Federal learning system based on multi-key homomorphic encryption and adaptive differential privacy

Abstract

The invention relates to a federated learning system based on multi-key homomorphic encryption and adaptive differential privacy, and belongs to the technical field of privacy computing. According to the system, on the premise that no trusted third party exists, a multi-client collaborative key generation and threshold decryption mechanism is achieved, it is ensured that model parameters are always in an encrypted state in the aggregation process, and leakage of a single node is prevented. By introducing a parameter sensitivity analysis and selective encryption strategy, the system only encrypts high-risk parameters, and the encryption burden is effectively reduced. Meanwhile, in combination with an adaptive privacy budget allocation mechanism, the system dynamically adjusts noise intensity according to a model training state, and model performance and convergence speed are maintained while privacy protection capability is improved. According to the method, high robustness and collusion resistance are realized, stable operation under the condition that part of clients are offline is supported, and the method is suitable for application scenes such as medical treatment and finance with high data sensitivity and strict performance requirements.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of privacy computing, and particularly relates to a federated learning system based on multi-key homomorphic encryption and adaptive differential privacy. BACKGROUND

[0002] In recent years, federated learning (FL) has received extensive attention as a privacy-preserving distributed machine learning method. Federated learning allows multiple clients to collaboratively train a global model without sharing raw data, thus completing model construction while protecting data privacy. Unlike traditional centralized machine learning, federated learning performs model training locally on clients and only exchanges model updates with the server. This distributed architecture effectively reduces the risk of data leakage as there is no need to collect data on a central server. Although federated learning protects data privacy to some extent by keeping data on local devices, it still faces privacy leakage and security threats during model aggregation and data transmission. During model training and aggregation, malicious attackers can infer sensitive information from shared model updates through various known attacks such as gradient inversion, reconstruction attacks, membership inference, and attribute inference. In addition, adversarial attacks from dishonest clients or compromised servers can interfere with the integrity of model updates, leading to decreased model performance or privacy leakage. Therefore, in federated learning, the security of protecting data and model privacy is crucial. To address privacy and security issues in FL, current research mainly adopts methods such as homomorphic encryption (HE) and differential privacy (DP).

[0003] Homomorphic encryption (HE) allows direct computation on data in an encrypted state, and the server cannot directly access sensitive information during aggregation. Through homomorphic encryption, the server can complete model aggregation without decrypting the data. However, the main drawback of homomorphic encryption is its high computational and communication overhead, especially when dealing with large-scale model parameters, which significantly affects the efficiency and scalability of the federated learning system. In most existing federated learning homomorphic encryption schemes, the computational and communication overhead is often not fully optimized, especially when dealing with large-scale models, the performance bottleneck brought by HE becomes particularly prominent. This overhead not only affects the efficiency of model training, but also hinders the application of federated learning on resource-constrained devices.

[0004] Differential privacy (DP) prevents malicious attackers from inferring individual data from model updates by injecting noise into the model updates. Differential privacy techniques provide privacy protection by adjusting the privacy budget and noise size. However, excessive noise can lead to a decrease in model performance, especially in non-independent and identically distributed (Non-IID) data scenarios, where model convergence speed and accuracy can be significantly affected. Existing differential privacy methods usually use a fixed amplitude of noise injection, which can cause training effects to be impaired when the model approaches the optimal solution, reducing the accuracy of the final model. Although the application of differential privacy in federated learning can effectively prevent privacy leakage, its impact on model accuracy remains a key issue in practical applications.

[0005] Although existing technologies have made positive contributions to privacy protection, these solutions still have some non-negligible problems: high computational and communication overhead: existing homomorphic encryption methods cause significant computational and communication overhead during model training and aggregation. Especially when dealing with large-scale model parameters, the computational burden and data transmission volume of homomorphic encryption are non-negligible bottlenecks, limiting the practical application of federated learning in large-scale deployment; insufficient protection against internal attacks: existing homomorphic encryption schemes usually use a unified public key and private key for encryption, allowing attackers to decrypt all model updates by mastering only one private key, thereby leaking sensitive information. This scheme cannot effectively prevent data leakage attacks from "internal curious devices" and "collusion attacks between internal devices and servers"; excessive noise introduced by differential privacy: existing differential privacy methods usually use a fixed noise injection amplitude, which provides strong privacy protection at the beginning of model training, but as training progresses, noise can affect the improvement of model accuracy, especially when the model approaches the optimal solution, noise can cause poor training results; lack of flexible privacy protection mechanisms: many existing privacy protection mechanisms, such as homomorphic encryption and differential privacy, often fail to fully consider the data heterogeneity in federated learning and the changes in training stages, lacking flexible privacy protection strategies, which limits their adaptability and effectiveness in different scenarios.

[0006] Therefore, it is a challenge to design a privacy protection federated learning framework that is both efficient and has high accuracy and high security. SUMMARY

[0007] The present application aims to solve the problems of high computational and communication overhead, key management relying on a trusted third party, and rough privacy budget configuration in existing solutions, which make it difficult to ensure data security while considering system performance. In addition, the existing methods have limited protection capabilities against potential collusion attacks between clients and servers, and the risk of privacy leakage still exists. Therefore, a federated learning system based on multi-key homomorphic encryption and adaptive differential privacy, MKSE-AdpFL, is provided.

[0008] To achieve the above object, the technical scheme of the present application is: a federated learning system based on multi-key homomorphic encryption and adaptive differential privacy, comprising a client and a server, wherein the client is divided into a private key holding client PKC and a non-private key holding client Non-PKC according to whether it holds a private key share; during the entire federated learning training process, only encrypted model parameters are exchanged between the client and the server, and the server cannot directly obtain the plaintext information of any model, so as to effectively guarantee the privacy security of the model during transmission and aggregation.

[0009] Further, the server, as the coordination and aggregation core in the system, is responsible for receiving encrypted model updates from the client in each round of training. For the encrypted parameters uploaded by the client, the server directly performs secure aggregation in the ciphertext domain without decrypting the intermediate calculation, ensuring that the client information is not leaked. After aggregation, the server sends the result to the client, and the client that meets the threshold condition cooperates to complete joint decryption and updates the global model accordingly. The private key holding client PKC cooperates to generate the public key of the Paillier encryption system through a secret sharing mechanism in the system initialization stage, and each implicitly holds a corresponding private key share locally. In the training process, the private key holding client PKC first receives the encrypted global model from the server, decrypts it partially using the local private key share, and cooperates with other private key holding clients PKC to complete joint decryption to restore the global model. Subsequently, the private key holding client PKC performs model training based on the local private data set and injects adaptive differential privacy noise during the training process to enhance the privacy protection capability. After training, the private key holding client PKC selectively encrypts the local model parameters based on the parameter sensitivity using Paillier encryption and uploads the encrypted model parameters to the server for subsequent secure aggregation. The non-private key holding client Non-PKC is used to receive the model and perform precision evaluation, does not participate in private key generation and holding, cannot perform model parameter encryption and aggregation decryption, and does not participate in the training process or encryption and decryption operations.

[0010] Further, the private key holding client PKC cooperates to generate the public key of the Paillier encryption system through a secret sharing mechanism in the system initialization stage, and each implicitly holds a corresponding private key share locally, and a multi-key Paillier threshold encryption scheme is adopted.

