Federal learning-based privacy protection system

Abstract

The invention discloses a privacy protection system based on federated learning, and relates to the technical field of privacy protection. The system comprises a distributed participating node cluster, wherein each participating node is configured with a local model training unit and a privacy protection module; the coordination server is connected with each participating node through a secure communication layer and comprises a model aggregation module and a dynamic trust evaluation module; the global model distribution channel is used for broadcasting the encrypted global model parameters to participating nodes; and the privacy protection module is integrated in a local participating node and comprises a homomorphic encryption engine and a local differential privacy injector. According to the method, privacy protection strength improvement, model utility optimization, system efficiency breakthrough and security boundary expansion are synchronously achieved under a federated learning framework, and an industrial-grade solution is provided for cross-domain data collaborative learning.

Description

Technical Field

[0001] The present invention relates to the field of privacy protection technology, and in particular to a privacy protection system based on federated learning. Background Art

[0002] Federated learning, a distributed machine learning framework, is based on the principle of allowing multiple participants to collaboratively train a global model by exchanging model parameters, without leaving their local data's original storage location. This architecture aims to address data silos and meet increasingly stringent privacy regulations. However, in actual deployment, federated learning has exposed serious privacy vulnerabilities: attackers can reconstruct the original training data from plaintext gradients through gradient inversion, while membership inference attacks can determine whether specific samples participated in training. Untrusted servers or malicious participants may steal private information through collusion, model tampering, or intermediate parameter analysis. The high-dimensional nature of model parameters increases the computational and communication overhead of privacy protection, making traditional encryption methods difficult to directly adapt.

[0003] Current federated learning privacy protection technologies mainly rely on three types of methods, but all have significant limitations: 1. Cryptography methods, which assign independent keys to different clients, encrypt local model parameters, and then upload them to the server for aggregation. This method requires multi-client collaboration for joint decryption, has high computational complexity, and is prone to key leakage. 2. Differential privacy methods, which add noise to gradients or model parameters to prevent attackers from distinguishing the impact of individual data. This method's global noise addition leads to a loss of model accuracy, especially in non-independent and identically distributed data scenarios. Furthermore, it does not consider data heterogeneity, resulting in insufficient protection for high-value core data and excessive perturbation of low-value redundant data. 3. Hybrid protection mechanisms, which combine traditional differential privacy and cryptography techniques to attempt to balance privacy and model availability. This method has poor compatibility, and the noise addition of traditional differential privacy conflicts with the mathematical properties of the encryption protocol. Furthermore, the terminal device needs to perform encryption and noise injection simultaneously, which consumes resources beyond the capacity of IoT devices. Therefore, based on the above difficulties, the present invention proposes a privacy protection system based on federated learning. Summary of the Invention

[0004] Technical Purpose In order to solve the above problems, the purpose of the present invention is to provide a privacy protection system based on federated learning, which aims to resist gradient inversion attacks and member inference attacks, prevent local data features from being leaked through transmission parameters, break through the model accuracy loss caused by the global noise addition mechanism of traditional differential privacy, and achieve precise protection of data value perception. It avoids the synchronous communication bottleneck of secure multi-party computing and the key management risk of homomorphic encryption, builds a lightweight privacy protection architecture, establishes a decentralized trust mechanism, and suppresses server collusion and participating node data poisoning attacks.

[0005] Technical Solution To achieve the above objectives, the present invention provides a privacy protection system based on federated learning. This scheme dynamically divides core data sets and non-core data sets based on local data feature weights, and injects adaptive noise into each of them to realize the distribution of privacy budget according to data value; adopts a secret sharing sharding mechanism to replace traditional joint decryption, and the client uploads the secret shard of the noise parameter to the server, and completes security fusion through linear aggregation and threshold verification; integrates a multi-dimensional behavior analysis model to generate dynamic weight coefficient optimization aggregation, and deploys a CNN gradient anomaly identifier to intercept malicious parameter injection; also compresses gradient data through sparse ternary quantization coding, and combines it with a dual-channel encryption architecture to reduce transmission overhead.

