Anonymous and Byzantine robust federated learning privacy protection method and system

Abstract

The invention belongs to the technical field of federated learning privacy protection, and discloses an anonymous and Byzantine robust federated learning privacy protection method and system with safe and efficient aggregation. Firstly, the invention provides a single mask protocol, which not only can effectively protect the security of privacy data, but also improves the aggregation efficiency. And then, anonymous ring signature and secure shuffling are used, so that the metadata of the client message is eliminated while the identity of the client is ensured to be legal, and the legality and anonymity of the identity of the client are ensured at the same time. The invention also realizes a baffle mechanism for malicious update, so that the influence of the malicious update on the global model can be ignored, thereby realizing Byzantine robustness.

Description

Technical Field

[0001] This invention belongs to the field of privacy protection technology in federated learning, and particularly relates to an anonymous and Byzantine robust federated learning privacy protection method and system. Background Technology

[0002] Federated learning achieves collaborative modeling across data sources through a distributed architecture. Its core mechanism lies in enabling multiple participants to jointly optimize the global model through multiple rounds of parameter exchange without sharing local data. Specifically, each client calculates local model parameters based on its local private dataset, and the central server aggregates these parameters and calculates and generates global model parameters, thus completing collaborative training under conditions of physical data isolation. However, while federated learning solves the "data silo" problem caused by traditional centralized machine learning, it also raises more complex security threats, prompting researchers to delve deeper into its potential risks from multiple dimensions. One of the most important research directions is the security of federated learning. Although the federated learning framework avoids the leakage of raw data through local data storage, the local model parameters uploaded by the client still pose a risk of privacy leakage. Attackers can use gradient inversion techniques to reverse-engineer the statistical features of the original training samples from the local model parameters. In text generation tasks, this manifests as semantic leakage of the client's input corpus, while in image classification scenarios, it may expose key visual patterns of the training images. Such data privacy breaches not only seriously threaten the security of clients' private data, but also directly violate privacy protection regulations such as the EU's General Data Protection Regulation (GDPR), the US California Consumer Privacy Act, and China's Personal Information Protection Law.

[0003] Recent secure aggregation schemes encrypt model parameters uploaded by clients using cryptographic methods, ensuring that the central server can only decrypt the aggregated global parameter mean, but cannot access the individual parameter content of any participant. Taking the secure aggregation scheme proposed by Google engineers as an example, in each training round, the client adds pairs of random masks to its local model parameters and uploads the masked local model parameters to the server. The server can only decrypt the aggregated gradient through a mask cancellation mechanism when the number of participating clients reaches a preset secret sharing recovery threshold. However, such schemes often require multiple rounds of interaction between the client and server to achieve parameter privacy, which not only significantly increases communication overhead but may also lead to reverse engineering of client behavior patterns due to the exposure of verification information. More importantly, there is a fundamental contradiction between the privacy protection characteristics of secure aggregation mechanisms and Byzantine robustness within federated learning frameworks. Malicious clients can launch targeted or non-targeted attacks by constructing parameters that deviate from the normal distribution: non-targeted attacks significantly distort gradient directions or parameter value ranges to reduce the overall performance of the global model; targeted attacks, on the other hand, implant specific backdoor functions to manipulate the model in the target scene, such as tampering with model parameters in an autonomous driving system to make it misinterpret a stop sign as a speed limit sign. Because the encrypted aggregation process completely obscures the server's observability of individual parameters, it cannot effectively identify and filter malicious parameters, thus significantly reducing the difficulty of carrying out attacks.

[0004] The anonymity of client identities within federated learning frameworks is also a research area that urgently needs further exploration. While secure aggregation mechanisms can effectively protect the privacy of model parameters, client metadata, such as network addresses, communication timing, and interaction frequency, still poses a potential risk of privacy breaches. This risk is particularly pronounced in highly sensitive scenarios such as smart healthcare, where attackers can indirectly infer client identities and health conditions by parsing metadata. For example, a client's network address can be traced back to a medical institution within a specific geographical region. If that institution specializes in treating rare diseases, the associated client's metadata may directly suggest that the client suffers from such a disease. Furthermore, the time interval between data uploads, request frequency, and communication persistence can indirectly reflect a patient's treatment cycle and disease progression—high-frequency data transmission typically corresponds to the acute treatment phase, low-frequency uploads may indicate a stabilizing condition, and communication termination may indicate patient recovery or withdrawal from treatment.

[0005] Current federated learning systems still face multiple challenges in terms of security. First, secure aggregation protocols rely on multi-round interactive verification between the client and server, which not only leads to an exponential increase in communication overhead but may also expose the client's resource attributes and data distribution characteristics through time-series feature analysis. More seriously, existing secure aggregation schemes for federated learning cannot eliminate implicit associations between client metadata and sensitive information. For example, in scenarios such as collaborative medical modeling, the network trajectories of participants may directly map to specific disease treatment institutions, forming a strong correlation factor for identity inference. Finally, there is a structural conflict between privacy protection mechanisms and model robustness requirements: while encrypted aggregation processes can effectively prevent the leakage of individual parameters, they simultaneously block the detection of malicious behavior based on gradient feature analysis, allowing Byzantine attackers to carry out targeted or non-targeted damage through covert parameter tampering. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention provides a privacy protection method and system for anonymous and Byzantine robust federated learning, and particularly relates to an anonymous and Byzantine robust federated learning method and system with secure and efficient aggregation.

[0007] This invention employs a single-mask protocol during federated learning training, which effectively protects the security of private data and improves aggregation efficiency. Then, anonymous ring signatures and secure shuffling are used to simultaneously ensure both client legitimacy and anonymity. Finally, a shielding mechanism for malicious parameters is implemented, preventing them from affecting the global model and thus achieving Byzantine robustness.

[0008] This invention is implemented as follows: a privacy-preserving method for anonymous and Byzantine robust federated learning, comprising: using a single-mask protocol to protect local model parameters and improve aggregation efficiency; subsequently, using ring signatures and secure shuffling to achieve anonymous authentication and metadata removal; furthermore, a baffle mechanism is developed to protect the accuracy of the global model and resist malicious parameters. The scheme includes four stages: initialization, anonymous authentication, local training and secure shuffling, and robust aggregation; the server, fog node, and client sequentially initialize the key homomorphic pseudo-random function and homomorphic secret sharing function, the anonymous ring signature and secure shuffling algorithm, and the symmetric key and anonymous signature parameters; the client generates an anonymous signature using the relevant parameters of the anonymous ring signature and the public keys of other clients in the group; the fog node anonymously verifies the legitimacy of the client's identity and publishes a list of legitimate clients; the client generates a mask seed, generates a secret sharing share using the homomorphic secret sharing function, and encrypts the secret sharing share using a symmetric key; the client calculates the mask using the key homomorphic pseudo-random function based on the mask seed and adds it to the local model parameters; the client sends the encrypted secret sharing share to the fog node. Fog nodes broadcast encrypted secret share portions to other clients; clients decrypt to obtain secret share portions and accumulate them; clients construct vectors using a secure shuffling algorithm, containing masked local model parameters, secret share random numbers, and the sum of secret share portions; fog nodes calculate and generate fog node vectors and forward them to the server; the server recovers the masked local model parameters, secret share random numbers, and the sum of secret shares based on the fog node vectors; the server uses a homomorphic secret sharing function to calculate the aggregated fog node mask; the server aggregates the masked local model parameters to obtain fog node model parameters, adds the fog node mask, and eliminates the influence of the mask; the server uses cosine similarity and clustering algorithms to weight the fog node parameters, finally generating weighted global model parameters, and broadcasts them to all clients.