[0011] Further, the multi-key Paillier threshold encryption scheme includes client key generation, distributed double prime test, plaintext encryption and plaintext decryption; wherein the client key generation adopts a distributed protocol, and the public key and private key shares are jointly generated by multiple holders under a semi-honest security model; the distributed double prime test is used for distributed double prime test on the candidate N in the process of client key generation; the plaintext encryption is Paillier encryption of the local model parameters of the client; and the plaintext decryption is decryption of the encrypted global model from the server to restore the global model.

[0012] Further, the private key holding client PKC selectively performs Paillier encryption on the local model parameters according to parameter sensitivity, and a selectable parameter encryption scheme is adopted.

[0013] Further, the selectable parameter encryption scheme selectively encrypts the most sensitive parameters, reduces the calculation and communication burden, and provides targeted privacy protection for the model.

[0014] Further, the selectable parameter encryption scheme is implemented as follows:

[0015] Step 1 Privacy leakage analysis: At the beginning of each round of federated learning, the client first evaluates the privacy sensitivity of each parameter in the model based on the local data set to identify the model parameters that are most likely to cause privacy leakage; specifically, the client measures the privacy leakage risk through the sensitivity of the gradient; given the model parameter matrix w, the input matrix x and the label vector y, the client calculates the sensitivity measure J m of the parameter w m (y k ) through the following formula:

[0016]

[0017] wherein is the loss function; J m (y k ) represents the change rate of the parameter w m to the model output y k , which measures the sensitivity of the parameter to the model output; by calculating the sensitivity measure on different data samples and taking the norm, the client obtains a matrix S i about the sensitivity of all parameters, i.e., the local sensitivity matrix; the client generates the local sensitivity matrix S i , and uploads the encrypted [[S i ]] to the server; the sensitivity matrix is used to identify the parameters that are most likely to cause privacy leakage by comparing the sensitivity of different parameters, and the parameters are taken as encryption objects;

[0018] Step 2 Client-side Encryption Mask Negotiation: After receiving the local encryption sensitivity matrix of all clients, the server generates a global sensitivity matrix [[S]] to measure the global privacy risk. The global sensitivity matrix is generated in the following way:

[0019] [[S]] = åa i · [[S i ]]

[0020] where a i is the aggregation weight of client i; the server determines the parameter set that needs to be encrypted according to the preset encryption ratio p e [0, 1], where p represents the proportion of parameters that need to be encrypted in the overall model parameters; the server sends the global sensitivity matrix [[S]] to the clients, where |W| represents the total number of parameters to be trained in the federated learning model, and the clients jointly decrypt and select the mask matrix corresponding to the most sensitive p x |W| parameters according to the ordering of the global sensitivity matrix, setting the corresponding positions to 1 and the remaining positions to 0, to generate the encryption mask matrix M.

[0021] Step 3 Selective Encryption Model Aggregation: In each round of communication, each client selectively encrypts the model parameters w i according to the encryption mask matrix M to form partially encrypted model parameters The specific selective encryption formula is as follows:

[0022]

[0023] where [[w i ]] is the result of full encryption of the local model parameters of client i; then the client uploads the partially encrypted model update to the server; the server directly aggregates the model updates in the encryption domain to obtain the global partially encrypted model where a i represents the aggregation weight of client i. Then, the server broadcasts the global partially encrypted model to all clients.

[0024] In the subsequent parameter aggregation process, the server always completes the aggregation operation in the encryption domain without decrypting the model parameters, ensuring the privacy and security of the model updates during transmission and aggregation.

[0025] Further, the private key holding client PKC performs model training based on the local private data set and injects adaptive differential privacy noise during the training process to enhance the privacy protection capability, which is realized through an adaptive differential privacy federated learning algorithm.

[0026] Further, in the adaptive differential privacy federated learning algorithm, the client dynamically adjusts the privacy budget and noise scale in each round of training according to the current model convergence state and gradient amplitude; a larger privacy budget is allocated in the early stage to inject stronger noise; the noise amplitude is reduced in the later stage to enhance the stability of the model when approaching the optimal solution; as the federated learning continues to advance and the global model accuracy continues to improve, to reduce the impact of noise on the local model training accuracy, the privacy budget allocated to the client should also be increased accordingly; after the client obtains the latest global model, if the loss function value of the model is calculated using local data and the loss function value of the two consecutive rounds shows a downward trend, it can be considered that the model is gradually approaching the optimal solution, at this time the privacy budget allocated to the local training of the client should be increased; the specific way of adaptive allocation of privacy budget: the client first sets an initial allocated privacy budget and a privacy budget growth rate γ; as the training iteration proceeds, if the loss function value of the model shows an upward trend in a certain round, more privacy budget is allocated to the current gradient update of the client, and the privacy budget allocated in the new round of training is dynamically adjusted by the following formula:

[0027]

[0028] That is, the current privacy budget is composed of the previous privacy budget and the newly allocated privacy budget ; to further improve the training efficiency, the gradient with the superimposed new disturbance is calculated using the improved gradient averaging algorithm based on zero central differential privacy zCDP.

[0029] Further, the system performs federated learning training as follows:

[0030] At the beginning of federated training, all clients perform initialization operations, use the multi-key Paillier threshold encryption scheme to generate keys without the need for a trusted third party, each client has a public and private key pair, and the private keys of each user are different; then, the client initializes the model using the local data set, and evaluates the privacy sensitivity of each parameter in the model to identify the model parameters that are most likely to cause privacy leakage, and generates a local sensitivity matrix S i ; at the same time, in the iterative training process of the model, random noise is added to the local model parameters through the adaptive differential privacy mechanism, and the scale of the noise is dynamically adjusted according to the convergence degree of the model; the client uploads the encrypted local sensitivity matrix S i and the local model parameters w i to the server; the server side securely aggregates the received client models and local sensitivity matrices, and broadcasts them to all clients participating in federated learning training;

[0031] In each subsequent federated learning process, the client first decrypts the global sensitivity and the global parameters, generates an encrypted mask matrix M according to the global sensitivity; the adaptive differential privacy is used for dynamic adjustment of noise disturbance during local training; after local training, the selective parameter encryption mechanism is adopted, the model parameters with high sensitivity are partially encrypted by Paillier, and the remaining insensitive parts are directly in plaintext form; meanwhile, the sensitivity matrix is recalculated and encrypted; finally, the client uploads the locally encrypted model gradient to the server together with the fully encrypted local sensitive gradient [[S i ]]. In the aggregation stage, the server directly performs aggregation operation in the encryption domain, and the aggregation result is decrypted by the client in the encrypted state through the Paillier threshold decryption mechanism, so that the model update and the global sensitivity matrix aggregation remain in the encrypted state in the whole process; in the joint decryption process of the client, each client only holds a private key share, and only after the joint decryption of the threshold number of clients, the aggregation result can be restored, thereby enhancing the defense capability of the system against internal curious devices and collusion attacks.

[0032] Compared with the prior art, the present application has the following beneficial effects: the present application is a federated learning system MKSE-AdpFL based on multi-key homomorphic encryption and adaptive differential privacy, which solves the following key technical problems and defects through innovative scheme design:

[0033] (1) Stronger privacy protection: the present application uses Paillier combined with zCDP to ensure the security of the federated learning system. Paillier semi-homomorphic encryption provides end-to-end data protection capability, ensuring that the model parameters remain in an encrypted state during transmission and aggregation. Compared with other homomorphic encryption algorithms, the encryption calculation process of Paillier is relatively simple, the encryption and decryption efficiency is better, and Paillier has randomness. The zCDP technology has tighter privacy guarantee and more flexible privacy budget management capability. Compared with traditional differential privacy methods, it can better control privacy loss, especially in multiple rounds of training.