[0006] In a first aspect, the present invention provides a privacy protection system based on federated learning, comprising: A distributed cluster of participating nodes, each of which is equipped with a local model training unit and an embedded privacy protection module; The coordination server is connected to each participating node through a secure communication layer, and includes a model aggregation module and a dynamic trust assessment module; Global model distribution channel, used to broadcast encrypted global model parameters to participating nodes; The privacy protection module is integrated locally on participating nodes and includes a homomorphic encryption engine and a local differential privacy injector; The dynamic trust evaluation module generates dynamic weight coefficients based on the historical behavior data of participating nodes and inputs them into the model aggregation module.

[0007] Furthermore, the coordination server detects the distribution deviation of the gradients uploaded by the participating nodes through a feature space consistency verification unit, and identifies malicious gradient injection behavior based on a convolutional neural network through a gradient anomaly pattern recognizer.

[0008] Furthermore, the coordination server is connected to a traceability isolation controller, which is configured to implement a zero-knowledge proof challenge to the initiator of the abnormal gradient and trigger dynamic isolation of computing resources of participating nodes.

[0009] Furthermore, the secure communication layer adopts a dual-channel encryption architecture, in which the first transmission channel uses identity-based broadcast encryption to transmit the global model, and the second transmission channel uses a post-quantum cryptography algorithm to transmit local gradient data.

[0010] Furthermore, the model aggregation module adopts a sparse ternary quantization coding strategy to perform gradient compression, and performs nonlinear weighted fusion on the gradients of participating nodes according to dynamic weight coefficients.

[0011] Furthermore, the privacy protection module establishes a temporary computing alliance among participating nodes to perform cross-node feature cross-validation and joint gradient norm bound calculation.

[0012] Furthermore, the local differential privacy injector includes an adaptive noise generator, whose noise parameters are dynamically adjusted by the data sensitivity classification results of the current training round and the node trust value output by the dynamic trust evaluation module.

[0013] Furthermore, the adaptive noise generator integrates a noise parameter self-optimization feedback loop, which includes a privacy budget consumption monitor, a model utility loss evaluator, and a noise parameter dynamic adjustment strategy generator based on reinforcement learning.

[0014] Furthermore, the dynamic trust assessment module adopts a multi-dimensional behavior analysis model, and the analysis dimensions include gradient upload timing consistency, local data distribution credibility proof, historical participation behavior compliance index and computing resource authenticity verification results.

[0015] Furthermore, it also includes a hierarchical noise injection module, which is used to reconstruct the privacy budget allocation logic through the dynamic coupling of data value perception grading and node behavior trust evaluation. The privacy budget calculation formula is:

[0016] Where, For nodes In round privacy budget; Initialize the basic privacy budget for the system; For nodes In round Trust value; is the size of the core dataset; is the total size of the node's local data set; is the time attenuation coefficient; The current federated learning training round.

[0017] This mechanism implements fine-grained privacy perturbation during the federated learning process, adaptively adjusts noise intensity based on data sensitivity and node credibility, and significantly optimizes the privacy-utility trade-off; at the same time, it updates trust weights based on real-time feedback of gradient distribution deviation, effectively suppressing the interference of malicious nodes on model convergence and improving the robustness of the system in non-independent and identically distributed data scenarios.

[0018] Furthermore, it also includes a secure multi-party aggregation module for distributing key sharding by retaining the gradient significance value. The sparse coding formula is:

[0019] Where, is the compressed gradient vector; To retain The projection operator of the element with the largest absolute value; is element-wise multiplication; is the symbol mask matrix; is the indicator function; is the gradient; is the dynamic threshold.

[0020] This solution significantly reduces communication load and computational overhead by retaining gradient significance and distributing key sharding. It also uses blockchain evidence to ensure verifiability of aggregation results, providing provable security against collusion attacks and model tampering, and offering a lightweight solution for resource-constrained terminals to participate in federated training.

[0021] Furthermore, the system deploys a blockchain-assisted model verification mechanism, including: The model hash value on-chain storage unit is used to write the global model parameter hash value of each round into the blockchain; Distributed version consistency verifier, used to compare the matching degree between each node's receiving model and the records on the chain.