[0009] Furthermore, the privacy protection approach for anonymous and Byzantine robust federated learning includes the following steps:

[0010] Step 1, Initialization Phase: The server, fog nodes, and clients complete the initialization of various parameters, which will be used in subsequent steps in the scheme; including the key homomorphic pseudo-random function, homomorphic secret sharing function, relevant parameters and hash functions in anonymous ring signature, reversible Bloom lookup table and hash function in secure shuffling algorithm, as well as symmetric key and anonymous signature parameters;

[0011] Step 2, Anonymous Authentication Phase: The client generates a random number to calculate the parameters related to the anonymous signature and generates an anonymous signature; the fog node anonymously verifies the client's identity and publishes a list of legitimate clients;

[0012] Step 3, Local Training and Secure Shuffling Phase: The client generates a mask to encrypt local model parameters, completing the secure sharing of secret shares. Simultaneously, fog nodes collect and forward client messages. The client calculates the mask and adds it to the local model parameters. The client calculates the secret share of the mask seed and encrypts it before sending it to the fog nodes. The fog nodes broadcast this to other clients. The client receives the seed and calculates the sum of secret shares. The client uses the secure shuffling function to construct a vector from the masked local model parameters, the shared secret random number, and the sum of secret shares, and sends it to the fog nodes. The fog nodes construct fog node vectors using the secure shuffling algorithm and send them to the server.

[0013] Step 4, Robust Aggregation Phase: The server calculates the fog node model parameters and global model parameters, and performs malicious detection on the fog node model parameters; the server restores the fog node vectors to the masked local model parameters, secret shared random numbers, and secret share sum; the server calculates the fog node model parameters and global model parameters, and uses cosine similarity and clustering algorithms to perform malicious detection on the fog node model parameters; the server weighted aggregates the fog node model parameters, generates weighted global model parameters, and broadcasts the parameters.

[0014] Furthermore, during the initialization phase, the server constructs a key homomorphic pseudo-random function KF. LWE The system includes a homomorphic secret sharing function (HSS), the IBLT function in the secure shuffling algorithm, and k hash functions; fog nodes generate secret-shared random numbers r for each client in the group. u Ring signature related parameters; the client negotiates key with other clients in the group to generate a symmetric key sk. u,v It generates anonymous ring signature parameters and publishes the signature public key.

[0015] Furthermore, the initialization phase in step one specifically includes:

[0016] (1) Server initialization: The server constructs a key homomorphic pseudo-random function KD. LWE Homomorphic secret sharing function HSS, IBLT function in secure shuffling algorithm and k different hash functions H1…H k And send it to all fog nodes and clients.

[0017] (2) Fog node initialization: The fog node determines the number of clients in the group to be n, and uses integers from 1 to n as the identifiers of the clients; at the same time, it determines the secret shared random number r for each client in the group. u The homomorphic secret shares a threshold of t; an elliptic curve group E with selection order q' and generator P, and three hash functions. Random selection Calculate the master public key P respectively pub =sP and R u =r'u P; Calculation and e u =r' u +d u s mod q'; Publish public parameters (R) will be transmitted via a secure channel u ,e u Send to the corresponding client within the group; broadcast the secret shared random number r u The threshold for sharing homomorphic secrets is t, which is given to the client.

[0018] (3) Client initialization: The client identifies other clients in the group and performs key negotiation to generate a symmetric key sk. u,v Random selection Calculate T u =t u P, Public Key PK u =(T u ,R u Send public key PK u The fog node is published to other clients within the group; computation v∈{1,…,n}and v≠u; u,v represent the parameters generated by the current client in a one-to-one correspondence with other clients.

[0019] Furthermore, during the anonymization authentication phase, random numbers are selected in each round of training. use Hash function calculation l v (v∈{1,…,n} and v≠u) and h u ; Calculate the client's own c u l u And C; send anonymous signature σ=(C,c1,..,c n Give the fog node; calculate the fog node. u (u∈{1,…,n}); Anonymous verification of the client's identity.

[0020] Furthermore, the anonymous authentication phase in step two specifically includes:

[0021] (1) Generate anonymous signatures

[0022] 1) Select random numbers calculate v∈{1,…,n}and v≠u;

[0023] 2) Calculation in

[0024] 3) Calculate c u =h u -∑v∈U,v≠u c v mod q';

[0025] 4) Calculation And C = cc u (l u t u +e u )mod q';

[0026] 5) Send anonymous signature σ=(C,c1,..,c n Give the fog node.

[0027] (2) Verify signature

[0028] 1) Fog node calculation Where u∈{1,…,n};

[0029] 2) Anonymous client identity verification, verification If the equation is true, the client's identity is valid; otherwise, the client's identity is invalid.

[0030] 3) Publish a list of legitimate clients.

[0031] Furthermore, during the local training and secure shuffling phases, each client randomly generates a mask seed in each round of training. Where q is a large integer, b is shared using a homomorphic secret sharing algorithm. u Perform secret sharing to generate secret share b u,v The client uses a symmetric key sk. u,v Encrypted secret share b u,v , obtain ciphertext c u,v and ciphertext c u,v Send to the fog node; the fog node receives the ciphertext c u,v Broadcast to other clients in the group; clients receive and decrypt c v,u Obtain secret share b v,u The total secret share b' is calculated. u The client expands the mask seed into a vector b. u And using the key homomorphic pseudo-random function KF LWE Calculate the mask p u ; Bold parameters indicate that the parameter is in vector form, and this representation will be used throughout the text; The client generates local model parameters x based on the local dataset. u Calculate the masked local model parameters y u The client uses a secure shuffling algorithm to shuffle (y u ,r u ,b' u Construct a vector y'u The data is then sent to the fog nodes; the fog nodes perform secure shuffling, calculate the fog node vector y', and send it to the server.

[0032] Furthermore, the local training and secure shuffling phase in step three specifically includes:

[0033] (1) Homomorphic secret sharing of the mask seed

[0034] 1) The client randomly generates a mask seed. Where q is a large integer;

[0035] 2) The client randomly selects t-1 integer coefficients a1…a t-1 Construct polynomial f u (r)=a0+a1r+a2r 2 +…+a t-1 r t-1 mod p, where a0 = b u The client generates a secret share b for other clients. u,v =f u (r v Using a symmetric key sk u,v After encryption, the ciphertext c u,v Send to the fog node;

[0036] 3) Fog nodes broadcast to other clients;

[0037] 4) Client decryption c v,u Obtain secret share b v,u The total secret share b' is calculated. u =∑ v∈U b v,u .

[0038] (2) Generate a mask and encrypt local model parameters

[0039] 1) The client expands the mask seed into a vector b. u Using the key homomorphic pseudo-random function KF LWE Calculate the mask p u =KF LWE (b u );

[0040] 2) The client generates local model parameters x based on the local dataset. u Add the mask to the local model parameters and calculate y. u =x u +p u .