[0034] (2) No need for a trusted third party to distribute keys: the present application adopts a Paillier threshold key generation scheme without a trusted third party, and the system generates a public and private key pair in cooperation between the clients. Previous research mostly relies on a trusted third party to generate keys or only describes the generation process in theory, while the present application provides a complete and executable implementation scheme under the semi-honest security model.

[0035] (3) Support distributed computing and joint decryption: The decryption operation is completed through the joint participation of multiple parties, and each party can perform joint encryption and decryption without revealing its own key. Even if some holders are offline or malfunction, the system can still complete decryption through other valid parties, ensuring the continuity of model aggregation and training process, and enhancing the robustness of the system.

[0036] (4) Anti-collusion: The present application adopts a threshold decryption mechanism. During model aggregation, the server securely aggregates model parameters in the encrypted domain through Paillier threshold encryption. Only when the threshold value is met can the decryption operation be completed. Even if some holders collude maliciously, they cannot decrypt the complete ciphertext unless the number of colluding parties reaches the threshold value. By setting a suitable threshold value, the present application can maintain the confidentiality and integrity of the model parameters when facing internal collusion attacks and client-server collusion attacks.

[0037] (5) Selective parameter encryption: In the model update process, the present application selectively encrypts sensitive parameters using Paillier encryption. Parameters with low sensitivity are in plaintext form, reducing the number of encryption operations and communication data volume, and reducing computing and communication costs. Without sacrificing privacy protection capabilities, the system's communication and training efficiency is significantly improved.

[0038] (6) Adaptive differential privacy mechanism: By adaptively adjusting the noise amplitude of the client, the privacy budget is dynamically allocated. In the early stage of model training, larger noise is injected to enhance privacy protection capability; in the model convergence stage, the noise amplitude is reduced to improve model accuracy and convergence speed. Compared with the fixed budget scheme, this method can enhance privacy protection while reducing interference with model performance.

[0039] (7) Robustness and fault tolerance: In the case of client disconnection or partial client failure, the system can still complete model aggregation and decryption through the remaining holders, ensuring the robustness of the system in complex environments. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 The system architecture of the present application. DETAILED DESCRIPTION

[0041] The technical solutions of the present application will be specifically described below in conjunction with the drawings.

[0042] The application provides a federated learning system based on multi-key homomorphic encryption and adaptive differential privacy, comprising a client and a server, wherein the client is divided into a private key holding client (PKC) and a non-private key holding client (Non-PKC) according to whether a private key share is held; in the whole federated learning training process, only encrypted model parameters are exchanged between the client and the server, and the server cannot directly obtain the plaintext information of any model, so as to effectively guarantee the privacy security of the model in the transmission and aggregation process.

[0043] The following is the specific implementation process of the application.

[0044] 1. System framework

[0045] Figure 1 For the system architecture of the application, the system of the application comprises the following three entities:

[0046] The scheme proposed in the application is based on the traditional federated learning system architecture, and the system is composed of two types of entities: a server and a client. The client is further divided into a private key share-holding client (PKC) and a non-private key share-holding client (Non-PKC) according to whether a private key share is held. In the whole federated training process, only encrypted model parameters are exchanged between the client and the server, and the server cannot directly obtain the plaintext information of any model, so as to effectively guarantee the privacy security of the model in the transmission and aggregation process. The system framework of MKSE-AdpFL is as shown in Figure 1

[0047] Server (Server): The server is the coordination and aggregation core in the system, responsible for receiving encrypted model updates from the client in each round of training. For the encrypted parameters uploaded by the client, the server can directly perform secure aggregation in the ciphertext domain, without decryption, to complete intermediate calculation, so as to ensure that the client information is not leaked. After aggregation, the server sends the result to the client, and the client that meets the threshold condition cooperates to complete joint decryption, and updates the global model accordingly.

[0048] ​Private Key Holder Client (PKC): A private key holder client collaboratively generates the public key of the Paillier encryption system through a secret sharing mechanism during the system initialization phase, and implicitly holds a corresponding private key share locally. During the training process, the client first receives the encrypted global model from the server, partially decrypts it using the local private key share, and collaborates with other private key holder clients to complete joint decryption, restoring the global model. Subsequently, the client trains the model based on the local private dataset and injects adaptive differential privacy noise during the training process to enhance privacy protection capabilities. After training, the client selectively encrypts the local model parameters based on parameter sensitivity using Paillier encryption and uploads the encrypted model parameters to the server for subsequent secure aggregation.

[0049] Non-Private Key Holder Client (Non-PKC): Non-private key holder clients do not participate in private key generation and holding, and cannot perform model parameter encryption and aggregated decryption. Such clients are mainly used to receive models and perform accuracy evaluation, and do not participate in the training process or encryption and decryption operations. They play a role in receiving and verifying model updates in the system, ensuring the normal operation of the system.

[0050] 2. System Foundation Components

[0051] 2.1 Federated Learning

[0052] Federated learning is a distributed machine learning method that allows multiple clients (such as devices or organizations) to jointly train a global model without sharing their respective data. In this way, federated learning protects data privacy. A federated learning system generally consists of a central server and multiple local clients. Each client holds a local dataset D n , including training set validation set and test set The core goal of the system is to build a global model through the training of local clients on their respective data, combined with the aggregation operation of the central server. In this system, the server's task is to generate a new global model based on the local model parameters (such as weight updates Δw n ) uploaded by the clients. This aggregation process can be represented by the following formula:

[0053]

[0054] where N is the number of clients, and Δw n represents the weight update of client n. Each client trains the model based on its local data and sends the updated parameters to the server, which aggregates these local parameters to form a global update.

[0055] FedAvg (Federated Averaging) is one of the most commonly used algorithms in federated learning, aiming to minimize the global loss function F(w), i.e., obtaining the optimal global model parameters w through local training. The core idea of FedAvg is that the server updates the global model by weighted averaging of the local training results of the devices. The optimization problem of FedAvg can be represented as:

[0056]

[0057] where F(w) is the global loss function; F k (w) is the local loss function of the kth client; is the weight of each client data; n k is the number of data samples of client k; is the sum of all client data samples.

[0058] The local loss function F k (w) of client k is composed of the average loss of all its samples:

[0059]

[0060] where F i (w) is the loss of the ith sample, usually the cross-entropy loss in classification problems or the squared error in regression problems.

[0061] 2.2 Zero-Concentrated Differential Privacy

[0062] Zero-Concentrated Differential Privacy (zCDP) is an improvement and generalization of differential privacy, aiming to provide a more flexible way to measure privacy loss and provide more detailed privacy budget control while maintaining privacy protection. zCDP describes privacy loss through concentration bounds and Rényi divergence, which can effectively track privacy consumption in multiple rounds of queries or iterative operations, especially suitable for high-dimensional data machine learning tasks.