[0022] In a second aspect, the present invention further provides a privacy protection method based on federated learning. The method is based on the system described in the first aspect, comprising: Participating nodes calculate sensitivity scores based on local data feature weights, divide core and non-core datasets, generate adaptive privacy budgets based on dynamic trust values, and inject layered Gaussian noise. Apply sparse ternary quantization to the noisy local gradient and retain the top-k elements whose absolute value is greater than the dynamic threshold to generate a compressed gradient vector; The compressed gradient vector is encrypted using a public key to generate a ciphertext, and the private key is split into multiple shards through threshold secret sharing and distributed to edge nodes; The coordination server aggregates the ciphertext gradients homomorphically, and nodes with a threshold value collaborate to decrypt the gradients to obtain the aggregated results and update the global model. The node trust value is updated based on the gradient distribution deviation, and the global model hash value is written to the blockchain for version consistency verification.

[0023] In a third aspect, the present invention further provides a computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is run by a processor, the aforementioned privacy protection method based on federated learning is executed.

[0024] This invention dynamically adjusts the privacy budget based on data value grading and node behavior trust assessment to achieve fine-grained privacy perturbations. It combines sparse ternary quantization with threshold secret sharing decryption to build a lightweight encrypted communication architecture. It eliminates the risk of model splitting through hashing and on-chain evidence storage and distributed version comparison. It also uses feature space analysis and gradient pattern recognition to intercept malicious attacks. Within the framework of federated learning, this solution simultaneously achieves enhanced privacy protection, optimized model utility, breakthroughs in system efficiency, and expanded security boundaries, forming a full-stack technology system with controllable privacy, efficient communication, trustworthy models, and attack prevention, providing an industrial-grade solution for cross-domain data collaborative learning.

[0025] Beneficial effects By implementing the above-mentioned privacy protection system based on federated learning provided by the present invention, the following technical effects are achieved: (1) This application builds a decentralized model integrity assurance system by storing model hash values on-chain and using distributed version verifiers. This mechanism eliminates the risk of model splitting caused by single-point failure of the server in traditional federated learning, ensuring that all participating nodes receive the same global model version. It also provides tamper-proof audit traceability, strengthening the Byzantine fault tolerance of the federated architecture from a system level.

[0026] (2) Integrated feature space consistency verification and gradient anomaly pattern recognition dual engines. It uses convolutional neural networks to extract high-dimensional spatiotemporal features of gradients to accurately identify hidden threats such as malicious parameter injection and backdoor attacks. It also combines a zero-knowledge proof challenge mechanism to achieve attack tracing and resource isolation, significantly improving the system's inherent security in an open network environment.

[0027] (3) Through the dynamic coupling of data value perception grading and node behavior trust evaluation, the privacy budget allocation logic is reconstructed. This mechanism implements fine-grained privacy perturbations in the federated learning process, adaptively adjusts noise intensity based on data sensitivity and node credibility, and significantly optimizes the privacy-utility trade-off. At the same time, the trust weight is updated based on real-time feedback of gradient distribution deviation, effectively suppressing the interference of malicious nodes on model convergence and improving the robustness of the system in non-independent and identically distributed data scenarios.

[0028] (4) The solution integrates gradient sparse ternary quantization and threshold secret sharing decryption to break through the engineering bottleneck of traditional homomorphic encryption. This solution significantly reduces communication load and computational overhead by retaining gradient significance and distributing key sharding. At the same time, it uses blockchain to store evidence to achieve verifiability of aggregation results, providing provable security against collusion attacks and model tampering, and providing a lightweight solution for resource-constrained terminals to participate in federated training. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] To make the above-mentioned federated learning-based privacy protection system of the present invention more clear and easy to understand, the following is a brief introduction to the drawings required for the specific implementation of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without any creative effort.

[0030] Figure 1 Represents the system architecture diagram of this application; Figure 2 The flowchart of the present application method is shown. DETAILED DESCRIPTION

[0031] Example 1: A privacy protection system based on federated learning is provided. The system architecture is as follows: Figure 1 As shown, the system includes: a distributed cluster of participating nodes, each equipped with a local model training unit and an embedded privacy protection module; a coordination server connected to each participating node via a secure communication layer, which includes a model aggregation module and a dynamic trust assessment module; a global model distribution channel for broadcasting encrypted global model parameters to participating nodes; a privacy protection module, integrated locally on participating nodes, which includes a homomorphic encryption engine and a local differential privacy injector; and a dynamic trust assessment module, which generates dynamic weight coefficients based on the historical behavior data of participating nodes and inputs them into the model aggregation module. The details are as follows.