[0041] (3) Safe mixing

[0042] 1) The client uses a pseudo-random number generator to generate pseudo-name pIDs. u Construct an object (pID) u (m, counter), where counter represents a counter, initialized to 1; and m = (y u ,r u ,b' u ), y u These are the local model parameters after masking, r u It is a secret shared random number on the client side, b' u It is the sum of the secret shares received by the client;

[0043] 2) The client initializes a zero vector y' u Use k hash functions to convert pID u Mapped to vector y' u Find k distinct positions in the array and place (pID) u ,m,counter) to the corresponding position;

[0044] 3) The client will transfer vector y' u Send to the fog node;

[0045] 4) Perform safe mixed washing on fog nodes, and calculate the fog node vector y' = ∑ u∈U y' u , where each y' u (pID) u Add the corresponding values ​​of m and counter; send the fog node vector y' to the server.

[0046] Furthermore, in the robust aggregation phase, during each training round, the server recovers the data contained in the fog node vector y', obtaining y u ,r u ,b' u The server calculates the fog node model parameters y. FN =∑ u∈FN y u U∈FN indicates that the server knows which fog node the parameter comes from, but cannot determine which client within the fog node group it belongs to; the server uses a homomorphic secret sharing function to calculate the sum b of the mask seeds of clients within the fog node group. FN =∑ u∈FN b u The server will b FN Expanded to vector b FN And using the key homomorphic pseudo-random function KF LWE Calculate the mask p FN =KF LWE (b FNThe server removes the mask and calculates the model parameters and global model parameters for each fog node. The server performs malicious detection on the fog node model parameters and performs weighted aggregation to finally generate weighted global model parameters.

[0047] Furthermore, the robust aggregation phase in step four includes:

[0048] (1) Restore message

[0049] 1) The server receives the fog node vector y' and uses the secure shuffling algorithm to recover the message;

[0050] 2) The server initializes an empty list m' and a queue Q containing all the position data of vector y';

[0051] 3) The server retrieves the position information from the queue and then checks if the counter for that position is 1; if it is not equal to 1, it retrieves the next position information until counter = 1.

[0052] 4) If counter = 1, the server retrieves the message m at that location and puts it into m'; the server retrieves the pseudonym pID. u The storage location of the message in the vector y' is calculated using k hash functions, and the pID of these locations is subtracted from y'. u The data is m, counter); if the counter at this position is 1, then the position information H is... i∈k (pID u Add it to queue Q;

[0053] 5) Repeat steps 3) and 4) until the queue is empty, and finally output the message m' = ({y u ,r u ,b' u} u∈FN );

[0054] (2) Calculate model parameters

[0055] 1) The server calculates the fog node model parameters y. FN =∑ u∈FN y u y FN This represents the calculated fog node model parameters; the server contains multiple fog nodes, but for ease of description, the following descriptions will use a single fog node as a representative to describe the calculations related to the fog node.

[0056] 2) The server uses a homomorphic secret sharing function to reconstruct the mask seed. Where u≠v, b FN This represents the sum of the mask seeds for clients within the fog node group;

[0057] 3) Server extension b FN For vector b FN Using the key homomorphic pseudo-random function KF LWE Calculate the mask p FN =KF LWE (b FN );

[0058] 4) The server removes the mask and obtains the fog node model parameters x. FN =y FN -p FN =∑ u∈FN y u -KF LWE (b FN )=∑ u∈FN x u +∑ u∈FN KF LWE (b u )-KF LWE (b FN )=∑ u∈FN x u Among them, the key homomorphic pseudo-random function KF LWE The property makes ∑ u∈FN KF LWE (b u )=KF LWE (b FN );

[0059] 5) Server aggregates global model parameter x AS =∑ FN∈AS x FN ;

[0060] (3) Detect malicious parameters and perform weighted aggregation

[0061] 1) The server selects a baseline model parameter x based on the weights. base Calculate z AS =x base -x AS , z FN =x FN -x AS , The score is obtained from the parameters of the fog node model. FN ;

[0062] 2) The server assigns scores {score} FN} FN∈AS K-means clustering yields the first layer of clusters, which may produce three distribution types;

[0063] a) If the distribution is a single cluster, it means that the quality of all model parameters is within an acceptable range, and the weights wFN =1;

[0064] b) If the clusters are distributed in a single, dispersed manner, it indicates that there may be potential malicious clients launching poisoning attacks. The clustering results are divided into high-quality clusters and low-quality clusters; the fog node model parameter weights w in the high-quality clusters... FN =1, while the weight w in low-quality clusters FN =0;

[0065] c) If it is a multi-cluster distribution, it indicates that a malicious client has launched a poisoning attack; the weight w of the low-quality clusters in the first-level clustering. FN =0; high-quality clusters are further clustered into finer sub-clusters using a second layer of clustering; the centroid of the highest-scoring sub-cluster is _score_. best Weight w FN =1; If the high-quality sub-cluster contains less than half of the total number of model parameters, then select a small subset of 5%-10% from the remaining clusters and add it to the high-quality sub-cluster, with its weight... score′ FN =score FN -score best The remaining sub-cluster weights w FN =0; If the number of model parameters in a high-quality sub-cluster exceeds half of the total number of model parameters, then the remaining sub-cluster weight w FN =0;

[0066] 3) The server aggregates the weighted model parameters x AS =∑ FN∈AS w FN x FN The global model parameters are sent to each client as arguments. The client uses the global model parameters to calibrate its local model. After the parameters are completed, the next round of federated learning begins, and the process stops when the model parameters meet the conditions or the set number of rounds is reached.

[0067] Another object of the present invention is to provide a federated learning privacy protection system that applies the aforementioned anonymity and Byzantine robust federated learning privacy protection methods, the federated learning privacy protection system comprising:

[0068] The initialization module is used to complete the initialization of the key homomorphic pseudo-random function, homomorphic secret sharing function and symmetric key through the collaboration of the server, fog node and client, and establish the secret sharing auxiliary function and key infrastructure required for multi-party secure computation;

[0069] The anonymous authentication module is used by fog nodes to anonymously verify the legitimacy of clients within a group and publish a list of legitimate clients.

[0070] The local training and secure shuffling module is used by the client to generate a mask seed and generate shares through homomorphic secret sharing. After encryption using a symmetric key, the seed is sent to the fog node. After the fog node broadcasts the encrypted shares, the client decrypts and accumulates the shares. Combined with the secure shuffling algorithm, a vector containing masking model parameters, secret shared random numbers, and the sum of shares is constructed. The fog node summarizes and generates a fog node vector and forwards it to the server.

[0071] The robust aggregation module is used by the server to recover the masked local model parameters, the secret shared random numbers and the sum of the shares, and to calculate the fog node mask through homomorphic secret sharing. After aggregating the masked parameters, the influence of the mask is eliminated. The fog node parameters are weighted and aggregated by combining cosine similarity and clustering algorithms to generate weighted global model parameters and broadcast them to all clients.