[0063] The core idea of zCDP is to replace the single parameter ∈ in classical differential privacy with the variance of privacy loss. The constraint of traditional differential privacy is defined by the probability of the difference in output, while zCDP introduces a new loss measure called privacy loss random variable to measure the privacy consumption of the algorithm on the data set. This loss random variable is usually assumed to follow a quadratic distribution, hence the name "concentration".

[0064] Suppose there are two adjacent data sets D and D', which differ only in one data point. A randomized algorithm satisfies ρ-zCDP if for any two adjacent datasets D and D', the randomized algorithm The output privacy loss random variable L satisfies:

[0065]

[0066] where, denotes the mathematical expectation; ρ is a parameter that measures the privacy loss, called the concentration of privacy loss. zCDP uses this parameter to define the privacy consumption, and ρ is usually more flexible and easier to control than the privacy budget ∈ in traditional differential privacy.

[0067] zCDP is a further simplified form based on Rényi differential privacy (RDP). RDP uses the Rényi divergence D α to measure the difference between two distributions, while zCDP mainly uses the second-order Rényi divergence (i.e., the Rényi divergence when α = 2) to define privacy loss. Therefore, zCDP is a concentration constraint that constrains the second moment of privacy loss, rather than just an upper bound. This approach has better additive properties in privacy consumption tracking.

[0068] zCDP has good composition, that is, multiple algorithms that satisfy zCDP can still satisfy zCDP when combined. Specifically, if there are two algorithms that satisfy ρ1-zCDP and ρ2-zCDP respectively, then their combination satisfies (ρ1+ρ2)-zCDP. Compared with traditional differential privacy, zCDP can more accurately manage and track privacy consumption in multiple rounds of operations or complex algorithms. At the same time, zCDP can be converted to and from traditional (∈, δ)-DP:

[0069] If an algorithm satisfies ρ-zCDP, it also satisfies (∈, δ)-DP, and where ∈ is the privacy loss upper bound parameter in traditional differential privacy, used to quantify the maximum distinguishable degree of two adjacent datasets on the algorithm output result distribution, also called privacy budget; δ is the probability relaxation term in traditional differential privacy, used to tolerate the failure of privacy mechanisms under a very small probability. That is, in the extreme case of a probability of at most δ, the privacy disclosure of the algorithm may exceed the limit of ∈.

[0070] This means that zCDP can provide stronger privacy guarantees, especially when dealing with large amounts of data or multiple iterations. By reasonably selecting the parameter ρ, zCDP can provide good privacy protection for machine learning algorithms, and can effectively reduce privacy loss in practical applications.

[0071] 2.3 Shamir secret sharing over integer domain

[0072] The Shamir secret sharing scheme over integer domain is an extension of the traditional Shamir secret sharing scheme, which is suitable for secret sharing and reconstruction over integer domain (instead of finite field). In Paillier encryption system, both plaintext and ciphertext are in integer modulo N and N 2 The following operations, the traditional finite field Shamir secret sharing is no longer applicable in this scenario. Therefore, Shamir secret sharing over integer domain is introduced to solve the problem of integer domain operation and decryption carry in Paillier homomorphic encryption.

[0073] The Shamir secret sharing scheme over integer domain is also based on Lagrange interpolation, that is, in integer domain, a t-1 degree polynomial can be uniquely determined by at least t different data points. The main difference between the Shamir secret sharing scheme over integer domain and the finite field is:

[0074] The Shamir scheme over finite field needs to define a large prime number q, so that all operations are carried out in finite field .

[0075] The Shamir scheme over integer directly defines the polynomial in integer domain, which allows arbitrary integer coefficients and secrets.

[0076] In order to prevent secret leakage, randomization processing is needed for polynomial coefficients, and the commonly used method is to introduce large range randomness and integer congruence operation. The complete process of Shamir secret sharing scheme over integer domain is as follows:

[0077] (1) Secret generation (distribution phase): assuming s is the secret to be shared, defined in integer set , n is the total number of participants, t is the minimum number of shares required to recover the secret (threshold). Set a large integer interval [-I, I] to limit the range of secret and polynomial coefficients. Define a constant Δ = n! (i.e. the factorial of the number of participants), which is used to expand the solution space of interpolation and improve security. Randomly generate an integer polynomial of degree t-1: f(x) = Δs + a1x + a2x 2 +…+a t- 1x t-1 , where: s is the secret, a1, a2,..., a t-1 are uniformly randomly selected integers in the interval [-KΔ 2 , KΔ 2 ], K is a large constant to ensure the security of the algorithm, x is the independent variable of the polynomial, representing the unique identification number or index number of each participant. Generate a share S i i for each participant i. (i, S i) securely distributed to each participant i.

[0078] (2) Secret reconstruction (recovery phase): Assuming that t valid shares (x1, S1), (x2, S2),..., (x t , t , the constant term of the original polynomial (i.e., the secret s) can be recovered by Lagrange interpolation:

[0079]

[0080] where the Lagrange basis function is:

[0081]

[0082] Solving for the constant term at x = 0 recovers the secret:

[0083]

[0084] Dividing the result by Δ gives the original secret:

[0085]

[0086] 2.4 Threshold Paillier Encryption

[0087] In the standard Paillier scheme, decryption relies on the private key λ, and once the private key is compromised, the security is broken. In the threshold Paillier scheme, the private key λ is divided into n shares and distributed to n participants through a threshold scheme, such that the encryption scheme satisfies: at least t participants (threshold) must cooperate to complete decryption; less than t shares cannot recover the original private key. The threshold Paillier scheme consists of the following five algorithms:

[0088] S Threshold-Paillier = (KeyShareGen, PublicKeyGen, Enc, DecShare, Combine)

[0089] (1) KeyShareGen (Threshold Key Generation) distributes the Paillier private key λ to multiple parties through a threshold scheme. Generate two large prime numbers p and q, calculate n = p · q, λ = lcm(p - 1, q - 1). Split λ into n shares according to the Shamir threshold secret sharing scheme: f(x) = λ + a1x + a2x 2 + … + a t-1 x t-1 , generate a key share λ i = f(i) mod n for each participant, and publish the public key (n, g).

[0090] (2) PublicKeyGen (Generate Public Key): Collect all n shares of the public key part, calculate the Paillier public key n and the generator g.

[0091] (3) Enc (Encryption): The encryption operation is the same as the standard Paillier encryption: c = g m ·r n mod n 2 .

[0092] (4) DecShare (Generate Decryption Share): Each participant holding a private key share independently generates a decryption share, that is, each participant i uses its own private key share λ i Calculate: Where Δ = n!.

[0093] (5) Combine (Combine decryption results): When at least t decryption shares are collected, use Lagrange interpolation to combine the decryption results:

[0094]

[0095] Use standard Paillier decryption to recover the plaintext:

[0096]

[0097] 3、System design

[0098] 3.1 Multi-key Paillier threshold encryption

[0099] The multi-key Paillier threshold encryption scheme described in the present application is based on distributed key generation and threshold decryption mechanism, and proposes an efficient and secure encryption scheme suitable for privacy protection and secure aggregation tasks. The scheme supports multiple participants to cooperate to generate Paillier public keys, and implicitly holds key shares locally, ensuring the security of the system between multiple clients. The system completes key generation, encryption, decryption and aggregation operations through the following core modules.