[0032] The local model training unit is used to perform gradient calculation and back propagation.

[0033] The model aggregation module is used to receive encrypted gradients and perform homomorphic aggregation operations.

[0034] The dynamic trust evaluation module is used to generate a dynamic weight coefficient based on gradient temporal consistency and data distribution credibility.

[0035] The coordination server detects the distribution deviation of the gradients uploaded by the participating nodes through a feature space consistency verification unit, and identifies malicious gradient injection behavior based on a convolutional neural network through a gradient anomaly pattern recognizer.

[0036] The adversarial sample detection process specifically includes: Step 1: The feature space consistency verification unit calculates the KL divergence of the gradient distribution; Step 2: The CNN gradient anomaly detector inputs the gradient tensor and outputs the malicious probability: Network structure: 3 convolution layers + fully connected layer, kernel size is 3×3; Judgment rule: Isolate the node when the malicious behavior probability value output by the gradient anomaly identifier is greater than 0.95.

[0037] The coordination server is connected to a traceability isolation controller, which is configured to implement a zero-knowledge proof challenge on the initiator of the abnormal gradient and trigger dynamic isolation of computing resources of participating nodes.

[0038] The secure communication layer adopts a dual-channel encryption architecture. The first transmission channel of the architecture uses the Boneh-Gentry-Waters scheme, the group structure is a 256-bit elliptic curve group, and supports key updates when dynamic nodes join and exit. The second transmission channel uses the CRYSTALS-Kyber algorithm to transmit local gradients, with a key length of 1024 bits and an encryption mode of CCA-secure.

[0039] The model aggregation module adopts a sparse ternary quantization coding strategy to perform gradient compression and performs nonlinear weighted fusion of participating node gradients according to dynamic weight coefficients.

[0040] The privacy protection module establishes a temporary computing alliance among participating nodes to perform cross-node feature cross-validation and joint gradient norm bound calculation.

[0041] The local differential privacy injector includes an adaptive noise generator, whose noise parameters are dynamically adjusted by the data sensitivity classification results of the current training round and the node trust value output by the dynamic trust evaluation module.

[0042] The adaptive noise generator integrates a noise parameter self-optimization feedback loop, which includes a privacy budget consumption monitor, a model utility loss evaluator, and a noise parameter dynamic adjustment strategy generator based on reinforcement learning. The state space is the current privacy budget consumption rate, model utility loss, and node trust value variance, and the action space is the adjustment amplitude of the noise scale.

[0043] The dynamic trust assessment module adopts a multi-dimensional behavior analysis model, and the analysis dimensions include gradient upload timing consistency, local data distribution credibility proof, historical participation behavior compliance index and computing resource authenticity verification results.

[0044] The system deploys a blockchain-assisted model verification mechanism, including: The model hash value on-chain storage unit is used to coordinate the server to generate the global model parameter hash value and write it into the Hyperledger Fabric channel through the smart contract. The consensus mechanism is Raft. The distributed version consistency verifier is used to calculate the hash value of the received model locally on the participating nodes and compare it with the on-chain record. If the mismatch rate is greater than 5%, the model rollback protocol is triggered.

[0045] A privacy protection method based on federated learning is provided. The method is based on the aforementioned system. The process is as follows: Figure 2As shown, it includes: participating nodes calculate sensitivity scores based on local data feature weights, divide core data sets and non-core data sets, generate adaptive privacy budgets based on dynamic trust values, and inject hierarchical Gaussian noise; apply sparse ternary quantization to the noisy local gradient, and retain the Top-k elements whose absolute values are greater than the dynamic threshold to generate a compressed gradient vector; use the public key to encrypt the compressed gradient vector to generate a ciphertext, and the private key is split into multiple shards through threshold secret sharing and distributed to edge nodes; coordinate the server to homomorphically aggregate the ciphertext gradient, and the nodes with a value not less than the threshold collaborate to decrypt to obtain the aggregation result, and update the global model; update the node trust value based on the gradient distribution deviation, and write the global model hash value into the blockchain for version consistency verification.