[0072] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0073] First, this invention proposes an anonymous Byzantine robust federated learning method with secure and efficient aggregation. The core of this invention is the proposal of a single-mask protocol to protect local updates and improve aggregation efficiency. Subsequently, this invention uses anonymous ring signatures and secure shuffling to ensure client identity legitimacy while maintaining client anonymity. Furthermore, this invention develops a baffle mechanism to maintain the accuracy of the global model and resist malicious parameters. More specifically, this invention proposes a single-mask protocol based on homomorphic secret sharing and homomorphic pseudo-random functions as the underlying structure of our scheme. This protocol both protects local updates and improves aggregation efficiency. This invention also designs an anonymous ring signature and a secure shuffling mechanism using a reversible Bloom lookup table. This mechanism not only anonymously verifies the legitimacy of client identities but also eliminates client message metadata within a secure and efficient aggregation framework, achieving client anonymity. This invention also constructs a baffle mechanism based on a fog node grouping strategy, which utilizes cosine similarity and clustering algorithms to prevent malicious parameters. This mechanism prevents malicious parameters from propagating outside the fog nodes, ensuring that they do not have a non-negligible impact on the accuracy of the global model, thereby achieving Byzantine robustness.

[0074] Second, the single-mask federated learning method based on homomorphic secret sharing and key homomorphic pseudo-random functions provided by this invention protects the privacy of local updates, ensures the legitimacy and anonymity of client identities through anonymous ring signatures and secure shuffling mechanisms, and achieves Byzantine robustness using cosine similarity and clustering algorithms; it reduces client communication overhead and the influence of malicious parameters, improves model aggregation efficiency and security, saves mask computation resources while maintaining global model accuracy.

[0075] Compared with the prior art, the present invention has the following advantages:

[0076] (1) The security aggregation protocol relies on multiple rounds of client-server interaction for verification. These interactions not only multiply the communication overhead, but also pose a risk of exposing client resource attributes and data distribution characteristics through periodic analysis.

[0077] (2) A more critical issue lies in the inherent correlation between client metadata, such as network addresses and communication frequencies, and sensitive information in existing federated learning security aggregation schemes. For example, in a medical federated modeling scenario, a participant's network trajectory may be directly mapped to a specific disease treatment institution, forming a strong identity inference vector.

[0078] (3) There is a structural conflict between privacy protection mechanisms and the need for model robustness. Secure aggregation prevents the leakage of individual updates while hindering the detection of malicious behavior based on gradient features. This limitation allows Byzantine adversaries to perform targeted or non-targeted sabotage through covert parameter tampering.

[0079] Third, this invention proposes for the first time a single-mask federated learning scheme based on homomorphic secret sharing and a key homomorphic pseudo-random function. This scheme is suitable for federated learning in multi-client scenarios, effectively training machine learning models while ensuring the security of client data during training, thus improving the efficiency of federated learning. Simultaneously, it incorporates a secure shuffling algorithm based on a reversible Bloom lookup table, eliminating client message metadata within a secure and efficient aggregation framework, achieving client anonymity and ensuring client data privacy. Furthermore, this invention uses anonymous ring signatures to allow fog nodes to anonymously verify the legitimacy of client identities. Finally, this invention implements a baffle mechanism to resist the influence of malicious parameters on the global model, thereby ensuring Byzantine robustness.

[0080] Current domestic and international approaches to privacy protection in federated learning primarily focus on improving concurrency and authentication, lacking consideration for enhancing training efficiency, client anonymity, and Byzantine robustness. On one hand, attackers can reconstruct sensitive data features or infer client attributes by analyzing local updates. On the other hand, clients may upload malicious updates to disrupt global model aggregation, leading to performance degradation. Therefore, improving secure aggregation efficiency, protecting client anonymity, and resolving the structural conflict between privacy protection mechanisms and model robustness requirements have been long-standing but unresolved technical challenges. This invention addresses these long-standing problems, enabling secure and efficient aggregation with anonymity and Byzantine robustness in federated learning, making it more suitable for practical applications. Attached Figure Description

[0081] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0082] Figure 1 This is a flowchart of the privacy protection method for anonymized and Byzantine robust federated learning provided in this embodiment of the invention;

[0083] Figure 2 This is an interaction diagram of the anonymity and Byzantine robust federated learning privacy protection method provided in the embodiments of the present invention;

[0084] Figure 3 This is a schematic diagram of the privacy protection method for anonymity and Byzantine robust federated learning provided in this embodiment of the invention;

[0085] Figure 4 This is a schematic diagram of the single-mask encryption method provided in an embodiment of the present invention;

[0086] Figure 5 This is a diagram of a secure shuffling method based on a reversible Bloom lookup table provided in an embodiment of the present invention;

[0087] Figure 6 This is a schematic diagram illustrating the time overhead of existing federated learning schemes (SecAgg, Secure Aggregation; EffSecAgg, Efficient Secure Aggregation; EPPML, Efficient Privacy-Preserving Machine Learning) and the scheme of our invention (Our Scheme) under different training cycles.

[0088] Figure 7 This is a schematic diagram illustrating the core computational time overhead of the existing federated learning scheme (EPPML, Efficient Privacy-Preserving Machine Learning) and the scheme of the present invention (Our Scheme) under different training cycles. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0090] In existing federated learning architectures, although distributed training among multiple clients can be achieved, privacy breaches, low aggregation efficiency, and the risk of Byzantine attacks remain key unresolved technical challenges. On the one hand, without an effective anonymity mechanism during local model uploads, attackers can identify clients through metadata analysis and then launch differential inference attacks. On the other hand, most existing secure aggregation methods employ multi-round encrypted communication or complex multi-party computation protocols, leading to severe cumulative communication latency and a significant decrease in aggregation efficiency. Furthermore, in untrusted environments, some malicious clients may upload and tamper with parameters, thereby polluting the global model and causing a collapse in model accuracy, i.e., a "Byzantine failure."

[0091] To address the aforementioned issues, this method proposes an anonymous robust federated learning scheme based on a single-mask protocol. By introducing homomorphic secret sharing and homomorphic pseudo-random functions to construct a lightweight single-mask mechanism, local models are masked and then uploaded uniformly, achieving both privacy protection and aggregation compatibility. Based on the mask seed generated on the client side, secret shares are generated through polynomial construction and encrypted transmission using symmetric keys between clients, effectively preventing third-party access to the seed content. All mask shares are decrypted on the client side and accumulated to recover the mask and the sum of local model parameters. Before uploading, pseudo-identity codes and reversible Bloom lookup tables are used to obfuscate parameter metadata, achieving anonymous data publication.

[0092] Meanwhile, to address the issue of server reverse engineering of uploaded client parameters, this method embeds a secure shuffling mechanism into the aggregation framework. By constructing sparse vectors and shuffling their order using multiple hash mappings, the client-uploaded model loses its original identity information after aggregation at the fog nodes. The server can only perceive model vectors from a specific group of fog nodes and cannot pinpoint the specific client, thus achieving a path that balances upload security and anonymity. The entire shuffling mechanism is completed in a single communication, and combined with a single-mask protocol, significantly reduces bandwidth and time overhead.

[0093] To defend against Byzantine attacks, this method introduces a "baffle structure" of fog node grouping and a two-layer clustering mechanism. Cosine similarity is used to measure the difference between each model group and the global model, and K-means clustering is combined to determine parameter credibility. The first layer of clustering identifies the presence of malicious poisoning tendencies, while the second layer accurately identifies the sources of "low-quality" parameters. Finally, model weights are assigned according to the clustering results, with high-credibility models participating in global aggregation and low-credibility parameters directly masked, suppressing the influence of abnormal models on the global model's bias.