[0100] 3.1.1 Client key generation

[0101] Key generation adopts a distributed protocol, and multiple holding parties (parties) jointly generate public key and private key shares under the semi-honest security (semi-honest security) model. The key generation process includes the following steps:

[0102] Step 1: Generate a large prime number: First, all holding parties P iAgree on a random large prime P. Since the "prime" p and q are generated securely, the product N = p q of them needs to be computed. To ensure P > N, a large prime P of at least k bits is chosen.

[0103] Step 2 Generate random numbers and secret shares: Each party P i generates two random numbers p and q i of length i . Then, using a secret sharing scheme with threshold t, two t-1 degree polynomials f i (x) and g i (x) are generated in the integer field ( is a finite field (integer field modulo P), representing the set of all integers modulo a prime number P, forming a ring / field modulo P, also called prime field) to represent p i and q i respectively:

[0104]

[0105] Step 3 Generate additional random polynomials for randomization of multiplication protocol: Each party P i further generates a random polynomial h i (x) of degree 2(t-1) in the field , satisfying h i (0) = 0. This random polynomial is necessary in the secret sharing multiplication protocol to ensure that the polynomials in the encrypted parameter multiplication are random. Then, P i sends the generated share values <f i (j), g i (j), h i (j)> to all other parties P j (j∈{1,2,...,n}).

[0106] Step 4 Aggregate share values to generate candidate key: Each party P i after receiving the share values from other parties, calculates the following three sums:

[0107]

[0108] They represent the shares of p, q, and a random zero value respectively. Through these share values, the parties can generate the secret share value of the candidate key N, defined as:

[0109]

[0110] where N iis a data point of the secret sharing polynomial. By Lagrange interpolation, the complete candidate key N can be reconstructed from at least 2t-1 shares of the sharing values. After that, the candidate key N is used as the modulus in the Paillier encryption system, i.e. the product of two prime numbers.

[0111] Step 5 Generation of candidate key using Lagrange interpolation: From the 2t-1 shares of the sharing values, the complete candidate key N is generated using Lagrange interpolation, completing the candidate key generation.

[0112] Step 6 Primality test of candidate key: After the candidate key N is generated, each participant needs to test its primality (biprimality) to confirm whether it is the product of two prime numbers. If N does not meet this condition, the protocol will start over and generate a new candidate key.

[0113] Step 7 Additive sharing of φ(N): Once the candidate key N passes the primality test, N is added to the public key group, i.e. confirming that N is a suitable modulus, each participant will have the additive sharing of the prime factors p and q of N. According to the definition of Paillier encryption, the expression of φ(N) is: φ(N) = (p-1)(q-1) = pq-p-q+1 = N-p-q+1. Therefore, the φ(N) secret sharing value of each participant P i can be expressed as:

[0114]

[0115] This means that each participant implicitly holds the sharing value of φ(N) through the polynomial sharing mechanism.

[0116] Step 8 Generation of public key value θ: Each participant P i selects a random number and where K is a parameter generated on the integer domain according to the secret sharing protocol, β i and R i are the additive sharing of β and R, i.e.

[0117] β, R are intermediate values in the key calculation process, and each participant P i constructs the secret sharing of θ by locally calculating the following expression:

[0118] θ i = Δf φ (i) β i +NΔR i +0 mod P

[0119] where 0 is shared by a random polynomial and hi (x) Same as Δ = n! (i.e. factorial of the number of participants). Since R is shared over the integer domain, Δf φ (i) β i and Δ·R are expressed as integers modulo P over the integer domain. From the shared values θ i of the 2t-1 θ secret holders, θ is reconstructed using Lagrange interpolation. Since θ is computed modulo P, θ mod N is added to the public key set, which is (N, θ).

[0120] Step 9 generates P i The corresponding private key share: holder P i According to the corresponding secret sharing value θ i of θ modulo P, generate its corresponding private key share: f priv_key (i) = θ - NΔR i

[0121] In order to correctly calculate θ and N in , the prime number P needs to be large enough. That is: The maximum values of N and θ are denoted as N max and θ max , respectively. Since p i and q i have a length of , it can be deduced that And θ = Δφ(N)β + NΔR, then Therefore, in order to prevent overflow under modulo P, P should satisfy: P > 2θ max .

[0122] 3.1.2 Distributed primality test

[0123] In a federated learning system based on multi-key Paillier threshold encryption, generating a secure key pair requires ensuring that the generated N is the product of two large prime numbers while preventing a single holder or server from inferring the specific value of the prime factor. Therefore, distributed primality testing of the candidate N is required in the key generation process to ensure that it is the product of two large prime numbers. The present application adopts the following distributed primality testing protocol: the primality test requires p ≡ q ≡ 3 mod 4, and the shared shares generated by the first holder P1 satisfy p1 mod 4 = q1 mod 4 = 3, and the other holders P i The generated shared shares satisfy p i mod4 = q i mod4 = 0. The test is completed by performing the following steps under the semi-honest security (Semi-Honest Security) model:

[0124] Step 1 Generate random numbers and share: Each party first agrees to generate a random value in a large prime field and make sure its Jacobi symbol satisfies

[0125] Step 2 Parameter calculation and release: The first holding party P1 calculates and releases:

[0126]

[0127] Other holding parties P i calculate and release:

[0128]

[0129] Step 3 Consistency check: All holding parties verify whether the following equation holds in the shared field:

[0130]

[0131] If the equation does not hold, it means that N is not the product of two prime numbers.

[0132] Step 4 Repeat the test and confidence control: Since a single test may be misjudged due to accidental factors, the protocol will repeat the execution of different random values g multiple times until the probability of a non-prime number N passing the test is very low. More precisely, the probability of a non-prime number N passing this test is controlled to be

[0133] Proof:

[0134] According to Euler's theorem, for prime numbers p and q, we have:

[0135]

[0136] Therefore, if p≡q≡3mod4, and is an odd number, then:

[0137]

[0138] Thus, the Jacobi symbol of the two prime numbers p and q is equal, and satisfies:

[0139]

[0140] From the equation holds: and i≠ 1Q i modN holds.

[0141] During the above testing process, each party completes the verification of the N-co-primality through distributed computing, and does not leak the specific value of the prime factor. In addition, Boneh and Franklin have proved that the upper bound of the probability of incorrect non-co-primality judgment of the protocol is This distributed co-primality testing mechanism ensures that the generated Paillier key pair meets the basic security requirements, while effectively preventing potential holder collusion and inference attacks.

[0142] 3.1.3 plaintext encryption

[0143] In the encryption process of the multi-key Paillier threshold encryption, the client first generates a model update parameter locally and converts it into an integer to meet the format requirements of Paillier encryption. Then, the holder P1 generates a random factor to ensure the randomness and security of the encryption process. The model update parameter is encrypted using the Paillier public key N, and the formula is c = (1 + N) m ·r N mod N 2 , where m is the model update parameter, N is the Paillier public key, and r is the random factor. After encryption, the client uploads the ciphertext to the server. The server performs direct addition operation on the model update ciphertext of all clients in the encryption domain, and the generated result corresponds to the encryption value of the sum of the update parameters of each client Paillier encryption has the property of homomorphic addition, allowing direct aggregation of model updates in the encryption domain. The server cannot directly decrypt the model updates during aggregation, ensuring the privacy and security of client data. In addition, due to the use of independent random factors and threshold decryption technology in the multi-key Paillier mechanism, replay attacks, eavesdropping attacks, and internal collusion attacks are prevented, enhancing the overall security and robustness of the federated learning system.