[0046] Example 2: Based on the above embodiments, to address the problem of global fixed noise in traditional differential privacy leading to a decrease in model utility, a dynamic trust-driven hierarchical noise injection mechanism is added, introducing dual dynamic factors of data value perception and node behavior trust evaluation.

[0047] Dynamically divide core data sets and non-core data sets based on local data feature weights (such as gradient contribution and feature scarcity) and allocate differentiated privacy budgets.

[0048] The dynamic trust evaluation module generates trust weights and adjusts the amount of node-level noise. High-trust nodes inject less noise into the core data, while low-trust nodes inject more noise.

[0049] Classify data value and calculate data points on the client side Sensitivity score:

[0050] Where, For data points sensitivity score; is the model parameter Next data point The gradient of the loss function; is the maximum value of the gradient norm of all data points; is the domain adjustment factor, preferably 0.3, which is used to balance the weight of gradient contribution and feature importance; is the text feature weight.

[0051] node In round Privacy budget:

[0052] Where, For nodes In round privacy budget; Initialize the basic privacy budget for the system; For nodes In round Trust value; is the size of the core dataset; is the total size of the node's local data set; is the time attenuation coefficient; The current federated learning training round.

[0053] according to Compute Gaussian noise scale and inject local gradient.

[0054] After each round of aggregation, the server verifies the node Gradient distribution deviation, update the trust value:

[0055] Where, is the historical weight, preferably 0.8; is an indicator function, where the deviation is 1 if it meets the standard, and 0 otherwise; For nodes The gradient distribution deviation; is the deviation threshold, preferably 0.15.

[0056] Verification shows that while obtaining an average error similar to that of the above-mentioned embodiment, this mechanism maintains the model accuracy close to the unperturbed benchmark under strict privacy constraints through differentiated privacy perturbation strategies and dynamic feedback of behavioral trust, significantly alleviating the utility decay problem of traditional differential privacy; trust assessment based on gradient distribution deviation analysis can quickly identify abnormal nodes and effectively block the contamination of the global model by data poisoning attacks; and by injecting layered noise through data value grading, the convergence stability and generalization performance of heterogeneous data scenarios are greatly improved.

[0057] Example 3: Based on the above examples, in order to reduce the computational overhead of homomorphic encryption and defend against collusion attacks, gradient sparsification is combined with threshold secret sharing. Gradient compression uses sparse ternary encoding to retain the gradient significance value, reducing the amount of data to be encrypted. The private key shards are distributed and held by the client and edge server. Aggregation is required. The two parties collaborate on decryption to prevent a single malicious party from stealing gradients.

[0058] The client computes the gradients and applies improved STE compression:

[0059] Where, is the compressed gradient vector; To retain The projection operator of the element with the largest absolute value; is element-wise multiplication; is the symbol mask matrix; is the indicator function; is the gradient; is the dynamic threshold.

[0060] The key generation center generates the HE private key , split into shards , distributed to clients and edge servers.

[0061] Client uses public key encryption have to , upload to the server.

[0062] The server performs homomorphic aggregation: .

[0063] Depend on Holds Node collaborative decryption:

[0064] Where, is the global gradient vector after aggregation; is the homomorphic decryption function; is the encrypted aggregate gradient ciphertext; A collection of private key shards participating in collaborative decryption. is the node index set; is the threshold value.

[0065] Assume that a 3-node federated learning scenario is considered and a 3D linear regression model is trained. The gradient data is: Node 1, the original gradient vector is ; Node 2, the original gradient vector is ; Node 3, the original gradient vector is .

[0066] Gradient sparse coding, dynamic thresholding , retain the top-2 elements: Node 1: ; Node 2: ; Node 3: .

[0067] Distributed key sharding aggregation, threshold : Private Key Sharding: , , ; Ciphertext aggregation: ; Collaborative Decryption: .

[0068] Aggregation results: ; Update the model: .