[0094] The mask removal process is based on the summation and reconstruction of the mask shares secretly shared by all clients within the fog node to obtain a unified mask. Then, a key-homogeneous pseudo-random function is used to calculate the overall mask vector of the fog node, thereby offsetting perturbations in the aggregated model and restoring the true model parameters. Based on this, the aggregated model retains only the contributions of trusted model data and is not contaminated by anomalous parameters. The final output global model can resist three types of attack threats: parameter poisoning, identity inference, and model contamination.

[0095] This solution achieves a systemic approach that integrates privacy protection, efficiency improvement, and Byzantine robustness through a four-dimensional collaboration of "lightweight encryption, anonymous identity, group isolation, and malicious detection." Compared to existing solutions that rely on multiple rounds of interaction or excessive homomorphic encryption, this method significantly reduces communication complexity, enhances security, and possesses strong deployability and cross-platform portability, making it suitable for federated learning deployment scenarios among large-scale untrusted edge devices.

[0096] To address the problems existing in the prior art, this invention provides an anonymous and Byzantine robust federated learning privacy protection method and system, which will be described in detail below with reference to the accompanying drawings.

[0097] like Figure 1 As shown, the privacy protection method for anonymized and Byzantine robust federated learning provided in this embodiment of the invention includes the following steps:

[0098] S101, Initialization Phase: The server, fog node, and client complete the initialization of various parameters, including the key homomorphic pseudo-random function, homomorphic secret sharing function, relevant parameters and hash function in anonymous ring signature, reversible Bloom lookup table and hash function in secure shuffling algorithm, as well as symmetric key and anonymous signature parameters;

[0099] S102, Anonymous Authentication Phase: The client generates a random number to calculate the parameters related to the anonymous signature and generates an anonymous signature; the fog node anonymously verifies the client's identity and publishes a list of legitimate clients;

[0100] S103, Local Training and Secure Shuffling Phase: The client generates a mask to encrypt local model parameters, completing the secure sharing of the secret share; Fog nodes collect and forward client messages, construct fog node vectors through a secure shuffling algorithm, and send them to the server.

[0101] S104, Robust Aggregation Phase: The server calculates fog node model parameters and global model parameters, uses cosine similarity and clustering algorithms to perform malicious detection on fog node parameters, generates weighted global model parameters, and broadcasts them to all clients.

[0102] The privacy protection method of this invention targets a typical scenario of interaction between participants and the aggregation server: a client-server scenario, where their interaction methods are as follows: Figure 2As shown. The method of this invention mainly targets four stages: initialization, anonymization authentication, local training and secure shuffling, and robust aggregation. The federated learning scheme described in this invention operates as follows: the first round of joint training includes the above four stages, and each subsequent round of joint training only requires running the anonymization authentication, local training and secure shuffling, and robust aggregation stages. In short, the initialization stage only runs in the first round of joint training. In this invention, u represents the current client, and v represents the set of other clients besides the current fog node group.

[0103] During the initialization phase, the server constructs a key homomorphic pseudo-random function KF. LWE The system includes a homomorphic secret sharing function (HSS), the IBLT function in the secure shuffling algorithm, and k hash functions; fog nodes generate secret-shared random numbers r for each client in the group. u Parameters related to anonymous ring signatures; the client negotiates key with other clients in the group to generate a symmetric key sk. u,v It generates anonymous ring signature parameters and publishes the signature public key.

[0104] During the anonymization authentication phase, random numbers are selected in each round of training. use Hash function calculation l v (v∈{1,…,n} and v≠u) and h u ; Calculate the client's own c u l u And C; send anonymous signature σ=(C,c1,..,c n Give the fog node; calculate the fog node. u (u∈{1,…,n}); Anonymously verify the legitimacy of the client's identity and publish the list of legitimate clients U.

[0105] During the local training and secure shuffling phases, each client randomly generates a mask seed in each round of training. Where q is a large integer, b is shared using a homomorphic secret sharing algorithm. u Perform secret sharing to generate secret share b u,v The client uses a symmetric key sk. u,v Encrypted secret share b u,v , obtain ciphertext c u,v and ciphertext c u,v Send to the fog node; the fog node receives the ciphertext c u,v Broadcast to other clients in the group; clients receive and decrypt c v,u Obtain secret share b v,u The total secret share b' is calculated. u The client expands the mask seed into a vector b. uAnd using the key homomorphic pseudo-random function KF LWE Calculate the mask p u ; Bold parameters indicate that the parameter is in vector form, and this representation will be used throughout the text; The client generates local model parameters x based on the local dataset. u Calculate the masked local model parameters y u The client uses a secure shuffling algorithm to shuffle (y u ,r u ,b' u Construct a vector y' u The data is then sent to the fog nodes; the fog nodes perform secure shuffling, calculate the fog node vector y', and send it to the server.

[0106] During the robust aggregation phase, in each training round, the server recovers the data contained in the fog node vector y', obtaining y u ,r u ,b' u The server calculates the fog node model parameters y. FN =∑ u∈FN y u , u∈FN indicates that the server knows which fog node the parameter comes from, but cannot determine which client within the fog node group it belongs to; the server uses a homomorphic secret sharing function to calculate the sum b of the mask seeds of clients within the fog node group. FN =∑ u∈FN b u The server will b FN Expanded to vector b FN And using the key homomorphic pseudo-random function KF LWC Calculate the mask p FN =KF LWE (b FN The server removes the mask and calculates the model parameters and global model parameters for each fog node. The server performs malicious detection on the fog node model parameters and performs weighted aggregation to finally generate weighted global model parameters.

[0107] As a preferred embodiment, such as Figure 3 As shown, the present invention provides a privacy protection method for secure and efficient aggregation of anonymized and Byzantine robust federated learning, which specifically includes the following steps:

[0108] Step 1: Initialization phase.

[0109] The server constructs a key homomorphic pseudo-random function KF. LWE The system includes a homomorphic secret sharing function (HSS), the IBLT function in the secure shuffling algorithm, and k hash functions; fog nodes generate secret-shared random numbers r for each client in the group. uRing signature related parameters; the client negotiates key with other clients in the group to generate a symmetric key sk. u,v It generates anonymous ring signature parameters and publishes the signature public key.

[0110] Step 1.1: Server initialization.

[0111] (1) The server constructs a key homomorphic pseudo-random function KF. LWE Homomorphic secret sharing function HSS, IBLT function in secure shuffling algorithm and k different hash functions H1…H k And send it to all fog nodes and clients.

[0112] Step 1.2: Initialization of fog nodes.

[0113] (1) Fog nodes determine the number of clients in the group as n, and use integers 1, ..., n as the identifiers of the clients;

[0114] (2) Simultaneously determine the secret shared random number r for each client. u The threshold for sharing the homomorphic secret is t, and it is broadcast to the client.

[0115] (3) Choose the elliptic curve group E of order q' and generator P, and three hash functions.

[0116] (4) Random selection Calculate the master public key P respectively pub =sP and R u =r' u P;

[0117] (5) Calculation and e u =r' u +d u s mod q';

[0118] (6) Publish public parameters (R) will be transmitted via a secure channel u ,e u Send it to the corresponding client in the group.

[0119] Step 1.3: Client initialization.

[0120] (1) The client identifies other clients in the group and performs key negotiation to generate a symmetric key sk. u,v u, v represent the parameters generated in a one-to-one correspondence between the current client and other clients.

[0121] (2) Random selection Calculate T u =t uP, Public Key PK u =(T u ,R u Send public key PK u The fog node is then published to other clients within the group.