[0144] 3.1.4 plaintext decryption

[0145] In the decryption process of the multi-key Paillier threshold encryption, at least 2t-1 holders are required to participate in decryption, and each holder P i uses its private key share to calculate the decryption share corresponding to the client, and shares the result with other holders. Then, each holder combines at least 2t-1 decryption shares to obtain the complete decryption result, and the specific decryption steps are as follows:

[0146] Step 1: Holders participate in decryption: At least 2t-1 holders are required to participate in decryption, and each holder uses its private key share to perform partial decryption on the ciphertext c. That is, each holder calculates:

[0147]

[0148] and their results c i shared with other shareholders.

[0149] Step 2: Merge partial decryption results: Each shareholder combines these partial decryption results through product aggregation, and reconstructs the decryption intermediate value through Lagrange interpolation The specific formula is:

[0150]

[0151] Step 3: Recover the plaintext: Finally, the complete plaintext m is recovered by the following formula:

[0152]

[0153] where φ(N) is the Euler function of N, and θ is a public key shared by all shareholders. Since f priv_key (x) is a polynomial of degree 2t-2, at least 2t-1 shareholders are needed to complete decryption. However, by re-sharing f priv_key (x), the threshold can be reduced to t.

[0154] Through the threshold decryption mechanism, the system can complete decryption without relying on a single shareholder, as long as the threshold number is met. Even if some shareholders are offline or behave maliciously, the system can still successfully recover the plaintext through the remaining shareholders. This mechanism improves the security and robustness of the system in actual deployment.

[0155] 3.2 Selective parameter encryption

[0156] In federated learning, fully encrypted models can provide high privacy protection, but will significantly increase computational complexity and communication overhead, affecting the training efficiency of the model. To maintain model accuracy while providing effective privacy protection, the present invention proposes a selective parameter encryption (SPE) scheme. This scheme analyzes the privacy sensitivity of model parameters and selectively encrypts the most sensitive parameters, reducing computational and communication burden while providing targeted privacy protection for the model. The following are the detailed design steps of selective parameter encryption:

[0157] Step 1 Privacy Leakage Analysis: At the beginning of each round of federated learning, the client first evaluates the privacy sensitivity of each parameter in the model based on the local dataset to identify the model parameters that are most likely to cause privacy leakage. Specifically, the client measures the privacy leakage risk by sensitivity to gradients. Given the model parameter matrix w, the input matrix x, and the label vector y, the client calculates the parameter w using the following formula: m The sensitivity measure J m (y k ):

[0158]

[0159] in is the loss function; J m (y k ) represents the parameter w m Output y to the model k The rate of change of measures the sensitivity of the parameters to the model output. By calculating this value on different data samples and taking its norm, the client can obtain a matrix S about the sensitivity of all parameters. i (i.e. local sensitivity matrix). The client generates the local sensitivity matrix S i , and the encrypted [[S i The sensitivity matrix is ​​used to compare the sensitivity of different parameters and identify the parameters that are most likely to cause privacy leakage as encryption targets.

[0160] Step 2: Inter-client encryption mask negotiation: After receiving the local encryption sensitivity matrices of all clients, the server generates a global sensitivity matrix [[S]] to measure the global privacy risk. The global sensitivity matrix is ​​generated as follows:

[0161] [[S]]=∑α i ·[[S i ]]

[0162] where α i is the aggregation weight of client i. The server determines the set of parameters that need to be encrypted based on the preset encryption ratio p∈[0,1], where p represents the proportion of parameters that need to be encrypted in the overall model parameters. The server sends the global sensitivity matrix [[S]] to the client, where |W| represents the total number of parameters to be trained in the federated learning model. The client jointly decrypts and, based on the sorting of the global sensitivity matrix, selects the mask matrix corresponding to the first p×|W| most sensitive parameters and sets them to 1. The remaining positions are set to 0, thus generating the encrypted mask matrix M.

[0163] Step 3 Selective encryption model aggregation: In each round of communication, each client selectively encrypts the model parameters w i according to the encryption mask matrix M, forming partially encrypted model parameters The specific selective encryption formula is as follows:

[0164]

[0165] where [[w i ]] is the result of full encryption of the local model parameters of client i; then the client uploads the partially encrypted model update to the server; the server directly weights and aggregates the model update in the encryption domain to obtain the global partially encrypted model where α i represents the aggregation weight of client i. Then, the server broadcasts the global partially encrypted model to all clients.

[0166] In the subsequent parameter aggregation process, the server always completes the aggregation operation directly in the encryption domain without decrypting the model parameters, ensuring the privacy and security of the model update during transmission and aggregation.

[0167] By introducing privacy sensitivity analysis, dynamic encryption mask generation, and selective parameter encryption, the proposed scheme achieves a good balance between model accuracy, communication efficiency, and privacy protection. By encrypting only the most sensitive parameters, the amount of encrypted and transmitted data is effectively reduced. Selective parameter encryption reduces the communication and computational burden of the system while providing high privacy protection and excellent model performance.

[0168] 3.3 Adaptive differential privacy

[0169] The present application believes that in the early stage of federated learning, the parameters of the model have not been fully optimized, and the amplitude of gradient update is large, at this time the influence of noise on the model is relatively small. Therefore, in the early stage of training, appropriately increase the noise scale, by injecting more noise in the stochastic gradient descent (SGD), it can help the model quickly jump out of the saddle point, so as to improve the exploration ability of the model and speed up the convergence speed of the model. However, as the training progresses, the model gradually approaches the optimal solution, and the amplitude of gradient update gradually decreases. At this time, the interference of noise on the model performance will gradually increase, which may cause the model to oscillate and even have difficulty converging when approaching the optimal solution. Therefore, in the later stage of training, the noise scale needs to be appropriately reduced to reduce the interference of noise on the model update, so as to improve the final accuracy and convergence speed of the model.

[0170] Based on the above analysis, the application proposes a self-adaptive differential privacy federated learning algorithm. In this algorithm, the client dynamically adjusts the privacy budget and noise scale in each round of training according to the current model convergence state and gradient amplitude. In the early stage, a larger privacy budget is allocated, and stronger noise is injected to improve the robustness and exploration ability of the model; in the later stage, the noise amplitude is reduced to enhance the stability of the model when approaching the optimal solution, thereby improving the final accuracy of the model. By reasonably dynamically allocating the privacy budget, the algorithm improves the model accuracy while maintaining a high level of privacy protection.