[0069] Comparison of the performance of traditional homomorphic encryption and this scheme on the CIFAR-10 dataset: Table 1. Performance comparison between traditional homomorphic encryption and this solution

[0070] As shown in the experimental table, sparse coding reduces data volume by 30.2%. Combined with ternary coding, it further compresses data. Distributed key sharding mitigates single-point leakage risks. Gradient sparsification significantly increases reconstruction difficulty, improving model accuracy by 0.8%. Experimental data demonstrates that sparse ternary coding significantly reduces transmission overhead, enabling resource-constrained terminals to stably participate in multiple rounds of federated training. The threshold decryption mechanism increases resistance to collusion attacks to the theoretical limit, while blockchain-based evidence storage provides verifiable aggregate integrity assurance. The split encryption process significantly reduces end-to-end latency, breaking through the engineering bottleneck of homomorphic encryption.

[0071] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media containing computer-usable program code.

[0072] The present invention can provide computer program instructions to a management platform of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the management platform of the computer or other programmable data processing device produce a device for implementing the system.

[0073] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device that implements the functions of the system.

[0074] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions of the described system.

Claims

1. A privacy protection system based on federated learning, characterized by: include: A distributed cluster of participating nodes, each of which is equipped with a local model training unit and a privacy protection module; The coordination server is connected to each participating node through a secure communication layer, and includes a model aggregation module and a dynamic trust assessment module; Global model distribution channel, used to broadcast encrypted global model parameters to participating nodes; The privacy protection module is integrated locally in the participating nodes and includes a homomorphic encryption engine and a local differential privacy injector.

2. The system according to claim 1, wherein: The coordination server detects the distribution deviation of the gradients uploaded by the participating nodes through a feature space consistency verification unit, and identifies malicious gradient injection behavior based on a convolutional neural network through a gradient anomaly pattern recognizer.

3. The system according to claim 1 or 2, characterized in that: The coordination server is connected to a traceability isolation controller, which is configured to implement a zero-knowledge proof challenge on the initiator of the abnormal gradient and trigger dynamic isolation of computing resources of participating nodes.

4. The system according to claim 1, wherein: The secure communication layer adopts a dual-channel encryption architecture. The first transmission channel of the architecture uses identity-based broadcast encryption to transmit the global model, and the second transmission channel uses a post-quantum cryptography algorithm to transmit local gradient data.

5. The system according to claim 1, wherein: The model aggregation module adopts a sparse ternary quantization coding strategy to perform gradient compression and performs nonlinear weighted fusion of participating node gradients according to dynamic weight coefficients.

6. The system according to claim 1, wherein: The privacy protection module establishes a temporary computing alliance among participating nodes to perform cross-node feature cross-validation and joint gradient norm bound calculation.

7. The system according to claim 1 or 6, characterized in that: The local differential privacy injector includes an adaptive noise generator, whose noise parameters are dynamically adjusted by the data sensitivity classification results of the current training round and the node trust value output by the dynamic trust evaluation module.

8. The system according to claim 1, wherein: It also includes a hierarchical noise injection module for reconstructing the privacy budget allocation logic through the dynamic coupling of data value perception grading and node behavior trust evaluation. The privacy budget calculation formula is: Where, For nodes In round privacy budget; Initialize the basic privacy budget for the system; For nodes In round Trust value; is the size of the core dataset; is the total size of the node's local data set; is the time attenuation coefficient; The current federated learning training round.

9. The system according to claim 1, wherein: It also includes a secure multi-party aggregation module for distributing key sharding by retaining the gradient significance value. The sparse coding formula is: Where, is the compressed gradient vector; To retain The projection operator of the element with the largest absolute value; is element-wise multiplication; is the symbol mask matrix; is the indicator function; is the gradient; is the dynamic threshold.

10. A privacy protection method based on federated learning, characterized by: The method is implemented based on the system described in claim 1: The method comprises: Participating nodes calculate sensitivity scores based on local data feature weights, divide core and non-core datasets, generate adaptive privacy budgets based on dynamic trust values, and inject layered Gaussian noise. Apply sparse ternary quantization to the noisy local gradient and retain the top-k elements whose absolute value is greater than the dynamic threshold to generate a compressed gradient vector; The compressed gradient vector is encrypted using a public key to generate a ciphertext, and the private key is split into multiple shards through threshold secret sharing and distributed to edge nodes; The coordination server aggregates the ciphertext gradients homomorphically, and nodes with a threshold value collaborate to decrypt the gradients to obtain the aggregated results and update the global model. The node trust value is updated based on the gradient distribution deviation, and the global model hash value is written to the blockchain for version consistency verification.

Images