[0122] (3) Calculation v∈{1,…,n}and v≠u.

[0123] Step 2: Anonymous authentication phase.

[0124] Step 2.1: Generate anonymous signature.

[0125] (1) Select random numbers calculate v∈{1,…,n}and v≠u;

[0126] (2) Calculation in

[0127] (3) Calculate c u =h u -∑ v∈U,v≠u c v mod q';

[0128] (4) Calculation And C = cc u (l u t u +e u )mod q';

[0129] (5) Send anonymous signature σ=(C,c1,..,c n Give the fog node.

[0130] Step 2.2: Verify the signature.

[0131] (1) Fog node calculation Where u∈{1,…,n};

[0132] (2) Anonymously verify the client's identity. If the equation is true, the client's identity is valid; otherwise, the client's identity is invalid.

[0133] (3) Publish the list of legitimate clients U.

[0134] Step 3: Local training and secure shuffling phase.

[0135] Step 3.1: Share the mask seed using a homomorphic secret.

[0136] (1) The client randomly generates a mask seed. Where q is a large integer;

[0137] (2) The client generates a secret share b for other clients. u,v =f u (r v Using a symmetric key sk u,v After encryption, the ciphertext c u,v Send to the fog node;

[0138] (3) Fog nodes broadcast to other clients;

[0139] (4) Client decryption c v,u Obtain secret share b v,u The total secret share b' is calculated. u =∑ v∈U b v,u .

[0140] Step 3.2: Generate a mask and encrypt the local model parameters.

[0141] (1) The client calculates the mask p u =KF LWE (b u );

[0142] (2) The client generates local model parameters x based on the local dataset. u Calculate y u =x u +p u .

[0143] Step 3.3: Safe mixed washing.

[0144] (1) The client constructs an object (pID) u ,m,counter);

[0145] (2) The client will (pID) u Place m, counter) into vector y' u The corresponding location;

[0146] (3) The client will transfer vector y' u Send to the fog node;

[0147] (4) Fog node calculation yields fog node vector y'=Σ u∈U y' u Send it to the server.

[0148] Step 4: Robust aggregation stage.

[0149] Step 4.1: Restore messages.

[0150] (1) The server receives the fog node vector y' and uses the secure shuffling algorithm to recover the message m' = ({y u ,r u ,b' u} u∈FN );

[0151] Step 4.2: Calculate the model parameters.

[0152] (1) The server calculates the fog node model parameters y FN =Σ u∈FN y u ;

[0153] (2) The server reconstructs the mask seed b using a homomorphic secret sharing function. FN ;

[0154] (3) The server calculates the mask p FN =KF LWE (b FN );

[0155] (4) The server removes the mask and obtains the fog node model parameters x. FN ;

[0156] (5) Server aggregates global model parameters x AS =∑ FN∈AS x FN ;

[0157] Step 4.3: Detect malicious parameters and perform weighted aggregation.

[0158] (1) The server selects a baseline model parameter x based on the weights. base Calculate z AS =x base -x AS , z FN =x FN -x AS , The score is obtained from the parameters of the fog node model. FN ;

[0159] (2) The server assigns the score {score} FN} FN∈AS K-means clustering yields the first layer of clusters, which may produce three distribution types;

[0160] 1) If it is a single-cluster clustered distribution, it means that the quality of all model parameters is within an acceptable range, and the weights w FN =1;

[0161] 2) If the clusters are distributed in a single, dispersed manner, it indicates that there may be potential malicious clients launching poisoning attacks. The clustering results are then divided into high-quality clusters and low-quality clusters; the fog node model parameter weights w in the high-quality clusters... FN =1, while the weight w in low-quality clusters FN =0;

[0162] 3) If it is a multi-cluster distribution, it indicates that a malicious client has launched a poisoning attack; the weight w of the low-quality clusters in the first-level clustering. FN =0; high-quality clusters are further clustered into finer sub-clusters using a second layer of clustering; the centroid of the highest-scoring sub-cluster is _score_. best Weight w FN =1; If the high-quality sub-cluster contains less than half of the total number of model parameters, then select a small subset of 5%-10% from the remaining clusters and add it to the high-quality sub-cluster, with its weight... score′ FN =score FN -score best The remaining sub-cluster weights w FN =0; If the number of model parameters in a high-quality sub-cluster exceeds half of the total number of model parameters, then the remaining sub-cluster weight w FN =0;

[0163] (3) The server will aggregate the weighted model parameters x AS =∑ FN∈AS w FN x FN The global model parameters are sent to each client as arguments. The client uses the global model parameters to calibrate its local model. After the parameters are completed, the next round of federated learning begins, and the process stops when the model parameters meet the conditions or the set number of rounds is reached.

[0164] Steps 3.1, 3.2, and 3.3.2 form the complete aggregation process as follows: Figure 4 As shown, it includes the following steps:

[0165] Step 3.1 involves homomorphically sharing the mask seed as follows: Figure 4 As shown in (a), (b), and (c), the steps include:

[0166] (1) The client randomly generates a mask seed. Where q is a large integer;

[0167] (2) The client randomly selects t-1 integer coefficients a1…a1…a2… t-1 Construct polynomial f u (r)=a0+a1r+a2r 2 +…+a t-1r t-1 mod p, where a0 = b u The client generates a secret share b for other clients. u,v =f u (r v Using a symmetric key sk u,v After encryption, the ciphertext c u,v Send to the fog node;

[0168] (3) Fog nodes broadcast to other clients;

[0169] (4) Client decryption c v,u Obtain secret share b v,u The total secret share b' is calculated. u =∑ v∈U b v,u .

[0170] Step 3.2, the process of generating a mask and encrypting local model parameters, is as follows: Figure 4 As shown in (d), the steps include:

[0171] (1) The client expands the mask seed into vector b u Using the key homomorphic pseudo-random function KF LWE Calculate the mask p u =KF LWE (b u );

[0172] (2) The client generates local model parameters x based on the local dataset. u Add the mask to the local model parameters and calculate y. u =x u +p u .

[0173] Step 4.2 The process of calculating model parameters is as follows: Figure 4 As shown in (e), the steps include:

[0174] (1) The server calculates the fog node model parameters y FN =∑ u∈FN y u y FN This represents the calculated fog node model parameters; the server contains multiple fog nodes, but for ease of description, the following descriptions will use a single fog node as a representative to describe the calculations related to the fog node.

[0175] (2) The server reconstructs the mask seed using a homomorphic secret sharing function. Where u≠v, b FN This represents the sum of the mask seeds for clients within the fog node group;

[0176] (3) Server extension b FN For vector b FN Using the key homomorphic pseudo-random function KF LWE Calculate the mask p FN =KF LWE (b FN );

[0177] (4) The server removes the mask and obtains the fog node model parameters x. FN =y FN -p FN =∑ u∈FN y u -KF LWE (b FN )=∑ u∈FN x u +∑ u∈FN KF LWE (b u )-KF LWE (b FN )=∑ u∈FN x u Among them, the key homomorphic pseudo-random function KF LWE The property makes ∑ u∈FN KF LWE (b u )=KF LWE (b FN );

[0178] (5) Server aggregates global model parameters x AS =∑ FN∈AS x FN ;

[0179] Steps 3.3 and 4.1 are the complete safe mixing process as follows: Figure 5 As shown in (a) and (b), the steps include:

[0180] Step 3.3: Safe mixed washing.

