN: The master node CM selects x model training participants with high reputation as the candidate master node CN; in the candidate master node CN, a new master node CM is selected according to the consensus agreement of reputation; the new master node CM updates the master node of the previous round The credibility and reputation of CM, and broadcast it to the system network; the new master node CM broadcasts the global model; Step 10, judge whether the global model is convergent, if so, go to step 11; otherwise, go to step 3; Step 11, end the collaborative training and obtain the global model. 2. According to claim 1, the DFL method of resisting Byzantine attacks based on performance evaluation and committee voting is characterized in that, the step of randomly selecting master node CM and candidate master node CN described in step 2 is as follows: The first step is to randomly select one of all model training participants, and use the selected participant as the master node CM; the master node CM broadcasts the initialization parameters of the global model; The second step is to randomly select x nodes from all participants except the master node CM to form the candidate master node CN; x=n×α, where n represents the total number of model training participants, and α represents the candidate The ratio of master node CN to all model training participants, and 0<α<1. 3. according to the DFL method of the anti-Byzantine attack based on performance evaluation and committee voting according to claim 1, it is characterized in that, the step of training node TN described in step 3 using its own local data set to train the global model is as follows: In the first step, participants other than the master node CM form a training node TN; In the second step, each training node TN updates its local model with the received global model; In the third step, each training node TN inputs its own local data set into its own local model, and uses the SGD gradient descent algorithm to perform τ rounds of iterations to obtain the optimal local model. 4. according to the described DFL method of the anti-Byzantine attack based on performance evaluation and committee voting of claim 1, it is characterized in that, the step of training node TN described in step 4 to utilize DP to generate differential privacy local model is as follows: In the first step, each training node TN selects the privacy budget ε _i and the relaxation constant δ _i according to the local privacy requirements, and the sensitivity of the model parameters The standard deviation of the Gaussian noise is set to /> Among them, C is the clipping threshold of the local model parameters, and DS _i is the local data set of the i-th training node TN; In the second step, each training node TN generates Gaussian noise obey the distribution /> In the third step, the training nodes TN add the Gaussian noise generated by each to the local model to obtain a differentially private local model for detecting whether each training node TN is a Byzantine node; In the fourth step, the training node TN sends the differential privacy local model parameters to the master node CM. 5. according to the described DFL method of the anti-Byzantine attack based on performance assessment and committee voting of claim 1, it is characterized in that, described in step 5, the step of adding secret random number perturbation item in each local model is as follows: In the first step, each training node TN randomly generates a secret random perturbation item R _i with any non-zero element, and adds it to the local model to generate a secret random number to perturb the local model; In the second step, the training node TN sends the secret random perturbation item to all candidate master nodes CN, and transmits the secret random number perturbation local model parameters to the master node CM. 6. The DFL method based on performance evaluation and committee voting according to claim 1, wherein the differentially private local model of each training node TN is in the discriminant sample set during the current round of iteration as described in step 6. The loss value on is obtained by the following formula: Among them, loss _i represents the model loss value of the i-th training node TN on the discriminant sample set dds, |·| represents the modulo operation, L _i (·) represents the loss function of the i-th training node TN, Indicates the parameters of the differentially private local model of the i-th training node TN, and dds _j indicates the j-th sample in dds. 7. The DFL method of anti-Byzantine attack based on performance evaluation and committee voting according to claim 1, characterized in that, the average loss value of the differential privacy local model of each training node TN in the current round of iteration as described in step 6 is obtained by: Among them, avglv represents the average loss value of the differentially private local model of the ith training node TN on the discriminant sample set, and S represents the set of training nodes TN. 8. The anti-Byzantine attack DFL method based on performance evaluation and committee voting according to claim 1, characterized in that, the aggregated benign node index set in step 7.1 The secret random perturbation local model in is realized by the following formula: in, Indicates a parameter in the encrypted global model, /> Represents a parameter in the secret random number perturbation local model. 9. The DFL method based on performance evaluation and committee voting according to claim 1, wherein the reliability and reputation of updating each training node TN described in step 7.6 are obtained by the following formula : in, Indicates the credibility of the i-th training node TN in the t-th iteration, /> Indicates the reputation of the i-th training node TN in the t-th iteration, a, b, and c are the standard parameters of the Gompertz function, and Gompertz represents a function describing the relationship between gradient credibility and reputation. 10. The DFL method of anti-Byzantine attack based on performance evaluation and committee voting according to claim 1, characterized in that, the evaluation of the global model by the fluctuation threshold described in step 8.2 is realized by the following formula: in, Indicates the loss value of the i-th training node TN at round t, and μ indicates the fluctuation threshold of the global model loss value.