[0171] With the continuous promotion of federated learning and the continuous improvement of global model accuracy, to reduce the impact of noise on the training accuracy of the local model, the privacy budget allocated to the client should also be increased accordingly. When the client obtains the latest global model, if the loss function value of the model is calculated using local data and the loss function value of the two consecutive rounds is decreasing, that is, then it can be considered that the model is gradually approaching the optimal solution, and the privacy budget allocated to the local training of the client should be appropriately increased. The specific client privacy budget allocation strategy is as follows:

[0172]

[0173] In the model iteration process of federated learning, the client adaptively adjusts the privacy budget used in each round of gradient update according to the allocated privacy budget. The specific way of adaptive allocation of privacy budget is as follows: the client first sets an initial allocated privacy budget and a privacy budget growth rate γ. With the progress of training iteration, the initial allocated privacy budget may be too small, resulting in a larger noise amplitude introduced in the gradient update, affecting the convergence speed of the model. If the loss function value of the model shows an upward trend in a certain round, that is, t+1 )>F(w t ), which indicates that the current noise disturbance may be too large, inhibiting the normal update of the model. Therefore, more privacy budget needs to be allocated to the current gradient update of the client to reduce the impact of noise and improve the convergence effect of the model. The privacy budget allocated in the new round of training can be dynamically adjusted by the following formula:

[0174]

[0175] That is, the current privacy budget is the superposition of the previous privacy budget and the newly allocated privacy budget Co-constitute. In order to further improve the training efficiency, the improved gradient average algorithm based on zCDP is used to calculate the gradient of the superimposed new disturbance. Without discarding the original disturbance gradient, the accuracy of the disturbance gradient is improved step by step until the gradient after disturbance does not affect the convergence of the model, that is, F(w t+1 )≤F(w t ). The above adaptive privacy budget allocation method is used to add noise disturbance to the local model of the client until the client completes the local model training or the privacy budget set by the client is exhausted.

[0176] 3.4 Federated learning system based on multi-key homomorphic encryption and adaptive differential privacy

[0177] The present application proposes an efficient and secure federated learning system based on multi-key Paillier threshold encryption and adaptive differential privacy. The federated learning system structure is composed of a server and K clients. The global aggregation round is T. The training epoch number of each client is E. The evaluation index is the global model accuracy after T rounds.

[0178] Unlike traditional federated learning algorithms, the present application is based on multi-key Paillier threshold encryption and adaptive differential privacy, which protects sensitive parameters through noise disturbance and encryption algorithm, and simultaneously adopts an adaptive privacy budget allocation method to dynamically adjust the noise scale, ensuring that the model performance and training efficiency are maintained while improving privacy protection. Since fully encrypted models can significantly increase computational complexity and communication overhead, thereby affecting the training efficiency of the model, the present application proposes a selectable parameter encryption scheme that selectively encrypts the most sensitive parameters, reducing the computational and communication burden while providing targeted privacy protection for the model.

[0179] At the beginning of federated training, all clients perform initialization operations, use the multi-key Paillier threshold encryption scheme to generate keys without the need for a trusted third party, each client has a public-private key pair, and the private keys of each user are different. Subsequently, the client initializes the model using the local data set and evaluates the privacy sensitivity of each parameter in the model to identify the model parameters that are most likely to cause privacy leakage, generating a local sensitivity matrix S i . At the same time, during the iterative training of the model, random noise is added to the local model parameters through the adaptive differential privacy mechanism, and the scale of the noise is dynamically adjusted according to the convergence degree of the model. The client uploads the encrypted local sensitivity matrix S i and local model parameters w i to the server. The server side securely aggregates the received client models and local sensitivity matrices and broadcasts them to all clients participating in federated learning training.

[0180] In each subsequent federated learning process, the client first decrypts the global sensitivity and global parameters, generates an encrypted mask matrix M according to the global sensitivity. The adaptive differential privacy is used to dynamically adjust the noise disturbance during local training. After local training, the selective parameter encryption mechanism is adopted. For the model parameters with high sensitivity, Paillier encryption is used, and the remaining insensitive parts are directly taken in the form of plaintext. At the same time, the sensitivity matrix is recalculated and encrypted. Finally, the client uploads the locally encrypted model gradient to the server together with the fully encrypted local sensitive gradient [[S i ]]. In the aggregation stage, the server directly performs aggregation operation in the encryption domain. The aggregation result is decrypted by the client in the encryption state through the Paillier threshold decryption mechanism, so that the model update and the global sensitivity matrix aggregation remain in the encryption state in the whole process. In the joint decryption process of the client, each client only holds a private key share. Only when the threshold number of clients jointly decrypt, the aggregation result can be restored, thereby enhancing the defense ability of the system against internal curious devices and collusion attacks.

[0181] The present application combines the multi-key Paillier threshold encryption and adaptive differential privacy, and can provide strong privacy protection in a semi-honest environment while maintaining the convergence speed and performance of the model. Through selective parameter encryption, the system is significantly superior to the existing method in terms of communication and calculation overhead, and provides a new solution for the practical deployment of large-scale federated learning systems.

[0182] The system of the present application is aimed at the federated learning application scenario with high privacy requirements, and is designed to realize efficient model collaborative training while protecting the security of user data. By introducing the multi-key Paillier threshold encryption mechanism without a trusted third party, the system can encrypt and transmit and aggregate the model parameters under the condition that the server is untrusted, thereby effectively preventing the model information from being stolen or misused in the transmission and processing process, and protecting the privacy and security of the local model and data of the participants.

[0183] At the same time, the system combines an adaptive differential privacy mechanism, which can dynamically allocate privacy budget and adjust the noise intensity according to the loss change in the model training process, so as to reduce the influence on the model accuracy as much as possible while ensuring differential privacy protection. In order to further reduce the calculation and communication overhead, the product designs a selective encryption mechanism based on parameter sensitivity, which only encrypts the parameters with high risk of leakage, realizes the balance between privacy protection strength and system performance, and is suitable for financial, medical and other scenes with dual requirements of privacy protection and calculation efficiency.

[0184] The above is the preferred embodiment of the present application, any change made according to the technical solution of the present application, as long as the function generated does not exceed the scope of the technical solution of the present application, belongs to the protection scope of the present application.

Claims

1. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy, characterized by: It includes clients and servers, among which clients are divided into private key holding clients PKC and non-private key holding clients Non-PKC according to whether they hold private key shares; during the entire federated learning training process, only encrypted model parameters are exchanged between the client and the server, and the server cannot directly obtain any plaintext information of the model, so as to effectively protect the privacy security of the model during transmission and aggregation.

2. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 1, characterized in that: The server, as the coordination and aggregation core of the system, is responsible for receiving encrypted model updates from the client during each training round. For the encrypted parameters uploaded by the client, the server performs secure aggregation directly in the ciphertext domain, without decrypting the intermediate calculations, ensuring that client information is not leaked. After the aggregation is completed, the server sends the result to the client, and the clients that meet the threshold conditions collaborate to complete the joint decryption and update the global model accordingly; the private key holding client PKC collaboratively generates the public key of the Paillier encryption system through the secret sharing mechanism during the system initialization phase, and each implicitly holds the corresponding private key share locally; during the training process, the private key holding client PKC first receives the encrypted global model from the server, partially decrypts it using the local private key share, and collaborates with other private key holding client PKC to complete the joint decryption to restore the global model. Subsequently, the private key holding client PKC trains the model based on the local private data set, and injects adaptive differential privacy noise during the training process to enhance privacy protection capabilities; after training is completed, the private key holding client PKC selectively Paillier encrypts the local model parameters according to the parameter sensitivity, and uploads the encrypted model parameters to the server for subsequent secure aggregation; the non-private key holding client Non-PKC is used to receive the model and perform accuracy evaluation. It does not participate in the generation and holding of private keys, cannot encrypt model parameters and aggregate decryption, and does not participate in the training process or encryption and decryption operations.

3. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 2, characterized in that: The private key holder is the client PKC. During the system initialization phase, the public key of the Paillier encryption system is collaboratively generated through a secret sharing mechanism, and each client implicitly holds the corresponding private key share locally. This is implemented using a multi-key Paillier threshold encryption scheme.

4. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 3, characterized in that: A multi-key Paillier threshold encryption scheme includes client key generation, distributed biprimality testing, plaintext encryption, and plaintext decryption. Client key generation uses a distributed protocol, where multiple holders jointly generate shares of public and private keys under a semi-honest security model. The distributed biprimality testing is used to perform distributed biprimality testing on the candidate N during the client key generation process. Plaintext encryption performs Paillier encryption on the client's local model parameters. Plaintext decryption decrypts the encrypted global model from the server to restore the global model.

5. The federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 2, characterized in that: The private key holding client PKC selectively performs Paillier encryption on local model parameters according to parameter sensitivity, using a selectable parameter encryption scheme.

6. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 5, characterized in that: Optional parameter encryption schemes can be used to selectively encrypt the most sensitive parameters, reducing computational and communication burdens while providing targeted privacy protection for the model.

7. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 5 or 6, characterized in that: You can choose a parameter encryption scheme, which is implemented as follows: Step 1 Privacy Leakage Analysis: At the beginning of each round of federated learning, the client first evaluates the privacy sensitivity of each parameter in the model based on the local dataset to identify the model parameters that are most likely to cause privacy leakage. Specifically, the client measures the privacy leakage risk by its sensitivity to gradients. Given the model parameter matrix w, the input matrix x, and the label vector y, the client calculates the parameter w using the following formula: m The sensitivity measure J m (y k ): Where l(·) is the loss function; J m (y k ) represents the parameter w m Output y to the model k The rate of change of the parameter is used to measure the sensitivity of the parameter to the model output. By calculating the sensitivity measurement value on different data samples and taking its norm, the client obtains a matrix S about the sensitivity of all parameters. i That is, the local sensitivity matrix; the client generates the local sensitivity matrix S i , and the encrypted [[S i ]]Upload to the server; the purpose of the sensitivity matrix is ​​to identify the parameters that are most likely to cause privacy leakage by comparing the sensitivity of different parameters, and use them as encryption objects; Step 2: Inter-client encryption mask negotiation: After receiving the local encryption sensitivity matrices of all clients, the server generates a global sensitivity matrix [[S]] to measure the global privacy risk. The global sensitivity matrix is ​​generated as follows: [[S]]=∑α i ·[[S i ]] where α i is the aggregation weight of client i; the server determines the set of parameters that need to be encrypted based on the preset encryption ratio p∈[0,1], where p represents the proportion of the parameters that need to be encrypted in the overall model parameters; The server sends the global sensitivity matrix [[S]] to the client, where |W| represents the total number of parameters to be trained in the federated learning model. The client jointly decrypts and, based on the sorting of the global sensitivity matrix, selects the mask matrices corresponding to the first p×|W| most sensitive parameters and sets them to 1, and sets the remaining positions to 0, thus generating an encrypted mask matrix M. Step 3 Selectively encrypted model aggregation: In each round of communication, each client selectively encodes the model parameters w according to the encryption mask matrix M. i Encrypt to form partially encrypted model parameters The specific selective encryption formula is as follows: Among them [[w i ]] is the result of fully encrypting the local model parameters of client i; the client then uploads the partially encrypted model update to the server; The server directly performs weighted aggregation on the model updates in the encryption domain to obtain the global partial encryption model. where α i represents the aggregate weight of client i; The server then encrypts the global partial model Broadcast to all clients; During the subsequent parameter aggregation process, the server always completes the aggregation operation directly in the encrypted domain without decrypting the model parameters, ensuring the privacy and security of model updates during transmission and aggregation.

8. The federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 2, characterized in that: The private key holding client PKC performs model training based on a local private dataset and injects adaptive differential privacy noise during the training process to enhance privacy protection capabilities. This is specifically achieved through an adaptive differential privacy federated learning algorithm.

9. The federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to claim 8, characterized in that: In the adaptive differential privacy federated learning algorithm, the client dynamically adjusts the privacy budget and noise scale in each round of training based on the current model convergence state and gradient amplitude. In the early stages, a larger privacy budget is allocated, injecting stronger noise; in the later stages, the noise amplitude is reduced to enhance the stability of the model as it approaches the optimal solution. With the continuous advancement of federated learning and the continuous improvement of global model accuracy, in order to reduce the impact of noise on the accuracy of local model training, the privacy budget required to be allocated by the client should also be increased accordingly; after the client obtains the latest global model, if the loss function value of the model is calculated using local data, and the loss function value shows a downward trend for two consecutive rounds, it can be considered that the model is gradually approaching the optimal solution. At this time, the privacy budget allocated to the client's local training should be increased; the specific method of adaptively allocating privacy budget: the client first sets an initial allocated privacy budget and the privacy budget growth rate γ; as the training iterations proceed, if the model's loss function value shows an upward trend in a certain round, more privacy budget is allocated to the client's current gradient update. The privacy budget allocated in the new round of training is dynamically adjusted by the following formula: That is, the current privacy budget is determined by the previous privacy budget Adding the newly allocated privacy budget Together they constitute; to further improve the training efficiency, an improved gradient averaging algorithm based on zero-centralized differential privacy zCDP is used to calculate the gradient of the superimposed new perturbation.

10. A federated learning system based on multi-key homomorphic encryption and adaptive differential privacy according to any one of claims 1 to 9, characterized in that: The system performs federated learning training as follows: At the beginning of federated training, all clients perform initialization operations and use the multi-key Paillier threshold encryption scheme to generate keys without the need for a trusted third party. Each client has a public-private key pair, and each user's private key is different. Subsequently, the client initializes the model with a local dataset and evaluates the privacy sensitivity of each parameter in the model to identify the model parameters that are most likely to cause privacy leakage and generate a local sensitivity matrix S. i At the same time, during the iterative training of the model, random noise is added to the local model parameters through the adaptive differential privacy mechanism, and the scale of the noise is dynamically adjusted according to the degree of convergence of the model; The client will local sensitivity matrix S i and local model parameters w i After encryption, it is uploaded to the server; the server securely aggregates the received client model and local sensitivity matrix and broadcasts it to all clients participating in the federated learning training; In each subsequent round of federated learning, the client first decrypts the global sensitivity and global parameters, and generates an encrypted mask matrix M based on the global sensitivity. Adaptive differential privacy is used to dynamically adjust noise perturbations during local training. After local training is complete, a selective parameter encryption mechanism is used, using Paillier encryption for the more sensitive model parameters, while the remaining insensitive parameters are directly in plain text. Simultaneously, the sensitivity matrix is ​​recalculated and encrypted. Finally, the client will selectively encrypt the local model gradient Compared with the fully encrypted local sensitive gradient [[S i ]] is uploaded to the server; in the aggregation phase, the server performs aggregation operations directly in the encrypted domain, and the aggregation results are jointly decrypted by the clients through the Paillier threshold decryption mechanism in an encrypted state, ensuring that the model update and the global sensitivity matrix aggregation remain encrypted throughout the entire process; in the client joint decryption process, each client only holds a share of the private key, and the aggregation results can only be restored after a threshold number of clients have jointly decrypted them, thereby enhancing the system's defense capabilities against internal curious devices and collusion attacks.

Images