[0181] (1) The client uses a pseudo-random number generator to generate a pseudo-name pID. u Construct an object (pID) u (m, counter), where counter represents a counter, initialized to 1; and m = (y u ,r u ,b' u ), y u These are the local model parameters after masking, r u It is a secret shared random number on the client side, b' u It is the sum of the secret shares received by the client;

[0182] (2) The client initializes a zero vector y' u Use k hash functions to convert pID u Mapped to vector y' u Find k distinct positions in the array and place (pID) u ,m,counter) to the corresponding position;

[0183] (3) The client will transfer vector y' u Send to the fog node;

[0184] (4) Fog nodes undergo safe mixed washing, and the fog node vector y' = ∑ u∈U y' u , where each y' u (pID) u Add the corresponding values ​​of m and counter; send the fog node vector y' to the server.

[0185] Step 4.1: Restore messages.

[0186] (1) The server receives the fog node vector y' and uses the secure shuffling algorithm to recover the message;

[0187] (2) The server initializes an empty list m' and a queue Q containing all position data of vector y';

[0188] (3) The server retrieves the position information from the queue and then checks whether the counter for that position is 1; if it is not equal to 1, it retrieves the next position information until counter = 1.

[0189] (4) If counter = 1, the server retrieves the message m at that position and puts it into m'; the server retrieves the pseudonym pID. u The storage location of the message in the vector y' is calculated using k hash functions, and the pID of these locations is subtracted from y'. u The data is m, counter); if the counter at this position is 1, then the position information H is... i∈k (pID u Add it to queue Q;

[0190] (5) Repeat steps (3) and (4) until the queue is empty, and finally output the message m' = ({y u ,r u ,b' u} u∈FN );

[0191] The federated learning privacy protection system provided in this embodiment of the invention includes:

[0192] The initialization module is used to complete the initialization of the key homomorphic pseudo-random function, homomorphic secret sharing function and symmetric key through the collaboration of the server, fog node and client, and establish the secret sharing auxiliary function and key infrastructure required for multi-party secure computation;

[0193] The anonymous authentication module is used by the client to generate random numbers, calculate parameters related to the anonymous signature, and generate an anonymous signature; the fog node anonymously verifies the client's identity and publishes a list of legitimate clients;

[0194] The local training and secure shuffling module is used by the client to generate a mask seed and generate shares through homomorphic secret sharing. After encryption using a symmetric key, the seed is sent to the fog node. After the fog node broadcasts the encrypted shares, the client decrypts and accumulates the shares. Combined with the secure shuffling algorithm, a vector containing masking model parameters, secret shared random numbers, and the sum of shares is constructed. The fog node summarizes and generates a fog node vector and forwards it to the server.

[0195] The robust aggregation module is used by the server to recover the masked local model parameters, the secret shared random numbers and the sum of the shares, and to calculate the fog node mask through homomorphic secret sharing. After aggregating the masked parameters, the influence of the mask is eliminated. The fog node parameters are weighted and aggregated by combining cosine similarity and clustering algorithms to generate weighted global model parameters and broadcast them to all clients.

[0196] Based on practical application scenarios, a single-mask protocol is used to protect local updates and improve aggregation efficiency. This anonymous ring signature is integrated with a secure shuffling mechanism to ensure the client's identity is both legitimate and anonymous. Furthermore, a baffle mechanism is developed to maintain the accuracy of the global model and resist malicious parameters. The resulting privacy-preserving scheme for secure and efficient aggregation in anonymous Byzantine robust federated learning has practical value for real-world application scenarios.

[0197] In smart healthcare systems, clients can deploy IoT devices or wearable devices to collect health data. After local training, the trained parameters are sent to a server for federated learning. The server then obtains optimized model parameters and trains a better model. However, during this process, participating clients need to communicate individually with the server, significantly increasing communication time and reducing training efficiency and resource consumption. This invention eliminates the need for clients to engage in extensive individual communication with the server during federated learning, thereby reducing communication time and resource consumption and improving training efficiency.

[0198] In this scenario, because client-side local data may contain private information, such as blood oxygen saturation or abnormal heart rate information, the client may not want this private information to be disclosed. This places privacy protection requirements on federated learning schemes. When combined with this invention, the security of client data during the training process of federated learning can be guaranteed. The server can only obtain the aggregated model parameter results and cannot access the private data of any individual client.

[0199] Furthermore, in practical applications, while the secure aggregation mechanism effectively protects the privacy of model update content, client metadata such as network addresses, communication times, and interaction frequencies still pose potential privacy risks. These risks are particularly pronounced in highly sensitive scenarios such as smart healthcare, where attackers may indirectly infer a client's identity and health status by analyzing metadata. For example, a client's network address can be traced back to a medical institution in a specific geographic region. If these institutions specialize in treating rare diseases, the relevant metadata may directly suggest the client's diagnosis. Additionally, data upload intervals, request frequencies, and communication persistence may indirectly reflect a patient's treatment cycle and disease progression. For instance, high-frequency data transmission is often associated with acute treatment phases, while low-frequency uploads may indicate a stable clinical condition. Conversely, communication termination may indicate patient recovery or withdrawal from treatment intervention. This solution designs a secure shuffling mechanism that combines a reversible Bloom lookup table with a single-mask protocol. This mechanism eliminates client message metadata within a secure and efficient aggregation framework, achieving client anonymity.

[0200] More importantly, there is a fundamental contradiction between privacy guarantees and Byzantine robustness in secure aggregation within the federated learning framework. Malicious clients may launch targeted or untargeted attacks by creating parameter updates that deviate from the normal distribution. Untargeted attacks degrade the performance of the global model by distorting gradient directions or parameter ranges. Conversely, targeted attacks implant backdoor functionality to manipulate model behavior in specific scenarios. For example, an attacker might deliberately change model parameters, causing an autonomous driving system to misclassify a stop sign as a speed limit sign. Since cryptographic aggregation completely masks individual updates observed by the server, it is impossible to effectively detect and filter malicious parameters, thus significantly reducing the difficulty of executing such attacks. This scheme constructs a baffle mechanism based on a fog node grouping strategy, which utilizes cosine similarity and clustering algorithms to block malicious updates. This mechanism prevents malicious updates from propagating outside the fog nodes, ensuring that they do not have a non-negligible impact on the accuracy of the global model, thereby achieving Byzantine robustness.

[0201] This invention is the first to propose an anonymous Byzantine robust federated learning model with secure and efficient aggregation, which can meet certain social needs and has practical value.

[0202] like Figure 2 The diagram illustrates the framework of federated learning. The federated learning framework used in this solution is essentially the same as existing technologies: clients generate model parameters, fog nodes forward client messages, and the server aggregates the collected client model parameters and sends the optimized parameters to all clients. This invention optimizes and adjusts existing federated learning frameworks, resulting in higher efficiency and lower time overhead compared to current methods.

[0203] like Figure 5 As shown, a comparison of the training time of the proposed scheme and existing federated learning schemes is presented. It is clear that existing federated learning schemes (SecAgg, Secure Aggregation; EffSecAgg, EfficientSecure Aggregation; EPPML, Efficient Privacy-Preserving Machine Learning) have higher time costs than the scheme of our invention, and the difference increases with the increase of federated learning training epochs.

[0204] like Figure 6 The diagram illustrates a comparison of the core computational time overhead of our scheme and existing, more efficient federated learning schemes (EPPML, Efficient Privacy-Preserving Machine Learning). Ignoring communication fluctuations, the core operation time of our scheme increases almost linearly with the number of training epochs, while the overhead of existing more efficient federated learning schemes increases exponentially due to computational complexity. This gap widens significantly with increasing client numbers and training epochs, highlighting the practical deployment advantages of our scheme.

[0205] In one specific implementation, the system is deployed in an edge computing environment containing 50 clients and 5 fog nodes, employing the anonymous Byzantine robust federated learning method proposed in this invention. Each client randomly generates a mask seed and generates a secret share through homomorphic secret sharing. After negotiating with other clients in the group to generate a symmetric key, encrypted transmission is completed. The client encodes the masked model parameters and related metadata using a reversible Bloom lookup table and sends them to the corresponding fog node. The fog node performs secure shuffling and uploads the data to the server.

[0206] After receiving the shuffled fog node vectors, the server reconstructs the mask and eliminates perturbations. Cosine similarity and K-means clustering are used to identify the degree of model anomalies, and malicious parameters are removed before weighted aggregation. After 10 rounds of federated training, the test model's accuracy on non-independent identically distributed datasets (such as MNIST and CIFAR-10) recovered to over 98% of its pre-attack level. Simultaneously, it successfully suppressed simulated poisoning attacks, verifying the effectiveness of this method in privacy protection and robust aggregation in real-world scenarios.

[0207] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0208] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A privacy-preserving method for anonymous and Byzantine robust federated learning, characterized in that, Includes the following steps: Step 1 Initialization Phase: The server generates a homomorphic pseudo-random function, a homomorphic secret sharing function, a reversible Bloom lookup table function, and multiple hash functions; the client negotiates with other clients to generate a symmetric key; the fog node generates a secret sharing random number and anonymous signature parameters and broadcasts them. Step 2 Anonymous Verification Phase: The client generates a random number and calculates the parameters related to the anonymous signature to generate an anonymous signature; the fog node verifies the legitimacy of the client's identity based on the anonymous signature and publishes a list of legitimate clients; Step 3: Local Training and Secure Shuffling Phase: The client randomly generates a mask seed for this round of computation and generates a secret share using a homomorphic secret sharing function with polynomial interpolation. The secret share is encrypted with a symmetric key and sent to the fog node and broadcast to other clients. The client uses a key-homomorphic pseudo-random function to convert the expanded mask seed into a mask vector and adds the mask vector to the local model parameters to form masked model parameters. The client constructs a vector containing the masked model parameters, random numbers, and the sum of secret shares and sends it to the fog node. The fog node uses a reversible Bloom lookup table to map the vectors submitted by each client to multiple positions to form sparse vectors, which are then merged and sent to the server. Step 4 Robust Aggregation Phase: The server receives the sparse vector sent by the fog nodes and recovers the original message content from the client using a counter; The server uses homomorphic secret sharing to reconstruct the sum of all client mask seeds at the fog node, calculates the corresponding mask vector to eliminate mask interference in the aggregated model parameters to obtain the true model parameters; the server calculates the cosine similarity score based on the difference vector between the fog node model parameters and the global model parameters, and performs malicious detection and clustering on all fog node model parameters in combination with clustering algorithms, assigning different aggregation weights according to the clustering type to achieve Byzantine robustness, and finally obtains the global model parameters.

2. The anonymized and Byzantine robust federated learning privacy protection method as described in claim 1, characterized in that, In step two, the fog node can only verify the legitimacy of the client's identity based on the anonymous signature uploaded by the client, but cannot know the client's true identity. Only after the verification is passed will the client be included in the list of legitimate clients.

3. The anonymized and Byzantine robust federated learning privacy protection method as described in claim 1, characterized in that, In step three, the client randomly generates a mask seed in each round and uses polynomial interpolation to divide the mask seed into multiple secret shares. The generated secret shares are encrypted with a symmetric key and then broadcast to other clients by fog nodes, ensuring that no single node can recover the original mask.

4. The anonymized and Byzantine robust federated learning privacy protection method as described in claim 1, characterized in that, In step three, the client uses a key homomorphic pseudo-random function to perform pseudo-random operations on the expanded mask seed to obtain a mask vector, and then adds the mask vector to the local model parameters to obtain the masked model parameters before participating in the shuffling.

5. The anonymized and Byzantine robust federated learning privacy protection method as described in claim 1, characterized in that, In step three, the fog node maps each client model data to multiple locations based on a reversible Bloom lookup table to form a high-dimensional sparse vector. The fog node merges the sparse vectors of all clients and sends them to the server. The server uses a counter to reconstruct the message content in reverse to obtain the original data of each client.

6. A federated learning privacy protection system applied to the anonymity and Byzantine robust federated learning privacy protection method described in any one of claims 1 to 5, characterized in that, The system includes: The initialization module is used to generate a key homomorphic pseudo-random function, a homomorphic secret sharing function, a reversible Bloom lookup table function, and multiple hash functions, and to negotiate the client's symmetric key; and the fog node generates secret sharing random numbers and anonymous signature parameters locally and broadcasts them. The anonymous authentication module is used by the client to generate an anonymous signature and submit it to the fog node. The fog node verifies the legitimacy of the client's identity based on the anonymous signature and publishes a list of legitimate clients. The local training and shuffling module is used to randomly generate mask seeds on the client and generate secret shares through homomorphic secret sharing. After encryption, the secret shares are broadcast to other clients via fog nodes. After the client decrypts and calculates the sum of secret shares, it generates masked model parameters and constructs the vector to be shuffled. The fog nodes use an invertible Bloom lookup table to map the vectors submitted by the client into sparse vectors and merge them to send to the server. The aggregation module is used by the server to restore the original message content of the client, reconstruct the sum of all client mask seeds and calculate the mask vector to eliminate mask interference in the aggregation model; it also uses the difference vector between the fog node model parameters and the global model parameters to calculate the cosine similarity score, performs cluster analysis on all fog node model parameters, and assigns aggregation weights based on the clustering results to output the global model parameters.

7. The federated learning privacy protection system as described in claim 6, characterized in that, The initialization module constructs no fewer than three hash functions, each with an independent output field to achieve multi-point mapping and conflict avoidance of client pseudonyms.

8. The federated learning privacy protection system as described in claim 6, characterized in that, In the local training and shuffling module, the client vectors are encoded using fixed-dimensional sparse coding, the fog nodes record the vector state through a counter, and the server recovers the client message content in reverse based on the queue and the counter.

9. A fog node device, characterized in that, It includes a processor and a memory, wherein the memory stores instructions, and the processor executes the instructions to perform the following functions: Generate a locally shared secret random number and anonymous signature parameters, and broadcast them. Receive and verify the anonymous signature submitted by the client to confirm the client's legitimacy; Receive the encrypted secret share from the client and broadcast it to other clients; Each received client vector is mapped using a reversible Bloom lookup table, and the mapping results are merged to form a sparse vector and sent to the server.

10. A non-volatile computer-readable storage medium having stored thereon computer-executable instructions that cause a processor to perform the privacy-preserving method for anonymous and Byzantine robust federated learning as described in claim 1.

Images